In the Linux kernel, the following vulnerability has been resolved: scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() In iscsit_dec_conn_usage_count(), the function calls complete() while holding the conn->conn_usage_lock. As soon as complete() is invoked, the waiter (such as iscsit_close_connection()) may wake up and proceed to free the iscsit_conn structure. If the waiter frees the memory before the current thread reaches spin_unlock_bh(), it results in a KASAN slab-use-after-free as the function attempts to release a lock within the already-freed connection structure. Fix this by releasing the spinlock before calling complete().

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:10756 advisory.

    The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with     extremely high determinism requirements.

    Security Fix(es):

    * kernel: Linux kernel: RDMA/rxe use-after-free vulnerability leading to potential arbitrary code     execution (CVE-2025-38024)

    * kernel: iavf: Fix reset error handling (CVE-2022-50053)

    * kernel: Linux kernel: Use-After-Free vulnerability in ATM subsystem (CVE-2025-38180)

    * kernel: RDMA/rxe: Fix incomplete state save in rxe_requester (CVE-2023-53539)

    * kernel: scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CVE-2026-23193)

    * kernel: net/sched: cls_u32: use skb_header_pointer_careful() (CVE-2026-23204)

    * kernel: scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CVE-2026-23216)

    * kernel: kernel: Privilege escalation or denial of service via use-after-free in nf_tables_addchain()     (CVE-2026-23231)

    * kernel: Linux kernel (qla2xxx): Double free vulnerability leads to denial of service and potential     privilege escalation. (CVE-2025-71238)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:1573-1 advisory.

    The SUSE Linux Enterprise 15 SP7 RT kernel was updated to receive various security bugfixes.


    The following security bugs were fixed:

    - CVE-2025-39998: scsi: target: target_core_configfs: Add length check to avoid buffer overflow     (bsc#1252073).
    - CVE-2025-68794: iomap: adjust read range correctly for non-block-aligned positions (bsc#1256647).
    - CVE-2025-71268: btrfs: fix reservation leak in some error paths when inserting inline extent     (bsc#1259865).
    - CVE-2025-71269: btrfs: do not free data reservation in fallback from inline due to -ENOSPC     (bsc#1259889).
    - CVE-2026-23030: phy: rockchip: inno-usb2: Fix a double free bug in rockchip_usb2phy_probe()     (bsc#1257561).
    - CVE-2026-23047: libceph: make calc_target() set t->paused, not just clear it (bsc#1257682).
    - CVE-2026-23103: ipvlan: Make the addrs_lock be per port (bsc#1257773).
    - CVE-2026-23120: l2tp: avoid one data-race in l2tp_tunnel_del_work() (bsc#1258280).
    - CVE-2026-23136: libceph: reset sparse-read state in osd_fault() (bsc#1258303).
    - CVE-2026-23140: bpf, test_run: Subtract size of xdp_frame from allowed metadata size (bsc#1258305).
    - CVE-2026-23187: pmdomain: imx8m-blk-ctrl: fix out-of-range access of bc->domains (bsc#1258330).
    - CVE-2026-23193: scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count()     (bsc#1258414).
    - CVE-2026-23201: ceph: fix oops due to invalid pointer for kfree() in parse_longname() (bsc#1258337).
    - CVE-2026-23215: x86/vmware: Fix hypercall clobbers (bsc#1258476).
    - CVE-2026-23216: scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (bsc#1258447).
    - CVE-2026-23231: netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (bsc#1259188).
    - CVE-2026-23242: RDMA/siw: Fix potential NULL pointer dereference in header processing (bsc#1259795).
    - CVE-2026-23243: RDMA/umad: Reject negative data_len in ib_umad_write (bsc#1259797).
    - CVE-2026-23255: net: add proper RCU protection to /proc/net/ptype (bsc#1259891).
    - CVE-2026-23259: io_uring/rw: free potentially allocated iovec on cache put failure (bsc#1259866).
    - CVE-2026-23270: net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks     (bsc#1259886).
    - CVE-2026-23272: netfilter: nf_tables: unconditionally bump set->nelems before insertion (bsc#1260009).
    - CVE-2026-23274: netfilter: xt_IDLETIMER: reject rev0 reuse of ALARM timer labels (bsc#1260005).
    - CVE-2026-23277: net/sched: teql: fix NULL pointer dereference in iptunnel_xmit on TEQL slave xmit     (bsc#1259997).
    - CVE-2026-23278: netfilter: nf_tables: always walk all pending catchall elements (bsc#1259998).
    - CVE-2026-23281: wifi: libertas: fix use-after-free in lbs_free_adapter() (bsc#1260464).
    - CVE-2026-23292: scsi: target: Fix recursive locking in __configfs_open_file() (bsc#1260500).
    - CVE-2026-23293: net: vxlan: fix nd_tbl NULL dereference when IPv6 is disabled (bsc#1260486).
    - CVE-2026-23317: drm/vmwgfx: Return the correct value in vmw_translate_ptr functions (bsc#1260562).
    - CVE-2026-23319: bpf: Fix a UAF issue in bpf_trampoline_link_cgroup_shim (bsc#1260735).
    - CVE-2026-23361: PCI: dwc: ep: Flush MSI-X write before unmapping its ATU entry (bsc#1260732).
    - CVE-2026-23379: net/sched: ets: fix divide by zero in the offload path (bsc#1260481).
    - CVE-2026-23381: net: bridge: fix nd_tbl NULL dereference when IPv6 is disabled (bsc#1260471).
    - CVE-2026-23386: gve: fix incorrect buffer cleanup in gve_tx_clean_pending_packets for QPL (bsc#1260799).
    - CVE-2026-23398: icmp: fix NULL pointer dereference in icmp_tag_validation() (bsc#1260730).
    - CVE-2026-23413: clsact: Fix use-after-free in init/destroy rollback asymmetry (bsc#1261498).
    - CVE-2026-23414: tls: Purge async_hold in tls_decrypt_async_wait() (bsc#1261496).
    - CVE-2026-31788: xen/privcmd: restrict usage in unprivileged domU (bsc#1259707).


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:9870 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: Linux kernel: RDMA/rxe use-after-free vulnerability leading to potential arbitrary code     execution (CVE-2025-38024)

    * kernel: iavf: Fix reset error handling (CVE-2022-50053)

    * kernel: Linux kernel: Use-After-Free vulnerability in ATM subsystem (CVE-2025-38180)

    * kernel: RDMA/rxe: Fix incomplete state save in rxe_requester (CVE-2023-53539)

    * kernel: scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CVE-2026-23193)

    * kernel: net/sched: cls_u32: use skb_header_pointer_careful() (CVE-2026-23204)

    * kernel: scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CVE-2026-23216)

    * kernel: kernel: Privilege escalation or denial of service via use-after-free in nf_tables_addchain()     (CVE-2026-23231)

    * kernel: Linux kernel (qla2xxx): Double free vulnerability leads to denial of service and potential     privilege escalation. (CVE-2025-71238)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:20572-1 advisory.

    The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues

    The following security issues were fixed:

    - CVE-2025-39998: scsi: target: target_core_configfs: Add length check to avoid buffer overflow     (bsc#1252073).
    - CVE-2025-40253: s390/ctcm: Fix double-kfree (bsc#1255084).
    - CVE-2025-68794: iomap: adjust read range correctly for non-block-aligned positions (bsc#1256647).
    - CVE-2025-71239: audit: add fchmodat2() to change attributes class (bsc#1259759).
    - CVE-2026-23072: l2tp: Fix memleak in l2tp_udp_encap_recv() (bsc#1257708).
    - CVE-2026-23103: ipvlan: Make the addrs_lock be per port (bsc#1257773).
    - CVE-2026-23120: l2tp: avoid one data-race in l2tp_tunnel_del_work() (bsc#1258280).
    - CVE-2026-23125: sctp: move SCTP_CMD_ASSOC_SHKEY right after SCTP_CMD_PEER_INIT (bsc#1258293).
    - CVE-2026-23138: kABI: Preserve values of the trace recursion bits (bsc#1258301).
    - CVE-2026-23140: bpf, test_run: Subtract size of xdp_frame from allowed metadata size (bsc#1258305).
    - CVE-2026-23187: pmdomain: imx8m-blk-ctrl: fix out-of-range access of bc->domains (bsc#1258330).
    - CVE-2026-23193: scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count()     (bsc#1258414).
    - CVE-2026-23201: ceph: fix oops due to invalid pointer for kfree() in parse_longname() (bsc#1258337).
    - CVE-2026-23204: net: add skb_header_pointer_careful() helper (bsc#1258340).
    - CVE-2026-23215: x86/vmware: Fix hypercall clobbers (bsc#1258476).
    - CVE-2026-23216: scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (bsc#1258447).
    - CVE-2026-23231: netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (bsc#1259188).
    - CVE-2026-23239: espintcp: Fix race condition in espintcp_close() (bsc#1259485).
    - CVE-2026-23240: tls: Fix race condition in tls_sw_cancel_work_tx() (bsc#1259484).
    - CVE-2026-23242: RDMA/siw: Fix potential NULL pointer dereference in header processing (bsc#1259795).
    - CVE-2026-23243: RDMA/umad: Reject negative data_len in ib_umad_write (bsc#1259797).
    - CVE-2026-23255: net: add proper RCU protection to /proc/net/ptype (bsc#1259891).
    - CVE-2026-23262: gve: Fix stats report corruption on queue count change (bsc#1259870).
    - CVE-2026-23270: net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks     (bsc#1259886).
    - CVE-2026-23272: netfilter: nf_tables: unconditionally bump set->nelems before insertion (bsc#1260009).
    - CVE-2026-23274: netfilter: xt_IDLETIMER: reject rev0 reuse of ALARM timer labels (bsc#1260005).
    - CVE-2026-23277: net/sched: teql: fix NULL pointer dereference in iptunnel_xmit on TEQL slave xmit     (bsc#1259997).
    - CVE-2026-23278: netfilter: nf_tables: always walk all pending catchall elements (bsc#1259998).
    - CVE-2026-23281: wifi: libertas: fix use-after-free in lbs_free_adapter() (bsc#1260464).
    - CVE-2026-23292: scsi: target: Fix recursive locking in __configfs_open_file() (bsc#1260500).
    - CVE-2026-23293: net: vxlan: fix nd_tbl NULL dereference when IPv6 is disabled (bsc#1260486).
    - CVE-2026-23297: nfsd: Fix cred ref leak in nfsd_nl_threads_set_doit() (bsc#1260490).
    - CVE-2026-23304: ipv6: fix NULL pointer deref in ip6_rt_get_dev_rcu() (bsc#1260544).
    - CVE-2026-23319: bpf: Fix a UAF issue in bpf_trampoline_link_cgroup_shim (bsc#1260735).
    - CVE-2026-23326: xsk: Fix fragment node deletion to prevent buffer leak (bsc#1260606).
    - CVE-2026-23335: RDMA/irdma: Fix kernel stack leak in irdma_create_user_ah() (bsc#1260550).
    - CVE-2026-23343: xdp: produce a warning when calculated tailroom is negative (bsc#1260527).
    - CVE-2026-23361: PCI: dwc: ep: Flush MSI-X write before unmapping its ATU entry (bsc#1260732).
    - CVE-2026-23379: net/sched: ets: fix divide by zero in the offload path (bsc#1260481).
    - CVE-2026-23381: net: bridge: fix nd_tbl NULL dereference when IPv6 is disabled (bsc#1260471).
    - CVE-2026-23383: bpf, arm64: Force 8-byte alignment for JIT buffer to prevent atomic tearing     (bsc#1260497).
    - CVE-2026-23386: gve: fix incorrect buffer cleanup in gve_tx_clean_pending_packets for QPL (bsc#1260799).
    - CVE-2026-23393: bridge: cfm: Fix race condition in peer_mep deletion (bsc#1260522).
    - CVE-2026-23398: icmp: fix NULL pointer dereference in icmp_tag_validation() (bsc#1260730).
    - CVE-2026-23413: clsact: Fix use-after-free in init/destroy rollback asymmetry (bsc#1261498).
    - CVE-2026-23414: tls: Purge async_hold in tls_decrypt_async_wait() (bsc#1261496).
    - CVE-2026-23419: net/rds: Fix circular locking dependency in rds_tcp_tune (bsc#1261507).
    - CVE-2026-23425: KVM: arm64: Fix ID register initialization for non-protected pKVM guests (bsc#1261506).
    - CVE-2026-31788: xen/privcmd: restrict usage in unprivileged domU (bsc#1259707).

    The following non security issues were fixed:

    - KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (bsc#1259461).
    - KVM: x86: synthesize CPUID bits only if CPU capability is set (bsc#1257511).
    - Revert drm/i915/display: Add quirk to skip retraining of dp link (bsc#1253129).
    - Update config files (bsc#1254307).
    - apparmor: Fix double free of ns_name in aa_replace_profiles() (bsc#1258849).
    - apparmor: fix differential encoding verification (bsc#1258849).
    - apparmor: fix memory leak in verify_header (bsc#1258849).
    - apparmor: fix missing bounds check on DEFAULT table in verify_dfa() (bsc#1258849).
    - apparmor: fix race between freeing data and fs accessing it (bsc#1258849).
    - apparmor: fix race on rawdata dereference (bsc#1258849).
    - apparmor: fix side-effect bug in match_char() macro usage (bsc#1258849).
    - apparmor: fix unprivileged local user can do privileged policy management (bsc#1258849).
    - apparmor: fix: limit the number of levels of policy namespaces (bsc#1258849).
    - apparmor: replace recursive profile removal with iterative approach (bsc#1258849).
    - apparmor: validate DFA start states are in bounds in unpack_pdb (bsc#1258849).
    - bpf, btf: Enforce destructor kfunc type with CFI (bsc#1259955).
    - bpf: crypto: Use the correct destructor kfunc type (bsc#1259955).
    - btrfs: only enforce free space tree if v1 cache is required for bs < ps cases (bsc#1260459).
    - btrfs: tracepoints: get correct superblock from dentry in event btrfs_sync_file() (bsc#1257777).
    - dmaengine: sh: rz-dmac: Move CHCTRL updates under spinlock (git-fixes).
    - drm/amdkfd: Unreserve bo if queue update failed (git-fixes).
    - drm/i915/display: Add module param to skip retraining of dp link (bsc#1253129).
    - drm/i915/dsc: Add Selective Update register definitions (stable-fixes).
    - drm/i915/dsc: Add helper for writing DSC Selective Update ET parameters (stable-fixes).
    - firmware: microchip: fail auto-update probe if no flash found (git-fixes).
    - kABI: Include trace recursion bits in kABI tracking (bsc#1258301).
    - net: mana: Trigger VF reset/recovery on health check failure due to HWC timeout (bsc#1259580).
    - nvme: add support for dynamic quirk configuration via module parameter (bsc#1243208).
    - nvme: expose active quirks in sysfs (bsc#1243208).
    - nvme: fix memory leak in quirks_param_set() (bsc#1243208).
    - powerpc/crash: adjust the elfcorehdr size (jsc#PED-11175 git-fixes).
    - powerpc/kdump: Fix size calculation for hot-removed memory ranges (jsc#PED-11175 git-fixes).
    - s390/cio: Update purge function to unregister the unused subchannels (bsc#1254214).
    - s390/ipl: Clear SBP flag when bootprog is set (bsc#1258175).
    - s390: Disable ARCH_WANT_OPTIMIZE_HUGETLB_VMEMMAP (bsc#1254306).
    - scsi: fnic: Add Cisco hardware model names (jsc#PED-15441).
    - scsi: fnic: Add and integrate support for FDMI (jsc#PED-15441).
    - scsi: fnic: Add and integrate support for FIP (jsc#PED-15441).
    - scsi: fnic: Add functionality in fnic to support FDLS (jsc#PED-15441).
    - scsi: fnic: Add headers and definitions for FDLS (jsc#PED-15441).
    - scsi: fnic: Add stats and related functionality (jsc#PED-15441).
    - scsi: fnic: Add support for fabric based solicited requests and responses (jsc#PED-15441).
    - scsi: fnic: Add support for target based solicited requests and responses (jsc#PED-15441).
    - scsi: fnic: Add support for unsolicited requests and responses (jsc#PED-15441).
    - scsi: fnic: Add support to handle port channel RSCN (jsc#PED-15441).
    - scsi: fnic: Code cleanup (jsc#PED-15441).
    - scsi: fnic: Delete incorrect debugfs error handling (jsc#PED-15441).
    - scsi: fnic: Fix crash in fnic_wq_cmpl_handler when FDMI times out (jsc#PED-15441).
    - scsi: fnic: Fix indentation and remove unnecessary parenthesis (jsc#PED-15441).
    - scsi: fnic: Fix missing DMA mapping error in fnic_send_frame() (jsc#PED-15441).
    - scsi: fnic: Fix use of uninitialized value in debug message (jsc#PED-15441).
    - scsi: fnic: Increment driver version (jsc#PED-15441).
    - scsi: fnic: Modify IO path to use FDLS (jsc#PED-15441).
    - scsi: fnic: Modify fnic interfaces to use FDLS (jsc#PED-15441).
    - scsi: fnic: Propagate SCSI error code from fnic_scsi_drv_init() (jsc#PED-15441).
    - scsi: fnic: Remove always-true IS_FNIC_FCP_INITIATOR macro (jsc#PED-15441).
    - scsi: fnic: Remove extern definition from .c files (jsc#PED-15441).
    - scsi: fnic: Remove unnecessary debug print (jsc#PED-15441).
    - scsi: fnic: Remove unnecessary else and unnecessary break in FDLS (jsc#PED-15441).
    - scsi: fnic: Remove unnecessary else to fix warning in FDLS FIP (jsc#PED-15441).
    - scsi: fnic: Remove unnecessary spinlock locking and unlocking (jsc#PED-15441).
    - scsi: fnic: Replace fnic->lock_flags with local flags (jsc#PED-15441).
    - scsi: fnic: Replace shost_printk() with dev_info()/dev_err() (jsc#PED-15441).
    - scsi: fnic: Replace use of sizeof with standard usage (jsc#PED-15441).
    - scsi: fnic: Return appropriate error code for mem alloc failure (jsc#PED-15441).
    - scsi: fnic: Return appropriate error code from failure of scsi drv init (jsc#PED-15441).
    - scsi: fnic: Test for memory allocation failure and return error code (jsc#PED-15441).
    - scsi: fnic: Turn off FDMI ACTIVE flags on link down (jsc#PED-15441).
    - scsi: hisi_sas: Fix NULL pointer exception during user_scan() (bsc#1255687).
    - scsi: scsi_transport_sas: Fix the maximum channel scanning issue (bsc#1255687, git-fixes).
    - scsi: smartpqi: Fix memory leak in pqi_report_phys_luns() (git-fixes, jsc#PED-15042).
    - selftests/bpf: Use the correct destructor kfunc type (bsc#1259955).
    - selftests/powerpc: Suppress -Wmaybe-uninitialized with GCC 15 (bsc#1261669 ltc#212590).
    - tg3: Fix race for querying speed/duplex (bsc#1257183).
    - x86/platform/uv: Handle deconfigured sockets (bsc#1260347).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 10 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-50232 advisory.

    - ipv6: use RCU in ip6_xmit() (Eric Dumazet)  [Orabug: 39202432]  {CVE-2025-40135}
    - dst: fix races in rt6_uncached_list_del() and rt_del_uncached_list() (Eric Dumazet)  [Orabug: 39202431]     {CVE-2026-23004}
    - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (Inseo An)  [Orabug: 39044468]     {CVE-2026-23231}
    - KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Sean Christopherson)     [Orabug: 39153394]  {CVE-2026-23401}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1487 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    md: suspend array while updating raid_disks via sysfs (CVE-2025-71225)

    In the Linux kernel, the following vulnerability has been resolved:

    btrfs: fix reservation leak in some error paths when inserting inline extent (CVE-2025-71268)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CVE-2026-23111)

    In the Linux kernel, the following vulnerability has been resolved:

    net: fix segmentation of forwarding fraglist GRO (CVE-2026-23154)

    In the Linux kernel, the following vulnerability has been resolved:

    efivarfs: fix error propagation in efivar_entry_get() (CVE-2026-23156)

    In the Linux kernel, the following vulnerability has been resolved:

    perf: sched: Fix perf crash with new is_user_task() helper (CVE-2026-23159)

    In the Linux kernel, the following vulnerability has been resolved:

    mm/shmem, swap: fix race of truncate and swap entry split (CVE-2026-23161)

    In the Linux kernel, the following vulnerability has been resolved:

    flex_proportions: make fprop_new_period() hardirq safe (CVE-2026-23168)

    In the Linux kernel, the following vulnerability has been resolved:

    mptcp: fix race in mptcp_pm_nl_flush_addrs_doit() (CVE-2026-23169)

    In the Linux kernel, the following vulnerability has been resolved:

    net/mlx5e: TC, delete flows only for existing peers (CVE-2026-23173)

    In the Linux kernel, the following vulnerability has been resolved:

    mm, shmem: prevent infinite loop on truncate race (CVE-2026-23177)

    In the Linux kernel, the following vulnerability has been resolved:

    ceph: fix NULL pointer dereference in ceph_mds_auth_match() (CVE-2026-23189)

    In the Linux kernel, the following vulnerability has been resolved:

    scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CVE-2026-23193)

    In the Linux kernel, the following vulnerability has been resolved:

    KVM: Don't clobber irqfd routing type when deassigning irqfd (CVE-2026-23198)

    In the Linux kernel, the following vulnerability has been resolved:

    procfs: avoid fetching build ID while holding VMA lock (CVE-2026-23199)

    In the Linux kernel, the following vulnerability has been resolved:

    ipv6: Fix ECMP sibling count mismatch when clearing RTF_ADDRCONF (CVE-2026-23200)

    In the Linux kernel, the following vulnerability has been resolved:

    ceph: fix oops due to invalid pointer for kfree() in parse_longname() (CVE-2026-23201)

    In the Linux kernel, the following vulnerability has been resolved:

    spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (CVE-2026-23202)

    In the Linux kernel, the following vulnerability has been resolved:

    net/sched: cls_u32: use skb_header_pointer_careful() (CVE-2026-23204)

    In the Linux kernel, the following vulnerability has been resolved:

    smb/client: fix memory leak in smb2_open_file() (CVE-2026-23205)

    In the Linux kernel, the following vulnerability has been resolved:

    macvlan: fix error recovery in macvlan_common_newlink() (CVE-2026-23209)

    In the Linux kernel, the following vulnerability has been resolved:

    bonding: annotate data-races around slave->last_rx (CVE-2026-23212)

    In the Linux kernel, the following vulnerability has been resolved:

    btrfs: reject new transactions if the fs is fully read-only (CVE-2026-23214)

    In the Linux kernel, the following vulnerability has been resolved:

    x86/vmware: Fix hypercall clobbers (CVE-2026-23215)

    In the Linux kernel, the following vulnerability has been resolved:

    scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CVE-2026-23216)

    In the Linux kernel, the following vulnerability has been resolved:

    mm/slab: Add alloc_tagging_slab_free_hook for memcg_alloc_abort_single (CVE-2026-23219)

    In the Linux kernel, the following vulnerability has been resolved: xfs: fix UAF in     xchk_btree_check_block_owner We cannot dereference bs->cur when trying to determine if bs->cur aliases     bs->sc->sa.{bno,rmap}_cur after the latter has been freed. Fix this by sampling before type before any     freeing could happen. The correct temporal ordering was broken when we removed xfs_btnum_t.
    (CVE-2026-23223)

    In the Linux kernel, the following vulnerability has been resolved: erofs: fix UAF issue for file-backed     mounts w/ directio option [ 9.269940][ T3222] Call trace: [ 9.269948][ T3222]     ext4_file_read_iter+0xac/0x108 [ 9.269979][ T3222] vfs_iocb_iter_read+0xac/0x198 [ 9.269993][ T3222]     erofs_fileio_rq_submit+0x12c/0x180 [ 9.270008][ T3222] erofs_fileio_submit_bio+0x14/0x24 [ 9.270030][     T3222] z_erofs_runqueue+0x834/0x8ac [ 9.270054][ T3222] z_erofs_read_folio+0x120/0x220 [ 9.270083][ T3222]     filemap_read_folio+0x60/0x120 [ 9.270102][ T3222] filemap_fault+0xcac/0x1060 [ 9.270119][ T3222]     do_pte_missing+0x2d8/0x1554 [ 9.270131][ T3222] handle_mm_fault+0x5ec/0x70c [ 9.270142][ T3222]     do_page_fault+0x178/0x88c [ 9.270167][ T3222] do_translation_fault+0x38/0x54 [ 9.270183][ T3222]     do_mem_abort+0x54/0xac [ 9.270208][ T3222] el0_da+0x44/0x7c [ 9.270227][ T3222]     el0t_64_sync_handler+0x5c/0xf4 [ 9.270253][ T3222] el0t_64_sync+0x1bc/0x1c0 EROFS may encounter above     panic when enabling file-backed mount w/ directio mount option, the root cause is it may suffer UAF in     below race condition: - z_erofs_read_folio wq s_dio_done_wq - z_erofs_runqueue - erofs_fileio_submit_bio -     erofs_fileio_rq_submit - vfs_iocb_iter_read - ext4_file_read_iter - ext4_dio_read_iter - iomap_dio_rw :
    bio was submitted and return -EIOCBQUEUED - dio_aio_complete_work - dio_complete - dio->iocb->ki_complete     (erofs_fileio_ki_complete()) - kfree(rq) : it frees iocb, iocb.ki_filp can be UAF in file_accessed(). -     file_accessed : access NULL file point Introduce a reference count in struct erofs_fileio_rq, and     initialize it as two, both erofs_fileio_ki_complete() and erofs_fileio_rq_submit() will decrease reference     count, the last one decreasing the reference count to zero will free rq. (CVE-2026-23224)

    In the Linux kernel, the following vulnerability has been resolved: smb: client: split cached_fid     bitfields to avoid shared-byte RMW races is_open, has_lease and on_list are stored in the same bitfield     byte in struct cached_fid but are updated in different code paths that may run concurrently. Bitfield     assignments generate byte read-modify-write operations (e.g. `orb $mask, addr` on x86_64), so updating one     flag can restore stale values of the others. A possible interleaving is: CPU1: load old byte (has_lease=1,     on_list=1) CPU2: clear both flags (store 0) CPU1: RMW store (old | IS_OPEN) -> reintroduces cleared bits     To avoid this class of races, convert these flags to separate bool fields. (CVE-2026-23230)

    In the Linux kernel, the following vulnerability has been resolved:

    net: gro: fix outer network offset (CVE-2026-23254)

    In the Linux kernel, the following vulnerability has been resolved:

    regmap: maple: free entry on mas_store_gfp() failure (CVE-2026-23260)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 10 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-50160 advisory.

    - mm/hugetlb: fix hugetlb_pmd_shared() (David Hildenbrand) [Orabug: 38931087] {CVE-2026-23100}
    - platform/x86: classmate-laptop: Add missing NULL pointer checks (Rafael J. Wysocki) [Orabug: 39044501]     {CVE-2026-23237}
    - scsi: qla2xxx: Fix bsg_done() causing double free (Anil Gurumurthy) [Orabug: 39044457] {CVE-2025-71238}
    - wifi: rtl8xxxu: fix slab-out-of-bounds in rtl8xxxu_sta_add (Ali Tariq) [Orabug: 38997990]     {CVE-2025-71234}
    - xfs: fix UAF in xchk_btree_check_block_owner (Darrick J. Wong) [Orabug: 38998028] {CVE-2026-23223}
    - scsi: qla2xxx: Free sp in error path to fix system crash (Anil Gurumurthy) [Orabug: 38997979]     {CVE-2025-71232}
    - scsi: qla2xxx: Delay module unload while fabric scan in progress (Anil Gurumurthy) [Orabug: 38997992]     {CVE-2025-71235}
    - scsi: qla2xxx: Validate sp before freeing associated memory (Anil Gurumurthy) [Orabug: 38997998]     {CVE-2025-71236}
    - wifi: rtw88: Fix alignment fault in rtw_core_enable_beacon() (Bitterblue Smith) [Orabug: 38997972]     {CVE-2025-71229}
    - crypto: virtio - Add spinlock protection with virtqueue notification (Bibo Mao) [Orabug: 38998052]     {CVE-2026-23229}
    - crypto: iaa - Fix out-of-bounds index in find_empty_iaa_compression_mode (Thorsten Blum) [Orabug:
    38997976] {CVE-2025-71231}
    - smb: client: split cached_fid bitfields to avoid shared-byte RMW races (Henrique Carvalho) [Orabug:
    38998059] {CVE-2026-23230}
    - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Breno Leitao) [Orabug: 38970593]     {CVE-2026-23202}
    - ASoC: amd: fix memory leak in acp3x pdm dma ops (Chris Bainbridge) [Orabug: 38970441] {CVE-2026-23190}
    - ipv6: Fix ECMP sibling count mismatch when clearing RTF_ADDRCONF (Shigeru Yoshida) [Orabug: 38970598]     {CVE-2026-23200}
    - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (Andrew Fasano) [Orabug:
    38970170] {CVE-2026-23111}
    - net: usb: r8152: fix resume reset deadlock (Sergey Senozhatsky) [Orabug: 38970438] {CVE-2026-23188}
    - macvlan: fix error recovery in macvlan_common_newlink() (Eric Dumazet) [Orabug: 38970508]     {CVE-2026-23209}
    - net/sched: cls_u32: use skb_header_pointer_careful() (Eric Dumazet) [Orabug: 38970487] {CVE-2026-23204}
    - smb/client: fix memory leak in smb2_open_file() (Chenxiaosong) [Orabug: 38970578] {CVE-2026-23205}
    - btrfs: reject new transactions if the fs is fully read-only (Qu Wenruo) [Orabug: 38985156]     {CVE-2026-23214}
    - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (Maurizio Lombardi) [Orabug:
    38985169] {CVE-2026-23216}
    - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (Maurizio Lombardi) [Orabug:
    38970453] {CVE-2026-23193}
    - nvmet-tcp: fixup hang in nvmet_tcp_listen_data_ready() (Hannes Reinecke) [Orabug: 38970416]     {CVE-2026-23179}
    - drm/amd/pm: Disable MMIO access during SMU Mode 1 reset (Perry Yuan) [Orabug: 38985149] {CVE-2026-23213}
    - HID: i2c-hid: fix potential buffer overflow in i2c_hid_get_report() (Kwok Kin Ming) [Orabug: 38970413]     {CVE-2026-23178}
    - md: suspend array while updating raid_disks via sysfs (Danny Shih) [Orabug: 38985108] {CVE-2025-71225}
    - wifi: wlcore: ensure skb headroom before skb_push (Peter Astrand) [Orabug: 38970152] {CVE-2025-71222}
    - wifi: mac80211: ocb: skip rx_no_sta when interface is not joined (Moon Hee Lee) [Orabug: 38970163]     {CVE-2025-71224}
    - procfs: avoid fetching build ID while holding VMA lock (Andrii Nakryiko) [Orabug: 38970476]     {CVE-2026-23199}
    - mm, shmem: prevent infinite loop on truncate race (Kairui Song) [Orabug: 38970409] {CVE-2026-23177}
    - ceph: fix oops due to invalid pointer for kfree() in parse_longname() (Daniel Vogelbacher) [Orabug:
    38970590] {CVE-2026-23201}
    - ceph: fix NULL pointer dereference in ceph_mds_auth_match() (Viacheslav Dubeyko) [Orabug: 38970595]     {CVE-2026-23189}
    - mm/slab: Add alloc_tagging_slab_free_hook for memcg_alloc_abort_single (Hao Ge) [Orabug: 38985192]     {CVE-2026-23219}
    - ALSA: aloop: Fix racy access at PCM trigger (Takashi Iwai) [Orabug: 38970445] {CVE-2026-23191}
    - x86/vmware: Fix hypercall clobbers (Josh Poimboeuf) [Orabug: 38985163] {CVE-2026-23215}
    - nvmet-tcp: add bounds checks in nvmet_tcp_build_pdu_iovec (Yunje Shin) [Orabug: 38970176]     {CVE-2026-23112}
    - perf: sched: Fix perf crash with new is_user_task() helper (Steven Rostedt) [Orabug: 38970581]     {CVE-2026-23159}
    - wifi: ath11k: add srng->lock for ath11k_hal_srng_* in monitor mode (Kang Yang) [Orabug: 37844126]     {CVE-2024-58096}
    - drm/amdgpu: fix NULL pointer dereference in amdgpu_gmc_filter_faults_remove (Jon Doron) [Orabug:
    38970348] {CVE-2026-23163}
    - net: fix segmentation of forwarding fraglist GRO (Jibin Zhang) [Orabug: 38970318] {CVE-2026-23154}
    - mm/shmem, swap: fix race of truncate and swap entry split (Kairui Song) [Orabug: 38970345]     {CVE-2026-23161}
    - flex_proportions: make fprop_new_period() hardirq safe (Jan Kara) [Orabug: 38970373] {CVE-2026-23168}
    - nvmet: fix race in nvmet_bio_done() leading to NULL pointer dereference (Ming Lei) [Orabug: 38970608]     {CVE-2026-23148}
    - efivarfs: fix error propagation in efivar_entry_get() (Kohei Enju) [Orabug: 38970325] {CVE-2026-23156}
    - net/mlx5e: TC, delete flows only for existing peers (Mark Bloch) [Orabug: 38970397] {CVE-2026-23173}
    - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Aaron Ma) [Orabug: 38970364]     {CVE-2026-23166}
    - rocker: fix memory leak in rocker_world_port_post_fini() (Kery Qi) [Orabug: 38970351] {CVE-2026-23164}
    - bonding: annotate data-races around slave->last_rx (Eric Dumazet) [Orabug: 38985142] {CVE-2026-23212}
    - Bluetooth: MGMT: Fix memory leak in set_ssp_complete (Jianpeng Chang) [Orabug: 38970587]     {CVE-2026-23151}
    - Bluetooth: hci_uart: fix null-ptr-deref in hci_uart_write_work (Jia-Hong Su) [Orabug: 38970604]     {CVE-2026-23146}
    - wifi: ath11k: fix RCU stall while reaping monitor destination ring (P Praneesh) [Orabug: 37844129]     {CVE-2024-58097}
    - btrfs: fix racy bitfield write in btrfs_clear_space_info_full() (Boris Burkov) [Orabug: 38798802]     {CVE-2025-68358}
    - sched_ext: Fix possible deadlock in the deferred_irq_workfn() (Zqiang) [Orabug: 38792605]     {CVE-2025-68333}
    - exfat: fix refcount leak in exfat_find (Shuhao Fu) [Orabug: 38798780] {CVE-2025-68351}
    - bpf: Do not let BPF test infra emit invalid GSO types to stack (Daniel Borkmann) [Orabug: 38798881]     {CVE-2025-68725}
    - migrate: correct lock ordering for hugetlb file folios (Matthew Wilcox) [Orabug: 38931066]     {CVE-2026-23097}
    - can: usb_8dev: usb_8dev_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde) [Orabug: 38931120]     {CVE-2026-23108}
    - can: kvaser_usb: kvaser_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde) [Orabug:
    38930881] {CVE-2026-23061}
    - can: ems_usb: ems_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde) [Orabug: 38930859]     {CVE-2026-23058}
    - irqchip/gic-v3-its: Avoid truncating memory addresses (Arnd Bergmann) [Orabug: 38931001]     {CVE-2026-23085}
    - intel_th: fix device leak on output open() (Johan Hovold) [Orabug: 38931040] {CVE-2026-23091}
    - tracing: Fix crash on synthetic stacktrace field usage (Steven Rostedt) [Orabug: 38931024]     {CVE-2026-23088}
    - arm64: Set __nocfi on swsusp_arch_resume() (Zhaoyang Huang) [Orabug: 38970241] {CVE-2026-23128}
    - arm64/fpsimd: signal: Allocate SSVE storage when restoring ZA (Mark Rutland) [Orabug: 38931118]     {CVE-2026-23107}
    - wifi: rsi: Fix memory corruption due to not set vif driver data size (Marek Vasut) [Orabug: 38930939]     {CVE-2026-23073}
    - wifi: ath10k: fix dma_free_coherent() pointer (Thomas Fourier) [Orabug: 38970253] {CVE-2026-23133}
    - ALSA: usb-audio: Fix use-after-free in snd_usb_mixer_free() (Berk Cem Goksel) [Orabug: 38931029]     {CVE-2026-23089}
    - ALSA: scarlett2: Fix buffer overflow in config retrieval (Samasth Norway Ananda) [Orabug: 38930973]     {CVE-2026-23078}
    - ALSA: ctxfi: Fix potential OOB access in audio mixer handling (Takashi Iwai) [Orabug: 38930966]     {CVE-2026-23076}
    - leds: led-class: Only Add LED to leds_list when it is fully ready (Hans de Goede) [Orabug: 38931091]     {CVE-2026-23101}
    - dpll: Prevent duplicate registrations (Ivan Vecera) [Orabug: 38970244] {CVE-2026-23129}
    - vsock/virtio: cap TX credit to local buffer size (Melbin K Mathew) [Orabug: 38931008] {CVE-2026-23086}
    - vsock/virtio: fix potential underflow in virtio_transport_get_credit() (Melbin K Mathew) [Orabug:
    38930919] {CVE-2026-23069}
    - bonding: provide a net pointer to __skb_flow_dissect() (Eric Dumazet) [Orabug: 38970199]     {CVE-2026-23119}
    - be2net: Fix NULL pointer dereference in be_cmd_get_mac_from_list (Andrey Vatoropin) [Orabug: 38930992]     {CVE-2026-23084}
    - ipv6: annotate data-race in ndisc_router_discovery() (Eric Dumazet) [Orabug: 38970222] {CVE-2026-23124}
    - netdevsim: fix a race issue related to the operation on bpf_bound_progs list (Yun Lu) [Orabug: 38970233]     {CVE-2026-23126}
    - scsi: qla2xxx: Sanitize payload size to prevent member overflow (Jiasheng Jiang) [Orabug: 38930867]     {CVE-2026-23059}
    - scsi: core: Wake up the error handler when final completions race against each other (David Jeffery)     [Orabug: 38931132] {CVE-2026-23110}
    - regmap: Fix race condition in hwspinlock irqsave routine (Cheng-Yu Lee) [Orabug: 38930930]     {CVE-2026-23071}
    - interconnect: debugfs: initialize src_node and dst_node to empty strings (Georgi Djakov) [Orabug:
    38970218] {CVE-2026-23123}
    - io_uring/io-wq: check IO_WQ_BIT_EXIT inside work run loop (Jens Axboe) [Orabug: 38970181]     {CVE-2026-23113}
    - platform/x86: hp-bioscfg: Fix kernel panic in GET_INSTANCE_ID macro (Mario Limonciello) [Orabug:
    38930890] {CVE-2026-23062}
    - platform/x86: hp-bioscfg: Fix kobject warnings for empty attribute names (Mario Limonciello) [Orabug:
    38970247] {CVE-2026-23131}
    - scsi: xen: scsiback: Fix potential memory leak in scsiback_remove() (Abdun Nihaal) [Orabug: 38931014]     {CVE-2026-23087}
    - w1: therm: Fix off-by-one buffer overflow in alarms_store (Thorsten Blum) [Orabug: 38930796]     {CVE-2025-71197}
    - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec (Taeyang Lee) [Orabug:
    38930874] {CVE-2026-23060}
    - net/sched: qfq: Use cl_is_active to determine whether class is active in qfq_rm_from_ag (Jamal Hadi     Salim) [Orabug: 38931110] {CVE-2026-23105}
    - net/sched: Enforce that teql can only be used as root qdisc (Jamal Hadi Salim) [Orabug: 38930948]     {CVE-2026-23074}
    - ipvlan: Make the addrs_lock be per port (Dmitry Skorodumov) [Orabug: 38931102] {CVE-2026-23103}
    - l2tp: avoid one data-race in l2tp_tunnel_del_work() (Eric Dumazet) [Orabug: 38970202] {CVE-2026-23120}
    - gue: Fix skb memleak with inner IP protocol 0. (Kuniyuki Iwashima) [Orabug: 38931057] {CVE-2026-23095}
    - sctp: move SCTP_CMD_ASSOC_SHKEY right after SCTP_CMD_PEER_INIT (Xin Long) [Orabug: 38970225]     {CVE-2026-23125}
    - can: gs_usb: gs_usb_receive_bulk_callback(): unanchor URL on usb_submit_urb() error (Marc Kleine-Budde)     [Orabug: 38931184] {CVE-2026-23082}
    - l2tp: Fix memleak in l2tp_udp_encap_recv(). (Kuniyuki Iwashima) [Orabug: 38930935] {CVE-2026-23072}
    - bonding: limit BOND_MODE_8023AD to Ethernet devices (Eric Dumazet) [Orabug: 38931079] {CVE-2026-23099}
    - vsock/virtio: Coalesce only linear skb (Michal Luczaj) [Orabug: 38930857] {CVE-2026-23057}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4498 advisory.

    -------------------------------------------------------------------------     Debian LTS Advisory DLA-4498-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                        Ben Hutchings     March 13, 2026                                https://wiki.debian.org/LTS
    -------------------------------------------------------------------------

    Package        : linux     Version        : 5.10.251-1     CVE ID         : CVE-2022-50516 CVE-2025-38201 CVE-2025-71222 CVE-2025-71224                      CVE-2025-71232 CVE-2025-71235 CVE-2025-71236 CVE-2025-71237                      CVE-2025-71238 CVE-2026-23112 CVE-2026-23176 CVE-2026-23190                      CVE-2026-23193 CVE-2026-23198 CVE-2026-23209 CVE-2026-23216                      CVE-2026-23222 CVE-2026-23229 CVE-2026-23234 CVE-2026-23235                      CVE-2026-23236 CVE-2026-23237 CVE-2026-23238     Debian Bug     : 1127597

    Several vulnerabilities have been discovered in the Linux kernel that     may lead to a privilege escalation, denial of service or information     leaks.

    The Qualys Threat Research Unit (TRU) discovered several vulnerabilities     in Apparmor. Details can be found in the Qualys advisory at     https://www.qualys.com/2026/03/10/crack-armor.txt

    For Debian 11 bullseye, these problems have been fixed in version     5.10.251-1.  This version also fixes a regression in the previous     update.  It additionally includes many more bug fixes from stable     updates 5.10.250 and 5.10.251.

    We recommend that you upgrade your linux packages.

    For the detailed security status of linux please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/linux

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS     Attachment:
    signature.asc     Description: PGP signature

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4499 advisory.

    -------------------------------------------------------------------------     Debian LTS Advisory DLA-4499-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                        Ben Hutchings     March 13, 2026                                https://wiki.debian.org/LTS
    -------------------------------------------------------------------------

    Package        : linux-6.1     Version        : 6.1.164-1~deb11u1     CVE ID         : CVE-2023-53424 CVE-2024-26822 CVE-2024-57895 CVE-2025-22026                      CVE-2025-23155 CVE-2025-37786 CVE-2025-37822 CVE-2025-37920                      CVE-2025-38201 CVE-2025-38643 CVE-2025-39763 CVE-2025-40082                      CVE-2025-40251 CVE-2025-68358 CVE-2025-71089 CVE-2025-71144                      CVE-2025-71220 CVE-2025-71222 CVE-2025-71224 CVE-2025-71232                      CVE-2025-71233 CVE-2025-71235 CVE-2025-71236 CVE-2025-71237                      CVE-2025-71238 CVE-2026-23111 CVE-2026-23112 CVE-2026-23169                      CVE-2026-23176 CVE-2026-23178 CVE-2026-23180 CVE-2026-23182                      CVE-2026-23187 CVE-2026-23190 CVE-2026-23193 CVE-2026-23198                      CVE-2026-23202 CVE-2026-23205 CVE-2026-23206 CVE-2026-23209                      CVE-2026-23216 CVE-2026-23220 CVE-2026-23221 CVE-2026-23222                      CVE-2026-23228 CVE-2026-23229 CVE-2026-23230 CVE-2026-23234                      CVE-2026-23235 CVE-2026-23236 CVE-2026-23237 CVE-2026-23238     Debian Bug     : 1127597

    Several vulnerabilities have been discovered in the Linux kernel that     may lead to a privilege escalation, denial of service or information     leaks.

    The Qualys Threat Research Unit (TRU) discovered several vulnerabilities     in Apparmor. Details can be found in the Qualys advisory at     https://www.qualys.com/2026/03/10/crack-armor.txt

    For Debian 11 bullseye, these problems have been fixed in version     6.1.164-1~deb11u1.  This version also fixes a regression in the     previous update.  It additionally includes many more bug fixes from     stable updates 6.1.163 and 6.1.164.

    We recommend that you upgrade your linux-6.1 packages.

    For the detailed security status of linux-6.1 please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/linux-6.1

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS     Attachment:
    signature.asc     Description: PGP signature

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6163 advisory.

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-6163-1                   security@debian.org     https://www.debian.org/security/                     Salvatore Bonaccorso     March 12, 2026                        https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : linux     CVE ID         : CVE-2023-53424 CVE-2024-26822 CVE-2024-57895 CVE-2025-22026                      CVE-2025-23155 CVE-2025-37786 CVE-2025-37822 CVE-2025-37920                      CVE-2025-38201 CVE-2025-38643 CVE-2025-39763 CVE-2025-40082                      CVE-2025-40251 CVE-2025-68358 CVE-2025-71089 CVE-2025-71144                      CVE-2025-71220 CVE-2025-71222 CVE-2025-71224 CVE-2025-71232                      CVE-2025-71233 CVE-2025-71235 CVE-2025-71236 CVE-2025-71237                      CVE-2025-71238 CVE-2026-23111 CVE-2026-23112 CVE-2026-23169                      CVE-2026-23176 CVE-2026-23178 CVE-2026-23180 CVE-2026-23182                      CVE-2026-23187 CVE-2026-23190 CVE-2026-23193 CVE-2026-23198                      CVE-2026-23202 CVE-2026-23205 CVE-2026-23206 CVE-2026-23209                      CVE-2026-23216 CVE-2026-23220 CVE-2026-23221 CVE-2026-23222                      CVE-2026-23228 CVE-2026-23229 CVE-2026-23230 CVE-2026-23234                      CVE-2026-23235 CVE-2026-23236 CVE-2026-23237 CVE-2026-23238

    Several vulnerabilities have been discovered in the Linux kernel that     may lead to a privilege escalation, denial of service or information     leaks.

    The Qualys Threat Research Unit (TRU) discovered several vulnerabilities     in Apparmor. Details can be found in the Qualys advisory at     https://www.qualys.com/2026/03/10/crack-armor.txt

    For the oldstable distribution (bookworm), these problems have been fixed     in version 6.1.164-1.

    We recommend that you upgrade your linux packages.

    For the detailed security status of linux please refer to its security     tracker page at:
    https://security-tracker.debian.org/tracker/linux

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1468 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    blk-cgroup: Reinit blkg_iostat_set after clearing in blkcg_reset_stats() (CVE-2023-53421)

    In the Linux kernel, the following vulnerability has been resolved:

    iomap: Fix possible overflow condition in iomap_write_delalloc_scan (CVE-2023-54285)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf: Reject narrower access to pointer ctx fields (CVE-2025-38591)

    In the Linux kernel, the following vulnerability has been resolved:

    sctp: linearize cloned gso packets in sctp_rcv (CVE-2025-38718)

    In the Linux kernel, the following vulnerability has been resolved:

    smb: client: fix potential UAF in smb2_close_cached_fid() (CVE-2025-40328)

    In the Linux kernel, the following vulnerability has been resolved:

    team: Move team device type change at the end of team_port_add (CVE-2025-68340)

    In the Linux kernel, the following vulnerability has been resolved:

    fs/ntfs3: Initialize allocated memory before use (CVE-2025-68365)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf: Do not let BPF test infra emit invalid GSO types to stack (CVE-2025-68725)

    In the Linux kernel, the following vulnerability has been resolved:

    iommu: disable SVA when CONFIG_X86 is set (CVE-2025-71089)

    In the Linux kernel, the following vulnerability has been resolved:

    btrfs: fix deadlock in wait_current_trans() due to ignored transaction type (CVE-2025-71194)

    In the Linux kernel, the following vulnerability has been resolved:

    btrfs: fix reservation leak in some error paths when inserting inline extent (CVE-2025-71268)

    In the Linux kernel, the following vulnerability has been resolved:

    net/sched: sch_qfq: do not free existing class in qfq_change_class() (CVE-2026-22999)

    In the Linux kernel, the following vulnerability has been resolved:

    macvlan: fix possible UAF in macvlan_forward_source() (CVE-2026-23001)

    In the Linux kernel, the following vulnerability has been resolved:

    ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CVE-2026-23003)

    In the Linux kernel, the following vulnerability has been resolved:

    x86/fpu: Clear XSTATE_BV[i] in guest XSAVE state whenever XFD[i]=1 (CVE-2026-23005)

    In the Linux kernel, the following vulnerability has been resolved:

    ipv6: Fix use-after-free in inet6_addr_del(). (CVE-2026-23010)

    In the Linux kernel, the following vulnerability has been resolved:

    ipv4: ip_gre: make ipgre_header() robust (CVE-2026-23011)

    In the Linux kernel, the following vulnerability has been resolved:

    mm/page_alloc: prevent pcp corruption with SMP=n (CVE-2026-23025)

    In the Linux kernel, the following vulnerability has been resolved:

    pnfs/flexfiles: Fix memory leak in nfs4_ff_alloc_deviceid_node() (CVE-2026-23038)

    In the Linux kernel, the following vulnerability has been resolved:

    net: hv_netvsc: reject RSS hash key programming without RX indirection table (CVE-2026-23054)

    In the Linux kernel, the following vulnerability has been resolved:

    crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec (CVE-2026-23060)

    In the Linux kernel, the following vulnerability has been resolved:

    vsock/virtio: fix potential underflow in virtio_transport_get_credit() (CVE-2026-23069)

    In the Linux kernel, the following vulnerability has been resolved:

    regmap: Fix race condition in hwspinlock irqsave routine (CVE-2026-23071)

    In the Linux kernel, the following vulnerability has been resolved:

    net/sched: Enforce that teql can only be used as root qdisc (CVE-2026-23074)

    In the Linux kernel, the following vulnerability has been resolved:

    fou: Don't allow 0 for FOU_ATTR_IPPROTO. (CVE-2026-23083)

    In the Linux kernel, the following vulnerability has been resolved:

    irqchip/gic-v3-its: Avoid truncating memory addresses (CVE-2026-23085)

    In the Linux kernel, the following vulnerability has been resolved:

    vsock/virtio: cap TX credit to local buffer size (CVE-2026-23086)

    In the Linux kernel, the following vulnerability has been resolved:

    gue: Fix skb memleak with inner IP protocol 0. (CVE-2026-23095)

    In the Linux kernel, the following vulnerability has been resolved:

    migrate: correct lock ordering for hugetlb file folios (CVE-2026-23097)

    In the Linux kernel, the following vulnerability has been resolved:

    bonding: limit BOND_MODE_8023AD to Ethernet devices (CVE-2026-23099)

    In the Linux kernel, the following vulnerability has been resolved:

    arm64/fpsimd: signal: Fix restoration of SVE context (CVE-2026-23102)

    In the Linux kernel, the following vulnerability has been resolved:

    ipvlan: Make the addrs_lock be per port (CVE-2026-23103)

    In the Linux kernel, the following vulnerability has been resolved:

    net/sched: qfq: Use cl_is_active to determine whether class is active in qfq_rm_from_ag (CVE-2026-23105)

    In the Linux kernel, the following vulnerability has been resolved:

    arm64/fpsimd: signal: Allocate SSVE storage when restoring ZA (CVE-2026-23107)

    In the Linux kernel, the following vulnerability has been resolved:

    scsi: core: Wake up the error handler when final completions race against each other (CVE-2026-23110)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CVE-2026-23111)

    In the Linux kernel, the following vulnerability has been resolved:

    bonding: provide a net pointer to __skb_flow_dissect() (CVE-2026-23119)

    In the Linux kernel, the following vulnerability has been resolved:

    ipv6: annotate data-race in ndisc_router_discovery() (CVE-2026-23124)

    In the Linux kernel, the following vulnerability has been resolved:

    sctp: move SCTP_CMD_ASSOC_SHKEY right after SCTP_CMD_PEER_INIT (CVE-2026-23125)

    In the Linux kernel, the following vulnerability has been resolved:

    netdevsim: fix a race issue related to the operation on bpf_bound_progs list (CVE-2026-23126)

    In the Linux kernel, the following vulnerability has been resolved:

    arm64: Set __nocfi on swsusp_arch_resume() (CVE-2026-23128)

    In the Linux kernel, the following vulnerability has been resolved:

    mm/damon/sysfs-scheme: cleanup access_pattern subdirs on scheme dir setup failure (CVE-2026-23142)

    In the Linux kernel, the following vulnerability has been resolved:

    mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (CVE-2026-23144)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: fix iloc.bh leak in ext4_xattr_inode_update_ref (CVE-2026-23145)

    In the Linux kernel, the following vulnerability has been resolved:

    efivarfs: fix error propagation in efivar_entry_get() (CVE-2026-23156)

    In the Linux kernel, the following vulnerability has been resolved:

    flex_proportions: make fprop_new_period() hardirq safe (CVE-2026-23168)

    In the Linux kernel, the following vulnerability has been resolved:

    scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CVE-2026-23193)

    In the Linux kernel, the following vulnerability has been resolved:

    KVM: Don't clobber irqfd routing type when deassigning irqfd (CVE-2026-23198)

    In the Linux kernel, the following vulnerability has been resolved:

    smb/client: fix memory leak in smb2_open_file() (CVE-2026-23205)

    In the Linux kernel, the following vulnerability has been resolved:

    macvlan: fix error recovery in macvlan_common_newlink() (CVE-2026-23209)

    In the Linux kernel, the following vulnerability has been resolved:

    bonding: annotate data-races around slave->last_rx (CVE-2026-23212)

    In the Linux kernel, the following vulnerability has been resolved:

    scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CVE-2026-23216)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the linux package has been released.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() In iscsit_dec_conn_usage_count(),     the function calls complete() while holding the conn->conn_usage_lock. As soon as complete() is invoked,     the waiter (such as iscsit_close_connection()) may wake up and proceed to free the iscsit_conn structure.
    If the waiter frees the memory before the current thread reaches spin_unlock_bh(), it results in a KASAN     slab-use-after-free as the function attempts to release a lock within the already-freed connection     structure. Fix this by releasing the spinlock before calling complete(). (CVE-2026-23216)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote Debian 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6141 advisory.

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-6141-1                   security@debian.org     https://www.debian.org/security/                     Salvatore Bonaccorso     February 18, 2026                     https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : linux     CVE ID         : CVE-2025-40082 CVE-2025-68823 CVE-2025-71203 CVE-2025-71204                      CVE-2025-71220 CVE-2025-71222 CVE-2025-71223 CVE-2025-71224                      CVE-2025-71225 CVE-2025-71228 CVE-2025-71229 CVE-2025-71231                      CVE-2025-71232 CVE-2025-71233 CVE-2025-71234 CVE-2025-71235                      CVE-2025-71236 CVE-2025-71237 CVE-2026-23111 CVE-2026-23112                      CVE-2026-23169 CVE-2026-23176 CVE-2026-23177 CVE-2026-23178                      CVE-2026-23179 CVE-2026-23180 CVE-2026-23182 CVE-2026-23187                      CVE-2026-23188 CVE-2026-23189 CVE-2026-23190 CVE-2026-23191                      CVE-2026-23193 CVE-2026-23198 CVE-2026-23199 CVE-2026-23200                      CVE-2026-23201 CVE-2026-23202 CVE-2026-23204 CVE-2026-23205                      CVE-2026-23206 CVE-2026-23209 CVE-2026-23213 CVE-2026-23214                      CVE-2026-23215 CVE-2026-23216 CVE-2026-23219 CVE-2026-23220                      CVE-2026-23222 CVE-2026-23223 CVE-2026-23224 CVE-2026-23228                      CVE-2026-23229 CVE-2026-23230     Debian Bug     : 1125405 1127597

    Several vulnerabilities have been discovered in the Linux kernel that     may lead to a privilege escalation, denial of service or information     leaks.

    For the stable distribution (trixie), these problems have been fixed in     version 6.12.73-1.

    We recommend that you upgrade your linux packages.

    For the detailed security status of linux please refer to its security     tracker page at:
    https://security-tracker.debian.org/tracker/linux

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
310413	RHEL 7 : kernel-rt (RHSA-2026:10756)	Nessus	Red Hat Local Security Checks	high
310061	SUSE SLES15 Security Update : kernel (SUSE-SU-2026:1573-1)	Nessus	SuSE Local Security Checks	high
309747	RHEL 7 : kernel (RHSA-2026:9870)	Nessus	Red Hat Local Security Checks	high
309153	openSUSE 16 Security Update : kernel (openSUSE-SU-2026:20572-1)	Nessus	SuSE Local Security Checks	high
306779	Oracle Linux 10 / 9 : Unbreakable Enterprise kernel (ELSA-2026-50232)	Nessus	Oracle Linux Local Security Checks	critical
304272	Amazon Linux 2023 : bpftool6.12, kernel6.12, kernel6.12-devel (ALAS2023-2026-1487)	Nessus	Amazon Linux Local Security Checks	high
303468	Oracle Linux 10 / 9 : Unbreakable Enterprise kernel (ELSA-2026-50160)	Nessus	Oracle Linux Local Security Checks	critical
303103	Amazon Linux 2 : kernel, --advisory ALAS2KERNEL-5.10-2026-114 (ALASKERNEL-5.10-2026-114)	Nessus	Amazon Linux Local Security Checks	high
302189	Debian dla-4498 : ata-modules-5.10.0-38-armmp-di - security update	Nessus	Debian Local Security Checks	critical
302188	Debian dla-4499 : linux-config-6.1 - security update	Nessus	Debian Local Security Checks	critical
302008	Debian dsa-6163 : affs-modules-6.1.0-43-4kc-malta-di - security update	Nessus	Debian Local Security Checks	critical
301346	Amazon Linux 2023 : bpftool, kernel, kernel-devel (ALAS2023-2026-1468)	Nessus	Amazon Linux Local Security Checks	high
299743	Photon OS 5.0: Linux PHSA-2026-5.0-0770	Nessus	PhotonOS Local Security Checks	critical
299662	Photon OS 4.0: Linux PHSA-2026-4.0-0965	Nessus	PhotonOS Local Security Checks	critical
299448	Linux Distros Unpatched Vulnerability : CVE-2026-23216	Nessus	Misc.	high
299419	Debian dsa-6141 : ata-modules-6.12.31-armmp-di - security update	Nessus	Debian Local Security Checks	critical

Detections

Analytics

CVE-2026-23216

high

Tenable Plugins

high

high

high

high

critical

high

critical

high

critical

critical

critical

high

critical

critical

high

critical