In the Linux kernel, the following vulnerability has been resolved: net: fix segmentation of forwarding fraglist GRO This patch enhances GSO segment handling by properly checking the SKB_GSO_DODGY flag for frag_list GSO packets, addressing low throughput issues observed when a station accesses IPv4 servers via hotspots with an IPv6-only upstream interface. Specifically, it fixes a bug in GSO segmentation when forwarding GRO packets containing a frag_list. The function skb_segment_list cannot correctly process GRO skbs that have been converted by XLAT, since XLAT only translates the header of the head skb. Consequently, skbs in the frag_list may remain untranslated, resulting in protocol inconsistencies and reduced throughput. To address this, the patch explicitly sets the SKB_GSO_DODGY flag for GSO packets in XLAT's IPv4/IPv6 protocol translation helpers (bpf_skb_proto_4_to_6 and bpf_skb_proto_6_to_4). This marks GSO packets as potentially modified after protocol translation. As a result, GSO segmentation will avoid using skb_segment_list and instead falls back to skb_segment for packets with the SKB_GSO_DODGY flag. This ensures that only safe and fully translated frag_list packets are processed by skb_segment_list, resolving protocol inconsistencies and improving throughput when forwarding GRO packets converted by XLAT.

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4561 advisory.

    -------------------------------------------------------------------------     Debian LTS Advisory DLA-4561-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                        Ben Hutchings     May 02, 2026                                  https://wiki.debian.org/LTS
    -------------------------------------------------------------------------

    Package        : linux-6.1     Version        : 6.1.170-1~deb11u1     CVE ID         : CVE-2023-53228 CVE-2023-53510 CVE-2023-53545 CVE-2024-47736                      CVE-2024-47809 CVE-2024-49998 CVE-2024-50298 CVE-2024-56719                      CVE-2025-21676 CVE-2025-21682 CVE-2025-37945 CVE-2025-37980                      CVE-2025-38105 CVE-2025-38162 CVE-2025-38192 CVE-2025-38250                      CVE-2025-38303 CVE-2025-38436 CVE-2025-38626 CVE-2025-38659                      CVE-2025-38704 CVE-2025-39748 CVE-2025-39764 CVE-2025-39863                      CVE-2025-40005 CVE-2025-40016 CVE-2025-40135 CVE-2025-40219                      CVE-2025-40242 CVE-2025-40261 CVE-2025-40358 CVE-2025-68206                      CVE-2025-68239 CVE-2025-68265 CVE-2025-71067 CVE-2025-71161                      CVE-2025-71221 CVE-2025-71265 CVE-2025-71266 CVE-2025-71267                      CVE-2025-71269 CVE-2026-23100 CVE-2026-23113 CVE-2026-23141                      CVE-2026-23154 CVE-2026-23157 CVE-2026-23204 CVE-2026-23227                      CVE-2026-23231 CVE-2026-23242 CVE-2026-23243 CVE-2026-23245                      CVE-2026-23253 CVE-2026-23270 CVE-2026-23271 CVE-2026-23273                      CVE-2026-23274 CVE-2026-23277 CVE-2026-23279 CVE-2026-23281                      CVE-2026-23284 CVE-2026-23286 CVE-2026-23287 CVE-2026-23289                      CVE-2026-23290 CVE-2026-23291 CVE-2026-23292 CVE-2026-23293                      CVE-2026-23296 CVE-2026-23298 CVE-2026-23300 CVE-2026-23303                      CVE-2026-23304 CVE-2026-23306 CVE-2026-23307 CVE-2026-23312                      CVE-2026-23315 CVE-2026-23317 CVE-2026-23318 CVE-2026-23319                      CVE-2026-23321 CVE-2026-23324 CVE-2026-23335 CVE-2026-23336                      CVE-2026-23339 CVE-2026-23340 CVE-2026-23343 CVE-2026-23351                      CVE-2026-23352 CVE-2026-23356 CVE-2026-23357 CVE-2026-23359                      CVE-2026-23362 CVE-2026-23364 CVE-2026-23365 CVE-2026-23367                      CVE-2026-23368 CVE-2026-23370 CVE-2026-23372 CVE-2026-23378                      CVE-2026-23379 CVE-2026-23381 CVE-2026-23382 CVE-2026-23388                      CVE-2026-23391 CVE-2026-23392 CVE-2026-23395 CVE-2026-23396                      CVE-2026-23397 CVE-2026-23398 CVE-2026-23401 CVE-2026-23414                      CVE-2026-23420 CVE-2026-23422 CVE-2026-23426 CVE-2026-23428                      CVE-2026-23434 CVE-2026-23438 CVE-2026-23439 CVE-2026-23446                      CVE-2026-23449 CVE-2026-23450 CVE-2026-23452 CVE-2026-23454                      CVE-2026-23455 CVE-2026-23456 CVE-2026-23457 CVE-2026-23458                      CVE-2026-23460 CVE-2026-23462 CVE-2026-23463 CVE-2026-23474                      CVE-2026-23475 CVE-2026-31389 CVE-2026-31391 CVE-2026-31392                      CVE-2026-31393 CVE-2026-31396 CVE-2026-31399 CVE-2026-31400                      CVE-2026-31402 CVE-2026-31403 CVE-2026-31405 CVE-2026-31408                      CVE-2026-31409 CVE-2026-31411 CVE-2026-31412 CVE-2026-31414                      CVE-2026-31415 CVE-2026-31416 CVE-2026-31417 CVE-2026-31418                      CVE-2026-31421 CVE-2026-31422 CVE-2026-31423 CVE-2026-31424                      CVE-2026-31425 CVE-2026-31426 CVE-2026-31427 CVE-2026-31428                      CVE-2026-31431 CVE-2026-31433 CVE-2026-31434 CVE-2026-31441                      CVE-2026-31446 CVE-2026-31447 CVE-2026-31448 CVE-2026-31450                      CVE-2026-31452 CVE-2026-31453 CVE-2026-31454 CVE-2026-31455                      CVE-2026-31464 CVE-2026-31466 CVE-2026-31467 CVE-2026-31469                      CVE-2026-31473 CVE-2026-31476 CVE-2026-31477 CVE-2026-31478                      CVE-2026-31480 CVE-2026-31483 CVE-2026-31485 CVE-2026-31492                      CVE-2026-31494 CVE-2026-31495 CVE-2026-31496 CVE-2026-31497                      CVE-2026-31498 CVE-2026-31503 CVE-2026-31504 CVE-2026-31507                      CVE-2026-31508 CVE-2026-31509 CVE-2026-31510 CVE-2026-31512                      CVE-2026-31515 CVE-2026-31518 CVE-2026-31519 CVE-2026-31520                      CVE-2026-31521 CVE-2026-31522 CVE-2026-31523 CVE-2026-31524                      CVE-2026-31533 CVE-2026-31540 CVE-2026-31545 CVE-2026-31546                      CVE-2026-31548 CVE-2026-31549 CVE-2026-31550 CVE-2026-31551                      CVE-2026-31552 CVE-2026-31555 CVE-2026-31563 CVE-2026-31565                      CVE-2026-31566 CVE-2026-31570 CVE-2026-31628 CVE-2026-31634                      CVE-2026-31649 CVE-2026-31651 CVE-2026-31656 CVE-2026-31657                      CVE-2026-31658 CVE-2026-31659 CVE-2026-31660 CVE-2026-31661                      CVE-2026-31662 CVE-2026-31664 CVE-2026-31665 CVE-2026-31667                      CVE-2026-31668 CVE-2026-31669 CVE-2026-31670 CVE-2026-31671                      CVE-2026-31672 CVE-2026-31674 CVE-2026-31678 CVE-2026-31679                      CVE-2026-31680 CVE-2026-31682 CVE-2026-31683 CVE-2026-31689                      CVE-2026-31695 CVE-2026-31720 CVE-2026-31721 CVE-2026-31726                      CVE-2026-31728 CVE-2026-31737 CVE-2026-31738 CVE-2026-31747                      CVE-2026-31748 CVE-2026-31749 CVE-2026-31751 CVE-2026-31752                      CVE-2026-31754 CVE-2026-31755 CVE-2026-31756 CVE-2026-31758                      CVE-2026-31759 CVE-2026-31761 CVE-2026-31762 CVE-2026-31763                      CVE-2026-31768 CVE-2026-31770 CVE-2026-31773 CVE-2026-31776                      CVE-2026-31778 CVE-2026-31779 CVE-2026-31780 CVE-2026-31781                      CVE-2026-31786 CVE-2026-31787 CVE-2026-31788 CVE-2026-43011                      CVE-2026-43013 CVE-2026-43014 CVE-2026-43015 CVE-2026-43017                      CVE-2026-43018 CVE-2026-43020 CVE-2026-43023 CVE-2026-43024                      CVE-2026-43025 CVE-2026-43026 CVE-2026-43027 CVE-2026-43028                      CVE-2026-43030 CVE-2026-43032 CVE-2026-43033 CVE-2026-43035                      CVE-2026-43037 CVE-2026-43038 CVE-2026-43040 CVE-2026-43041                      CVE-2026-43043 CVE-2026-43046 CVE-2026-43047 CVE-2026-43050                      CVE-2026-43051 CVE-2026-43054 CVE-2026-43057

    Several vulnerabilities have been discovered in the Linux kernel that     may lead to a privilege escalation, denial of service or information     leaks.

    For Debian 11 bullseye, these problems have been fixed in version     6.1.170-1~deb11u1.

    We recommend that you upgrade your linux-6.1 packages.

    For the detailed security status of linux-6.1 please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/linux-6.1

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS     Attachment:
    signature.asc     Description: PGP signature

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6243 advisory.

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-6243-1                   security@debian.org     https://www.debian.org/security/                     Salvatore Bonaccorso     May 01, 2026                          https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : linux     CVE ID         : CVE-2023-53228 CVE-2023-53510 CVE-2023-53545 CVE-2024-47736                      CVE-2024-47809 CVE-2024-49998 CVE-2024-50298 CVE-2024-56719                      CVE-2025-21676 CVE-2025-21682 CVE-2025-37945 CVE-2025-37980                      CVE-2025-38105 CVE-2025-38162 CVE-2025-38192 CVE-2025-38250                      CVE-2025-38303 CVE-2025-38436 CVE-2025-38626 CVE-2025-38659                      CVE-2025-38704 CVE-2025-39748 CVE-2025-39764 CVE-2025-39863                      CVE-2025-40005 CVE-2025-40016 CVE-2025-40135 CVE-2025-40219                      CVE-2025-40242 CVE-2025-40261 CVE-2025-40358 CVE-2025-68206                      CVE-2025-68239 CVE-2025-68265 CVE-2025-71067 CVE-2025-71161                      CVE-2025-71221 CVE-2025-71265 CVE-2025-71266 CVE-2025-71267                      CVE-2025-71269 CVE-2026-23100 CVE-2026-23113 CVE-2026-23141                      CVE-2026-23154 CVE-2026-23157 CVE-2026-23204 CVE-2026-23227                      CVE-2026-23231 CVE-2026-23242 CVE-2026-23243 CVE-2026-23245                      CVE-2026-23253 CVE-2026-23270 CVE-2026-23271 CVE-2026-23273                      CVE-2026-23274 CVE-2026-23277 CVE-2026-23279 CVE-2026-23281                      CVE-2026-23284 CVE-2026-23286 CVE-2026-23287 CVE-2026-23289                      CVE-2026-23290 CVE-2026-23291 CVE-2026-23292 CVE-2026-23293                      CVE-2026-23296 CVE-2026-23298 CVE-2026-23300 CVE-2026-23303                      CVE-2026-23304 CVE-2026-23306 CVE-2026-23307 CVE-2026-23312                      CVE-2026-23315 CVE-2026-23317 CVE-2026-23318 CVE-2026-23319                      CVE-2026-23321 CVE-2026-23324 CVE-2026-23335 CVE-2026-23336                      CVE-2026-23339 CVE-2026-23340 CVE-2026-23343 CVE-2026-23351                      CVE-2026-23352 CVE-2026-23356 CVE-2026-23357 CVE-2026-23359                      CVE-2026-23362 CVE-2026-23364 CVE-2026-23365 CVE-2026-23367                      CVE-2026-23368 CVE-2026-23370 CVE-2026-23372 CVE-2026-23378                      CVE-2026-23379 CVE-2026-23381 CVE-2026-23382 CVE-2026-23388                      CVE-2026-23391 CVE-2026-23392 CVE-2026-23395 CVE-2026-23396                      CVE-2026-23397 CVE-2026-23398 CVE-2026-23401 CVE-2026-23414                      CVE-2026-23420 CVE-2026-23422 CVE-2026-23426 CVE-2026-23428                      CVE-2026-23434 CVE-2026-23438 CVE-2026-23439 CVE-2026-23446                      CVE-2026-23449 CVE-2026-23450 CVE-2026-23452 CVE-2026-23454                      CVE-2026-23455 CVE-2026-23456 CVE-2026-23457 CVE-2026-23458                      CVE-2026-23460 CVE-2026-23462 CVE-2026-23463 CVE-2026-23474                      CVE-2026-23475 CVE-2026-31389 CVE-2026-31391 CVE-2026-31392                      CVE-2026-31393 CVE-2026-31396 CVE-2026-31399 CVE-2026-31400                      CVE-2026-31402 CVE-2026-31403 CVE-2026-31405 CVE-2026-31408                      CVE-2026-31409 CVE-2026-31411 CVE-2026-31412 CVE-2026-31414                      CVE-2026-31415 CVE-2026-31416 CVE-2026-31417 CVE-2026-31418                      CVE-2026-31421 CVE-2026-31422 CVE-2026-31423 CVE-2026-31424                      CVE-2026-31425 CVE-2026-31426 CVE-2026-31427 CVE-2026-31428                      CVE-2026-31431 CVE-2026-31433 CVE-2026-31434 CVE-2026-31441                      CVE-2026-31446 CVE-2026-31447 CVE-2026-31448 CVE-2026-31450                      CVE-2026-31452 CVE-2026-31453 CVE-2026-31454 CVE-2026-31455                      CVE-2026-31464 CVE-2026-31466 CVE-2026-31467 CVE-2026-31469                      CVE-2026-31473 CVE-2026-31476 CVE-2026-31477 CVE-2026-31478                      CVE-2026-31480 CVE-2026-31483 CVE-2026-31485 CVE-2026-31492                      CVE-2026-31494 CVE-2026-31495 CVE-2026-31496 CVE-2026-31497                      CVE-2026-31498 CVE-2026-31503 CVE-2026-31504 CVE-2026-31507                      CVE-2026-31508 CVE-2026-31509 CVE-2026-31510 CVE-2026-31512                      CVE-2026-31515 CVE-2026-31518 CVE-2026-31519 CVE-2026-31520                      CVE-2026-31521 CVE-2026-31522 CVE-2026-31523 CVE-2026-31524                      CVE-2026-31533 CVE-2026-31540 CVE-2026-31545 CVE-2026-31546                      CVE-2026-31548 CVE-2026-31549 CVE-2026-31550 CVE-2026-31551                      CVE-2026-31552 CVE-2026-31555 CVE-2026-31563 CVE-2026-31565                      CVE-2026-31566 CVE-2026-31570 CVE-2026-31628 CVE-2026-31634                      CVE-2026-31649 CVE-2026-31651 CVE-2026-31656 CVE-2026-31657                      CVE-2026-31658 CVE-2026-31659 CVE-2026-31660 CVE-2026-31661                      CVE-2026-31662 CVE-2026-31664 CVE-2026-31665 CVE-2026-31667                      CVE-2026-31668 CVE-2026-31669 CVE-2026-31670 CVE-2026-31671                      CVE-2026-31672 CVE-2026-31674 CVE-2026-31678 CVE-2026-31679                      CVE-2026-31680 CVE-2026-31682 CVE-2026-31683 CVE-2026-31689                      CVE-2026-31695 CVE-2026-31720 CVE-2026-31721 CVE-2026-31726                      CVE-2026-31728 CVE-2026-31737 CVE-2026-31738 CVE-2026-31747                      CVE-2026-31748 CVE-2026-31749 CVE-2026-31751 CVE-2026-31752                      CVE-2026-31754 CVE-2026-31755 CVE-2026-31756 CVE-2026-31758                      CVE-2026-31759 CVE-2026-31761 CVE-2026-31762 CVE-2026-31763                      CVE-2026-31768 CVE-2026-31770 CVE-2026-31773 CVE-2026-31776                      CVE-2026-31778 CVE-2026-31779 CVE-2026-31780 CVE-2026-31781                      CVE-2026-31786 CVE-2026-31787 CVE-2026-31788 CVE-2026-43011                      CVE-2026-43013 CVE-2026-43014 CVE-2026-43015 CVE-2026-43017                      CVE-2026-43018 CVE-2026-43020 CVE-2026-43023 CVE-2026-43024                      CVE-2026-43025 CVE-2026-43026 CVE-2026-43027 CVE-2026-43028                      CVE-2026-43030 CVE-2026-43032 CVE-2026-43033 CVE-2026-43035                      CVE-2026-43037 CVE-2026-43038 CVE-2026-43040 CVE-2026-43041                      CVE-2026-43043 CVE-2026-43046 CVE-2026-43047 CVE-2026-43050                      CVE-2026-43051 CVE-2026-43054 CVE-2026-43057

    Several vulnerabilities have been discovered in the Linux kernel that     may lead to a privilege escalation, denial of service or information     leaks.

    For the oldstable distribution (bookworm), these problems have been fixed     in version 6.1.170-1.

    We recommend that you upgrade your linux packages.

    For the detailed security status of linux please refer to its security     tracker page at:
    https://security-tracker.debian.org/tracker/linux

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 10 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-50232 advisory.

    - ipv6: use RCU in ip6_xmit() (Eric Dumazet)  [Orabug: 39202432]  {CVE-2025-40135}
    - dst: fix races in rt6_uncached_list_del() and rt_del_uncached_list() (Eric Dumazet)  [Orabug: 39202431]     {CVE-2026-23004}
    - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (Inseo An)  [Orabug: 39044468]     {CVE-2026-23231}
    - KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Sean Christopherson)     [Orabug: 39153394]  {CVE-2026-23401}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the linux package has been released.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1487 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    md: suspend array while updating raid_disks via sysfs (CVE-2025-71225)

    In the Linux kernel, the following vulnerability has been resolved:

    btrfs: fix reservation leak in some error paths when inserting inline extent (CVE-2025-71268)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CVE-2026-23111)

    In the Linux kernel, the following vulnerability has been resolved:

    net: fix segmentation of forwarding fraglist GRO (CVE-2026-23154)

    In the Linux kernel, the following vulnerability has been resolved:

    efivarfs: fix error propagation in efivar_entry_get() (CVE-2026-23156)

    In the Linux kernel, the following vulnerability has been resolved:

    perf: sched: Fix perf crash with new is_user_task() helper (CVE-2026-23159)

    In the Linux kernel, the following vulnerability has been resolved:

    mm/shmem, swap: fix race of truncate and swap entry split (CVE-2026-23161)

    In the Linux kernel, the following vulnerability has been resolved:

    flex_proportions: make fprop_new_period() hardirq safe (CVE-2026-23168)

    In the Linux kernel, the following vulnerability has been resolved:

    mptcp: fix race in mptcp_pm_nl_flush_addrs_doit() (CVE-2026-23169)

    In the Linux kernel, the following vulnerability has been resolved:

    net/mlx5e: TC, delete flows only for existing peers (CVE-2026-23173)

    In the Linux kernel, the following vulnerability has been resolved:

    mm, shmem: prevent infinite loop on truncate race (CVE-2026-23177)

    In the Linux kernel, the following vulnerability has been resolved:

    ceph: fix NULL pointer dereference in ceph_mds_auth_match() (CVE-2026-23189)

    In the Linux kernel, the following vulnerability has been resolved:

    scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CVE-2026-23193)

    In the Linux kernel, the following vulnerability has been resolved:

    KVM: Don't clobber irqfd routing type when deassigning irqfd (CVE-2026-23198)

    In the Linux kernel, the following vulnerability has been resolved:

    procfs: avoid fetching build ID while holding VMA lock (CVE-2026-23199)

    In the Linux kernel, the following vulnerability has been resolved:

    ipv6: Fix ECMP sibling count mismatch when clearing RTF_ADDRCONF (CVE-2026-23200)

    In the Linux kernel, the following vulnerability has been resolved:

    ceph: fix oops due to invalid pointer for kfree() in parse_longname() (CVE-2026-23201)

    In the Linux kernel, the following vulnerability has been resolved:

    spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (CVE-2026-23202)

    In the Linux kernel, the following vulnerability has been resolved:

    net/sched: cls_u32: use skb_header_pointer_careful() (CVE-2026-23204)

    In the Linux kernel, the following vulnerability has been resolved:

    smb/client: fix memory leak in smb2_open_file() (CVE-2026-23205)

    In the Linux kernel, the following vulnerability has been resolved:

    macvlan: fix error recovery in macvlan_common_newlink() (CVE-2026-23209)

    In the Linux kernel, the following vulnerability has been resolved:

    bonding: annotate data-races around slave->last_rx (CVE-2026-23212)

    In the Linux kernel, the following vulnerability has been resolved:

    btrfs: reject new transactions if the fs is fully read-only (CVE-2026-23214)

    In the Linux kernel, the following vulnerability has been resolved:

    x86/vmware: Fix hypercall clobbers (CVE-2026-23215)

    In the Linux kernel, the following vulnerability has been resolved:

    scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CVE-2026-23216)

    In the Linux kernel, the following vulnerability has been resolved:

    mm/slab: Add alloc_tagging_slab_free_hook for memcg_alloc_abort_single (CVE-2026-23219)

    In the Linux kernel, the following vulnerability has been resolved: xfs: fix UAF in     xchk_btree_check_block_owner We cannot dereference bs->cur when trying to determine if bs->cur aliases     bs->sc->sa.{bno,rmap}_cur after the latter has been freed. Fix this by sampling before type before any     freeing could happen. The correct temporal ordering was broken when we removed xfs_btnum_t.
    (CVE-2026-23223)

    In the Linux kernel, the following vulnerability has been resolved: erofs: fix UAF issue for file-backed     mounts w/ directio option [ 9.269940][ T3222] Call trace: [ 9.269948][ T3222]     ext4_file_read_iter+0xac/0x108 [ 9.269979][ T3222] vfs_iocb_iter_read+0xac/0x198 [ 9.269993][ T3222]     erofs_fileio_rq_submit+0x12c/0x180 [ 9.270008][ T3222] erofs_fileio_submit_bio+0x14/0x24 [ 9.270030][     T3222] z_erofs_runqueue+0x834/0x8ac [ 9.270054][ T3222] z_erofs_read_folio+0x120/0x220 [ 9.270083][ T3222]     filemap_read_folio+0x60/0x120 [ 9.270102][ T3222] filemap_fault+0xcac/0x1060 [ 9.270119][ T3222]     do_pte_missing+0x2d8/0x1554 [ 9.270131][ T3222] handle_mm_fault+0x5ec/0x70c [ 9.270142][ T3222]     do_page_fault+0x178/0x88c [ 9.270167][ T3222] do_translation_fault+0x38/0x54 [ 9.270183][ T3222]     do_mem_abort+0x54/0xac [ 9.270208][ T3222] el0_da+0x44/0x7c [ 9.270227][ T3222]     el0t_64_sync_handler+0x5c/0xf4 [ 9.270253][ T3222] el0t_64_sync+0x1bc/0x1c0 EROFS may encounter above     panic when enabling file-backed mount w/ directio mount option, the root cause is it may suffer UAF in     below race condition: - z_erofs_read_folio wq s_dio_done_wq - z_erofs_runqueue - erofs_fileio_submit_bio -     erofs_fileio_rq_submit - vfs_iocb_iter_read - ext4_file_read_iter - ext4_dio_read_iter - iomap_dio_rw :
    bio was submitted and return -EIOCBQUEUED - dio_aio_complete_work - dio_complete - dio->iocb->ki_complete     (erofs_fileio_ki_complete()) - kfree(rq) : it frees iocb, iocb.ki_filp can be UAF in file_accessed(). -     file_accessed : access NULL file point Introduce a reference count in struct erofs_fileio_rq, and     initialize it as two, both erofs_fileio_ki_complete() and erofs_fileio_rq_submit() will decrease reference     count, the last one decreasing the reference count to zero will free rq. (CVE-2026-23224)

    In the Linux kernel, the following vulnerability has been resolved: smb: client: split cached_fid     bitfields to avoid shared-byte RMW races is_open, has_lease and on_list are stored in the same bitfield     byte in struct cached_fid but are updated in different code paths that may run concurrently. Bitfield     assignments generate byte read-modify-write operations (e.g. `orb $mask, addr` on x86_64), so updating one     flag can restore stale values of the others. A possible interleaving is: CPU1: load old byte (has_lease=1,     on_list=1) CPU2: clear both flags (store 0) CPU1: RMW store (old | IS_OPEN) -> reintroduces cleared bits     To avoid this class of races, convert these flags to separate bool fields. (CVE-2026-23230)

    In the Linux kernel, the following vulnerability has been resolved:

    net: gro: fix outer network offset (CVE-2026-23254)

    In the Linux kernel, the following vulnerability has been resolved:

    regmap: maple: free entry on mas_store_gfp() failure (CVE-2026-23260)

    In the Linux kernel, the following vulnerability has been resolved:

    driver core: enforce device_lock for driver_match_device() (CVE-2026-31688)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:20416-1 advisory.

    The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues.

    The following security issues were fixed:

    - CVE-2025-39753: gfs2: Set .migrate_folio in gfs2_{rgrp,meta}_aops (bsc#1249590).
    - CVE-2025-39964: crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (bsc#1251966).
    - CVE-2025-40099: cifs: parse_dfs_referrals: prevent oob on malformed input (bsc#1252911).
    - CVE-2025-40103: smb: client: Fix refcount leak for cifs_sb_tlink (bsc#1252924).
    - CVE-2025-40230: mm: prevent poison consumption when splitting THP (bsc#1254817).
    - CVE-2025-68173: ftrace: Fix softlockup in ftrace_module_enable (bsc#1255311).
    - CVE-2025-68186: ring-buffer: Do not warn in ring_buffer_map_get_reader() when reader catches up     (bsc#1255144).
    - CVE-2025-68292: mm/memfd: fix information leak in hugetlb folios (bsc#1255148).
    - CVE-2025-68295: smb: client: fix memory leak in cifs_construct_tcon() (bsc#1255129).
    - CVE-2025-68329: tracing: Fix WARN_ON in tracing_buffers_mmap_close for split VMAs (bsc#1255490).
    - CVE-2025-68371: scsi: smartpqi: Fix device resources accessed after device removal (bsc#1255572).
    - CVE-2025-68745: scsi: qla2xxx: Clear cmds after chip reset (bsc#1255721).
    - CVE-2025-68785: net: openvswitch: fix middle attribute validation in push_nsh() action (bsc#1256640).
    - CVE-2025-68810: KVM: Disallow toggling KVM_MEM_GUEST_MEMFD on an existing memslot (bsc#1256679).
    - CVE-2025-71071: iommu/mediatek: fix use-after-free on probe deferral (bsc#1256802).
    - CVE-2025-71104: KVM: x86: Fix VM hard lockup after prolonged inactivity with periodic HV timer     (bsc#1256708).
    - CVE-2025-71125: tracing: Do not register unsupported perf events (bsc#1256784).
    - CVE-2025-71134: mm/page_alloc: change all pageblocks migrate type on coalescing (bsc#1256732).
    - CVE-2025-71161: dm-verity: disable recursive forward error correction (bsc#1257174).
    - CVE-2025-71184: btrfs: tracepoints: use btrfs_root_id() to get the id of a root (bsc#1257635).
    - CVE-2025-71193: phy: qcom-qusb2: Fix NULL pointer dereference on early suspend (bsc#1257686).
    - CVE-2025-71225: md: suspend array while updating raid_disks via sysfs (bsc#1258411).
    - CVE-2026-22979: net: fix memory leak in skb_segment_list for GRO packets (bsc#1257228).
    - CVE-2026-22998: nvme-tcp: fix NULL pointer dereferences in nvmet_tcp_build_pdu_iovec (bsc#1257209).
    - CVE-2026-23003: ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (bsc#1257246).
    - CVE-2026-23004: dst: fix races in rt6_uncached_list_del() and rt_del_uncached_list() (bsc#1257231).
    - CVE-2026-23010: ipv6: Fix use-after-free in inet6_addr_del() (bsc#1257332).
    - CVE-2026-23017: idpf: fix error handling in the init_task on load (bsc#1257552).
    - CVE-2026-23022: idpf: fix memory leak in idpf_vc_core_deinit() (bsc#1257581).
    - CVE-2026-23023: idpf: fix memory leak in idpf_vport_rel() (bsc#1257556).
    - CVE-2026-23024: idpf: fix memory leak of flow steer list on rmmod (bsc#1257572).
    - CVE-2026-23035: net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (bsc#1257559).
    - CVE-2026-23042: idpf: fix aux device unplugging when rdma is not supported by vport (bsc#1257705).
    - CVE-2026-23047: libceph: make calc_target() set t->paused, not just clear it (bsc#1257682).
    - CVE-2026-23053: NFS: Fix a deadlock involving nfs_release_folio() (bsc#1257718).
    - CVE-2026-23057: vsock/virtio: Coalesce only linear skb (bsc#1257740).
    - CVE-2026-23064: net/sched: act_ife: avoid possible NULL deref (bsc#1257765).
    - CVE-2026-23066: rxrpc: Fix recvmsg() unconditional requeue (bsc#1257726).
    - CVE-2026-23068: spi: spi-sprd-adi: Fix double free in probe error path (bsc#1257805).
    - CVE-2026-23069: vsock/virtio: fix potential underflow in virtio_transport_get_credit() (bsc#1257755).
    - CVE-2026-23070: Octeontx2-af: Add proper checks for fwdata (bsc#1257709).
    - CVE-2026-23074: net/sched: Enforce that teql can only be used as root qdisc (bsc#1257749).
    - CVE-2026-23083: tools: ynl-gen: use big-endian netlink attribute types (bsc#1257745).
    - CVE-2026-23084: be2net: Fix NULL pointer dereference in be_cmd_get_mac_from_list (bsc#1257830).
    - CVE-2026-23085: irqchip/gic-v3-its: Avoid truncating memory addresses (bsc#1257758).
    - CVE-2026-23086: vsock/virtio: cap TX credit to local buffer size (bsc#1257757).
    - CVE-2026-23088: tracing: Fix crash on synthetic stacktrace field usage (bsc#1257814).
    - CVE-2026-23095: gue: Fix skb memleak with inner IP protocol 0 (bsc#1257808).
    - CVE-2026-23097: migrate: correct lock ordering for hugetlb file folios (bsc#1257815).
    - CVE-2026-23099: bonding: limit BOND_MODE_8023AD to Ethernet devices (bsc#1257816).
    - CVE-2026-23100: mm/hugetlb: fix hugetlb_pmd_shared() (bsc#1257817).
    - CVE-2026-23102: arm64/fpsimd: signal: Fix restoration of SVE context (bsc#1257772).
    - CVE-2026-23104: ice: fix devlink reload call trace (bsc#1257763).
    - CVE-2026-23105: net/sched: qfq: Use cl_is_active to determine whether class is active in qfq_rm_from_ag     (bsc#1257775).
    - CVE-2026-23107: arm64/fpsimd: signal: Allocate SSVE storage when restoring ZA (bsc#1257762).
    - CVE-2026-23110: scsi: core: Wake up the error handler when final completions race against each other     (bsc#1257761).
    - CVE-2026-23111: netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate()     (bsc#1258181).
    - CVE-2026-23112: nvmet-tcp: add bounds checks in nvmet_tcp_build_pdu_iovec (bsc#1258184).
    - CVE-2026-23116: pmdomain: imx8m-blk-ctrl: Remove separate rst and clk mask for 8mq vpu (bsc#1258277).
    - CVE-2026-23119: bonding: provide a net pointer to __skb_flow_dissect() (bsc#1258273).
    - CVE-2026-23136: libceph: reset sparse-read state in osd_fault() (bsc#1258303).
    - CVE-2026-23139: netfilter: nf_conncount: update last_gc only when GC has been performed (bsc#1258304).
    - CVE-2026-23141: btrfs: send: check for inline extents in range_is_hole_in_parent() (bsc#1258377).
    - CVE-2026-23142: mm/damon/sysfs-scheme: cleanup access_pattern subdirs on scheme dir setup failure     (bsc#1258289).
    - CVE-2026-23144: mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (bsc#1258290).
    - CVE-2026-23148: nvmet: fix race in nvmet_bio_done() leading to NULL pointer dereference (bsc#1258258).
    - CVE-2026-23154: net: fix segmentation of forwarding fraglist GRO (bsc#1258286).
    - CVE-2026-23161: mm/shmem, swap: fix race of truncate and swap entry split (bsc#1258355).
    - CVE-2026-23166: ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (bsc#1258272).
    - CVE-2026-23169: mptcp: fix race in mptcp_pm_nl_flush_addrs_doit() (bsc#1258389).
    - CVE-2026-23171: bonding: fix use-after-free due to enslave fail after slave array update (bsc#1258349).
    - CVE-2026-23173: net/mlx5e: TC, delete flows only for existing peers (bsc#1258520).
    - CVE-2026-23179: nvmet-tcp: fixup hang in nvmet_tcp_listen_data_ready() (bsc#1258394).
    - CVE-2026-23189: ceph: fix NULL pointer dereference in ceph_mds_auth_match() (bsc#1258308).
    - CVE-2026-23198: KVM: Don't clobber irqfd routing type when deassigning irqfd (bsc#1258321).
    - CVE-2026-23208: ALSA: usb-audio: Prevent excessive number of frames (bsc#1258468).
    - CVE-2026-23209: macvlan: fix error recovery in macvlan_common_newlink() (bsc#1258518).
    - CVE-2026-23210: ice: Fix PTP NULL pointer dereference during VSI rebuild (bsc#1258517).
    - CVE-2026-23214: btrfs: reject new transactions if the fs is fully read-only (bsc#1258464).
    - CVE-2026-23223: xfs: fix UAF in xchk_btree_check_block_owner (bsc#1258483).
    - CVE-2026-23224: erofs: fix UAF issue for file-backed mounts w/ directio option (bsc#1258461).

    The following non security issues were fixed:

    - ALSA: usb-audio: Update the number of packets properly at receiving (stable-fixes).
    - ALSA: usb-audio: fix broken logic in snd_audigy2nx_led_update() (git-fixes).
    - ASoC: SOF: ipc4-control: If there is no data do not send bytes update (git-fixes).
    - Add bugnumber to existing mana and mana_ib changes (bsc#1251135 bsc#1251971).
    - HID: apple: Add EPOMAKER TH87 to the non-apple keyboards list (bsc#1258455).
    - HID: intel-ish-hid: Update ishtp bus match to support device ID table (stable-fixes).
    - PCI/DOE: Poll DOE Busy bit for up to 1 second in pci_doe_send_req() (bsc#1255868).
    - PCI: Add ASPEED vendor ID to pci_ids.h (bsc#1258672)
    - PCI: Add PCI_BRIDGE_NO_ALIAS quirk for ASPEED AST1150 (bsc#1258672)
    - PM: sleep: wakeirq: Update outdated documentation comments (git-fixes).
    - Refresh and move upstreamed ath12k patch into sorted section
    - Update drm/mgag200: fix mgag200_bmc_stop_scanout() bug number (bsc#1258153)
    - add bugnumber to existing mana change (bsc#1252266).
    - arm64: contpte: fix set_access_flags() no-op check for SMMU/ATS (bsc#1259329)
    - bonding: only set speed/duplex to unknown, if getting speed failed (bsc#1253691).
    - can: bcm: fix locking for bcm_op runtime updates (git-fixes).
    - clk: qcom: gcc-sm8450: Update the SDCC RCGs to use shared_floor_ops (git-fixes).
    - clocksource: Fix the CPUs' choice in the watchdog per CPU verification (bsc#1257818).
    - clocksource: Print durations for sync check unconditionally (bsc#1257818).
    - clocksource: Reduce watchdog readout delay limit to prevent false positives (bsc#1257818).
    - clocksource: Use pr_info() for Checking clocksource synchronization message (bsc#1257818).
    - dm: Fix deadlock when reloading a multipath table (bsc#1254928).
    - drm/i915/display: Add quirk to skip retraining of dp link (bsc#1253129).
    - ext4: fix iloc.bh leak in ext4_xattr_inode_update_ref (git-fixes).
    - gpiolib-acpi: Update file references in the Documentation and MAINTAINERS (git-fixes).
    - i3c: master: Update hot-join flag only on success (git-fixes).
    - ktls, sockmap: Fix missing uncharge operation (bsc#1252008).
    - media: qcom: camss: vfe: Fix out-of-bounds access in vfe_isr_reg_update() (git-fixes).
    - modpost: Ensure exported symbol namespaces are not quoted (bsc#1258489).
    - net: mana: Handle hardware recovery events when probing the device (bsc#1257466).
    - net: mana: Implement ndo_tx_timeout and serialize queue resets per port (bsc#1257472).
    - platform/x86/amd: amd_3d_vcache: Add AMD 3D V-Cache optimizer driver (jsc#PED-11563).
    - sched/core: Avoid direct access to hrtimer clockbase (bsc#1234634).
    - sched/deadline: Fix race in push_dl_task() (bsc#1234634).
    - sched/deadline: Stop dl_server before CPU goes offline (bsc#1234634).
    - sched/fair: Fix pelt clock sync when entering idle (bsc#1234634).
    - sched/fair: Fix pelt lost idle time detection (bsc#1234634).
    - staging: rtl8723bs: fix missing status update on sdio_alloc_irq() failure (stable-fixes).
    - wifi: cfg80211: Fix use_for flag update on BSS refresh (git-fixes).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 10 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-50160 advisory.

    - mm/hugetlb: fix hugetlb_pmd_shared() (David Hildenbrand) [Orabug: 38931087] {CVE-2026-23100}
    - platform/x86: classmate-laptop: Add missing NULL pointer checks (Rafael J. Wysocki) [Orabug: 39044501]     {CVE-2026-23237}
    - scsi: qla2xxx: Fix bsg_done() causing double free (Anil Gurumurthy) [Orabug: 39044457] {CVE-2025-71238}
    - wifi: rtl8xxxu: fix slab-out-of-bounds in rtl8xxxu_sta_add (Ali Tariq) [Orabug: 38997990]     {CVE-2025-71234}
    - xfs: fix UAF in xchk_btree_check_block_owner (Darrick J. Wong) [Orabug: 38998028] {CVE-2026-23223}
    - scsi: qla2xxx: Free sp in error path to fix system crash (Anil Gurumurthy) [Orabug: 38997979]     {CVE-2025-71232}
    - scsi: qla2xxx: Delay module unload while fabric scan in progress (Anil Gurumurthy) [Orabug: 38997992]     {CVE-2025-71235}
    - scsi: qla2xxx: Validate sp before freeing associated memory (Anil Gurumurthy) [Orabug: 38997998]     {CVE-2025-71236}
    - wifi: rtw88: Fix alignment fault in rtw_core_enable_beacon() (Bitterblue Smith) [Orabug: 38997972]     {CVE-2025-71229}
    - crypto: virtio - Add spinlock protection with virtqueue notification (Bibo Mao) [Orabug: 38998052]     {CVE-2026-23229}
    - crypto: iaa - Fix out-of-bounds index in find_empty_iaa_compression_mode (Thorsten Blum) [Orabug:
    38997976] {CVE-2025-71231}
    - smb: client: split cached_fid bitfields to avoid shared-byte RMW races (Henrique Carvalho) [Orabug:
    38998059] {CVE-2026-23230}
    - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Breno Leitao) [Orabug: 38970593]     {CVE-2026-23202}
    - ASoC: amd: fix memory leak in acp3x pdm dma ops (Chris Bainbridge) [Orabug: 38970441] {CVE-2026-23190}
    - ipv6: Fix ECMP sibling count mismatch when clearing RTF_ADDRCONF (Shigeru Yoshida) [Orabug: 38970598]     {CVE-2026-23200}
    - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (Andrew Fasano) [Orabug:
    38970170] {CVE-2026-23111}
    - net: usb: r8152: fix resume reset deadlock (Sergey Senozhatsky) [Orabug: 38970438] {CVE-2026-23188}
    - macvlan: fix error recovery in macvlan_common_newlink() (Eric Dumazet) [Orabug: 38970508]     {CVE-2026-23209}
    - net/sched: cls_u32: use skb_header_pointer_careful() (Eric Dumazet) [Orabug: 38970487] {CVE-2026-23204}
    - smb/client: fix memory leak in smb2_open_file() (Chenxiaosong) [Orabug: 38970578] {CVE-2026-23205}
    - btrfs: reject new transactions if the fs is fully read-only (Qu Wenruo) [Orabug: 38985156]     {CVE-2026-23214}
    - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (Maurizio Lombardi) [Orabug:
    38985169] {CVE-2026-23216}
    - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (Maurizio Lombardi) [Orabug:
    38970453] {CVE-2026-23193}
    - nvmet-tcp: fixup hang in nvmet_tcp_listen_data_ready() (Hannes Reinecke) [Orabug: 38970416]     {CVE-2026-23179}
    - drm/amd/pm: Disable MMIO access during SMU Mode 1 reset (Perry Yuan) [Orabug: 38985149] {CVE-2026-23213}
    - HID: i2c-hid: fix potential buffer overflow in i2c_hid_get_report() (Kwok Kin Ming) [Orabug: 38970413]     {CVE-2026-23178}
    - md: suspend array while updating raid_disks via sysfs (Danny Shih) [Orabug: 38985108] {CVE-2025-71225}
    - wifi: wlcore: ensure skb headroom before skb_push (Peter Astrand) [Orabug: 38970152] {CVE-2025-71222}
    - wifi: mac80211: ocb: skip rx_no_sta when interface is not joined (Moon Hee Lee) [Orabug: 38970163]     {CVE-2025-71224}
    - procfs: avoid fetching build ID while holding VMA lock (Andrii Nakryiko) [Orabug: 38970476]     {CVE-2026-23199}
    - mm, shmem: prevent infinite loop on truncate race (Kairui Song) [Orabug: 38970409] {CVE-2026-23177}
    - ceph: fix oops due to invalid pointer for kfree() in parse_longname() (Daniel Vogelbacher) [Orabug:
    38970590] {CVE-2026-23201}
    - ceph: fix NULL pointer dereference in ceph_mds_auth_match() (Viacheslav Dubeyko) [Orabug: 38970595]     {CVE-2026-23189}
    - mm/slab: Add alloc_tagging_slab_free_hook for memcg_alloc_abort_single (Hao Ge) [Orabug: 38985192]     {CVE-2026-23219}
    - ALSA: aloop: Fix racy access at PCM trigger (Takashi Iwai) [Orabug: 38970445] {CVE-2026-23191}
    - x86/vmware: Fix hypercall clobbers (Josh Poimboeuf) [Orabug: 38985163] {CVE-2026-23215}
    - nvmet-tcp: add bounds checks in nvmet_tcp_build_pdu_iovec (Yunje Shin) [Orabug: 38970176]     {CVE-2026-23112}
    - perf: sched: Fix perf crash with new is_user_task() helper (Steven Rostedt) [Orabug: 38970581]     {CVE-2026-23159}
    - wifi: ath11k: add srng->lock for ath11k_hal_srng_* in monitor mode (Kang Yang) [Orabug: 37844126]     {CVE-2024-58096}
    - drm/amdgpu: fix NULL pointer dereference in amdgpu_gmc_filter_faults_remove (Jon Doron) [Orabug:
    38970348] {CVE-2026-23163}
    - net: fix segmentation of forwarding fraglist GRO (Jibin Zhang) [Orabug: 38970318] {CVE-2026-23154}
    - mm/shmem, swap: fix race of truncate and swap entry split (Kairui Song) [Orabug: 38970345]     {CVE-2026-23161}
    - flex_proportions: make fprop_new_period() hardirq safe (Jan Kara) [Orabug: 38970373] {CVE-2026-23168}
    - nvmet: fix race in nvmet_bio_done() leading to NULL pointer dereference (Ming Lei) [Orabug: 38970608]     {CVE-2026-23148}
    - efivarfs: fix error propagation in efivar_entry_get() (Kohei Enju) [Orabug: 38970325] {CVE-2026-23156}
    - net/mlx5e: TC, delete flows only for existing peers (Mark Bloch) [Orabug: 38970397] {CVE-2026-23173}
    - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Aaron Ma) [Orabug: 38970364]     {CVE-2026-23166}
    - rocker: fix memory leak in rocker_world_port_post_fini() (Kery Qi) [Orabug: 38970351] {CVE-2026-23164}
    - bonding: annotate data-races around slave->last_rx (Eric Dumazet) [Orabug: 38985142] {CVE-2026-23212}
    - Bluetooth: MGMT: Fix memory leak in set_ssp_complete (Jianpeng Chang) [Orabug: 38970587]     {CVE-2026-23151}
    - Bluetooth: hci_uart: fix null-ptr-deref in hci_uart_write_work (Jia-Hong Su) [Orabug: 38970604]     {CVE-2026-23146}
    - wifi: ath11k: fix RCU stall while reaping monitor destination ring (P Praneesh) [Orabug: 37844129]     {CVE-2024-58097}
    - btrfs: fix racy bitfield write in btrfs_clear_space_info_full() (Boris Burkov) [Orabug: 38798802]     {CVE-2025-68358}
    - sched_ext: Fix possible deadlock in the deferred_irq_workfn() (Zqiang) [Orabug: 38792605]     {CVE-2025-68333}
    - exfat: fix refcount leak in exfat_find (Shuhao Fu) [Orabug: 38798780] {CVE-2025-68351}
    - bpf: Do not let BPF test infra emit invalid GSO types to stack (Daniel Borkmann) [Orabug: 38798881]     {CVE-2025-68725}
    - migrate: correct lock ordering for hugetlb file folios (Matthew Wilcox) [Orabug: 38931066]     {CVE-2026-23097}
    - can: usb_8dev: usb_8dev_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde) [Orabug: 38931120]     {CVE-2026-23108}
    - can: kvaser_usb: kvaser_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde) [Orabug:
    38930881] {CVE-2026-23061}
    - can: ems_usb: ems_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde) [Orabug: 38930859]     {CVE-2026-23058}
    - irqchip/gic-v3-its: Avoid truncating memory addresses (Arnd Bergmann) [Orabug: 38931001]     {CVE-2026-23085}
    - intel_th: fix device leak on output open() (Johan Hovold) [Orabug: 38931040] {CVE-2026-23091}
    - tracing: Fix crash on synthetic stacktrace field usage (Steven Rostedt) [Orabug: 38931024]     {CVE-2026-23088}
    - arm64: Set __nocfi on swsusp_arch_resume() (Zhaoyang Huang) [Orabug: 38970241] {CVE-2026-23128}
    - arm64/fpsimd: signal: Allocate SSVE storage when restoring ZA (Mark Rutland) [Orabug: 38931118]     {CVE-2026-23107}
    - wifi: rsi: Fix memory corruption due to not set vif driver data size (Marek Vasut) [Orabug: 38930939]     {CVE-2026-23073}
    - wifi: ath10k: fix dma_free_coherent() pointer (Thomas Fourier) [Orabug: 38970253] {CVE-2026-23133}
    - ALSA: usb-audio: Fix use-after-free in snd_usb_mixer_free() (Berk Cem Goksel) [Orabug: 38931029]     {CVE-2026-23089}
    - ALSA: scarlett2: Fix buffer overflow in config retrieval (Samasth Norway Ananda) [Orabug: 38930973]     {CVE-2026-23078}
    - ALSA: ctxfi: Fix potential OOB access in audio mixer handling (Takashi Iwai) [Orabug: 38930966]     {CVE-2026-23076}
    - leds: led-class: Only Add LED to leds_list when it is fully ready (Hans de Goede) [Orabug: 38931091]     {CVE-2026-23101}
    - dpll: Prevent duplicate registrations (Ivan Vecera) [Orabug: 38970244] {CVE-2026-23129}
    - vsock/virtio: cap TX credit to local buffer size (Melbin K Mathew) [Orabug: 38931008] {CVE-2026-23086}
    - vsock/virtio: fix potential underflow in virtio_transport_get_credit() (Melbin K Mathew) [Orabug:
    38930919] {CVE-2026-23069}
    - bonding: provide a net pointer to __skb_flow_dissect() (Eric Dumazet) [Orabug: 38970199]     {CVE-2026-23119}
    - be2net: Fix NULL pointer dereference in be_cmd_get_mac_from_list (Andrey Vatoropin) [Orabug: 38930992]     {CVE-2026-23084}
    - ipv6: annotate data-race in ndisc_router_discovery() (Eric Dumazet) [Orabug: 38970222] {CVE-2026-23124}
    - netdevsim: fix a race issue related to the operation on bpf_bound_progs list (Yun Lu) [Orabug: 38970233]     {CVE-2026-23126}
    - scsi: qla2xxx: Sanitize payload size to prevent member overflow (Jiasheng Jiang) [Orabug: 38930867]     {CVE-2026-23059}
    - scsi: core: Wake up the error handler when final completions race against each other (David Jeffery)     [Orabug: 38931132] {CVE-2026-23110}
    - regmap: Fix race condition in hwspinlock irqsave routine (Cheng-Yu Lee) [Orabug: 38930930]     {CVE-2026-23071}
    - interconnect: debugfs: initialize src_node and dst_node to empty strings (Georgi Djakov) [Orabug:
    38970218] {CVE-2026-23123}
    - io_uring/io-wq: check IO_WQ_BIT_EXIT inside work run loop (Jens Axboe) [Orabug: 38970181]     {CVE-2026-23113}
    - platform/x86: hp-bioscfg: Fix kernel panic in GET_INSTANCE_ID macro (Mario Limonciello) [Orabug:
    38930890] {CVE-2026-23062}
    - platform/x86: hp-bioscfg: Fix kobject warnings for empty attribute names (Mario Limonciello) [Orabug:
    38970247] {CVE-2026-23131}
    - scsi: xen: scsiback: Fix potential memory leak in scsiback_remove() (Abdun Nihaal) [Orabug: 38931014]     {CVE-2026-23087}
    - w1: therm: Fix off-by-one buffer overflow in alarms_store (Thorsten Blum) [Orabug: 38930796]     {CVE-2025-71197}
    - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec (Taeyang Lee) [Orabug:
    38930874] {CVE-2026-23060}
    - net/sched: qfq: Use cl_is_active to determine whether class is active in qfq_rm_from_ag (Jamal Hadi     Salim) [Orabug: 38931110] {CVE-2026-23105}
    - net/sched: Enforce that teql can only be used as root qdisc (Jamal Hadi Salim) [Orabug: 38930948]     {CVE-2026-23074}
    - ipvlan: Make the addrs_lock be per port (Dmitry Skorodumov) [Orabug: 38931102] {CVE-2026-23103}
    - l2tp: avoid one data-race in l2tp_tunnel_del_work() (Eric Dumazet) [Orabug: 38970202] {CVE-2026-23120}
    - gue: Fix skb memleak with inner IP protocol 0. (Kuniyuki Iwashima) [Orabug: 38931057] {CVE-2026-23095}
    - sctp: move SCTP_CMD_ASSOC_SHKEY right after SCTP_CMD_PEER_INIT (Xin Long) [Orabug: 38970225]     {CVE-2026-23125}
    - can: gs_usb: gs_usb_receive_bulk_callback(): unanchor URL on usb_submit_urb() error (Marc Kleine-Budde)     [Orabug: 38931184] {CVE-2026-23082}
    - l2tp: Fix memleak in l2tp_udp_encap_recv(). (Kuniyuki Iwashima) [Orabug: 38930935] {CVE-2026-23072}
    - bonding: limit BOND_MODE_8023AD to Ethernet devices (Eric Dumazet) [Orabug: 38931079] {CVE-2026-23099}
    - vsock/virtio: Coalesce only linear skb (Michal Luczaj) [Orabug: 38930857] {CVE-2026-23057}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:0962-1 advisory.

    The SUSE Linux Enterprise 15 SP7 RT kernel was updated to receive various security bugfixes.


    The following security bugs were fixed:

    - CVE-2023-53817: crypto: lib/mpi - avoid null pointer deref in mpi_cmp_ui() (bsc#1254992).
    - CVE-2025-39748: bpf: Forget ranges when refining tnum after JSET (bsc#1249587).
    - CVE-2025-39817: efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare (bsc#1249998).
    - CVE-2025-39964: crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (bsc#1251966).
    - CVE-2025-40099: cifs: parse_dfs_referrals: prevent oob on malformed input (bsc#1252911).
    - CVE-2025-40103: smb: client: Fix refcount leak for cifs_sb_tlink (bsc#1252924).
    - CVE-2025-40201: kernel/sys.c: fix the racy usage of task_lock(tsk->group_leader) in sys_prlimit64()     paths
    - CVE-2025-40253: s390/ctcm: Fix double-kfree (bsc#1255084).
    - CVE-2025-68283: libceph: replace BUG_ON with bounds check for map->max_osd (bsc#1255379).
    - CVE-2025-68295: smb: client: fix memory leak in cifs_construct_tcon() (bsc#1255129).
    - CVE-2025-68374: md: fix rcu protection in md_wakeup_thread (bsc#1255530).
    - CVE-2025-68735: drm/panthor: Prevent potential UAF in group creation (bsc#1255811).
    - CVE-2025-68736: landlock: Fix handling of disconnected directories (bsc#1255698).
    - CVE-2025-68778: btrfs: don't log conflicting inode if it's a dir moved in the current transaction     (bsc#1256683).
    - CVE-2025-68785: net: openvswitch: fix middle attribute validation in push_nsh() action (bsc#1256640).
    - CVE-2025-68810: KVM: Disallow toggling KVM_MEM_GUEST_MEMFD on an existing memslot (bsc#1256679).
    - CVE-2025-71071: iommu/mediatek: fix use-after-free on probe deferral (bsc#1256802).
    - CVE-2025-71104: KVM: x86: Fix VM hard lockup after prolonged inactivity with periodic HV timer     (bsc#1256708).
    - CVE-2025-71113: crypto: af_alg - zero initialize memory allocated via sock_kmalloc (bsc#1256716).
    - CVE-2025-71125: tracing: Do not register unsupported perf events (bsc#1256784).
    - CVE-2025-71126: mptcp: reset fallback status gracefully at disconnect() time (bsc#1256755).
    - CVE-2025-71148: net/handshake: restore destructor on submit failure (bsc#1257159).
    - CVE-2025-71184: btrfs: fix NULL dereference on root when tracing inode eviction (bsc#1257635).
    - CVE-2025-71194: btrfs: fix deadlock in wait_current_trans() due to ignored transaction type     (bsc#1257687).
    - CVE-2025-71225: md: suspend array while updating raid_disks via sysfs (bsc#1258411).
    - CVE-2026-22979: net: fix memory leak in skb_segment_list for GRO packets (bsc#1257228).
    - CVE-2026-22982: net: mscc: ocelot: Fix crash when adding interface under a lag (bsc#1257179).
    - CVE-2026-22998: nvme-tcp: fix NULL pointer dereferences in nvmet_tcp_build_pdu_iovec (bsc#1257209).
    - CVE-2026-23003: geneve: Fix incorrect inner network header offset when innerprotoinherit is set     (bsc#1257246).
    - CVE-2026-23004: dst: fix races in rt6_uncached_list_del() and rt_del_uncached_list() (bsc#1257231).
    - CVE-2026-23010: ipv6: Fix use-after-free in inet6_addr_del() (bsc#1257332).
    - CVE-2026-23017: idpf: fix error handling in the init_task on load (bsc#1257552).
    - CVE-2026-23023: idpf: fix memory leak in idpf_vport_rel() (bsc#1257556).
    - CVE-2026-23035: net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (bsc#1257559).
    - CVE-2026-23053: NFS: Fix a deadlock involving nfs_release_folio() (bsc#1257718).
    - CVE-2026-23057: vsock/virtio: Coalesce only linear skb (bsc#1257740).
    - CVE-2026-23060: crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec     (bsc#1257735).
    - CVE-2026-23064: net/sched: act_ife: avoid possible NULL deref (bsc#1257765).
    - CVE-2026-23069: vsock/virtio: fix potential underflow in virtio_transport_get_credit() (bsc#1257755).
    - CVE-2026-23070: Octeontx2-af: Add proper checks for fwdata (bsc#1257709).
    - CVE-2026-23074: net/sched: Enforce that teql can only be used as root qdisc (bsc#1257749).
    - CVE-2026-23083: fou: Don't allow 0 for FOU_ATTR_IPPROTO (bsc#1257745).
    - CVE-2026-23084: be2net: Fix NULL pointer dereference in be_cmd_get_mac_from_list (bsc#1257830).
    - CVE-2026-23085: irqchip/gic-v3-its: Avoid truncating memory addresses (bsc#1257758).
    - CVE-2026-23086: vsock/virtio: cap TX credit to local buffer size (bsc#1257757).
    - CVE-2026-23088: tracing: Fix crash on synthetic stacktrace field usage (bsc#1257814).
    - CVE-2026-23089: ALSA: usb-audio: Fix use-after-free in snd_usb_mixer_free() (bsc#1257790).
    - CVE-2026-23095: gue: Fix skb memleak with inner IP protocol 0 (bsc#1257808).
    - CVE-2026-23099: bonding: limit BOND_MODE_8023AD to Ethernet devices (bsc#1257816).
    - CVE-2026-23102: arm64/fpsimd: signal: Mandate SVE payload for streaming-mode state (bsc#1257772).
    - CVE-2026-23104: ice: fix devlink reload call trace (bsc#1257763).
    - CVE-2026-23105: net/sched: qfq: Use cl_is_active to determine whether class is active in qfq_rm_from_ag     (bsc#1257775).
    - CVE-2026-23107: arm64/fpsimd: signal: Allocate SSVE storage when restoring ZA (bsc#1257762).
    - CVE-2026-23110: scsi: core: Wake up the error handler when final completions race against each other     (bsc#1257761).
    - CVE-2026-23111: netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate()     (bsc#1258181).
    - CVE-2026-23112: nvmet-tcp: add bounds checks in nvmet_tcp_build_pdu_iovec (bsc#1258184).
    - CVE-2026-23113: io_uring/io-wq: check IO_WQ_BIT_EXIT inside work run loop (bsc#1258278).
    - CVE-2026-23116: pmdomain: imx8m-blk-ctrl: Remove separate rst and clk mask for 8mq vpu (bsc#1258277).
    - CVE-2026-23119: bonding: provide a net pointer to __skb_flow_dissect() (bsc#1258273).
    - CVE-2026-23125: sctp: move SCTP_CMD_ASSOC_SHKEY right after SCTP_CMD_PEER_INIT (bsc#1258293).
    - CVE-2026-23139: netfilter: nf_conncount: update last_gc only when GC has been performed (bsc#1258304).
    - CVE-2026-23141: btrfs: send: check for inline extents in range_is_hole_in_parent() (bsc#1258377).
    - CVE-2026-23154: net: fix segmentation of forwarding fraglist GRO (bsc#1258286).
    - CVE-2026-23166: ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (bsc#1258272).
    - CVE-2026-23169: mptcp: fix race in mptcp_pm_nl_flush_addrs_doit() (bsc#1258389).
    - CVE-2026-23171: net: bonding: update the slave array for broadcast mode (bsc#1258349).
    - CVE-2026-23173: net/mlx5e: TC, delete flows only for existing peers (bsc#1258520).
    - CVE-2026-23179: nvmet-tcp: fixup hang in nvmet_tcp_listen_data_ready() (bsc#1258394).
    - CVE-2026-23191: ALSA: aloop: Fix racy access at PCM trigger (bsc#1258395).
    - CVE-2026-23198: KVM: Don't clobber irqfd routing type when deassigning irqfd (bsc#1258321).
    - CVE-2026-23204: net/sched: cls_u32: use skb_header_pointer_careful() (bsc#1258340).
    - CVE-2026-23208: ALSA: usb-audio: Prevent excessive number of frames (bsc#1258468).
    - CVE-2026-23209: macvlan: fix error recovery in macvlan_common_newlink() (bsc#1258518).
    - CVE-2026-23210: ice: Fix PTP NULL pointer dereference during VSI rebuild (bsc#1258517).
    - CVE-2026-23213: drm/amd/pm: Disable MMIO access during SMU Mode 1 reset (bsc#1258465).
    - CVE-2026-23214: btrfs: reject new transactions if the fs is fully read-only (bsc#1258464).
    - CVE-2026-23268: apparmor: fix unprivileged local user can do privileged policy management
    - CVE-2026-23269: apparmor: validate DFA start states are in bounds in unpack_pdb


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - net: fix segmentation of forwarding fraglist GRO This patch enhances GSO segment handling by properly     checking the SKB_GSO_DODGY flag for frag_list GSO packets, addressing low throughput issues observed when     a station accesses IPv4 servers via hotspots with an IPv6-only upstream interface. Specifically, it fixes     a bug in GSO segmentation when forwarding GRO packets containing a frag_list. The function     skb_segment_list cannot correctly process GRO skbs that have been converted by XLAT, since XLAT only     translates the header of the head skb. Consequently, skbs in the frag_list may remain untranslated,     resulting in protocol inconsistencies and reduced throughput. To address this, the patch explicitly sets     the SKB_GSO_DODGY flag for GSO packets in XLAT's IPv4/IPv6 protocol translation helpers     (bpf_skb_proto_4_to_6 and bpf_skb_proto_6_to_4). This marks GSO packets as potentially modified after     protocol translation. As a result, GSO segmentation will avoid using skb_segment_list and instead falls     back to skb_segment for packets with the SKB_GSO_DODGY flag. This ensures that only safe and fully     translated frag_list packets are processed by skb_segment_list, resolving protocol inconsistencies and     improving throughput when forwarding GRO packets converted by XLAT. (CVE-2026-23154)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
313522	Amazon Linux 2023 : bpftool, kernel, kernel-devel (ALAS2023-2026-1681)	Nessus	Amazon Linux Local Security Checks	high
311783	Debian dla-4561 : linux-config-6.1 - security update	Nessus	Debian Local Security Checks	high
311547	Debian dsa-6243 : affs-modules-6.1.0-44-4kc-malta-di - security update	Nessus	Debian Local Security Checks	high
306779	Oracle Linux 10 / 9 : Unbreakable Enterprise kernel (ELSA-2026-50232)	Nessus	Oracle Linux Local Security Checks	critical
306005	Photon OS 5.0: Linux PHSA-2026-5.0-0813	Nessus	PhotonOS Local Security Checks	high
304272	Amazon Linux 2023 : bpftool6.12, kernel6.12, kernel6.12-devel (ALAS2023-2026-1487)	Nessus	Amazon Linux Local Security Checks	high
304219	openSUSE 16 Security Update : kernel (openSUSE-SU-2026:20416-1)	Nessus	SuSE Local Security Checks	critical
303965	SUSE SLED15 / SLES15 : Recommended update for initial livepatch (SUSE-SU-2026:1081-1)	Nessus	SuSE Local Security Checks	critical
303468	Oracle Linux 10 / 9 : Unbreakable Enterprise kernel (ELSA-2026-50160)	Nessus	Oracle Linux Local Security Checks	critical
303406	SUSE SLES15 Security Update : kernel (SUSE-SU-2026:0962-1)	Nessus	SuSE Local Security Checks	critical
299079	Linux Distros Unpatched Vulnerability : CVE-2026-23154	Nessus	Misc.	medium

Detections

Analytics

CVE-2026-23154

medium

Tenable Plugins

high

high

high

critical

high

high

critical

critical

critical

critical

medium