In the Linux kernel, the following vulnerability has been resolved: KVM: Don't clobber irqfd routing type when deassigning irqfd When deassigning a KVM_IRQFD, don't clobber the irqfd's copy of the IRQ's routing entry as doing so breaks kvm_arch_irq_bypass_del_producer() on x86 and arm64, which explicitly look for KVM_IRQ_ROUTING_MSI. Instead, to handle a concurrent routing update, verify that the irqfd is still active before consuming the routing information. As evidenced by the x86 and arm64 bugs, and another bug in kvm_arch_update_irqfd_routing() (see below), clobbering the entry type without notifying arch code is surprising and error prone. As a bonus, checking that the irqfd is active provides a convenient location for documenting _why_ KVM must not consume the routing entry for an irqfd that is in the process of being deassigned: once the irqfd is deleted from the list (which happens *before* the eventfd is detached), it will no longer receive updates via kvm_irq_routing_update(), and so KVM could deliver an event using stale routing information (relative to KVM_SET_GSI_ROUTING returning to userspace). As an even better bonus, explicitly checking for the irqfd being active fixes a similar bug to the one the clobbering is trying to prevent: if an irqfd is deactivated, and then its routing is changed, kvm_irq_routing_update() won't invoke kvm_arch_update_irqfd_routing() (because the irqfd isn't in the list). And so if the irqfd is in bypass mode, IRQs will continue to be posted using the old routing information. As for kvm_arch_irq_bypass_del_producer(), clobbering the routing type results in KVM incorrectly keeping the IRQ in bypass mode, which is especially problematic on AMD as KVM tracks IRQs that are being posted to a vCPU in a list whose lifetime is tied to the irqfd. Without the help of KASAN to detect use-after-free, the most common sympton on AMD is a NULL pointer deref in amd_iommu_update_ga() due to the memory for irqfd structure being re-allocated and zeroed, resulting in irqfd->irq_bypass_data being NULL when read by avic_update_iommu_vcpu_affinity(): BUG: kernel NULL pointer dereference, address: 0000000000000018 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 40cf2b9067 P4D 40cf2b9067 PUD 408362a067 PMD 0 Oops: Oops: 0000 [#1] SMP CPU: 6 UID: 0 PID: 40383 Comm: vfio_irq_test Tainted: G U W O 6.19.0-smp--5dddc257e6b2-irqfd #31 NONE Tainted: [U]=USER, [W]=WARN, [O]=OOT_MODULE Hardware name: Google, Inc. Arcadia_IT_80/Arcadia_IT_80, BIOS 34.78.2-0 09/05/2025 RIP: 0010:amd_iommu_update_ga+0x19/0xe0 Call Trace: <TASK> avic_update_iommu_vcpu_affinity+0x3d/0x90 [kvm_amd] __avic_vcpu_load+0xf4/0x130 [kvm_amd] kvm_arch_vcpu_load+0x89/0x210 [kvm] vcpu_load+0x30/0x40 [kvm] kvm_arch_vcpu_ioctl_run+0x45/0x620 [kvm] kvm_vcpu_ioctl+0x571/0x6a0 [kvm] __se_sys_ioctl+0x6d/0xb0 do_syscall_64+0x6f/0x9d0 entry_SYSCALL_64_after_hwframe+0x4b/0x53 RIP: 0033:0x46893b </TASK> ---[ end trace 0000000000000000 ]--- If AVIC is inhibited when the irfd is deassigned, the bug will manifest as list corruption, e.g. on the next irqfd assignment. list_add corruption. next->prev should be prev (ffff8d474d5cd588), but was 0000000000000000. (next=ffff8d8658f86530). ------------[ cut here ]------------ kernel BUG at lib/list_debug.c:31! Oops: invalid opcode: 0000 [#1] SMP CPU: 128 UID: 0 PID: 80818 Comm: vfio_irq_test Tainted: G U W O 6.19.0-smp--f19dc4d680ba-irqfd #28 NONE Tainted: [U]=USER, [W]=WARN, [O]=OOT_MODULE Hardware name: Google, Inc. Arcadia_IT_80/Arcadia_IT_80, BIOS 34.78.2-0 09/05/2025 RIP: 0010:__list_add_valid_or_report+0x97/0xc0 Call Trace: <TASK> avic_pi_update_irte+0x28e/0x2b0 [kvm_amd] kvm_pi_update_irte+0xbf/0x190 [kvm] kvm_arch_irq_bypass_add_producer+0x72/0x90 [kvm] irq_bypass_register_consumer+0xcd/0x170 [irqbypa ---truncated---

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1487 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    md: suspend array while updating raid_disks via sysfs (CVE-2025-71225)

    In the Linux kernel, the following vulnerability has been resolved:

    btrfs: fix reservation leak in some error paths when inserting inline extent (CVE-2025-71268)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CVE-2026-23111)

    In the Linux kernel, the following vulnerability has been resolved:

    net: fix segmentation of forwarding fraglist GRO (CVE-2026-23154)

    In the Linux kernel, the following vulnerability has been resolved:

    efivarfs: fix error propagation in efivar_entry_get() (CVE-2026-23156)

    In the Linux kernel, the following vulnerability has been resolved:

    perf: sched: Fix perf crash with new is_user_task() helper (CVE-2026-23159)

    In the Linux kernel, the following vulnerability has been resolved:

    mm/shmem, swap: fix race of truncate and swap entry split (CVE-2026-23161)

    In the Linux kernel, the following vulnerability has been resolved:

    flex_proportions: make fprop_new_period() hardirq safe (CVE-2026-23168)

    In the Linux kernel, the following vulnerability has been resolved:

    mptcp: fix race in mptcp_pm_nl_flush_addrs_doit() (CVE-2026-23169)

    In the Linux kernel, the following vulnerability has been resolved:

    net/mlx5e: TC, delete flows only for existing peers (CVE-2026-23173)

    In the Linux kernel, the following vulnerability has been resolved:

    mm, shmem: prevent infinite loop on truncate race (CVE-2026-23177)

    In the Linux kernel, the following vulnerability has been resolved:

    ceph: fix NULL pointer dereference in ceph_mds_auth_match() (CVE-2026-23189)

    In the Linux kernel, the following vulnerability has been resolved:

    scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CVE-2026-23193)

    In the Linux kernel, the following vulnerability has been resolved:

    KVM: Don't clobber irqfd routing type when deassigning irqfd (CVE-2026-23198)

    In the Linux kernel, the following vulnerability has been resolved:

    procfs: avoid fetching build ID while holding VMA lock (CVE-2026-23199)

    In the Linux kernel, the following vulnerability has been resolved:

    ipv6: Fix ECMP sibling count mismatch when clearing RTF_ADDRCONF (CVE-2026-23200)

    In the Linux kernel, the following vulnerability has been resolved:

    ceph: fix oops due to invalid pointer for kfree() in parse_longname() (CVE-2026-23201)

    In the Linux kernel, the following vulnerability has been resolved:

    spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (CVE-2026-23202)

    In the Linux kernel, the following vulnerability has been resolved:

    net/sched: cls_u32: use skb_header_pointer_careful() (CVE-2026-23204)

    In the Linux kernel, the following vulnerability has been resolved:

    smb/client: fix memory leak in smb2_open_file() (CVE-2026-23205)

    In the Linux kernel, the following vulnerability has been resolved:

    macvlan: fix error recovery in macvlan_common_newlink() (CVE-2026-23209)

    In the Linux kernel, the following vulnerability has been resolved:

    bonding: annotate data-races around slave->last_rx (CVE-2026-23212)

    In the Linux kernel, the following vulnerability has been resolved:

    btrfs: reject new transactions if the fs is fully read-only (CVE-2026-23214)

    In the Linux kernel, the following vulnerability has been resolved:

    x86/vmware: Fix hypercall clobbers (CVE-2026-23215)

    In the Linux kernel, the following vulnerability has been resolved:

    scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CVE-2026-23216)

    In the Linux kernel, the following vulnerability has been resolved:

    mm/slab: Add alloc_tagging_slab_free_hook for memcg_alloc_abort_single (CVE-2026-23219)

    In the Linux kernel, the following vulnerability has been resolved: xfs: fix UAF in     xchk_btree_check_block_owner We cannot dereference bs->cur when trying to determine if bs->cur aliases     bs->sc->sa.{bno,rmap}_cur after the latter has been freed. Fix this by sampling before type before any     freeing could happen. The correct temporal ordering was broken when we removed xfs_btnum_t.
    (CVE-2026-23223)

    In the Linux kernel, the following vulnerability has been resolved: erofs: fix UAF issue for file-backed     mounts w/ directio option [ 9.269940][ T3222] Call trace: [ 9.269948][ T3222]     ext4_file_read_iter+0xac/0x108 [ 9.269979][ T3222] vfs_iocb_iter_read+0xac/0x198 [ 9.269993][ T3222]     erofs_fileio_rq_submit+0x12c/0x180 [ 9.270008][ T3222] erofs_fileio_submit_bio+0x14/0x24 [ 9.270030][     T3222] z_erofs_runqueue+0x834/0x8ac [ 9.270054][ T3222] z_erofs_read_folio+0x120/0x220 [ 9.270083][ T3222]     filemap_read_folio+0x60/0x120 [ 9.270102][ T3222] filemap_fault+0xcac/0x1060 [ 9.270119][ T3222]     do_pte_missing+0x2d8/0x1554 [ 9.270131][ T3222] handle_mm_fault+0x5ec/0x70c [ 9.270142][ T3222]     do_page_fault+0x178/0x88c [ 9.270167][ T3222] do_translation_fault+0x38/0x54 [ 9.270183][ T3222]     do_mem_abort+0x54/0xac [ 9.270208][ T3222] el0_da+0x44/0x7c [ 9.270227][ T3222]     el0t_64_sync_handler+0x5c/0xf4 [ 9.270253][ T3222] el0t_64_sync+0x1bc/0x1c0 EROFS may encounter above     panic when enabling file-backed mount w/ directio mount option, the root cause is it may suffer UAF in     below race condition: - z_erofs_read_folio wq s_dio_done_wq - z_erofs_runqueue - erofs_fileio_submit_bio -     erofs_fileio_rq_submit - vfs_iocb_iter_read - ext4_file_read_iter - ext4_dio_read_iter - iomap_dio_rw :
    bio was submitted and return -EIOCBQUEUED - dio_aio_complete_work - dio_complete - dio->iocb->ki_complete     (erofs_fileio_ki_complete()) - kfree(rq) : it frees iocb, iocb.ki_filp can be UAF in file_accessed(). -     file_accessed : access NULL file point Introduce a reference count in struct erofs_fileio_rq, and     initialize it as two, both erofs_fileio_ki_complete() and erofs_fileio_rq_submit() will decrease reference     count, the last one decreasing the reference count to zero will free rq. (CVE-2026-23224)

    In the Linux kernel, the following vulnerability has been resolved: smb: client: split cached_fid     bitfields to avoid shared-byte RMW races is_open, has_lease and on_list are stored in the same bitfield     byte in struct cached_fid but are updated in different code paths that may run concurrently. Bitfield     assignments generate byte read-modify-write operations (e.g. `orb $mask, addr` on x86_64), so updating one     flag can restore stale values of the others. A possible interleaving is: CPU1: load old byte (has_lease=1,     on_list=1) CPU2: clear both flags (store 0) CPU1: RMW store (old | IS_OPEN) -> reintroduces cleared bits     To avoid this class of races, convert these flags to separate bool fields. (CVE-2026-23230)

    In the Linux kernel, the following vulnerability has been resolved:

    net: gro: fix outer network offset (CVE-2026-23254)

    In the Linux kernel, the following vulnerability has been resolved:

    regmap: maple: free entry on mas_store_gfp() failure (CVE-2026-23260)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:20416-1 advisory.

    The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues.

    The following security issues were fixed:

    - CVE-2025-39753: gfs2: Set .migrate_folio in gfs2_{rgrp,meta}_aops (bsc#1249590).
    - CVE-2025-39964: crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (bsc#1251966).
    - CVE-2025-40099: cifs: parse_dfs_referrals: prevent oob on malformed input (bsc#1252911).
    - CVE-2025-40103: smb: client: Fix refcount leak for cifs_sb_tlink (bsc#1252924).
    - CVE-2025-40230: mm: prevent poison consumption when splitting THP (bsc#1254817).
    - CVE-2025-68173: ftrace: Fix softlockup in ftrace_module_enable (bsc#1255311).
    - CVE-2025-68186: ring-buffer: Do not warn in ring_buffer_map_get_reader() when reader catches up     (bsc#1255144).
    - CVE-2025-68292: mm/memfd: fix information leak in hugetlb folios (bsc#1255148).
    - CVE-2025-68295: smb: client: fix memory leak in cifs_construct_tcon() (bsc#1255129).
    - CVE-2025-68329: tracing: Fix WARN_ON in tracing_buffers_mmap_close for split VMAs (bsc#1255490).
    - CVE-2025-68371: scsi: smartpqi: Fix device resources accessed after device removal (bsc#1255572).
    - CVE-2025-68745: scsi: qla2xxx: Clear cmds after chip reset (bsc#1255721).
    - CVE-2025-68785: net: openvswitch: fix middle attribute validation in push_nsh() action (bsc#1256640).
    - CVE-2025-68810: KVM: Disallow toggling KVM_MEM_GUEST_MEMFD on an existing memslot (bsc#1256679).
    - CVE-2025-71071: iommu/mediatek: fix use-after-free on probe deferral (bsc#1256802).
    - CVE-2025-71104: KVM: x86: Fix VM hard lockup after prolonged inactivity with periodic HV timer     (bsc#1256708).
    - CVE-2025-71125: tracing: Do not register unsupported perf events (bsc#1256784).
    - CVE-2025-71134: mm/page_alloc: change all pageblocks migrate type on coalescing (bsc#1256732).
    - CVE-2025-71161: dm-verity: disable recursive forward error correction (bsc#1257174).
    - CVE-2025-71184: btrfs: tracepoints: use btrfs_root_id() to get the id of a root (bsc#1257635).
    - CVE-2025-71193: phy: qcom-qusb2: Fix NULL pointer dereference on early suspend (bsc#1257686).
    - CVE-2025-71225: md: suspend array while updating raid_disks via sysfs (bsc#1258411).
    - CVE-2026-22979: net: fix memory leak in skb_segment_list for GRO packets (bsc#1257228).
    - CVE-2026-22998: nvme-tcp: fix NULL pointer dereferences in nvmet_tcp_build_pdu_iovec (bsc#1257209).
    - CVE-2026-23003: ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (bsc#1257246).
    - CVE-2026-23004: dst: fix races in rt6_uncached_list_del() and rt_del_uncached_list() (bsc#1257231).
    - CVE-2026-23010: ipv6: Fix use-after-free in inet6_addr_del() (bsc#1257332).
    - CVE-2026-23017: idpf: fix error handling in the init_task on load (bsc#1257552).
    - CVE-2026-23022: idpf: fix memory leak in idpf_vc_core_deinit() (bsc#1257581).
    - CVE-2026-23023: idpf: fix memory leak in idpf_vport_rel() (bsc#1257556).
    - CVE-2026-23024: idpf: fix memory leak of flow steer list on rmmod (bsc#1257572).
    - CVE-2026-23035: net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (bsc#1257559).
    - CVE-2026-23042: idpf: fix aux device unplugging when rdma is not supported by vport (bsc#1257705).
    - CVE-2026-23047: libceph: make calc_target() set t->paused, not just clear it (bsc#1257682).
    - CVE-2026-23053: NFS: Fix a deadlock involving nfs_release_folio() (bsc#1257718).
    - CVE-2026-23057: vsock/virtio: Coalesce only linear skb (bsc#1257740).
    - CVE-2026-23064: net/sched: act_ife: avoid possible NULL deref (bsc#1257765).
    - CVE-2026-23066: rxrpc: Fix recvmsg() unconditional requeue (bsc#1257726).
    - CVE-2026-23068: spi: spi-sprd-adi: Fix double free in probe error path (bsc#1257805).
    - CVE-2026-23069: vsock/virtio: fix potential underflow in virtio_transport_get_credit() (bsc#1257755).
    - CVE-2026-23070: Octeontx2-af: Add proper checks for fwdata (bsc#1257709).
    - CVE-2026-23074: net/sched: Enforce that teql can only be used as root qdisc (bsc#1257749).
    - CVE-2026-23083: tools: ynl-gen: use big-endian netlink attribute types (bsc#1257745).
    - CVE-2026-23084: be2net: Fix NULL pointer dereference in be_cmd_get_mac_from_list (bsc#1257830).
    - CVE-2026-23085: irqchip/gic-v3-its: Avoid truncating memory addresses (bsc#1257758).
    - CVE-2026-23086: vsock/virtio: cap TX credit to local buffer size (bsc#1257757).
    - CVE-2026-23088: tracing: Fix crash on synthetic stacktrace field usage (bsc#1257814).
    - CVE-2026-23095: gue: Fix skb memleak with inner IP protocol 0 (bsc#1257808).
    - CVE-2026-23097: migrate: correct lock ordering for hugetlb file folios (bsc#1257815).
    - CVE-2026-23099: bonding: limit BOND_MODE_8023AD to Ethernet devices (bsc#1257816).
    - CVE-2026-23100: mm/hugetlb: fix hugetlb_pmd_shared() (bsc#1257817).
    - CVE-2026-23102: arm64/fpsimd: signal: Fix restoration of SVE context (bsc#1257772).
    - CVE-2026-23104: ice: fix devlink reload call trace (bsc#1257763).
    - CVE-2026-23105: net/sched: qfq: Use cl_is_active to determine whether class is active in qfq_rm_from_ag     (bsc#1257775).
    - CVE-2026-23107: arm64/fpsimd: signal: Allocate SSVE storage when restoring ZA (bsc#1257762).
    - CVE-2026-23110: scsi: core: Wake up the error handler when final completions race against each other     (bsc#1257761).
    - CVE-2026-23111: netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate()     (bsc#1258181).
    - CVE-2026-23112: nvmet-tcp: add bounds checks in nvmet_tcp_build_pdu_iovec (bsc#1258184).
    - CVE-2026-23116: pmdomain: imx8m-blk-ctrl: Remove separate rst and clk mask for 8mq vpu (bsc#1258277).
    - CVE-2026-23119: bonding: provide a net pointer to __skb_flow_dissect() (bsc#1258273).
    - CVE-2026-23136: libceph: reset sparse-read state in osd_fault() (bsc#1258303).
    - CVE-2026-23139: netfilter: nf_conncount: update last_gc only when GC has been performed (bsc#1258304).
    - CVE-2026-23141: btrfs: send: check for inline extents in range_is_hole_in_parent() (bsc#1258377).
    - CVE-2026-23142: mm/damon/sysfs-scheme: cleanup access_pattern subdirs on scheme dir setup failure     (bsc#1258289).
    - CVE-2026-23144: mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (bsc#1258290).
    - CVE-2026-23148: nvmet: fix race in nvmet_bio_done() leading to NULL pointer dereference (bsc#1258258).
    - CVE-2026-23154: net: fix segmentation of forwarding fraglist GRO (bsc#1258286).
    - CVE-2026-23161: mm/shmem, swap: fix race of truncate and swap entry split (bsc#1258355).
    - CVE-2026-23166: ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (bsc#1258272).
    - CVE-2026-23169: mptcp: fix race in mptcp_pm_nl_flush_addrs_doit() (bsc#1258389).
    - CVE-2026-23171: bonding: fix use-after-free due to enslave fail after slave array update (bsc#1258349).
    - CVE-2026-23173: net/mlx5e: TC, delete flows only for existing peers (bsc#1258520).
    - CVE-2026-23179: nvmet-tcp: fixup hang in nvmet_tcp_listen_data_ready() (bsc#1258394).
    - CVE-2026-23189: ceph: fix NULL pointer dereference in ceph_mds_auth_match() (bsc#1258308).
    - CVE-2026-23198: KVM: Don't clobber irqfd routing type when deassigning irqfd (bsc#1258321).
    - CVE-2026-23208: ALSA: usb-audio: Prevent excessive number of frames (bsc#1258468).
    - CVE-2026-23209: macvlan: fix error recovery in macvlan_common_newlink() (bsc#1258518).
    - CVE-2026-23210: ice: Fix PTP NULL pointer dereference during VSI rebuild (bsc#1258517).
    - CVE-2026-23214: btrfs: reject new transactions if the fs is fully read-only (bsc#1258464).
    - CVE-2026-23223: xfs: fix UAF in xchk_btree_check_block_owner (bsc#1258483).
    - CVE-2026-23224: erofs: fix UAF issue for file-backed mounts w/ directio option (bsc#1258461).

    The following non security issues were fixed:

    - ALSA: usb-audio: Update the number of packets properly at receiving (stable-fixes).
    - ALSA: usb-audio: fix broken logic in snd_audigy2nx_led_update() (git-fixes).
    - ASoC: SOF: ipc4-control: If there is no data do not send bytes update (git-fixes).
    - Add bugnumber to existing mana and mana_ib changes (bsc#1251135 bsc#1251971).
    - HID: apple: Add EPOMAKER TH87 to the non-apple keyboards list (bsc#1258455).
    - HID: intel-ish-hid: Update ishtp bus match to support device ID table (stable-fixes).
    - PCI/DOE: Poll DOE Busy bit for up to 1 second in pci_doe_send_req() (bsc#1255868).
    - PCI: Add ASPEED vendor ID to pci_ids.h (bsc#1258672)
    - PCI: Add PCI_BRIDGE_NO_ALIAS quirk for ASPEED AST1150 (bsc#1258672)
    - PM: sleep: wakeirq: Update outdated documentation comments (git-fixes).
    - Refresh and move upstreamed ath12k patch into sorted section
    - Update drm/mgag200: fix mgag200_bmc_stop_scanout() bug number (bsc#1258153)
    - add bugnumber to existing mana change (bsc#1252266).
    - arm64: contpte: fix set_access_flags() no-op check for SMMU/ATS (bsc#1259329)
    - bonding: only set speed/duplex to unknown, if getting speed failed (bsc#1253691).
    - can: bcm: fix locking for bcm_op runtime updates (git-fixes).
    - clk: qcom: gcc-sm8450: Update the SDCC RCGs to use shared_floor_ops (git-fixes).
    - clocksource: Fix the CPUs' choice in the watchdog per CPU verification (bsc#1257818).
    - clocksource: Print durations for sync check unconditionally (bsc#1257818).
    - clocksource: Reduce watchdog readout delay limit to prevent false positives (bsc#1257818).
    - clocksource: Use pr_info() for Checking clocksource synchronization message (bsc#1257818).
    - dm: Fix deadlock when reloading a multipath table (bsc#1254928).
    - drm/i915/display: Add quirk to skip retraining of dp link (bsc#1253129).
    - ext4: fix iloc.bh leak in ext4_xattr_inode_update_ref (git-fixes).
    - gpiolib-acpi: Update file references in the Documentation and MAINTAINERS (git-fixes).
    - i3c: master: Update hot-join flag only on success (git-fixes).
    - ktls, sockmap: Fix missing uncharge operation (bsc#1252008).
    - media: qcom: camss: vfe: Fix out-of-bounds access in vfe_isr_reg_update() (git-fixes).
    - modpost: Ensure exported symbol namespaces are not quoted (bsc#1258489).
    - net: mana: Handle hardware recovery events when probing the device (bsc#1257466).
    - net: mana: Implement ndo_tx_timeout and serialize queue resets per port (bsc#1257472).
    - platform/x86/amd: amd_3d_vcache: Add AMD 3D V-Cache optimizer driver (jsc#PED-11563).
    - sched/core: Avoid direct access to hrtimer clockbase (bsc#1234634).
    - sched/deadline: Fix race in push_dl_task() (bsc#1234634).
    - sched/deadline: Stop dl_server before CPU goes offline (bsc#1234634).
    - sched/fair: Fix pelt clock sync when entering idle (bsc#1234634).
    - sched/fair: Fix pelt lost idle time detection (bsc#1234634).
    - staging: rtl8723bs: fix missing status update on sdio_alloc_irq() failure (stable-fixes).
    - wifi: cfg80211: Fix use_for flag update on BSS refresh (git-fixes).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:1078-1 advisory.

    The SUSE Linux Enterprise 12 SP5 kernel was updated to receive various security bugfixes.


    The following security bugs were fixed:

    - CVE-2022-50453: gpiolib: cdev: fix NULL-pointer dereferences (bsc#1250887).
    - CVE-2023-53794: cifs: fix session state check in reconnect to avoid use-after-free issue (bsc#1255163).
    - CVE-2023-53802: wifi: ath9k: htc_hst: free skb in ath9k_htc_rx_msg() if there is no callback function     (bsc#1254725).
    - CVE-2023-53808: wifi: mwifiex: fix memory leak in mwifiex_histogram_read() (bsc#1254723).
    - CVE-2023-53816: drm/amdkfd: fix potential kgd_mem UAFs (bsc#1254958).
    - CVE-2023-53817: crypto: lib/mpi - avoid null pointer deref in mpi_cmp_ui() (bsc#1254992).
    - CVE-2023-53827: Bluetooth: L2CAP: Fix use-after-free in l2cap_disconnect_{req,rsp} (bsc#1255049).
    - CVE-2023-54184: scsi: target: iscsit: Free cmds before session free (bsc#1255991).
    - CVE-2025-21738: ata: libata-sff: Ensure that we cannot write outside the allocated buffer (bsc#1238917).
    - CVE-2025-22083: vhost-scsi: Fix handling of multiple calls to vhost_scsi_set_endpoint (bsc#1241414).
    - CVE-2025-22125: md/raid1,raid10: do not ignore IO flags (bsc#1241596).
    - CVE-2025-39748: bpf: Forget ranges when refining tnum after JSET (bsc#1249587).
    - CVE-2025-39817: efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare (bsc#1249998).
    - CVE-2025-39964: crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (bsc#1251966).
    - CVE-2025-39998: scsi: target: target_core_configfs: Add length check to avoid buffer overflow     (bsc#1252073).
    - CVE-2025-40099: cifs: parse_dfs_referrals: prevent oob on malformed input (bsc#1252911).
    - CVE-2025-40103: smb: client: Fix refcount leak for cifs_sb_tlink (bsc#1252924).
    - CVE-2025-40219: PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV (bsc#1254518).
    - CVE-2025-40220: fuse: fix livelock in synchronous file put from fuseblk workers (bsc#1254520).
    - CVE-2025-40242: gfs2: Fix unlikely race in gdlm_put_lock (bsc#1255075).
    - CVE-2025-40342: nvme-fc: use lock accessing port_state and rport state (bsc#1255274).
    - CVE-2025-68223: drm/radeon: delete radeon_fence_process in is_signaled, no deadlock (bsc#1255357).
    - CVE-2025-68234: scsi: imm: Fix use-after-free bug caused by unfinished delayed work (bsc#1255416).
    - CVE-2025-68283: libceph: replace BUG_ON with bounds check for map->max_osd (bsc#1255379).
    - CVE-2025-68285: libceph: fix potential use-after-free in have_mon_and_osd_map() (bsc#1255401).
    - CVE-2025-68287: usb: dwc3: Fix race condition between concurrent dwc3_remove_requests() call paths     (bsc#1255152).
    - CVE-2025-68295: smb: client: fix memory leak in cifs_construct_tcon() (bsc#1255129).
    - CVE-2025-68724: crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (bsc#1255550).
    - CVE-2025-68818: scsi: qla2xxx: Perform lockless command completion in abort path (bsc#1256675).
    - CVE-2025-71075: scsi: aic94xx: fix use-after-free in device removal path (bsc#1256629).
    - CVE-2025-71104: KVM: x86: Fix VM hard lockup after prolonged inactivity with periodic HV timer     (bsc#1256708).
    - CVE-2025-71113: crypto: af_alg - zero initialize memory allocated via sock_kmalloc (bsc#1256716).
    - CVE-2025-71116: libceph: make decode_pool() more resilient against corrupted osdmaps (bsc#1256744).
    - CVE-2025-71131: crypto: seqiv - Do not use req->iv after crypto_aead_encrypt (bsc#1256742).
    - CVE-2025-71183: btrfs: always detect conflicting inodes when logging inode refs (bsc#1257631).
    - CVE-2025-71184: btrfs: fix NULL dereference on root when tracing inode eviction (bsc#1257635).
    - CVE-2025-71194: btrfs: fix deadlock in wait_current_trans() due to ignored transaction type     (bsc#1257687).
    - CVE-2025-71224: wifi: mac80211: ocb: skip rx_no_sta when interface is not joined (bsc#1258824).
    - CVE-2025-71236: scsi: qla2xxx: Validate sp before freeing associated memory (bsc#1258442).
    - CVE-2026-22991: libceph: make free_choose_arg_map() resilient to partial allocation (bsc#1257220).
    - CVE-2026-22998: nvme-tcp: fix NULL pointer dereferences in nvmet_tcp_build_pdu_iovec (bsc#1257209).
    - CVE-2026-23004: dst: fix races in rt6_uncached_list_del() and rt_del_uncached_list() (bsc#1257231).
    - CVE-2026-23054: net: hv_netvsc: reject RSS hash key programming without RX indirection table     (bsc#1257732).
    - CVE-2026-23060: crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec     (bsc#1257735).
    - CVE-2026-23064: net/sched: act_ife: avoid possible NULL deref (bsc#1257765).
    - CVE-2026-23069: vsock/virtio: fix potential underflow in virtio_transport_get_credit() (bsc#1257755).
    - CVE-2026-23074: net/sched: Enforce that teql can only be used as root qdisc (bsc#1257749).
    - CVE-2026-23083: fou: Don't allow 0 for FOU_ATTR_IPPROTO (bsc#1257745).
    - CVE-2026-23084: be2net: Fix NULL pointer dereference in be_cmd_get_mac_from_list (bsc#1257830).
    - CVE-2026-23085: irqchip/gic-v3-its: Avoid truncating memory addresses (bsc#1257758).
    - CVE-2026-23086: vsock/virtio: cap TX credit to local buffer size (bsc#1257757).
    - CVE-2026-23089: ALSA: usb-audio: Fix use-after-free in snd_usb_mixer_free() (bsc#1257790).
    - CVE-2026-23095: gue: Fix skb memleak with inner IP protocol 0 (bsc#1257808).
    - CVE-2026-23099: bonding: limit BOND_MODE_8023AD to Ethernet devices (bsc#1257816).
    - CVE-2026-23105: net/sched: qfq: Use cl_is_active to determine whether class is active in qfq_rm_from_ag     (bsc#1257775).
    - CVE-2026-23112: nvmet-tcp: add bounds checks in nvmet_tcp_build_pdu_iovec (bsc#1258184).
    - CVE-2026-23125: sctp: move SCTP_CMD_ASSOC_SHKEY right after SCTP_CMD_PEER_INIT (bsc#1258293).
    - CVE-2026-23141: btrfs: send: check for inline extents in range_is_hole_in_parent() (bsc#1258377).
    - CVE-2026-23191: ALSA: aloop: Fix racy access at PCM trigger (bsc#1258395).
    - CVE-2026-23198: KVM: Don't clobber irqfd routing type when deassigning irqfd (bsc#1258321).
    - CVE-2026-23204: net/sched: cls_u32: use skb_header_pointer_careful() (bsc#1258340).
    - CVE-2026-23208: ALSA: usb-audio: Prevent excessive number of frames (bsc#1258468).
    - CVE-2026-23209: macvlan: fix error recovery in macvlan_common_newlink() (bsc#1258518).
    - CVE-2026-23268: apparmor: fix unprivileged local user can do privileged policy management (bsc#1258850).
    - CVE-2026-23269: apparmor: validate DFA start states are in bounds in unpack_pdb (bsc#1259857).


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 10 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-50160 advisory.

    - mm/hugetlb: fix hugetlb_pmd_shared() (David Hildenbrand) [Orabug: 38931087] {CVE-2026-23100}
    - platform/x86: classmate-laptop: Add missing NULL pointer checks (Rafael J. Wysocki) [Orabug: 39044501]     {CVE-2026-23237}
    - scsi: qla2xxx: Fix bsg_done() causing double free (Anil Gurumurthy) [Orabug: 39044457] {CVE-2025-71238}
    - wifi: rtl8xxxu: fix slab-out-of-bounds in rtl8xxxu_sta_add (Ali Tariq) [Orabug: 38997990]     {CVE-2025-71234}
    - xfs: fix UAF in xchk_btree_check_block_owner (Darrick J. Wong) [Orabug: 38998028] {CVE-2026-23223}
    - scsi: qla2xxx: Free sp in error path to fix system crash (Anil Gurumurthy) [Orabug: 38997979]     {CVE-2025-71232}
    - scsi: qla2xxx: Delay module unload while fabric scan in progress (Anil Gurumurthy) [Orabug: 38997992]     {CVE-2025-71235}
    - scsi: qla2xxx: Validate sp before freeing associated memory (Anil Gurumurthy) [Orabug: 38997998]     {CVE-2025-71236}
    - wifi: rtw88: Fix alignment fault in rtw_core_enable_beacon() (Bitterblue Smith) [Orabug: 38997972]     {CVE-2025-71229}
    - crypto: virtio - Add spinlock protection with virtqueue notification (Bibo Mao) [Orabug: 38998052]     {CVE-2026-23229}
    - crypto: iaa - Fix out-of-bounds index in find_empty_iaa_compression_mode (Thorsten Blum) [Orabug:
    38997976] {CVE-2025-71231}
    - smb: client: split cached_fid bitfields to avoid shared-byte RMW races (Henrique Carvalho) [Orabug:
    38998059] {CVE-2026-23230}
    - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Breno Leitao) [Orabug: 38970593]     {CVE-2026-23202}
    - ASoC: amd: fix memory leak in acp3x pdm dma ops (Chris Bainbridge) [Orabug: 38970441] {CVE-2026-23190}
    - ipv6: Fix ECMP sibling count mismatch when clearing RTF_ADDRCONF (Shigeru Yoshida) [Orabug: 38970598]     {CVE-2026-23200}
    - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (Andrew Fasano) [Orabug:
    38970170] {CVE-2026-23111}
    - net: usb: r8152: fix resume reset deadlock (Sergey Senozhatsky) [Orabug: 38970438] {CVE-2026-23188}
    - macvlan: fix error recovery in macvlan_common_newlink() (Eric Dumazet) [Orabug: 38970508]     {CVE-2026-23209}
    - net/sched: cls_u32: use skb_header_pointer_careful() (Eric Dumazet) [Orabug: 38970487] {CVE-2026-23204}
    - smb/client: fix memory leak in smb2_open_file() (Chenxiaosong) [Orabug: 38970578] {CVE-2026-23205}
    - btrfs: reject new transactions if the fs is fully read-only (Qu Wenruo) [Orabug: 38985156]     {CVE-2026-23214}
    - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (Maurizio Lombardi) [Orabug:
    38985169] {CVE-2026-23216}
    - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (Maurizio Lombardi) [Orabug:
    38970453] {CVE-2026-23193}
    - nvmet-tcp: fixup hang in nvmet_tcp_listen_data_ready() (Hannes Reinecke) [Orabug: 38970416]     {CVE-2026-23179}
    - drm/amd/pm: Disable MMIO access during SMU Mode 1 reset (Perry Yuan) [Orabug: 38985149] {CVE-2026-23213}
    - HID: i2c-hid: fix potential buffer overflow in i2c_hid_get_report() (Kwok Kin Ming) [Orabug: 38970413]     {CVE-2026-23178}
    - md: suspend array while updating raid_disks via sysfs (Danny Shih) [Orabug: 38985108] {CVE-2025-71225}
    - wifi: wlcore: ensure skb headroom before skb_push (Peter Astrand) [Orabug: 38970152] {CVE-2025-71222}
    - wifi: mac80211: ocb: skip rx_no_sta when interface is not joined (Moon Hee Lee) [Orabug: 38970163]     {CVE-2025-71224}
    - procfs: avoid fetching build ID while holding VMA lock (Andrii Nakryiko) [Orabug: 38970476]     {CVE-2026-23199}
    - mm, shmem: prevent infinite loop on truncate race (Kairui Song) [Orabug: 38970409] {CVE-2026-23177}
    - ceph: fix oops due to invalid pointer for kfree() in parse_longname() (Daniel Vogelbacher) [Orabug:
    38970590] {CVE-2026-23201}
    - ceph: fix NULL pointer dereference in ceph_mds_auth_match() (Viacheslav Dubeyko) [Orabug: 38970595]     {CVE-2026-23189}
    - mm/slab: Add alloc_tagging_slab_free_hook for memcg_alloc_abort_single (Hao Ge) [Orabug: 38985192]     {CVE-2026-23219}
    - ALSA: aloop: Fix racy access at PCM trigger (Takashi Iwai) [Orabug: 38970445] {CVE-2026-23191}
    - x86/vmware: Fix hypercall clobbers (Josh Poimboeuf) [Orabug: 38985163] {CVE-2026-23215}
    - nvmet-tcp: add bounds checks in nvmet_tcp_build_pdu_iovec (Yunje Shin) [Orabug: 38970176]     {CVE-2026-23112}
    - perf: sched: Fix perf crash with new is_user_task() helper (Steven Rostedt) [Orabug: 38970581]     {CVE-2026-23159}
    - wifi: ath11k: add srng->lock for ath11k_hal_srng_* in monitor mode (Kang Yang) [Orabug: 37844126]     {CVE-2024-58096}
    - drm/amdgpu: fix NULL pointer dereference in amdgpu_gmc_filter_faults_remove (Jon Doron) [Orabug:
    38970348] {CVE-2026-23163}
    - net: fix segmentation of forwarding fraglist GRO (Jibin Zhang) [Orabug: 38970318] {CVE-2026-23154}
    - mm/shmem, swap: fix race of truncate and swap entry split (Kairui Song) [Orabug: 38970345]     {CVE-2026-23161}
    - flex_proportions: make fprop_new_period() hardirq safe (Jan Kara) [Orabug: 38970373] {CVE-2026-23168}
    - nvmet: fix race in nvmet_bio_done() leading to NULL pointer dereference (Ming Lei) [Orabug: 38970608]     {CVE-2026-23148}
    - efivarfs: fix error propagation in efivar_entry_get() (Kohei Enju) [Orabug: 38970325] {CVE-2026-23156}
    - net/mlx5e: TC, delete flows only for existing peers (Mark Bloch) [Orabug: 38970397] {CVE-2026-23173}
    - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Aaron Ma) [Orabug: 38970364]     {CVE-2026-23166}
    - rocker: fix memory leak in rocker_world_port_post_fini() (Kery Qi) [Orabug: 38970351] {CVE-2026-23164}
    - bonding: annotate data-races around slave->last_rx (Eric Dumazet) [Orabug: 38985142] {CVE-2026-23212}
    - Bluetooth: MGMT: Fix memory leak in set_ssp_complete (Jianpeng Chang) [Orabug: 38970587]     {CVE-2026-23151}
    - Bluetooth: hci_uart: fix null-ptr-deref in hci_uart_write_work (Jia-Hong Su) [Orabug: 38970604]     {CVE-2026-23146}
    - wifi: ath11k: fix RCU stall while reaping monitor destination ring (P Praneesh) [Orabug: 37844129]     {CVE-2024-58097}
    - btrfs: fix racy bitfield write in btrfs_clear_space_info_full() (Boris Burkov) [Orabug: 38798802]     {CVE-2025-68358}
    - sched_ext: Fix possible deadlock in the deferred_irq_workfn() (Zqiang) [Orabug: 38792605]     {CVE-2025-68333}
    - exfat: fix refcount leak in exfat_find (Shuhao Fu) [Orabug: 38798780] {CVE-2025-68351}
    - bpf: Do not let BPF test infra emit invalid GSO types to stack (Daniel Borkmann) [Orabug: 38798881]     {CVE-2025-68725}
    - migrate: correct lock ordering for hugetlb file folios (Matthew Wilcox) [Orabug: 38931066]     {CVE-2026-23097}
    - can: usb_8dev: usb_8dev_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde) [Orabug: 38931120]     {CVE-2026-23108}
    - can: kvaser_usb: kvaser_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde) [Orabug:
    38930881] {CVE-2026-23061}
    - can: ems_usb: ems_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde) [Orabug: 38930859]     {CVE-2026-23058}
    - irqchip/gic-v3-its: Avoid truncating memory addresses (Arnd Bergmann) [Orabug: 38931001]     {CVE-2026-23085}
    - intel_th: fix device leak on output open() (Johan Hovold) [Orabug: 38931040] {CVE-2026-23091}
    - tracing: Fix crash on synthetic stacktrace field usage (Steven Rostedt) [Orabug: 38931024]     {CVE-2026-23088}
    - arm64: Set __nocfi on swsusp_arch_resume() (Zhaoyang Huang) [Orabug: 38970241] {CVE-2026-23128}
    - arm64/fpsimd: signal: Allocate SSVE storage when restoring ZA (Mark Rutland) [Orabug: 38931118]     {CVE-2026-23107}
    - wifi: rsi: Fix memory corruption due to not set vif driver data size (Marek Vasut) [Orabug: 38930939]     {CVE-2026-23073}
    - wifi: ath10k: fix dma_free_coherent() pointer (Thomas Fourier) [Orabug: 38970253] {CVE-2026-23133}
    - ALSA: usb-audio: Fix use-after-free in snd_usb_mixer_free() (Berk Cem Goksel) [Orabug: 38931029]     {CVE-2026-23089}
    - ALSA: scarlett2: Fix buffer overflow in config retrieval (Samasth Norway Ananda) [Orabug: 38930973]     {CVE-2026-23078}
    - ALSA: ctxfi: Fix potential OOB access in audio mixer handling (Takashi Iwai) [Orabug: 38930966]     {CVE-2026-23076}
    - leds: led-class: Only Add LED to leds_list when it is fully ready (Hans de Goede) [Orabug: 38931091]     {CVE-2026-23101}
    - dpll: Prevent duplicate registrations (Ivan Vecera) [Orabug: 38970244] {CVE-2026-23129}
    - vsock/virtio: cap TX credit to local buffer size (Melbin K Mathew) [Orabug: 38931008] {CVE-2026-23086}
    - vsock/virtio: fix potential underflow in virtio_transport_get_credit() (Melbin K Mathew) [Orabug:
    38930919] {CVE-2026-23069}
    - bonding: provide a net pointer to __skb_flow_dissect() (Eric Dumazet) [Orabug: 38970199]     {CVE-2026-23119}
    - be2net: Fix NULL pointer dereference in be_cmd_get_mac_from_list (Andrey Vatoropin) [Orabug: 38930992]     {CVE-2026-23084}
    - ipv6: annotate data-race in ndisc_router_discovery() (Eric Dumazet) [Orabug: 38970222] {CVE-2026-23124}
    - netdevsim: fix a race issue related to the operation on bpf_bound_progs list (Yun Lu) [Orabug: 38970233]     {CVE-2026-23126}
    - scsi: qla2xxx: Sanitize payload size to prevent member overflow (Jiasheng Jiang) [Orabug: 38930867]     {CVE-2026-23059}
    - scsi: core: Wake up the error handler when final completions race against each other (David Jeffery)     [Orabug: 38931132] {CVE-2026-23110}
    - regmap: Fix race condition in hwspinlock irqsave routine (Cheng-Yu Lee) [Orabug: 38930930]     {CVE-2026-23071}
    - interconnect: debugfs: initialize src_node and dst_node to empty strings (Georgi Djakov) [Orabug:
    38970218] {CVE-2026-23123}
    - io_uring/io-wq: check IO_WQ_BIT_EXIT inside work run loop (Jens Axboe) [Orabug: 38970181]     {CVE-2026-23113}
    - platform/x86: hp-bioscfg: Fix kernel panic in GET_INSTANCE_ID macro (Mario Limonciello) [Orabug:
    38930890] {CVE-2026-23062}
    - platform/x86: hp-bioscfg: Fix kobject warnings for empty attribute names (Mario Limonciello) [Orabug:
    38970247] {CVE-2026-23131}
    - scsi: xen: scsiback: Fix potential memory leak in scsiback_remove() (Abdun Nihaal) [Orabug: 38931014]     {CVE-2026-23087}
    - w1: therm: Fix off-by-one buffer overflow in alarms_store (Thorsten Blum) [Orabug: 38930796]     {CVE-2025-71197}
    - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec (Taeyang Lee) [Orabug:
    38930874] {CVE-2026-23060}
    - net/sched: qfq: Use cl_is_active to determine whether class is active in qfq_rm_from_ag (Jamal Hadi     Salim) [Orabug: 38931110] {CVE-2026-23105}
    - net/sched: Enforce that teql can only be used as root qdisc (Jamal Hadi Salim) [Orabug: 38930948]     {CVE-2026-23074}
    - ipvlan: Make the addrs_lock be per port (Dmitry Skorodumov) [Orabug: 38931102] {CVE-2026-23103}
    - l2tp: avoid one data-race in l2tp_tunnel_del_work() (Eric Dumazet) [Orabug: 38970202] {CVE-2026-23120}
    - gue: Fix skb memleak with inner IP protocol 0. (Kuniyuki Iwashima) [Orabug: 38931057] {CVE-2026-23095}
    - sctp: move SCTP_CMD_ASSOC_SHKEY right after SCTP_CMD_PEER_INIT (Xin Long) [Orabug: 38970225]     {CVE-2026-23125}
    - can: gs_usb: gs_usb_receive_bulk_callback(): unanchor URL on usb_submit_urb() error (Marc Kleine-Budde)     [Orabug: 38931184] {CVE-2026-23082}
    - l2tp: Fix memleak in l2tp_udp_encap_recv(). (Kuniyuki Iwashima) [Orabug: 38930935] {CVE-2026-23072}
    - bonding: limit BOND_MODE_8023AD to Ethernet devices (Eric Dumazet) [Orabug: 38931079] {CVE-2026-23099}
    - vsock/virtio: Coalesce only linear skb (Michal Luczaj) [Orabug: 38930857] {CVE-2026-23057}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:0962-1 advisory.

    The SUSE Linux Enterprise 15 SP7 RT kernel was updated to receive various security bugfixes.


    The following security bugs were fixed:

    - CVE-2023-53817: crypto: lib/mpi - avoid null pointer deref in mpi_cmp_ui() (bsc#1254992).
    - CVE-2025-39748: bpf: Forget ranges when refining tnum after JSET (bsc#1249587).
    - CVE-2025-39817: efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare (bsc#1249998).
    - CVE-2025-39964: crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (bsc#1251966).
    - CVE-2025-40099: cifs: parse_dfs_referrals: prevent oob on malformed input (bsc#1252911).
    - CVE-2025-40103: smb: client: Fix refcount leak for cifs_sb_tlink (bsc#1252924).
    - CVE-2025-40201: kernel/sys.c: fix the racy usage of task_lock(tsk->group_leader) in sys_prlimit64()     paths
    - CVE-2025-40253: s390/ctcm: Fix double-kfree (bsc#1255084).
    - CVE-2025-68283: libceph: replace BUG_ON with bounds check for map->max_osd (bsc#1255379).
    - CVE-2025-68295: smb: client: fix memory leak in cifs_construct_tcon() (bsc#1255129).
    - CVE-2025-68374: md: fix rcu protection in md_wakeup_thread (bsc#1255530).
    - CVE-2025-68735: drm/panthor: Prevent potential UAF in group creation (bsc#1255811).
    - CVE-2025-68736: landlock: Fix handling of disconnected directories (bsc#1255698).
    - CVE-2025-68778: btrfs: don't log conflicting inode if it's a dir moved in the current transaction     (bsc#1256683).
    - CVE-2025-68785: net: openvswitch: fix middle attribute validation in push_nsh() action (bsc#1256640).
    - CVE-2025-68810: KVM: Disallow toggling KVM_MEM_GUEST_MEMFD on an existing memslot (bsc#1256679).
    - CVE-2025-71071: iommu/mediatek: fix use-after-free on probe deferral (bsc#1256802).
    - CVE-2025-71104: KVM: x86: Fix VM hard lockup after prolonged inactivity with periodic HV timer     (bsc#1256708).
    - CVE-2025-71113: crypto: af_alg - zero initialize memory allocated via sock_kmalloc (bsc#1256716).
    - CVE-2025-71125: tracing: Do not register unsupported perf events (bsc#1256784).
    - CVE-2025-71126: mptcp: reset fallback status gracefully at disconnect() time (bsc#1256755).
    - CVE-2025-71148: net/handshake: restore destructor on submit failure (bsc#1257159).
    - CVE-2025-71184: btrfs: fix NULL dereference on root when tracing inode eviction (bsc#1257635).
    - CVE-2025-71194: btrfs: fix deadlock in wait_current_trans() due to ignored transaction type     (bsc#1257687).
    - CVE-2025-71225: md: suspend array while updating raid_disks via sysfs (bsc#1258411).
    - CVE-2026-22979: net: fix memory leak in skb_segment_list for GRO packets (bsc#1257228).
    - CVE-2026-22982: net: mscc: ocelot: Fix crash when adding interface under a lag (bsc#1257179).
    - CVE-2026-22998: nvme-tcp: fix NULL pointer dereferences in nvmet_tcp_build_pdu_iovec (bsc#1257209).
    - CVE-2026-23003: geneve: Fix incorrect inner network header offset when innerprotoinherit is set     (bsc#1257246).
    - CVE-2026-23004: dst: fix races in rt6_uncached_list_del() and rt_del_uncached_list() (bsc#1257231).
    - CVE-2026-23010: ipv6: Fix use-after-free in inet6_addr_del() (bsc#1257332).
    - CVE-2026-23017: idpf: fix error handling in the init_task on load (bsc#1257552).
    - CVE-2026-23023: idpf: fix memory leak in idpf_vport_rel() (bsc#1257556).
    - CVE-2026-23035: net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (bsc#1257559).
    - CVE-2026-23053: NFS: Fix a deadlock involving nfs_release_folio() (bsc#1257718).
    - CVE-2026-23057: vsock/virtio: Coalesce only linear skb (bsc#1257740).
    - CVE-2026-23060: crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec     (bsc#1257735).
    - CVE-2026-23064: net/sched: act_ife: avoid possible NULL deref (bsc#1257765).
    - CVE-2026-23069: vsock/virtio: fix potential underflow in virtio_transport_get_credit() (bsc#1257755).
    - CVE-2026-23070: Octeontx2-af: Add proper checks for fwdata (bsc#1257709).
    - CVE-2026-23074: net/sched: Enforce that teql can only be used as root qdisc (bsc#1257749).
    - CVE-2026-23083: fou: Don't allow 0 for FOU_ATTR_IPPROTO (bsc#1257745).
    - CVE-2026-23084: be2net: Fix NULL pointer dereference in be_cmd_get_mac_from_list (bsc#1257830).
    - CVE-2026-23085: irqchip/gic-v3-its: Avoid truncating memory addresses (bsc#1257758).
    - CVE-2026-23086: vsock/virtio: cap TX credit to local buffer size (bsc#1257757).
    - CVE-2026-23088: tracing: Fix crash on synthetic stacktrace field usage (bsc#1257814).
    - CVE-2026-23089: ALSA: usb-audio: Fix use-after-free in snd_usb_mixer_free() (bsc#1257790).
    - CVE-2026-23095: gue: Fix skb memleak with inner IP protocol 0 (bsc#1257808).
    - CVE-2026-23099: bonding: limit BOND_MODE_8023AD to Ethernet devices (bsc#1257816).
    - CVE-2026-23102: arm64/fpsimd: signal: Mandate SVE payload for streaming-mode state (bsc#1257772).
    - CVE-2026-23104: ice: fix devlink reload call trace (bsc#1257763).
    - CVE-2026-23105: net/sched: qfq: Use cl_is_active to determine whether class is active in qfq_rm_from_ag     (bsc#1257775).
    - CVE-2026-23107: arm64/fpsimd: signal: Allocate SSVE storage when restoring ZA (bsc#1257762).
    - CVE-2026-23110: scsi: core: Wake up the error handler when final completions race against each other     (bsc#1257761).
    - CVE-2026-23111: netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate()     (bsc#1258181).
    - CVE-2026-23112: nvmet-tcp: add bounds checks in nvmet_tcp_build_pdu_iovec (bsc#1258184).
    - CVE-2026-23113: io_uring/io-wq: check IO_WQ_BIT_EXIT inside work run loop (bsc#1258278).
    - CVE-2026-23116: pmdomain: imx8m-blk-ctrl: Remove separate rst and clk mask for 8mq vpu (bsc#1258277).
    - CVE-2026-23119: bonding: provide a net pointer to __skb_flow_dissect() (bsc#1258273).
    - CVE-2026-23125: sctp: move SCTP_CMD_ASSOC_SHKEY right after SCTP_CMD_PEER_INIT (bsc#1258293).
    - CVE-2026-23139: netfilter: nf_conncount: update last_gc only when GC has been performed (bsc#1258304).
    - CVE-2026-23141: btrfs: send: check for inline extents in range_is_hole_in_parent() (bsc#1258377).
    - CVE-2026-23154: net: fix segmentation of forwarding fraglist GRO (bsc#1258286).
    - CVE-2026-23166: ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (bsc#1258272).
    - CVE-2026-23169: mptcp: fix race in mptcp_pm_nl_flush_addrs_doit() (bsc#1258389).
    - CVE-2026-23171: net: bonding: update the slave array for broadcast mode (bsc#1258349).
    - CVE-2026-23173: net/mlx5e: TC, delete flows only for existing peers (bsc#1258520).
    - CVE-2026-23179: nvmet-tcp: fixup hang in nvmet_tcp_listen_data_ready() (bsc#1258394).
    - CVE-2026-23191: ALSA: aloop: Fix racy access at PCM trigger (bsc#1258395).
    - CVE-2026-23198: KVM: Don't clobber irqfd routing type when deassigning irqfd (bsc#1258321).
    - CVE-2026-23204: net/sched: cls_u32: use skb_header_pointer_careful() (bsc#1258340).
    - CVE-2026-23208: ALSA: usb-audio: Prevent excessive number of frames (bsc#1258468).
    - CVE-2026-23209: macvlan: fix error recovery in macvlan_common_newlink() (bsc#1258518).
    - CVE-2026-23210: ice: Fix PTP NULL pointer dereference during VSI rebuild (bsc#1258517).
    - CVE-2026-23213: drm/amd/pm: Disable MMIO access during SMU Mode 1 reset (bsc#1258465).
    - CVE-2026-23214: btrfs: reject new transactions if the fs is fully read-only (bsc#1258464).
    - CVE-2026-23268: apparmor: fix unprivileged local user can do privileged policy management
    - CVE-2026-23269: apparmor: validate DFA start states are in bounds in unpack_pdb


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4498 advisory.

    -------------------------------------------------------------------------     Debian LTS Advisory DLA-4498-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                        Ben Hutchings     March 13, 2026                                https://wiki.debian.org/LTS
    -------------------------------------------------------------------------

    Package        : linux     Version        : 5.10.251-1     CVE ID         : CVE-2022-50516 CVE-2025-38201 CVE-2025-71222 CVE-2025-71224                      CVE-2025-71232 CVE-2025-71235 CVE-2025-71236 CVE-2025-71237                      CVE-2025-71238 CVE-2026-23112 CVE-2026-23176 CVE-2026-23190                      CVE-2026-23193 CVE-2026-23198 CVE-2026-23209 CVE-2026-23216                      CVE-2026-23222 CVE-2026-23229 CVE-2026-23234 CVE-2026-23235                      CVE-2026-23236 CVE-2026-23237 CVE-2026-23238     Debian Bug     : 1127597

    Several vulnerabilities have been discovered in the Linux kernel that     may lead to a privilege escalation, denial of service or information     leaks.

    The Qualys Threat Research Unit (TRU) discovered several vulnerabilities     in Apparmor. Details can be found in the Qualys advisory at     https://www.qualys.com/2026/03/10/crack-armor.txt

    For Debian 11 bullseye, these problems have been fixed in version     5.10.251-1.  This version also fixes a regression in the previous     update.  It additionally includes many more bug fixes from stable     updates 5.10.250 and 5.10.251.

    We recommend that you upgrade your linux packages.

    For the detailed security status of linux please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/linux

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS     Attachment:
    signature.asc     Description: PGP signature

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4499 advisory.

    -------------------------------------------------------------------------     Debian LTS Advisory DLA-4499-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                        Ben Hutchings     March 13, 2026                                https://wiki.debian.org/LTS
    -------------------------------------------------------------------------

    Package        : linux-6.1     Version        : 6.1.164-1~deb11u1     CVE ID         : CVE-2023-53424 CVE-2024-26822 CVE-2024-57895 CVE-2025-22026                      CVE-2025-23155 CVE-2025-37786 CVE-2025-37822 CVE-2025-37920                      CVE-2025-38201 CVE-2025-38643 CVE-2025-39763 CVE-2025-40082                      CVE-2025-40251 CVE-2025-68358 CVE-2025-71089 CVE-2025-71144                      CVE-2025-71220 CVE-2025-71222 CVE-2025-71224 CVE-2025-71232                      CVE-2025-71233 CVE-2025-71235 CVE-2025-71236 CVE-2025-71237                      CVE-2025-71238 CVE-2026-23111 CVE-2026-23112 CVE-2026-23169                      CVE-2026-23176 CVE-2026-23178 CVE-2026-23180 CVE-2026-23182                      CVE-2026-23187 CVE-2026-23190 CVE-2026-23193 CVE-2026-23198                      CVE-2026-23202 CVE-2026-23205 CVE-2026-23206 CVE-2026-23209                      CVE-2026-23216 CVE-2026-23220 CVE-2026-23221 CVE-2026-23222                      CVE-2026-23228 CVE-2026-23229 CVE-2026-23230 CVE-2026-23234                      CVE-2026-23235 CVE-2026-23236 CVE-2026-23237 CVE-2026-23238     Debian Bug     : 1127597

    Several vulnerabilities have been discovered in the Linux kernel that     may lead to a privilege escalation, denial of service or information     leaks.

    The Qualys Threat Research Unit (TRU) discovered several vulnerabilities     in Apparmor. Details can be found in the Qualys advisory at     https://www.qualys.com/2026/03/10/crack-armor.txt

    For Debian 11 bullseye, these problems have been fixed in version     6.1.164-1~deb11u1.  This version also fixes a regression in the     previous update.  It additionally includes many more bug fixes from     stable updates 6.1.163 and 6.1.164.

    We recommend that you upgrade your linux-6.1 packages.

    For the detailed security status of linux-6.1 please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/linux-6.1

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS     Attachment:
    signature.asc     Description: PGP signature

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6163 advisory.

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-6163-1                   security@debian.org     https://www.debian.org/security/                     Salvatore Bonaccorso     March 12, 2026                        https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : linux     CVE ID         : CVE-2023-53424 CVE-2024-26822 CVE-2024-57895 CVE-2025-22026                      CVE-2025-23155 CVE-2025-37786 CVE-2025-37822 CVE-2025-37920                      CVE-2025-38201 CVE-2025-38643 CVE-2025-39763 CVE-2025-40082                      CVE-2025-40251 CVE-2025-68358 CVE-2025-71089 CVE-2025-71144                      CVE-2025-71220 CVE-2025-71222 CVE-2025-71224 CVE-2025-71232                      CVE-2025-71233 CVE-2025-71235 CVE-2025-71236 CVE-2025-71237                      CVE-2025-71238 CVE-2026-23111 CVE-2026-23112 CVE-2026-23169                      CVE-2026-23176 CVE-2026-23178 CVE-2026-23180 CVE-2026-23182                      CVE-2026-23187 CVE-2026-23190 CVE-2026-23193 CVE-2026-23198                      CVE-2026-23202 CVE-2026-23205 CVE-2026-23206 CVE-2026-23209                      CVE-2026-23216 CVE-2026-23220 CVE-2026-23221 CVE-2026-23222                      CVE-2026-23228 CVE-2026-23229 CVE-2026-23230 CVE-2026-23234                      CVE-2026-23235 CVE-2026-23236 CVE-2026-23237 CVE-2026-23238

    Several vulnerabilities have been discovered in the Linux kernel that     may lead to a privilege escalation, denial of service or information     leaks.

    The Qualys Threat Research Unit (TRU) discovered several vulnerabilities     in Apparmor. Details can be found in the Qualys advisory at     https://www.qualys.com/2026/03/10/crack-armor.txt

    For the oldstable distribution (bookworm), these problems have been fixed     in version 6.1.164-1.

    We recommend that you upgrade your linux packages.

    For the detailed security status of linux please refer to its security     tracker page at:
    https://security-tracker.debian.org/tracker/linux

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1468 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    blk-cgroup: Reinit blkg_iostat_set after clearing in blkcg_reset_stats() (CVE-2023-53421)

    In the Linux kernel, the following vulnerability has been resolved:

    iomap: Fix possible overflow condition in iomap_write_delalloc_scan (CVE-2023-54285)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf: Reject narrower access to pointer ctx fields (CVE-2025-38591)

    In the Linux kernel, the following vulnerability has been resolved:

    sctp: linearize cloned gso packets in sctp_rcv (CVE-2025-38718)

    In the Linux kernel, the following vulnerability has been resolved:

    smb: client: fix potential UAF in smb2_close_cached_fid() (CVE-2025-40328)

    In the Linux kernel, the following vulnerability has been resolved:

    team: Move team device type change at the end of team_port_add (CVE-2025-68340)

    In the Linux kernel, the following vulnerability has been resolved:

    fs/ntfs3: Initialize allocated memory before use (CVE-2025-68365)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf: Do not let BPF test infra emit invalid GSO types to stack (CVE-2025-68725)

    In the Linux kernel, the following vulnerability has been resolved:

    iommu: disable SVA when CONFIG_X86 is set (CVE-2025-71089)

    In the Linux kernel, the following vulnerability has been resolved:

    btrfs: fix deadlock in wait_current_trans() due to ignored transaction type (CVE-2025-71194)

    In the Linux kernel, the following vulnerability has been resolved:

    btrfs: fix reservation leak in some error paths when inserting inline extent (CVE-2025-71268)

    In the Linux kernel, the following vulnerability has been resolved:

    net/sched: sch_qfq: do not free existing class in qfq_change_class() (CVE-2026-22999)

    In the Linux kernel, the following vulnerability has been resolved:

    macvlan: fix possible UAF in macvlan_forward_source() (CVE-2026-23001)

    In the Linux kernel, the following vulnerability has been resolved:

    ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CVE-2026-23003)

    In the Linux kernel, the following vulnerability has been resolved:

    x86/fpu: Clear XSTATE_BV[i] in guest XSAVE state whenever XFD[i]=1 (CVE-2026-23005)

    In the Linux kernel, the following vulnerability has been resolved:

    ipv6: Fix use-after-free in inet6_addr_del(). (CVE-2026-23010)

    In the Linux kernel, the following vulnerability has been resolved:

    ipv4: ip_gre: make ipgre_header() robust (CVE-2026-23011)

    In the Linux kernel, the following vulnerability has been resolved:

    mm/page_alloc: prevent pcp corruption with SMP=n (CVE-2026-23025)

    In the Linux kernel, the following vulnerability has been resolved:

    pnfs/flexfiles: Fix memory leak in nfs4_ff_alloc_deviceid_node() (CVE-2026-23038)

    In the Linux kernel, the following vulnerability has been resolved:

    net: hv_netvsc: reject RSS hash key programming without RX indirection table (CVE-2026-23054)

    In the Linux kernel, the following vulnerability has been resolved:

    crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec (CVE-2026-23060)

    In the Linux kernel, the following vulnerability has been resolved:

    vsock/virtio: fix potential underflow in virtio_transport_get_credit() (CVE-2026-23069)

    In the Linux kernel, the following vulnerability has been resolved:

    regmap: Fix race condition in hwspinlock irqsave routine (CVE-2026-23071)

    In the Linux kernel, the following vulnerability has been resolved:

    net/sched: Enforce that teql can only be used as root qdisc (CVE-2026-23074)

    In the Linux kernel, the following vulnerability has been resolved:

    fou: Don't allow 0 for FOU_ATTR_IPPROTO. (CVE-2026-23083)

    In the Linux kernel, the following vulnerability has been resolved:

    irqchip/gic-v3-its: Avoid truncating memory addresses (CVE-2026-23085)

    In the Linux kernel, the following vulnerability has been resolved:

    vsock/virtio: cap TX credit to local buffer size (CVE-2026-23086)

    In the Linux kernel, the following vulnerability has been resolved:

    gue: Fix skb memleak with inner IP protocol 0. (CVE-2026-23095)

    In the Linux kernel, the following vulnerability has been resolved:

    migrate: correct lock ordering for hugetlb file folios (CVE-2026-23097)

    In the Linux kernel, the following vulnerability has been resolved:

    bonding: limit BOND_MODE_8023AD to Ethernet devices (CVE-2026-23099)

    In the Linux kernel, the following vulnerability has been resolved:

    arm64/fpsimd: signal: Fix restoration of SVE context (CVE-2026-23102)

    In the Linux kernel, the following vulnerability has been resolved:

    ipvlan: Make the addrs_lock be per port (CVE-2026-23103)

    In the Linux kernel, the following vulnerability has been resolved:

    net/sched: qfq: Use cl_is_active to determine whether class is active in qfq_rm_from_ag (CVE-2026-23105)

    In the Linux kernel, the following vulnerability has been resolved:

    arm64/fpsimd: signal: Allocate SSVE storage when restoring ZA (CVE-2026-23107)

    In the Linux kernel, the following vulnerability has been resolved:

    scsi: core: Wake up the error handler when final completions race against each other (CVE-2026-23110)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CVE-2026-23111)

    In the Linux kernel, the following vulnerability has been resolved:

    bonding: provide a net pointer to __skb_flow_dissect() (CVE-2026-23119)

    In the Linux kernel, the following vulnerability has been resolved:

    ipv6: annotate data-race in ndisc_router_discovery() (CVE-2026-23124)

    In the Linux kernel, the following vulnerability has been resolved:

    sctp: move SCTP_CMD_ASSOC_SHKEY right after SCTP_CMD_PEER_INIT (CVE-2026-23125)

    In the Linux kernel, the following vulnerability has been resolved:

    netdevsim: fix a race issue related to the operation on bpf_bound_progs list (CVE-2026-23126)

    In the Linux kernel, the following vulnerability has been resolved:

    arm64: Set __nocfi on swsusp_arch_resume() (CVE-2026-23128)

    In the Linux kernel, the following vulnerability has been resolved:

    mm/damon/sysfs-scheme: cleanup access_pattern subdirs on scheme dir setup failure (CVE-2026-23142)

    In the Linux kernel, the following vulnerability has been resolved:

    mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (CVE-2026-23144)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: fix iloc.bh leak in ext4_xattr_inode_update_ref (CVE-2026-23145)

    In the Linux kernel, the following vulnerability has been resolved:

    efivarfs: fix error propagation in efivar_entry_get() (CVE-2026-23156)

    In the Linux kernel, the following vulnerability has been resolved:

    flex_proportions: make fprop_new_period() hardirq safe (CVE-2026-23168)

    In the Linux kernel, the following vulnerability has been resolved:

    scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CVE-2026-23193)

    In the Linux kernel, the following vulnerability has been resolved:

    KVM: Don't clobber irqfd routing type when deassigning irqfd (CVE-2026-23198)

    In the Linux kernel, the following vulnerability has been resolved:

    smb/client: fix memory leak in smb2_open_file() (CVE-2026-23205)

    In the Linux kernel, the following vulnerability has been resolved:

    macvlan: fix error recovery in macvlan_common_newlink() (CVE-2026-23209)

    In the Linux kernel, the following vulnerability has been resolved:

    bonding: annotate data-races around slave->last_rx (CVE-2026-23212)

    In the Linux kernel, the following vulnerability has been resolved:

    scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CVE-2026-23216)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of kernel installed on the remote host is prior to 5.15.201-140.219. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.15-2026-098 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    drm/ttm: fix undefined behavior in bit shift for TTM_TT_FLAG_PRIV_POPULATED (CVE-2022-50390)

    In the Linux kernel, the following vulnerability has been resolved:

    blk-cgroup: Reinit blkg_iostat_set after clearing in blkcg_reset_stats() (CVE-2023-53421)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: fix memory leaks in ext4_fname_{setup_filename,prepare_lookup} (CVE-2023-53662)

    In the Linux kernel, the following vulnerability has been resolved:

    page_pool: Fix use-after-free in page_pool_recycle_in_ring (CVE-2025-38129)

    In the Linux kernel, the following vulnerability has been resolved:

    HID: core: Harden s32ton() against conversion to 0 bits (CVE-2025-38556)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf: Reject narrower access to pointer ctx fields (CVE-2025-38591)

    In the Linux kernel, the following vulnerability has been resolved:

    xfrm: delete x->tunnel as we delete x (CVE-2025-40215)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: add i_data_sem protection in ext4_destroy_inline_data_nolock() (CVE-2025-68261)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: refresh inline data size before write operations (CVE-2025-68264)

    In the Linux kernel, the following vulnerability has been resolved:

    net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop (CVE-2025-68325)

    In the Linux kernel, the following vulnerability has been resolved:

    jbd2: avoid bug_on in jbd2_journal_get_create_access() when file system corrupted (CVE-2025-68337)

    In the Linux kernel, the following vulnerability has been resolved:

    team: Move team device type change at the end of team_port_add (CVE-2025-68340)

    In the Linux kernel, the following vulnerability has been resolved:

    NFSv4/pNFS: Clear NFS_INO_LAYOUTCOMMIT in pnfs_mark_layout_stateid_invalid (CVE-2025-68349)

    In the Linux kernel, the following vulnerability has been resolved:

    btrfs: fix racy bitfield write in btrfs_clear_space_info_full() (CVE-2025-68358)

    In the Linux kernel, the following vulnerability has been resolved:

    fs/ntfs3: Initialize allocated memory before use (CVE-2025-68365)

    In the Linux kernel, the following vulnerability has been resolved:

    nbd: defer config unlock in nbd_genl_connect (CVE-2025-68366)

    In the Linux kernel, the following vulnerability has been resolved:

    nbd: defer config put in recv_work (CVE-2025-68372)

    In the Linux kernel, the following vulnerability has been resolved:

    crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CVE-2025-68724)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf: Do not let BPF test infra emit invalid GSO types to stack (CVE-2025-68725)

    In the Linux kernel, the following vulnerability has been resolved:

    ntfs3: Fix uninit buffer allocated by __getname() (CVE-2025-68727)

    In the Linux kernel, the following vulnerability has been resolved:

    ntfs3: fix uninit memory after failed mi_read in mi_format_new (CVE-2025-68728)

    In the Linux kernel, the following vulnerability has been resolved:

    ima: Handle error code returned by ima_filter_rule_match() (CVE-2025-68740)

    In the Linux kernel, the following vulnerability has been resolved:

    NFS: Automounted filesystems should inherit ro,noexec,nodev,sync flags (CVE-2025-68764)

    In the Linux kernel, the following vulnerability has been resolved:

    sched/deadline: only set free_cpus for online runqueues (CVE-2025-68780)

    In the Linux kernel, the following vulnerability has been resolved:

    scsi: target: Reset t_task_cdb pointer in error case (CVE-2025-68782)

    In the Linux kernel, the following vulnerability has been resolved:

    net: openvswitch: fix middle attribute validation in push_nsh() action (CVE-2025-68785)

    In the Linux kernel, the following vulnerability has been resolved:

    fsnotify: do not generate ACCESS/MODIFY events on child for special files (CVE-2025-68788)

    In the Linux kernel, the following vulnerability has been resolved:

    ethtool: Avoid overflowing userspace buffer on stats query (CVE-2025-68795)

    In the Linux kernel, the following vulnerability has been resolved:

    NFSD: NFSv4 file creation neglects setting ACL (CVE-2025-68803)

    In the Linux kernel, the following vulnerability has been resolved:

    ipvs: fix ipv4 null-ptr-deref in route error path (CVE-2025-68813)

    In the Linux kernel, the following vulnerability has been resolved:

    io_uring: fix filename leak in __io_openat_prep() (CVE-2025-68814)

    In the Linux kernel, the following vulnerability has been resolved:

    net/mlx5: fw_tracer, Validate format string parameters (CVE-2025-68816)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: xattr: fix null pointer deref in ext4_raw_inode() (CVE-2025-68820)

    In the Linux kernel, the following vulnerability has been resolved:

    fuse: fix readahead reclaim deadlock (CVE-2025-68821)

    In the Linux kernel, the following vulnerability has been resolved:

    tpm: Cap the number of PCR banks (CVE-2025-71077)

    In the Linux kernel, the following vulnerability has been resolved:

    drm/ttm: Avoid NULL pointer deref for evicted BOs (CVE-2025-71083)

    In the Linux kernel, the following vulnerability has been resolved:

    RDMA/cm: Fix leaking the multicast GID table reference (CVE-2025-71084)

    In the Linux kernel, the following vulnerability has been resolved:

    ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CVE-2025-71085)

    In the Linux kernel, the following vulnerability has been resolved:

    iommu: disable SVA when CONFIG_X86 is set (CVE-2025-71089)

    In the Linux kernel, the following vulnerability has been resolved:

    team: fix check for port enabled in team_queue_override_port_prio_changed() (CVE-2025-71091)

    In the Linux kernel, the following vulnerability has been resolved:

    e1000: fix OOB in e1000_tbi_should_accept() (CVE-2025-71093)

    In the Linux kernel, the following vulnerability has been resolved:

    RDMA/core: Check for the presence of LS_NLA_TYPE_DGID correctly (CVE-2025-71096)

    In the Linux kernel, the following vulnerability has been resolved:

    ipv4: Fix reference count leak when using error routes with nexthop objects (CVE-2025-71097)

    In the Linux kernel, the following vulnerability has been resolved:

    ip6_gre: make ip6gre_header() robust (CVE-2025-71098)

    In the Linux kernel, the following vulnerability has been resolved:

    KVM: x86: Fix VM hard lockup after prolonged inactivity with periodic HV timer (CVE-2025-71104)

    In the Linux kernel, the following vulnerability has been resolved:

    crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CVE-2025-71113)

    In the Linux kernel, the following vulnerability has been resolved:

    libceph: make decode_pool() more resilient against corrupted osdmaps (CVE-2025-71116)

    In the Linux kernel, the following vulnerability has been resolved:

    ACPICA: Avoid walking the Namespace if start_node is NULL (CVE-2025-71118)

    In the Linux kernel, the following vulnerability has been resolved:

    SUNRPC: svcauth_gss: avoid NULL deref on zero length gss_token in gss_read_proxy_verf (CVE-2025-71120)

    In the Linux kernel, the following vulnerability has been resolved:

    tracing: Do not register unsupported perf events (CVE-2025-71125)

    In the Linux kernel, the following vulnerability has been resolved:

    crypto: seqiv - Do not use req->iv after crypto_aead_encrypt (CVE-2025-71131)

    In the Linux kernel, the following vulnerability has been resolved:

    KEYS: trusted: Fix a memory leak in tpm2_load_cmd (CVE-2025-71147)

    In the Linux kernel, the following vulnerability has been resolved:

    btrfs: fix deadlock in wait_current_trans() due to ignored transaction type (CVE-2025-71194)

    In the Linux kernel, the following vulnerability has been resolved:

    net/sched: sch_qfq: Fix NULL deref when deactivating inactive aggregate in qfq_reset (CVE-2026-22976)

    In the Linux kernel, the following vulnerability has been resolved:

    net: sock: fix hardened usercopy panic in sock_recv_errqueue (CVE-2026-22977)

    In the Linux kernel, the following vulnerability has been resolved:

    nfsd: provide locking for v4_end_grace (CVE-2026-22980)

    In the Linux kernel, the following vulnerability has been resolved:

    libceph: prevent potential out-of-bounds reads in handle_auth_done() (CVE-2026-22984)

    In the Linux kernel, the following vulnerability has been resolved:

    libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CVE-2026-22990)

    In the Linux kernel, the following vulnerability has been resolved:

    libceph: make free_choose_arg_map() resilient to partial allocation (CVE-2026-22991)

    In the Linux kernel, the following vulnerability has been resolved:

    libceph: return the handler error from mon_handle_auth_done() (CVE-2026-22992)

    In the Linux kernel, the following vulnerability has been resolved:

    net/sched: sch_qfq: do not free existing class in qfq_change_class() (CVE-2026-22999)

    In the Linux kernel, the following vulnerability has been resolved:

    macvlan: fix possible UAF in macvlan_forward_source() (CVE-2026-23001)

    In the Linux kernel, the following vulnerability has been resolved:

    ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CVE-2026-23003)

    In the Linux kernel, the following vulnerability has been resolved:

    ipv4: ip_gre: make ipgre_header() robust (CVE-2026-23011)

    In the Linux kernel, the following vulnerability has been resolved:

    pnfs/flexfiles: Fix memory leak in nfs4_ff_alloc_deviceid_node() (CVE-2026-23038)

    In the Linux kernel, the following vulnerability has been resolved:

    libceph: make calc_target() set t->paused, not just clear it (CVE-2026-23047)

    In the Linux kernel, the following vulnerability has been resolved:

    crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec (CVE-2026-23060)

    In the Linux kernel, the following vulnerability has been resolved:

    regmap: Fix race condition in hwspinlock irqsave routine (CVE-2026-23071)

    In the Linux kernel, the following vulnerability has been resolved:

    net/sched: Enforce that teql can only be used as root qdisc (CVE-2026-23074)

    In the Linux kernel, the following vulnerability has been resolved:

    fou: Don't allow 0 for FOU_ATTR_IPPROTO. (CVE-2026-23083)

    In the Linux kernel, the following vulnerability has been resolved:

    irqchip/gic-v3-its: Avoid truncating memory addresses (CVE-2026-23085)

    In the Linux kernel, the following vulnerability has been resolved:

    gue: Fix skb memleak with inner IP protocol 0. (CVE-2026-23095)

    In the Linux kernel, the following vulnerability has been resolved:

    migrate: correct lock ordering for hugetlb file folios (CVE-2026-23097)

    In the Linux kernel, the following vulnerability has been resolved:

    bonding: limit BOND_MODE_8023AD to Ethernet devices (CVE-2026-23099)

    In the Linux kernel, the following vulnerability has been resolved:

    ipvlan: Make the addrs_lock be per port (CVE-2026-23103)

    In the Linux kernel, the following vulnerability has been resolved:

    net/sched: qfq: Use cl_is_active to determine whether class is active in qfq_rm_from_ag (CVE-2026-23105)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CVE-2026-23111)

    In the Linux kernel, the following vulnerability has been resolved:

    bonding: provide a net pointer to __skb_flow_dissect() (CVE-2026-23119)

    In the Linux kernel, the following vulnerability has been resolved:

    ipv6: annotate data-race in ndisc_router_discovery() (CVE-2026-23124)

    In the Linux kernel, the following vulnerability has been resolved:

    sctp: move SCTP_CMD_ASSOC_SHKEY right after SCTP_CMD_PEER_INIT (CVE-2026-23125)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: fix iloc.bh leak in ext4_xattr_inode_update_ref (CVE-2026-23145)

    In the Linux kernel, the following vulnerability has been resolved:

    mptcp: fix race in mptcp_pm_nl_flush_addrs_doit() (CVE-2026-23169)

    In the Linux kernel, the following vulnerability has been resolved:

    KVM: Don't clobber irqfd routing type when deassigning irqfd (CVE-2026-23198)

    In the Linux kernel, the following vulnerability has been resolved:

    macvlan: fix error recovery in macvlan_common_newlink() (CVE-2026-23209)

    In the Linux kernel, the following vulnerability has been resolved: bus: fsl-mc: fix use-after-free in     driver_override_show() The driver_override_show() function reads the driver_override string without     holding the device_lock. However, driver_override_store() uses driver_set_override(), which modifies and     frees the string while holding the device_lock. This can result in a concurrent use-after-free if the     string is freed by the store function while being read by the show function. Fix this by holding the     device_lock around the read operation. (CVE-2026-23221)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the linux package has been released.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - KVM: Don't clobber irqfd routing type when deassigning irqfd When deassigning a KVM_IRQFD, don't clobber     the irqfd's copy of the IRQ's routing entry as doing so breaks kvm_arch_irq_bypass_del_producer() on x86     and arm64, which explicitly look for KVM_IRQ_ROUTING_MSI. Instead, to handle a concurrent routing update,     verify that the irqfd is still active before consuming the routing information. As evidenced by the x86     and arm64 bugs, and another bug in kvm_arch_update_irqfd_routing() (see below), clobbering the entry type     without notifying arch code is surprising and error prone. As a bonus, checking that the irqfd is active     provides a convenient location for documenting _why_ KVM must not consume the routing entry for an irqfd     that is in the process of being deassigned: once the irqfd is deleted from the list (which happens
    *before* the eventfd is detached), it will no longer receive updates via kvm_irq_routing_update(), and so     KVM could deliver an event using stale routing information (relative to KVM_SET_GSI_ROUTING returning to     userspace). As an even better bonus, explicitly checking for the irqfd being active fixes a similar bug to     the one the clobbering is trying to prevent: if an irqfd is deactivated, and then its routing is changed,     kvm_irq_routing_update() won't invoke kvm_arch_update_irqfd_routing() (because the irqfd isn't in the     list). And so if the irqfd is in bypass mode, IRQs will continue to be posted using the old routing     information. As for kvm_arch_irq_bypass_del_producer(), clobbering the routing type results in KVM     incorrectly keeping the IRQ in bypass mode, which is especially problematic on AMD as KVM tracks IRQs that     are being posted to a vCPU in a list whose lifetime is tied to the irqfd. Without the help of KASAN to     detect use-after-free, the most common sympton on AMD is a NULL pointer deref in amd_iommu_update_ga() due     to the memory for irqfd structure being re-allocated and zeroed, resulting in irqfd->irq_bypass_data being     NULL when read by avic_update_iommu_vcpu_affinity(): BUG: kernel NULL pointer dereference, address:
    0000000000000018 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD     40cf2b9067 P4D 40cf2b9067 PUD 408362a067 PMD 0 Oops: Oops: 0000 [#1] SMP CPU: 6 UID: 0 PID: 40383 Comm:
    vfio_irq_test Tainted: G U W O 6.19.0-smp--5dddc257e6b2-irqfd #31 NONE Tainted: [U]=USER, [W]=WARN,     [O]=OOT_MODULE Hardware name: Google, Inc. Arcadia_IT_80/Arcadia_IT_80, BIOS 34.78.2-0 09/05/2025 RIP:
    0010:amd_iommu_update_ga+0x19/0xe0 Call Trace: <TASK> avic_update_iommu_vcpu_affinity+0x3d/0x90 [kvm_amd]
    __avic_vcpu_load+0xf4/0x130 [kvm_amd] kvm_arch_vcpu_load+0x89/0x210 [kvm] vcpu_load+0x30/0x40 [kvm]     kvm_arch_vcpu_ioctl_run+0x45/0x620 [kvm] kvm_vcpu_ioctl+0x571/0x6a0 [kvm] __se_sys_ioctl+0x6d/0xb0     do_syscall_64+0x6f/0x9d0 entry_SYSCALL_64_after_hwframe+0x4b/0x53 RIP: 0033:0x46893b </TASK> ---[ end     trace 0000000000000000 ]--- If AVIC is inhibited when the irfd is deassigned, the bug will manifest as     list corruption, e.g. on the next irqfd assignment. list_add corruption. next->prev should be prev     (ffff8d474d5cd588), but was 0000000000000000. (next=ffff8d8658f86530). ------------[ cut here     ]------------ kernel BUG at lib/list_debug.c:31! Oops: invalid opcode: 0000 [#1] SMP CPU: 128 UID: 0 PID:
    80818 Comm: vfio_irq_test Tainted: G U W O 6.19.0-smp--f19dc4d680ba-irqfd #28 NONE Tainted: [U]=USER,     [W]=WARN, [O]=OOT_MODULE Hardware name: Google, Inc. Arcadia_IT_80/Arcadia_IT_80, BIOS 34.78.2-0     09/05/2025 RIP: 0010:__list_add_valid_or_report+0x97/0xc0 Call Trace: <TASK>     avic_pi_update_irte+0x28e/0x2b0 [kvm_amd] kvm_pi_update_irte+0xbf/0x190 [kvm]     kvm_arch_irq_bypass_add_producer+0x72/0x90 [kvm] irq_bypass_register_consumer+0xcd/0x170 [irqbypa
    ---truncated--- (CVE-2026-23198)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
304272	Amazon Linux 2023 : bpftool6.12, kernel6.12, kernel6.12-devel (ALAS2023-2026-1487)	Nessus	Amazon Linux Local Security Checks	high
304219	openSUSE 16 Security Update : kernel (openSUSE-SU-2026:20416-1)	Nessus	SuSE Local Security Checks	critical
303965	SUSE SLED15 / SLES15 : Recommended update for initial livepatch (SUSE-SU-2026:1081-1)	Nessus	SuSE Local Security Checks	critical
303947	SUSE SLES12 : Recommended update for initial livepatch (SUSE-SU-2026:1078-1)	Nessus	SuSE Local Security Checks	critical
303468	Oracle Linux 10 / 9 : Unbreakable Enterprise kernel (ELSA-2026-50160)	Nessus	Oracle Linux Local Security Checks	critical
303406	SUSE SLES15 Security Update : kernel (SUSE-SU-2026:0962-1)	Nessus	SuSE Local Security Checks	critical
303103	Amazon Linux 2 : kernel, --advisory ALAS2KERNEL-5.10-2026-114 (ALASKERNEL-5.10-2026-114)	Nessus	Amazon Linux Local Security Checks	high
302189	Debian dla-4498 : ata-modules-5.10.0-38-armmp-di - security update	Nessus	Debian Local Security Checks	critical
302188	Debian dla-4499 : linux-config-6.1 - security update	Nessus	Debian Local Security Checks	critical
302008	Debian dsa-6163 : affs-modules-6.1.0-43-4kc-malta-di - security update	Nessus	Debian Local Security Checks	critical
301346	Amazon Linux 2023 : bpftool, kernel, kernel-devel (ALAS2023-2026-1468)	Nessus	Amazon Linux Local Security Checks	high
301269	Amazon Linux 2 : kernel, --advisory ALAS2KERNEL-5.15-2026-098 (ALASKERNEL-5.15-2026-098)	Nessus	Amazon Linux Local Security Checks	high
299743	Photon OS 5.0: Linux PHSA-2026-5.0-0770	Nessus	PhotonOS Local Security Checks	critical
299662	Photon OS 4.0: Linux PHSA-2026-4.0-0965	Nessus	PhotonOS Local Security Checks	critical
299082	Linux Distros Unpatched Vulnerability : CVE-2026-23198	Nessus	Misc.	medium

Detections

Analytics

CVE-2026-23198

medium

Tenable Plugins

high

critical

critical

critical

critical

critical

high

critical

critical

critical

high

high

critical

critical

medium