In the Linux kernel, the following vulnerability has been resolved: io_uring/rw: free potentially allocated iovec on cache put failure If a read/write request goes through io_req_rw_cleanup() and has an allocated iovec attached and fails to put to the rw_cache, then it may end up with an unaccounted iovec pointer. Have io_rw_recycle() return whether it recycled the request or not, and use that to gauge whether to free a potential iovec or not.

The remote SUSE Linux SLES15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:1573-1 advisory.

    The SUSE Linux Enterprise 15 SP7 RT kernel was updated to receive various security bugfixes.


    The following security bugs were fixed:

    - CVE-2025-39998: scsi: target: target_core_configfs: Add length check to avoid buffer overflow     (bsc#1252073).
    - CVE-2025-68794: iomap: adjust read range correctly for non-block-aligned positions (bsc#1256647).
    - CVE-2025-71268: btrfs: fix reservation leak in some error paths when inserting inline extent     (bsc#1259865).
    - CVE-2025-71269: btrfs: do not free data reservation in fallback from inline due to -ENOSPC     (bsc#1259889).
    - CVE-2026-23030: phy: rockchip: inno-usb2: Fix a double free bug in rockchip_usb2phy_probe()     (bsc#1257561).
    - CVE-2026-23047: libceph: make calc_target() set t->paused, not just clear it (bsc#1257682).
    - CVE-2026-23103: ipvlan: Make the addrs_lock be per port (bsc#1257773).
    - CVE-2026-23120: l2tp: avoid one data-race in l2tp_tunnel_del_work() (bsc#1258280).
    - CVE-2026-23136: libceph: reset sparse-read state in osd_fault() (bsc#1258303).
    - CVE-2026-23140: bpf, test_run: Subtract size of xdp_frame from allowed metadata size (bsc#1258305).
    - CVE-2026-23187: pmdomain: imx8m-blk-ctrl: fix out-of-range access of bc->domains (bsc#1258330).
    - CVE-2026-23193: scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count()     (bsc#1258414).
    - CVE-2026-23201: ceph: fix oops due to invalid pointer for kfree() in parse_longname() (bsc#1258337).
    - CVE-2026-23215: x86/vmware: Fix hypercall clobbers (bsc#1258476).
    - CVE-2026-23216: scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (bsc#1258447).
    - CVE-2026-23231: netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (bsc#1259188).
    - CVE-2026-23242: RDMA/siw: Fix potential NULL pointer dereference in header processing (bsc#1259795).
    - CVE-2026-23243: RDMA/umad: Reject negative data_len in ib_umad_write (bsc#1259797).
    - CVE-2026-23255: net: add proper RCU protection to /proc/net/ptype (bsc#1259891).
    - CVE-2026-23259: io_uring/rw: free potentially allocated iovec on cache put failure (bsc#1259866).
    - CVE-2026-23270: net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks     (bsc#1259886).
    - CVE-2026-23272: netfilter: nf_tables: unconditionally bump set->nelems before insertion (bsc#1260009).
    - CVE-2026-23274: netfilter: xt_IDLETIMER: reject rev0 reuse of ALARM timer labels (bsc#1260005).
    - CVE-2026-23277: net/sched: teql: fix NULL pointer dereference in iptunnel_xmit on TEQL slave xmit     (bsc#1259997).
    - CVE-2026-23278: netfilter: nf_tables: always walk all pending catchall elements (bsc#1259998).
    - CVE-2026-23281: wifi: libertas: fix use-after-free in lbs_free_adapter() (bsc#1260464).
    - CVE-2026-23292: scsi: target: Fix recursive locking in __configfs_open_file() (bsc#1260500).
    - CVE-2026-23293: net: vxlan: fix nd_tbl NULL dereference when IPv6 is disabled (bsc#1260486).
    - CVE-2026-23317: drm/vmwgfx: Return the correct value in vmw_translate_ptr functions (bsc#1260562).
    - CVE-2026-23319: bpf: Fix a UAF issue in bpf_trampoline_link_cgroup_shim (bsc#1260735).
    - CVE-2026-23361: PCI: dwc: ep: Flush MSI-X write before unmapping its ATU entry (bsc#1260732).
    - CVE-2026-23379: net/sched: ets: fix divide by zero in the offload path (bsc#1260481).
    - CVE-2026-23381: net: bridge: fix nd_tbl NULL dereference when IPv6 is disabled (bsc#1260471).
    - CVE-2026-23386: gve: fix incorrect buffer cleanup in gve_tx_clean_pending_packets for QPL (bsc#1260799).
    - CVE-2026-23398: icmp: fix NULL pointer dereference in icmp_tag_validation() (bsc#1260730).
    - CVE-2026-23413: clsact: Fix use-after-free in init/destroy rollback asymmetry (bsc#1261498).
    - CVE-2026-23414: tls: Purge async_hold in tls_decrypt_async_wait() (bsc#1261496).
    - CVE-2026-31788: xen/privcmd: restrict usage in unprivileged domU (bsc#1259707).


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1514 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    btrfs: fix reservation leak in some error paths when inserting inline extent (CVE-2025-71268)

    In the Linux kernel, the following vulnerability has been resolved:

    btrfs: do not free data reservation in fallback from inline due to -ENOSPC (CVE-2025-71269)

    In the Linux kernel, the following vulnerability has been resolved:

    smack: /smack/doi: accept previously used values (CVE-2025-71304)

    In the Linux kernel, the following vulnerability has been resolved:

    fs/ntfs3: Initialize new folios before use (CVE-2025-71311)

    In the Linux kernel, the following vulnerability has been resolved:

    RDMA/umad: Reject negative data_len in ib_umad_write (CVE-2026-23243)

    In the Linux kernel, the following vulnerability has been resolved:

    net: gro: fix outer network offset (CVE-2026-23254)

    In the Linux kernel, the following vulnerability has been resolved:

    net: add proper RCU protection to /proc/net/ptype (CVE-2026-23255)

    In the Linux kernel, the following vulnerability has been resolved:

    io_uring/rw: free potentially allocated iovec on cache put failure (CVE-2026-23259)

    In the Linux kernel, the following vulnerability has been resolved:

    regmap: maple: free entry on mas_store_gfp() failure (CVE-2026-23260)

    In the Linux kernel, the following vulnerability has been resolved:

    io_uring/zcrx: fix page array leak (CVE-2026-23263)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: nft_set_rbtree: validate open interval overlap (CVE-2026-23333)

    In the Linux kernel, the following vulnerability has been resolved:

    tracing/dma: Cap dma_map_sg tracepoint arrays to prevent buffer overflow (CVE-2026-23390)

    In the Linux kernel, the following vulnerability has been resolved:

    smb: client: make use of smbdirect_socket.recv_io.credits.available (CVE-2026-31535)

    In the Linux kernel, the following vulnerability has been resolved:

    smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (CVE-2026-31539)

    In the Linux kernel, the following vulnerability has been resolved:

    driver core: enforce device_lock for driver_match_device() (CVE-2026-31688)

    In the Linux kernel, the following vulnerability has been resolved:

    ACPI: processor: Update cpuidle driver check in __acpi_processor_start() (CVE-2026-43122)

    In the Linux kernel, the following vulnerability has been resolved:

    cpufreq: intel_pstate: Fix NULL pointer dereference in update_cpu_qos_request() (CVE-2026-43401)

    In the Linux kernel, the following vulnerability has been resolved:

    net: remove WARN_ON_ONCE when accessing forward path array (CVE-2026-45847)

    In the Linux kernel, the following vulnerability has been resolved:

    efi: Fix reservation of unaccepted memory table (CVE-2026-45851)

    In the Linux kernel, the following vulnerability has been resolved:

    ata: libata-scsi: avoid Non-NCQ command starvation (CVE-2026-45855)

    In the Linux kernel, the following vulnerability has been resolved:

    RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CVE-2026-45856)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: don't zero the entire extent if EXT4_EXT_DATA_PARTIAL_VALID1 (CVE-2026-45858)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: nfnetlink_queue: do shared-unconfirmed check before segmentation (CVE-2026-45859)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: nf_conncount: increase the connection clean up limit to 64 (CVE-2026-45860)

    In the Linux kernel, the following vulnerability has been resolved:

    iommu/vt-d: Flush cache for PASID table before using it (CVE-2026-45862)

    In the Linux kernel, the following vulnerability has been resolved:

    fs/ntfs3: prevent infinite loops caused by the next valid being the same (CVE-2026-45864)

    In the Linux kernel, the following vulnerability has been resolved:

    SUNRPC: auth_gss: fix memory leaks in XDR decoding error paths (CVE-2026-45870)

    In the Linux kernel, the following vulnerability has been resolved:

    scsi: smartpqi: Fix memory leak in pqi_report_phys_luns() (CVE-2026-45872)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: nft_set_rbtree: check for partial overlaps in anonymous sets (CVE-2026-45873)

    In the Linux kernel, the following vulnerability has been resolved:

    arm64/gcs: Fix error handling in arch_set_shadow_stack_status() (CVE-2026-45876)

    In the Linux kernel, the following vulnerability has been resolved:

    PCI/P2PDMA: Release per-CPU pgmap ref when vm_insert_page() fails (CVE-2026-45880)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf: Fix bpf_xdp_store_bytes proto for read-only arg (CVE-2026-45886)

    In the Linux kernel, the following vulnerability has been resolved:

    af_unix: Fix memleak of newsk in unix_stream_connect(). (CVE-2026-45887)

    In the Linux kernel, the following vulnerability has been resolved:

    md/raid1: fix memory leak in raid1_run() (CVE-2026-45888)

    In the Linux kernel, the following vulnerability has been resolved:

    mptcp: do not account for OoO in mptcp_rcvbuf_grow() (CVE-2026-45889)

    In the Linux kernel, the following vulnerability has been resolved:

    xen-netback: reject zero-queue configuration from guest (CVE-2026-45890)

    In the Linux kernel, the following vulnerability has been resolved:

    iommu/vt-d: Clear Present bit before tearing down PASID entry (CVE-2026-45894)

    In the Linux kernel, the following vulnerability has been resolved:

    quota: fix livelock between quotactl and freeze_super (CVE-2026-45895)

    In the Linux kernel, the following vulnerability has been resolved:

    RDMA/iwcm: Fix workqueue list corruption by removing work_list (CVE-2026-45898)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: drop extent cache when splitting extent fails (CVE-2026-45899)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf: Fix memory access flags in helper prototypes (CVE-2026-45903)

    In the Linux kernel, the following vulnerability has been resolved:

    xfrm: fix ip_rt_bug race in icmp_route_lookup reverse path (CVE-2026-45905)

    In the Linux kernel, the following vulnerability has been resolved:

    net/mlx5e: Fix deadlocks between devlink and netdev instance locks (CVE-2026-45907)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: don't cache extent during splitting extent (CVE-2026-45912)

    In the Linux kernel, the following vulnerability has been resolved:

    net: bridge: mcast: always update mdb_n_entries for vlan contexts (CVE-2026-45913)

    In the Linux kernel, the following vulnerability has been resolved:

    fat: avoid parent link count underflow in rmdir (CVE-2026-45915)

    In the Linux kernel, the following vulnerability has been resolved:

    ipvs: do not keep dest_dst if dev is going down (CVE-2026-45917)

    In the Linux kernel, the following vulnerability has been resolved:

    ovpn: tcp - don't deref NULL sk_socket member after tcp_close() (CVE-2026-45918)

    In the Linux kernel, the following vulnerability has been resolved:

    sched/rt: Skip currently executing CPU in rto_next_cpu() (CVE-2026-45919)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: fix dirtyclusters double decrement on fs shutdown (CVE-2026-45920)

    In the Linux kernel, the following vulnerability has been resolved:

    RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (CVE-2026-45922)

    In the Linux kernel, the following vulnerability has been resolved:

    thermal/of: Fix reference leak in thermal_of_cm_lookup() (CVE-2026-45925)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf: Require frozen map for calculating map hash (CVE-2026-45927)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf: Fix tcx/netkit detach permissions when prog fd isn't given (CVE-2026-45932)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf: Preserve id of register in sync_linked_regs() (CVE-2026-45933)

    In the Linux kernel, the following vulnerability has been resolved:

    btrfs: fix EEXIST abort due to non-consecutive gaps in chunk allocation (CVE-2026-45934)

    In the Linux kernel, the following vulnerability has been resolved:

    fs/ntfs3: Fix slab-out-of-bounds read in DeleteIndexEntryRoot (CVE-2026-45935)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: fix e4b bitmap inconsistency reports (CVE-2026-45942)

    In the Linux kernel, the following vulnerability has been resolved:

    erofs: fix inline data read failure for ztailpacking pclusters (CVE-2026-45943)

    In the Linux kernel, the following vulnerability has been resolved:

    iommu/vt-d: Clear Present bit before tearing down context entry (CVE-2026-45944)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: fix memory leak in ext4_ext_shift_extents() (CVE-2026-45948)

    In the Linux kernel, the following vulnerability has been resolved:

    hwrng: core - use RCU and work_struct to fix race condition (CVE-2026-45949)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf: Fix a potential use-after-free of BTF object (CVE-2026-45951)

    In the Linux kernel, the following vulnerability has been resolved:

    md/raid5: fix IO hang with degraded array with llbitmap (CVE-2026-45953)

    In the Linux kernel, the following vulnerability has been resolved:

    md/md-llbitmap: fix percpu_ref not resurrected on suspend timeout (CVE-2026-45955)

    In the Linux kernel, the following vulnerability has been resolved:

    rcu: Fix rcu_read_unlock() deadloop due to softirq (CVE-2026-45957)

    In the Linux kernel, the following vulnerability has been resolved:

    SUNRPC: fix gss_auth kref leak in gss_alloc_msg error path (CVE-2026-45964)

    In the Linux kernel, the following vulnerability has been resolved:

    cpuidle: Skip governor when only one idle state is available (CVE-2026-45968)

    In the Linux kernel, the following vulnerability has been resolved:

    bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CVE-2026-45970)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf: Limit bpf program signature size (CVE-2026-45971)

    In the Linux kernel, the following vulnerability has been resolved:

    RDMA/mlx5: Fix UMR hang in LAG error state unload (CVE-2026-45973)

    In the Linux kernel, the following vulnerability has been resolved:

    btrfs: fix invalid leaf access in btrfs_quota_enable() if ref key not found (CVE-2026-45974)

    In the Linux kernel, the following vulnerability has been resolved:

    ACPICA: Fix NULL pointer dereference in acpi_ev_address_space_dispatch() (CVE-2026-45982)

    In the Linux kernel, the following vulnerability has been resolved:

    nfsd: never defer requests during idmap lookup (CVE-2026-45983)

    In the Linux kernel, the following vulnerability has been resolved:

    btrfs: fix block_group_tree dirty_list corruption (CVE-2026-46251)

    In the Linux kernel, the following vulnerability has been resolved:

    pstore/ram: fix buffer overflow in persistent_ram_save_old() (CVE-2026-46253)

    In the Linux kernel, the following vulnerability has been resolved:

    NFS/localio: prevent direct reclaim recursion into NFS via nfs_writepages (CVE-2026-46256)

    In the Linux kernel, the following vulnerability has been resolved:

    procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CVE-2026-46259)

    In the Linux kernel, the following vulnerability has been resolved:

    inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (CVE-2026-46266)

    In the Linux kernel, the following vulnerability has been resolved:

    dm: fix unlocked test for dm_suspended_md (CVE-2026-46327)

    In the Linux kernel, the following vulnerability has been resolved:

    apparmor: fix rlimit for posix cpu timers (CVE-2026-46328)

    In the Linux kernel, the following vulnerability has been resolved:

    erofs: handle end of filesystem properly for file-backed mounts (CVE-2026-46329)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - io_uring/rw: free potentially allocated iovec on cache put failure If a read/write request goes through     io_req_rw_cleanup() and has an allocated iovec attached and fails to put to the rw_cache, then it may end     up with an unaccounted iovec pointer. Have io_rw_recycle() return whether it recycled the request or not,     and use that to gauge whether to free a potential iovec or not. (CVE-2026-23259)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
335080	openSUSE 16: cluster-md-kmp-64kb / cluster-md-kmp-azure / cluster-md-kmp-default / etc (openSUSE-SU-2026:21555-1)	Nessus	SuSE Local Security Checks	Local	high
311745	SUSE SLED15 / SLES15 : Security update for the Linux Kernel (SUSE-SU-2026:1661-1)	Nessus	SuSE Local Security Checks	Local	high
310061	SUSE SLES15 Security Update : kernel (SUSE-SU-2026:1573-1)	Nessus	SuSE Local Security Checks	Local	high
304298	Amazon Linux 2023 : bpftool6.18, kernel6.18, kernel6.18-devel (ALAS2023-2026-1514)	Nessus	Amazon Linux Local Security Checks	Local	high
302963	Linux Distros Unpatched Vulnerability : CVE-2026-23259	Nessus	Misc.	Local	medium

Detections

Analytics

CVE-2026-23259

medium

Tenable Plugins

high

high

high

high

medium