In the Linux kernel, the following vulnerability has been resolved: regmap: maple: free entry on mas_store_gfp() failure regcache_maple_write() allocates a new block ('entry') to merge adjacent ranges and then stores it with mas_store_gfp(). When mas_store_gfp() fails, the new 'entry' remains allocated and is never freed, leaking memory. Free 'entry' on the failure path; on success continue freeing the replaced neighbor blocks ('lower', 'upper').

The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1786352940 advisory.

  - In the Linux kernel, the following vulnerability has been resolved: serial: imx: fix tx statemachine     deadlock When using the serial port as RS485 port, the tx statemachine is used to control the RTS pin to     drive the RS485 transceiver TX_EN pin. When the TTY port is closed in the middle of a transmission (for     instance during userland application crash), imx_uart_shutdown disables the interface and disables the     Transmission Complete interrupt. afer that, imx_uart_stop_tx bails on an incomplete transmission, to be     retriggered by the TC interrupt. This interrupt is disabled and therefore the tx statemachine never     transitions out of SEND. The statemachine is in deadlock now, and the TX_EN remains low, making the     interface useless. imx_uart_stop_tx now checks for incomplete transmission AND whether TC interrupts are     enabled before bailing to be retriggered. This makes sure the state machine handling is reached, and is     properly set to WAIT_AFTER_SEND. (CVE-2023-52456)

  - In the Linux kernel, the following vulnerability has been resolved: kdb: Fix buffer overflow during tab-     complete Currently, when the user attempts symbol completion with the Tab key, kdb will use strncpy() to     insert the completed symbol into the command buffer. Unfortunately it passes the size of the source buffer     rather than the destination to strncpy() with predictably horrible results. Most obviously if the command     buffer is already full but cp, the cursor position, is in the middle of the buffer, then we will write     past the end of the supplied buffer. Fix this by replacing the dubious strncpy() calls with     memmove()/memcpy() calls plus explicit boundary checks to make sure we have enough space before we start     moving characters around. (CVE-2024-39480)

  - In the Linux kernel, the following vulnerability has been resolved: Fix userfaultfd_api to return EINVAL     as expected Currently if we request a feature that is not set in the Kernel config we fail silently and     return all the available features. However, the man page indicates we should return an EINVAL. We need to     fix this issue since we can end up with a Kernel warning should a program request the feature     UFFD_FEATURE_WP_UNPOPULATED on a kernel with the config not set with this feature. [ 200.812896] WARNING:
    CPU: 91 PID: 13634 at mm/memory.c:1660 zap_pte_range+0x43d/0x660 [ 200.820738] Modules linked in: [     200.869387] CPU: 91 PID: 13634 Comm: userfaultfd Kdump: loaded Not tainted 6.9.0-rc5+ #8 [ 200.877477]     Hardware name: Dell Inc. PowerEdge R6525/0N7YGH, BIOS 2.7.3 03/30/2022 [ 200.885052] RIP:
    0010:zap_pte_range+0x43d/0x660 (CVE-2024-41027)

  - In the Linux kernel, the following vulnerability has been resolved: mlxsw: core_linecards: Fix double     memory deallocation in case of invalid INI file In case of invalid INI file mlxsw_linecard_types_init()     deallocates memory but doesn't reset pointer to NULL and returns 0. In case of any error occurred after     mlxsw_linecard_types_init() call, mlxsw_linecards_init() calls mlxsw_linecard_types_fini() which performs     memory deallocation again. Add pointer reset to NULL. Found by Linux Verification Center     (linuxtesting.org) with SVACE. (CVE-2024-42138)

  - In the Linux kernel, the following vulnerability has been resolved: x86/tdx: Fix data leak in mmio_read()     The mmio_read() function makes a TDVMCALL to retrieve MMIO data for an address from the VMM. Sean noticed     that mmio_read() unintentionally exposes the value of an initialized variable (val) on the stack to the     VMM. This variable is only needed as an output value. It did not need to be passed to the VMM in the first     place. Do not send the original value of *val to the VMM. [ dhansen: clarify what 'val' is used for. ]     (CVE-2024-46794)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The AlmaLinux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1786352940 advisory.

  - In the Linux kernel, the following vulnerability has been resolved: serial: imx: fix tx statemachine     deadlock When using the serial port as RS485 port, the tx statemachine is used to control the RTS pin to     drive the RS485 transceiver TX_EN pin. When the TTY port is closed in the middle of a transmission (for     instance during userland application crash), imx_uart_shutdown disables the interface and disables the     Transmission Complete interrupt. afer that, imx_uart_stop_tx bails on an incomplete transmission, to be     retriggered by the TC interrupt. This interrupt is disabled and therefore the tx statemachine never     transitions out of SEND. The statemachine is in deadlock now, and the TX_EN remains low, making the     interface useless. imx_uart_stop_tx now checks for incomplete transmission AND whether TC interrupts are     enabled before bailing to be retriggered. This makes sure the state machine handling is reached, and is     properly set to WAIT_AFTER_SEND. (CVE-2023-52456)

  - In the Linux kernel, the following vulnerability has been resolved: kdb: Fix buffer overflow during tab-     complete Currently, when the user attempts symbol completion with the Tab key, kdb will use strncpy() to     insert the completed symbol into the command buffer. Unfortunately it passes the size of the source buffer     rather than the destination to strncpy() with predictably horrible results. Most obviously if the command     buffer is already full but cp, the cursor position, is in the middle of the buffer, then we will write     past the end of the supplied buffer. Fix this by replacing the dubious strncpy() calls with     memmove()/memcpy() calls plus explicit boundary checks to make sure we have enough space before we start     moving characters around. (CVE-2024-39480)

  - In the Linux kernel, the following vulnerability has been resolved: Fix userfaultfd_api to return EINVAL     as expected Currently if we request a feature that is not set in the Kernel config we fail silently and     return all the available features. However, the man page indicates we should return an EINVAL. We need to     fix this issue since we can end up with a Kernel warning should a program request the feature     UFFD_FEATURE_WP_UNPOPULATED on a kernel with the config not set with this feature. [ 200.812896] WARNING:
    CPU: 91 PID: 13634 at mm/memory.c:1660 zap_pte_range+0x43d/0x660 [ 200.820738] Modules linked in: [     200.869387] CPU: 91 PID: 13634 Comm: userfaultfd Kdump: loaded Not tainted 6.9.0-rc5+ #8 [ 200.877477]     Hardware name: Dell Inc. PowerEdge R6525/0N7YGH, BIOS 2.7.3 03/30/2022 [ 200.885052] RIP:
    0010:zap_pte_range+0x43d/0x660 (CVE-2024-41027)

  - In the Linux kernel, the following vulnerability has been resolved: mlxsw: core_linecards: Fix double     memory deallocation in case of invalid INI file In case of invalid INI file mlxsw_linecard_types_init()     deallocates memory but doesn't reset pointer to NULL and returns 0. In case of any error occurred after     mlxsw_linecard_types_init() call, mlxsw_linecards_init() calls mlxsw_linecard_types_fini() which performs     memory deallocation again. Add pointer reset to NULL. Found by Linux Verification Center     (linuxtesting.org) with SVACE. (CVE-2024-42138)

  - In the Linux kernel, the following vulnerability has been resolved: x86/tdx: Fix data leak in mmio_read()     The mmio_read() function makes a TDVMCALL to retrieve MMIO data for an address from the VMM. Sean noticed     that mmio_read() unintentionally exposes the value of an initialized variable (val) on the stack to the     VMM. This variable is only needed as an output value. It did not need to be passed to the VMM in the first     place. Do not send the original value of *val to the VMM. [ dhansen: clarify what 'val' is used for. ]     (CVE-2024-46794)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 10 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-50372 advisory.

    - net/sched: fix pedit partial COW leading to page cache corruption (Rajat Gupta)   {CVE-2026-46331}
    - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Christian Brauner)  [Orabug: 39668743]     {CVE-2026-46242}
    - net: skbuff: fix missing zerocopy reference in pskb_carve helpers (Minh Nguyen)  [Orabug: 39656679]     {CVE-2026-52943}
    - arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Rutland)  [Orabug: 39548792]     {CVE-2025-10263}
    - openvswitch: vport: fix self-deadlock on release of tunnel ports (Ilya Maximets) {CVE-2026-46165}
    - iommu/amd: serialize sequence allocation under concurrent TLB invalidations (Ankit Soni)     {CVE-2026-43220}
    - usb: ulpi: fix memory leak on ulpi_register() error paths (Felix Gu) {CVE-2026-46109}
    - smb: client: reject userspace cifs.spnego descriptions (Asim Viladi Oglu Manizada)  [Orabug: 39463671]     {CVE-2026-46243}
    - net: skbuff: propagate shared-frag marker through frag-transfer helpers (Hyunwoo Kim) [Orabug:
    39368826,39441323] {CVE-2026-43503,CVE-2026-46300}
    - net: skbuff: preserve shared-frag marker during coalescing (William Bowling) [Orabug: 39368826]     {CVE-2026-46300}
    - netfilter: reject zero shift in nft_bitwise (Kai Ma) [Orabug: 39452464] {CVE-2026-46101}
    - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Andrea Mayer) [Orabug: 39452457]     {CVE-2026-46099}
    - ALSA: caiaq: fix usb_dev refcount leak on probe failure (Deepanshu Kartikey) [Orabug: 39452739]     {CVE-2026-46048}
    - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Greg Kroah-Hartman) [Orabug: 39426003]     {CVE-2026-43501}
    - ALSA: caiaq: Fix potentially leftover ep1_in_urb at error path (Takashi Iwai) [Orabug: 39452746]     {CVE-2026-45992}
    - net: bonding: fix use-after-free in bond_xmit_broadcast() (Xiang Mei) [Orabug: 39205989]     {CVE-2026-31419}
    - crypto: authencesn - reject short ahash digests during instance creation (Yucheng Lu) [Orabug: 39452231]     {CVE-2026-46033}
    - spi: fix resource leaks on device setup failure (Johan Hovold) [Orabug: 39452400] {CVE-2026-46083}
    - net: qrtr: ns: Limit the total number of nodes (Manivannan Sadhasivam) [Orabug: 39452123]     {CVE-2026-46003}
    - net: bridge: use a stable FDB dst snapshot in RCU readers (Zhengchuan Liang) [Orabug: 39452411]     {CVE-2026-46086}
    - net: qrtr: ns: Limit the maximum number of lookups (Manivannan Sadhasivam) [Orabug: 39452207]     {CVE-2026-46026}
    - net: qrtr: ns: Limit the maximum server registration per node (Manivannan Sadhasivam) [Orabug: 39410851]     {CVE-2026-43491}
    - RDMA/mana_ib: Disable RX steering on RSS QP destroy (Long Li) [Orabug: 39452406] {CVE-2026-46084}
    - media: rc: igorplugusb: heed coherency rules (Oliver Neukum) [Orabug: 39452432] {CVE-2026-46091}
    - wifi: mwifiex: fix use-after-free in mwifiex_adapter_cleanup() (Daniel Hodges) [Orabug: 39452343]     {CVE-2026-46069}
    - thermal: core: Fix thermal zone governor cleanup issues (Rafael J. Wysocki) [Orabug: 39452186]     {CVE-2026-46021}
    - smb: client: validate the whole DACL before rewriting it in cifsacl (Michael Bommarito) [Orabug:
    39300611] {CVE-2026-31709}
    - scsi: sd: fix missing put_disk() when device_add(&disk_dev) fails (Yang Xiuwei) [Orabug: 39452100]     {CVE-2026-45997}
    - rtmutex: Use waiter::task instead of current in remove_waiter() (Keenan Dong) [Orabug: 39425998]     {CVE-2026-43499}
    - ceph: only d_add() negative dentries when they are unhashed (Max Kellermann) [Orabug: 39452291]     {CVE-2026-46052}
    - dm mirror: fix integer overflow in create_dirty_log() (Junrui Luo) [Orabug: 39452196] {CVE-2026-46023}
    - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (Shuvam Pandey) [Orabug: 39452304]     {CVE-2026-46056}
    - tcp: call sk_data_ready() after listener migration (Zhenzhong Wu) [Orabug: 39452159] {CVE-2026-46015}
    - inotify: fix watch count leak when fsnotify_add_inode_mark_locked() fails (Chia-Ming Chang) [Orabug:
    39452250] {CVE-2026-46040}
    - md/raid5: validate payload size before accessing journal metadata (Junrui Luo) [Orabug: 39452349]     {CVE-2026-46070}
    - md/raid5: fix soft lockup in retry_aligned_read() (Chia-Ming Chang) [Orabug: 39452287] {CVE-2026-46051}
    - ext4: fix missing brelse() in ext4_xattr_inode_dec_ref_all() (Sohei Koyama) [Orabug: 39452269]     {CVE-2026-46046}
    - ext4: fix bounds check in check_xattrs() to prevent out-of-bounds access (Deepanshu Kartikey) [Orabug:
    39452442] {CVE-2026-46094}
    - io_uring/poll: fix multishot recv missing EOF on wakeup race (Jens Axboe) {CVE-2026-23473}
    - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Kevin Cheng) [Orabug: 39452372]     {CVE-2026-46076}
    - KVM: SVM: Inject #UD for INVLPGA if EFER.SVME=0 (Kevin Cheng) [Orabug: 39452394] {CVE-2026-46082}
    - KVM: nSVM: Sync interrupt shadow to cached vmcb12 after VMRUN of L2 (Yosry Ahmed) [Orabug: 39452061]     {CVE-2026-45987}
    - xfs: fix a resource leak in xfs_alloc_buftarg() (Haoxiang Li) [Orabug: 39452131] {CVE-2026-46005}
    - libceph: Prevent potential null-ptr-deref in ceph_handle_auth_reply() (Raphael Zimmer) [Orabug:
    39452201] {CVE-2026-46024}
    - ipv4: icmp: validate reply type before using icmp_pointers (Ruide Cao) [Orabug: 39452243]     {CVE-2026-46037}
    - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Hkbinbin) [Orabug: 39452259]     {CVE-2026-46043}
    - net: qrtr: ns: Free the node during ctrl_cmd_bye() (Manivannan Sadhasivam) [Orabug: 39452246]     {CVE-2026-46038}
    - rxrpc: Fix rxkad crypto unalignment handling (David Howells) [Orabug: 39452728] {CVE-2026-46085}
    - ALSA: caiaq: Handle probe errors properly (Takashi Iwai) [Orabug: 39452126] {CVE-2026-46004}
    - rbd: fix null-ptr-deref when device_add_disk() fails (Dawei Feng) [Orabug: 39452385] {CVE-2026-46079}
    - md/raid10: fix deadlock with check operation and nowait requests (Josh Hunt) [Orabug: 39452284]     {CVE-2026-46050}
    - jbd2: fix deadlock in jbd2_journal_cancel_revoke() (Zhang Yi) [Orabug: 39452318] {CVE-2026-46061}
    - erofs: fix the out-of-bounds nameoff handling for trailing dirents (Gao Xiang) [Orabug: 39452380]     {CVE-2026-46078}
    - ALSA: ctxfi: Add fallback to default RSR for S/PDIF (Harin Lee) [Orabug: 39452280] {CVE-2026-46049}
    - ext2: reject inodes with zero i_nlink and valid mode in ext2_iget() (Vasiliy Kovalev) [Orabug: 39452119]     {CVE-2026-46002}
    - net: qrtr: ns: Fix use-after-free in driver remove() (Manivannan Sadhasivam) [Orabug: 39452274]     {CVE-2026-46047}
    - net: strparser: fix skb_head leak in strp_abort_strp() (Luxiao Xu) [Orabug: 39452468] {CVE-2026-46102}
    - ALSA: control: Validate buf_len before strnlen() in snd_ctl_elem_init_enum_names() (Ziqing Chen)     [Orabug: 39452416] {CVE-2026-46088}
    - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Herbert Xu) [Orabug: 39410863] {CVE-2026-43493}
    - wifi: rtw88: check for PCI upstream bridge existence (Fedor Pchelkin) [Orabug: 39452437]     {CVE-2026-46092}
    - zram: do not forget to endio for partial discard requests (Sergey Senozhatsky) [Orabug: 39452420]     {CVE-2026-46089}
    - ocfs2: split transactions in dio completion to avoid credit exhaustion (Heming Zhao) [Orabug: 39452388]     {CVE-2026-46080}
    - drm/amdgpu: Limit BO list entry count to prevent resource exhaustion (Jesse Zhang) [Orabug: 39167551]     {CVE-2026-23468}
    - padata: Fix pd UAF once and for all (Herbert Xu) [Orabug: 38335055] {CVE-2025-38584}
    - drm/nouveau: fix u32 overflow in pushbuf reloc bounds check (Greg Kroah-Hartman) [Orabug: 39452133]     {CVE-2026-46006}
    - ALSA: usb-audio: stop parsing UAC2 rates at MAX_NR_RATES (Cassio Gabriel) [Orabug: 39452170]     {CVE-2026-46018}
    - Buffer overflow in drivers/xen/sys-hypervisor.c (Juergen Gross) [Orabug: 39305898] {CVE-2026-31786}
    - xen/privcmd: fix double free via VMA splitting (Juergen Gross) [Orabug: 39305908] {CVE-2026-31787}
    - rxrpc: Fix missing validation of ticket length in non-XDR key preparsing (Anderson Nascimento) [Orabug:
    39300563] {CVE-2026-31696}
    - crypto: ccp: Don't attempt to copy ID to userspace if PSP command failed (Sean Christopherson)     {CVE-2026-31697}
    - crypto: ccp: Don't attempt to copy PDH cert to userspace if PSP command failed (Sean Christopherson)     {CVE-2026-31698}
    - crypto: ccp: Don't attempt to copy CSR to userspace if PSP command failed (Sean Christopherson)     {CVE-2026-31699}
    - net/packet: fix TOCTOU race on mmap'd vnet_hdr in tpacket_snd() (Bingquan Chen) {CVE-2026-31700}
    - ALSA: caiaq: take a reference on the USB device in create_card() (Berk Cem Goksel) [Orabug: 39300586]     {CVE-2026-31701}
    - smb: client: fix OOB read in smb2_ioctl_query_info QUERY_INFO path (Michael Bommarito) [Orabug:
    39300607] {CVE-2026-31708}
    - smb: client: require a full NFS mode SID before reading mode bits (Michael Bommarito) [Orabug: 39343707]     {CVE-2026-43350}
    - fuse: reject oversized dirents in page cache (Samuel Page) [Orabug: 39300556] {CVE-2026-31694}
    - mm/pagewalk: fix race between concurrent split and refault (Max Boone) [Orabug: 39250782]     {CVE-2026-31456}
    - wifi: mac80211: always free skb on ieee80211_tx_prepare_skb() failure (Felix Fietkau) [Orabug: 39167472]     {CVE-2026-23444}
    - mm/userfaultfd: fix hugetlb fault mutex hash calculation (Jianhui Zhou) [Orabug: 39273453]     {CVE-2026-31575}
    - ipv6: add NULL checks for idev in SRv6 paths (Heminhong) [Orabug: 39167467] {CVE-2026-23442}
    - ocfs2: fix out-of-bounds write in ocfs2_write_end_inline (Joseph Qi) [Orabug: 39331090] {CVE-2026-43075}
    - ocfs2: validate inline data i_size during inode read (Deepanshu Kartikey) [Orabug: 39331097]     {CVE-2026-43076}
    - media: as102: fix to not free memory after the device is registered in as102_usb_probe() (Jeongjun Park)     [Orabug: 39273467] {CVE-2026-31578}
    - bcache: fix cached_dev.sb_bio use-after-free and crash (Mingzhe Zou) [Orabug: 39273481] {CVE-2026-31580}
    - ALSA: 6fire: fix use-after-free on disconnect (Berk Cem Goksel) [Orabug: 39273486] {CVE-2026-31581}
    - media: em28xx: fix use-after-free in em28xx_v4l2_open() (Abhishek Kumar) [Orabug: 39273493]     {CVE-2026-31583}
    - mm: blk-cgroup: fix use-after-free in cgwb_release_workfn() (Breno Leitao) [Orabug: 39273507]     {CVE-2026-31586}
    - KVM: x86: Use scratch field in MMIO fragment to hold small write values (Sean Christopherson) [Orabug:
    39273521] {CVE-2026-31588}
    - x86-64: rename misleadingly named '__copy_user_nocache()' function (Linus Torvalds) [Orabug: 39323162]     {CVE-2026-43073}
    - kernel: be more careful about dup_mmap() failures and uprobe registering (Liam R. Howlett)     {CVE-2025-21709}
    - gpiolib: fix race condition for gdev->srcu (Pawel Narewski) [Orabug: 38887677] {CVE-2026-22986}
    - KVM: SEV: Drop WARN on large size for KVM_MEMORY_ENCRYPT_REG_REGION (Sean Christopherson) [Orabug:
    39273529] {CVE-2026-31590}
    - KVM: SEV: Reject attempts to sync VMSA of an already-launched/encrypted vCPU (Sean Christopherson)     [Orabug: 39273553] {CVE-2026-31593}
    - ocfs2: handle invalid dinode in ocfs2_group_extend (Zhengyuan Huang) [Orabug: 39273569] {CVE-2026-31596}
    - ocfs2: fix use-after-free in ocfs2_fault() when VM_FAULT_RETRY (Tejas Bharambe) [Orabug: 39273578]     {CVE-2026-31597}
    - ocfs2: fix possible deadlock between unlink and dio_end_io_write (Joseph Qi) [Orabug: 39273586]     {CVE-2026-31598}
    - dcache: Limit the minimal number of bucket to two (Zhihao Cheng) [Orabug: 39323133] {CVE-2026-43071}
    - ALSA: ctxfi: Limit PTP to a single page (Harin Lee) [Orabug: 39273608] {CVE-2026-31602}
    - wifi: rtw88: fix device leak on probe failure (Johan Hovold) [Orabug: 39273620] {CVE-2026-31604}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 24.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-8499-1 advisory.

    It was discovered that the Linux kernel algif_aead module did not properly handle in-place cryptographic     operations. This flaw is known as Copy Fail. A local attacker could use this to escalate privileges, or     possibly escape a container. (CVE-2026-31431)

    It was discovered that the Linux kernel did not properly handle shared page fragments during socket buffer     operations, collectively known as Dirty Frag. A logic flaw existed in the XFRM ESP-in-TCP subsystem and in     the RxRPC networking subsystem when processing paged fragments. A local attacker could use this to     escalate privileges, or possibly escape a container. (CVE-2026-43284, CVE-2026-43500, CVE-2026-45998,     CVE-2026-46000)

    It was discovered that a logic flaw existed in the XFRM ESP-in-TCP subsystem in the Linux kernel when     handling socket buffer fragments. This flaw is known as Fragnesia. A local attacker could use this to     escalate privileges, or possibly escape a container. (CVE-2026-43503, CVE-2026-46300)

    Qualys discovered that a race condition existed in the ptrace subsystem of the Linux kernel when     privileged processes are exiting. An unprivileged local attacker could use this issue to expose sensitive     information. (CVE-2026-46333)

    Tristan Madani discovered that Ubuntu Linux kernel 6.8, 6.17 and 7.0 contain a memory leak when handling     AppArmor notifications. A local attacker could use this to cause resource exhaustion. (CVE-2026-47326)

    Tristan Madani discovered that Ubuntu Linux kernel 6.8, 6.17 and 7.0 contain a NULL pointer dereference     when handling AppArmor notifications. A local attacker could use this to cause a kernel oops.
    (CVE-2026-47327)

    Tristan Madani discovered that Ubuntu Linux kernel 6.8, 6.17 and 7.0 contained an invalid free when     handling AppArmor notifications. A local attacker could use this to corrupt kernel memory.
    (CVE-2026-47328)

    Tristan Madani discovered that Ubuntu Linux kernel 6.8, 6.17 and 7.0 contained insufficient validation of     AppArmor notification responses. A local attacker could use this to allow crafted responses to be     processed. (CVE-2026-47329)

    Tristan Madani discovered that Ubuntu Linux kernel 6.8, 6.17 and 7.0 used an uninitialized variable when     handling AppArmor notifications. A local attacker could use this to cause incorrect caching of data.
    (CVE-2026-47330)

    Tristan Madani discovered that Ubuntu Linux kernel 6.8 contained a use- after-free (UAF) bug. A local     attacker could use this to cause memory corruption and, theoretically, arbitrary code execution.
    (CVE-2026-47331)

    Tristan Madani discovered that Ubuntu Linux kernel 6.8, 6.17 and 7.0 contained an out-of-bounds (OOB) read     when handling AppArmor notifications. A local attacker could use this to cause information disclosure of     kernel memory. (CVE-2026-47332)

    Tristan Madani discovered that Ubuntu Linux kernel 6.8, 6.17 and 7.0 contained a out-of-bounds (OOB) read     when handling AppArmor notifications. A local attacker could use this to cause kernel memory corruption     and, theoretically, influence processing of AppArmor policies. (CVE-2026-47333)

    Tristan Madani discovered that Ubuntu Linux kernel 6.8, 6.17 and 7.0 contained incorrect holding of locks     when handling AppArmor notifications. A local attacker could use this to cause a kernel panic or deadlock.
    (CVE-2026-47334)

    Tristan Madani discovered that Ubuntu Linux kernel 6.8 contained a NULL pointer dereference when handling     AppArmor notifications. A local attacker could use this to cause a kernel panic. (CVE-2026-47335)

    Tristan Madani discovered that Ubuntu Linux kernel 6.8 used an uninitialized variable when handling     AppArmor AF_INET/AF_INET6 socket mediation. A local attacker could use this to influence processing of     fine- grained network socket mediation. (CVE-2026-47336)

    Tristan Madani and Trevor Lawrence have each independently discovered that Ubuntu Linux kernel 6.8, 6.17     and 7.0 contained a NULL pointer dereference when handling AppArmor network socket mediation. A local     attacker could use this to cause a kernel oops. (CVE-2026-47337)

    Several security issues were discovered in the Linux kernel. An attacker could possibly use these to     compromise the system. This update corrects flaws in the following subsystems:

    - Foo-over-UDP (FOU);

    - ARM64 architecture;

    - MIPS architecture;

    - PowerPC architecture;

    - x86 architecture;

    - Block layer subsystem;

    - Cryptographic API;

    - Intel NPU Driver;

    - ACPI drivers;

    - ATM drivers;

    - Drivers core;

    - Null block device driver;

    - RNBD block device driver;

    - Ublk userspace block driver;

    - Bluetooth drivers;

    - Bus devices;

    - Character device driver;

    - TPM device driver;

    - Clock framework and drivers;

    - Clocksource drivers;

    - Counter interface drivers;

    - CPU idle management framework;

    - Hardware crypto device drivers;

    - DMA engine subsystem;

    - DPLL subsystem;

    - EFI core;

    - GPIO subsystem;

    - GPU drivers;

    - HID subsystem;

    - Hardware monitoring drivers;

    - Intel Trace Hub HW tracing drivers;

    - IIO subsystem;

    - IIO ADC drivers;

    - InfiniBand drivers;

    - On-Chip Interconnect management framework;

    - IOMMU subsystem;

    - IRQ chip drivers;

    - Modular ISDN driver;

    - LED subsystem;

    - Multiple devices driver;

    - Media drivers;

    - Multifunction device drivers;

    - Broadcom VK accelerator driver;

    - UACCE accelerator framework;

    - MMC subsystem;

    - MOST (Media Oriented Systems Transport) drivers;

    - MTD block device drivers;

    - Ethernet bonding driver;

    - Network drivers;

    - Mellanox network drivers;

    - STMicroelectronics network drivers;

    - NTB driver;

    - NVME drivers;

    - PCI subsystem;

    - Performance monitor drivers;

    - PHY drivers;

    - Pin controllers subsystem;

    - x86 platform drivers;

    - i.MX PM domains;

    - Power supply drivers;

    - RapidIO drivers;

    - RAS (Reliability, Availability, Serviceability) subsystem;

    - Remote Processor subsystem;

    - RPMSG subsystem;

    - S/390 drivers;

    - SCSI subsystem;

    - SLIMbus drivers;

    - MediaTek SoC drivers;

    - Texas Instruments SoC drivers;

    - SPI subsystem;

    - Greybus lights staging drivers;

    - Realtek RTL8723BS SDIO drivers;

    - TCM subsystem;

    - UFS subsystem;

    - ChipIdea USB driver;

    - DesignWare USB3 driver;

    - USB over IP driver;

    - vDPA drivers;

    - Virtio Host (VHOST) subsystem;

    - Framebuffer layer;

    - W1 Dallas's 1-wire bus driver;

    - Xen hypervisor drivers;

    - BTRFS file system;

    - File systems infrastructure;

    - Ceph distributed file system;

    - EFI Variable file system;

    - exFAT file system;

    - Ext4 file system;

    - F2FS file system;

    - FAT file system;

    - GFS2 file system;

    - HFS+ file system;

    - JFS file system;

    - Network file system (NFS) client;

    - Network file system (NFS) server daemon;

    - NILFS2 file system;

    - NTFS3 file system;

    - OCFS2 file system;

    - Proc file system;

    - Pstore file system;

    - Diskquota system;

    - SMB network file system;

    - XFS file system;

    - Audit subsystem;

    - Memory Management;

    - Scheduler infrastructure;

    - IPv6 networking;

    - Netfilter;

    - NFC subsystem;

    - Tracing infrastructure;

    - io_uring subsystem;

    - BPF subsystem;

    - Perf events;

    - Kernel kexec() syscall;

    - RCU subsystem;

    - Floating proportions library;

    - Scatterlist API;

    - Memory management;

    - 9P file system network protocol;

    - Asynchronous Transfer Mode (ATM) subsystem;

    - B.A.T.M.A.N. meshing protocol;

    - Bluetooth subsystem;

    - Ethernet bridge;

    - CAN network layer;

    - Ceph Core library;

    - Networking core;

    - IPv4 networking;

    - KCM (Kernel Connection Multiplexor) sockets driver;

    - L2TP protocol;

    - MAC80211 subsystem;

    - Multipath TCP;

    - NET/ROM layer;

    - Packet sockets;

    - RDS protocol;

    - RxRPC session sockets;

    - Network traffic control;

    - SCTP protocol;

    - SMC sockets;

    - Sun RPC protocol;

    - TLS protocol;

    - Unix domain sockets;

    - VMware vSockets driver;

    - Wireless networking;

    - X.25 network layer;

    - XFRM subsystem;

    - AppArmor security module;

    - Simplified Mandatory Access Control Kernel framework;

    - ALSA AC97 driver;

    - Generic PCM loopback sound driver;

    - Creative Sound Blaster X-Fi driver;

    - AMD SoC Alsa drivers;

    - Texas InstrumentS Audio (ASoC/HDA) drivers;

    - SOF drivers;

    - USB sound devices;

    - KVM subsystem; (CVE-2024-50004, CVE-2024-58096, CVE-2024-58097, CVE-2025-37926, CVE-2025-38201,     CVE-2025-38591, CVE-2025-40005, CVE-2025-40039, CVE-2025-40082, CVE-2025-40149, CVE-2025-68351,     CVE-2025-68358, CVE-2025-68365, CVE-2025-68725, CVE-2025-68749, CVE-2025-68803, CVE-2025-68823,     CVE-2025-71160, CVE-2025-71162, CVE-2025-71163, CVE-2025-71180, CVE-2025-71182, CVE-2025-71183,     CVE-2025-71184, CVE-2025-71185, CVE-2025-71186, CVE-2025-71188, CVE-2025-71189, CVE-2025-71190,     CVE-2025-71191, CVE-2025-71192, CVE-2025-71193, CVE-2025-71194, CVE-2025-71195, CVE-2025-71196,     CVE-2025-71197, CVE-2025-71198, CVE-2025-71199, CVE-2025-71200, CVE-2025-71220, CVE-2025-71222,     CVE-2025-71224, CVE-2025-71225, CVE-2025-71229, CVE-2025-71231, CVE-2025-71232, CVE-2025-71233,     CVE-2025-71235, CVE-2025-71236, CVE-2025-71237, CVE-2025-71238, CVE-2025-71239, CVE-2025-71265,     CVE-2025-71266, CVE-2025-71267, CVE-2025-71268, CVE-2025-71272, CVE-2025-71273, CVE-2025-71274,     CVE-2025-71286, CVE-2025-71291, CVE-2025-71292, CVE-2025-71294, CVE-2025-71295, CVE-2025-71297,     CVE-2025-71304, CVE-2025-71305, CVE-2026-22976, CVE-2026-22977, CVE-2026-22978, CVE-2026-22979,     CVE-2026-22980, CVE-2026-22982, CVE-2026-22984, CVE-2026-22990, CVE-2026-22991, CVE-2026-22992,     CVE-2026-22994, CVE-2026-22996, CVE-2026-22997, CVE-2026-22998, CVE-2026-22999, CVE-2026-23000,     CVE-2026-23001, CVE-2026-23003, CVE-2026-23005, CVE-2026-23006, CVE-2026-23010, CVE-2026-23011,     CVE-2026-23019, CVE-2026-23020, CVE-2026-23021, CVE-2026-23025, CVE-2026-23026, CVE-2026-23030,     CVE-2026-23031, CVE-2026-23032, CVE-2026-23033, CVE-2026-23035, CVE-2026-23037, CVE-2026-23038,     CVE-2026-23047, CVE-2026-23049, CVE-2026-23050, CVE-2026-23053, CVE-2026-23054, CVE-2026-23056,     CVE-2026-23057, CVE-2026-23058, CVE-2026-23059, CVE-2026-23061, CVE-2026-23062, CVE-2026-23063,     CVE-2026-23064, CVE-2026-23065, CVE-2026-23068, CVE-2026-23069, CVE-2026-23071, CVE-2026-23073,     CVE-2026-23075, CVE-2026-23076, CVE-2026-23078, CVE-2026-23080, CVE-2026-23083, CVE-2026-23084,     CVE-2026-23085, CVE-2026-23086, CVE-2026-23087, CVE-2026-23088, CVE-2026-23089, CVE-2026-23090,     CVE-2026-23091, CVE-2026-23093, CVE-2026-23094, CVE-2026-23095, CVE-2026-23096, CVE-2026-23097,     CVE-2026-23098, CVE-2026-23099, CVE-2026-23100, CVE-2026-23101, CVE-2026-23102, CVE-2026-23103,     CVE-2026-23105, CVE-2026-23107, CVE-2026-23108, CVE-2026-23110, CVE-2026-23113, CVE-2026-23116,     CVE-2026-23119, CVE-2026-23120, CVE-2026-23121, CVE-2026-23123, CVE-2026-23124, CVE-2026-23125,     CVE-2026-23126, CVE-2026-23128, CVE-2026-23129, CVE-2026-23131, CVE-2026-23133, CVE-2026-23135,     CVE-2026-23136, CVE-2026-23139, CVE-2026-23140, CVE-2026-23141, CVE-2026-23142, CVE-2026-23144,     CVE-2026-23145, CVE-2026-23146, CVE-2026-23148, CVE-2026-23150, CVE-2026-23151, CVE-2026-23156,     CVE-2026-23159, CVE-2026-23160, CVE-2026-23163, CVE-2026-23164, CVE-2026-23166, CVE-2026-23167,     CVE-2026-23168, CVE-2026-23169, CVE-2026-23170, CVE-2026-23172, CVE-2026-23173, CVE-2026-23176,     CVE-2026-23178, CVE-2026-23179, CVE-2026-23180, CVE-2026-23182, CVE-2026-23187, CVE-2026-23190,     CVE-2026-23191, CVE-2026-23193, CVE-2026-23198, CVE-2026-23200, CVE-2026-23202, CVE-2026-23204,     CVE-2026-23205, CVE-2026-23206, CVE-2026-23212, CVE-2026-23213, CVE-2026-23214, CVE-2026-23215,     CVE-2026-23216, CVE-2026-23220, CVE-2026-23221, CVE-2026-23222, CVE-2026-23228, CVE-2026-23229,     CVE-2026-23230, CVE-2026-23233, CVE-2026-23234, CVE-2026-23235, CVE-2026-23236, CVE-2026-23237,     CVE-2026-23238, CVE-2026-23241, CVE-2026-23242, CVE-2026-23243, CVE-2026-23249, CVE-2026-23254,     CVE-2026-23256, CVE-2026-23257, CVE-2026-23258, CVE-2026-23260, CVE-2026-23261, CVE-2026-23262,     CVE-2026-23264, CVE-2026-23266, CVE-2026-23267, CVE-2026-23272, CVE-2026-23274, CVE-2026-23278,     CVE-2026-23351, CVE-2026-23392, CVE-2026-23394, CVE-2026-23428, CVE-2026-23450, CVE-2026-23455,     CVE-2026-31402, CVE-2026-31411, CVE-2026-31418, CVE-2026-31419, CVE-2026-31436, CVE-2026-31448,     CVE-2026-31478, CVE-2026-31504, CVE-2026-31533, CVE-2026-31607, CVE-2026-31637, CVE-2026-31649,     CVE-2026-31657, CVE-2026-31659, CVE-2026-31668, CVE-2026-31669, CVE-2026-31676, CVE-2026-31682,     CVE-2026-31685, CVE-2026-31687, CVE-2026-31693, CVE-2026-43011, CVE-2026-43033, CVE-2026-43037,     CVE-2026-43038, CVE-2026-43071, CVE-2026-43077, CVE-2026-43078, CVE-2026-43114, CVE-2026-43117,     CVE-2026-43123, CVE-2026-43124, CVE-2026-43128, CVE-2026-43130, CVE-2026-43132, CVE-2026-43133,     CVE-2026-43134, CVE-2026-43135, CVE-2026-43136, CVE-2026-43137, CVE-2026-43139, CVE-2026-43140,     CVE-2026-43141, CVE-2026-43143, CVE-2026-43145, CVE-2026-43147, CVE-2026-43148, CVE-2026-43149,     CVE-2026-43150, CVE-2026-43152, CVE-2026-43153, CVE-2026-43156, CVE-2026-43157, CVE-2026-43158,     CVE-2026-43159, CVE-2026-43163, CVE-2026-43167, CVE-2026-43168, CVE-2026-43169, CVE-2026-43170,     CVE-2026-43171, CVE-2026-43173, CVE-2026-43175, CVE-2026-43180, CVE-2026-43182, CVE-2026-43183,     CVE-2026-43184, CVE-2026-43186, CVE-2026-43187, CVE-2026-43189, CVE-2026-43190, CVE-2026-43194,     CVE-2026-43196, CVE-2026-43199, CVE-2026-43200, CVE-2026-43201, CVE-2026-43202, CVE-2026-43203,     CVE-2026-43205, CVE-2026-43206, CVE-2026-43207, CVE-2026-43209, CVE-2026-43211, CVE-2026-43212,     CVE-2026-43214, CVE-2026-43215, CVE-2026-43218, CVE-2026-43221, CVE-2026-43222, CVE-2026-43223,     CVE-2026-43225, CVE-2026-43226, CVE-2026-43227, CVE-2026-43230, CVE-2026-43231, CVE-2026-43232,     CVE-2026-43233, CVE-2026-43236, CVE-2026-43238, CVE-2026-43239, CVE-2026-43241, CVE-2026-43242,     CVE-2026-43244, CVE-2026-43246, CVE-2026-43248, CVE-2026-43249, CVE-2026-43250, CVE-2026-43251,     CVE-2026-43253, CVE-2026-43255, CVE-2026-43256, CVE-2026-43257, CVE-2026-43258, CVE-2026-43261,     CVE-2026-43262, CVE-2026-43264, CVE-2026-43266, CVE-2026-43268, CVE-2026-43269, CVE-2026-43270,     CVE-2026-43271, CVE-2026-43273, CVE-2026-43275, CVE-2026-43277, CVE-2026-43278, CVE-2026-43279,     CVE-2026-43283, CVE-2026-43287, CVE-2026-43288, CVE-2026-43289, CVE-2026-43291, CVE-2026-43295,     CVE-2026-43296, CVE-2026-43297, CVE-2026-43300, CVE-2026-43302, CVE-2026-43304, CVE-2026-43312,     CVE-2026-43313, CVE-2026-43314, CVE-2026-43315, CVE-2026-43316, CVE-2026-43317, CVE-2026-43318,     CVE-2026-43319, CVE-2026-43320, CVE-2026-43341, CVE-2026-43378, CVE-2026-43383, CVE-2026-43384,     CVE-2026-43406, CVE-2026-43407, CVE-2026-43414, CVE-2026-43493, CVE-2026-43494, CVE-2026-43501,     CVE-2026-45847, CVE-2026-45848, CVE-2026-45849, CVE-2026-45851, CVE-2026-45852, CVE-2026-45856,     CVE-2026-45857, CVE-2026-45859, CVE-2026-45860, CVE-2026-45861, CVE-2026-45862, CVE-2026-45864,     CVE-2026-45865, CVE-2026-45866, CVE-2026-45867, CVE-2026-45868, CVE-2026-45869, CVE-2026-45870,     CVE-2026-45871, CVE-2026-45872, CVE-2026-45873, CVE-2026-45875, CVE-2026-45877, CVE-2026-45878,     CVE-2026-45879, CVE-2026-45880, CVE-2026-45881, CVE-2026-45882, CVE-2026-45883, CVE-2026-45884,     CVE-2026-45885, CVE-2026-45886, CVE-2026-45890, CVE-2026-45891, CVE-2026-45893, CVE-2026-45895,     CVE-2026-45902, CVE-2026-45904, CVE-2026-45905, CVE-2026-45910, CVE-2026-45912, CVE-2026-45913,     CVE-2026-45914, CVE-2026-45915, CVE-2026-45916, CVE-2026-45917, CVE-2026-45919, CVE-2026-45921,     CVE-2026-45923, CVE-2026-45928, CVE-2026-45935, CVE-2026-45936, CVE-2026-45938, CVE-2026-45941,     CVE-2026-45946, CVE-2026-45947, CVE-2026-45948, CVE-2026-45954, CVE-2026-45957, CVE-2026-45960,     CVE-2026-45962, CVE-2026-45964, CVE-2026-45965, CVE-2026-45968, CVE-2026-45969, CVE-2026-45970,     CVE-2026-45973, CVE-2026-45974, CVE-2026-45976, CVE-2026-45978, CVE-2026-45981, CVE-2026-45982,     CVE-2026-45983, CVE-2026-45984, CVE-2026-45988, CVE-2026-46028, CVE-2026-46043, CVE-2026-46115,     CVE-2026-46119, CVE-2026-46135, CVE-2026-46185, CVE-2026-46195, CVE-2026-46243, CVE-2026-46244,     CVE-2026-46246, CVE-2026-46247, CVE-2026-46249, CVE-2026-46250, CVE-2026-46251, CVE-2026-46253,     CVE-2026-46254, CVE-2026-46255, CVE-2026-46259, CVE-2026-46261, CVE-2026-46265, CVE-2026-46266,     CVE-2026-46267, CVE-2026-46270, CVE-2026-46289, CVE-2026-46323, CVE-2026-46328)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    crypto: algif_aead - Revert to operating out-of-place(CVE-2026-31431)

    bpf: Fix undefined behavior in interpreter sdiv/smod for INT_MIN(CVE-2026-31525)

    can: bcm: fix locking for bcm_op runtime updates(CVE-2026-23362)

    media: mediatek: vcodec: Use spinlock for context list protection lock(CVE-2025-71140)

    smb: client: Don#39;t log plaintext credentials in cifs_set_cifscreds(CVE-2026-23303)

    media: mc, v4l2: serialize REINIT and REQBUFS with req_queue_mutex(CVE-2026-31473)

    regmap: maple: free entry on mas_store_gfp() failure(CVE-2026-23260)

    ACPI: EC: clean up handlers on probe failure in acpi_ec_setup()(CVE-2026-31426)

    apparmor: replace recursive profile removal with iterative approach(CVE-2026-23404)

    tls: Fix race condition in tls_sw_cancel_work_tx()(CVE-2026-23240)

    macvlan: observe an RCU grace period in macvlan_common_newlink() error path(CVE-2026-23273)

    i40e: Fix preempt count leak in napi poll tracepoint(CVE-2026-23313)

    PM: runtime: Fix a race condition related to device removal(CVE-2026-23452)

    net: bridge: fix nd_tbl NULL dereference when IPv6 is disabled(CVE-2026-23381)

    p data-testid='vuln-description'Rejected reason: This CVE ID has been rejected or withdrawn by its     CVE Numbering Authority./pbr/(CVE-2026-23473)

    net: phy: register phy led_triggers during probe to avoid AB-BA deadlock(CVE-2026-23368)

    net: add proper RCU protection to /proc/net/ptype(CVE-2026-23255)

    ice: Fix memory leak in ice_set_ringparam()(CVE-2026-23389)

    ipv6: add NULL checks for idev in SRv6 paths(CVE-2026-23442)

    tracing: Fix potential deadlock in cpu hotplug with osnoise(CVE-2026-31480)

    ice: change XDP RxQ frag_size from DMA write length to xdp.frame_sz(CVE-2026-23377)

    tls: Purge async_hold in tls_decrypt_async_wait()(CVE-2026-23414)

    icmp: fix NULL pointer dereference in icmp_tag_validation()(CVE-2026-23398)

    apparmor: fix memory leak in verify_header(CVE-2026-23403)

    x86/efi: defer freeing of boot services memory(CVE-2026-23352)

    netfilter: nf_tables: always walk all pending catchall elements(CVE-2026-23278)

    nvme: fix admin queue leak on controller reset(CVE-2026-23360)

    media: dvb-net: fix OOB access in ULE extension header tables(CVE-2026-31405)

    netfilter: xt_IDLETIMER: reject rev0 reuse of ALARM timer labels(CVE-2026-23274)

    net: vxlan: fix nd_tbl NULL dereference when IPv6 is disabled(CVE-2026-23293)

    media: dvb-core: fix wrong reinitialization of ringbuffer on reopen(CVE-2026-23253)

    nvme-fc: release admin tagset if init fails(CVE-2026-23261)

    tcp: secure_seq: add back ports to TS offset(CVE-2026-23247)

    KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE(CVE-2026-23401)

    netfilter: bpf: defer hook memory release until rcu readers are done(CVE-2026-23412)

    apparmor: fix missing bounds check on DEFAULT table in verify_dfa()(CVE-2026-23407)

    ipv6: fix NULL pointer deref in ip6_rt_get_dev_rcu()(CVE-2026-23304)

    ext4: fix iloc.bh leak in ext4_xattr_inode_update_ref(CVE-2026-23145)

    net: gro: fix outer network offset(CVE-2026-23254)

    netfilter: nf_tables: release flowtable after rcu grace period on error(CVE-2026-23392)

    perf: Fix __perf_event_overflow() vs perf_remove_from_context() race(CVE-2026-23271)

    sunrpc: fix cache_request leak in cache_release(CVE-2026-31400)

    RDMA/umad: Reject negative data_len in ib_umad_write(CVE-2026-23243)

    af_unix: Give up GC if MSG_PEEK intervened.(CVE-2026-23394)

    clsact: Fix use-after-free in init/destroy rollback asymmetry(CVE-2026-23413)

    net: ipv6: fix panic when IPv4 route references loopback IPv6 nexthop(CVE-2026-23300)

    apparmor: fix unprivileged local user can do privileged policy management(CVE-2026-23268)

    blktrace: fix __this_cpu_read/write in preemptible context(CVE-2026-23374)

    arm64: io: Extract user memory type in ioremap_prot()(CVE-2026-23346)

    xdp: produce a warning when calculated tailroom is negative(CVE-2026-23343)

    mm: thp: deny THP for files on anonymous inodes(CVE-2026-23375)

    drm/vmwgfx: Return the correct value in vmw_translate_ptr functions(CVE-2026-23317)

    netfilter: nft_set_pipapo: split gc into unlink and reclaim phase(CVE-2026-23351)

    Squashfs: check metadata block offset is within range(CVE-2026-23388)

    net: add xmit recursion limit to tunnel xmit functions(CVE-2026-23276)

    net: sched: avoid qdisc_reset_all_tx_gt() vs dequeue race for lockless qdiscs(CVE-2026-23340)

    scsi: target: Fix recursive locking in __configfs_open_file()(CVE-2026-23292)

    netfilter: nf_tables: unconditionally bump set-gt;nelems before insertion(CVE-2026-23272)

    apparmor: fix differential encoding verification(CVE-2026-23409)

    dmaengine: idxd: Fix leaking event log memory(CVE-2026-31440)

    bpf/bonding: reject vlan+srcmac xmit_hash_policy change when XDP is loaded(CVE-2026-23310)

    apparmor: fix: limit the number of levels of policy namespaces(CVE-2026-23405)

    net: annotate data-races around sk-gt;sk_{data_ready,write_space}(CVE-2026-23302)

    nfnetlink_osf: validate individual option lengths in fingerprints(CVE-2026-23397)

    erofs: add GFP_NOIO in the bio completion if needed(CVE-2026-31467)

    nvme: fix memory allocation in nvme_pr_read_keys()(CVE-2026-23244)

    arm64: Set __nocfi on swsusp_arch_resume()(CVE-2026-23128)

    nf_tables: nft_dynset: fix possible stateful expression memleak in error path(CVE-2026-23399)

    apparmor: fix side-effect bug in match_char() macro usage(CVE-2026-23406)

    NFSD: Defer sub-object cleanup in export put callbacks(CVE-2026-31404)

    audit: add fchmodat2() to change attributes class(CVE-2025-71239)

    netfilter: xt_CT: drop pending enqueued packets on template removal(CVE-2026-23391)

    bpf: Fix a UAF issue in bpf_trampoline_link_cgroup_shim(CVE-2026-23319)

    apparmor: validate DFA start states are in bounds in unpack_pdb(CVE-2026-23269)

    bpf: Fix stack-out-of-bounds write in devmap(CVE-2026-23359)

    spi: fix use-after-free on controller registration failure(CVE-2026-31389)

    apparmor: Fix double free of ns_name in aa_replace_profiles()(CVE-2026-23408)

    spi: fix statistics allocation(CVE-2026-23475)

    smb: client: fix krb5 mount with username option(CVE-2026-31392)

    NFSD: Hold net reference for the lifetime of /proc/fs/nfs/exports fd(CVE-2026-31403)

    apparmor: fix race between freeing data and fs accessing it(CVE-2026-23411)

    apparmor: fix race on rawdata dereference(CVE-2026-23410)

    sched/deadline: Fix missing ENQUEUE_REPLENISH during PI de-boosting(CVE-2026-23371)

    dmaengine: idxd: Fix memory leak when a wq is reset(CVE-2026-31441)

Tenable has extracted the preceding description block directly from the EulerOS kernel security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 22.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-8440-1 advisory.

    Josh Eads, Kristoffer Janke, Eduardo Vela Nava, Tavis Ormandy, and Matteo Rizzo discovered that some AMD     Zen processors did not properly verify the signature of CPU microcode. This flaw is known as EntrySign. A     privileged attacker could possibly use this issue to cause load malicious CPU microcode causing loss of     integrity and confidentiality. (CVE-2024-36347)

    It was discovered that the Linux kernel algif_aead module did not properly handle in-place cryptographic     operations. This flaw is known as Copy Fail. A local attacker could use this to escalate privileges, or     possibly escape a container. (CVE-2026-31431)

    It was discovered that the Linux kernel did not properly handle shared page fragments during socket buffer     operations, collectively known as Dirty Frag. A logic flaw existed in the XFRM ESP-in-TCP subsystem and in     the RxRPC networking subsystem when processing paged fragments. A local attacker could use this to     escalate privileges, or possibly escape a container. (CVE-2026-43284, CVE-2026-43500, CVE-2026-45998,     CVE-2026-46000)

    It was discovered that a logic flaw existed in the XFRM ESP-in-TCP subsystem in the Linux kernel when     handling socket buffer fragments. This flaw is known as Fragnesia. A local attacker could use this to     escalate privileges, or possibly escape a container. (CVE-2026-43503, CVE-2026-46300)

    Qualys discovered that a race condition existed in the ptrace subsystem of the Linux kernel when     privileged processes are exiting. An unprivileged local attacker could use this issue to expose sensitive     information. (CVE-2026-46333)

    Tristan Madani discovered that Ubuntu Linux kernel 6.8, 6.17 and 7.0 contain a memory leak when handling     AppArmor notifications. A local attacker could use this to cause resource exhaustion. (CVE-2026-47326)

    Tristan Madani discovered that Ubuntu Linux kernel 6.8, 6.17 and 7.0 contain a NULL pointer dereference     when handling AppArmor notifications. A local attacker could use this to cause a kernel oops.
    (CVE-2026-47327)

    Tristan Madani discovered that Ubuntu Linux kernel 6.8, 6.17 and 7.0 contained an invalid free when     handling AppArmor notifications. A local attacker could use this to corrupt kernel memory.
    (CVE-2026-47328)

    Tristan Madani discovered that Ubuntu Linux kernel 6.8, 6.17 and 7.0 contained insufficient validation of     AppArmor notification responses. A local attacker could use this to allow crafted responses to be     processed. (CVE-2026-47329)

    Tristan Madani discovered that Ubuntu Linux kernel 6.8, 6.17 and 7.0 used an uninitialized variable when     handling AppArmor notifications. A local attacker could use this to cause incorrect caching of data.
    (CVE-2026-47330)

    Tristan Madani discovered that Ubuntu Linux kernel 6.8 contained a use- after-free (UAF) bug. A local     attacker could use this to cause memory corruption and, theoretically, arbitrary code execution.
    (CVE-2026-47331)

    Tristan Madani discovered that Ubuntu Linux kernel 6.8, 6.17 and 7.0 contained an out-of-bounds (OOB) read     when handling AppArmor notifications. A local attacker could use this to cause information disclosure of     kernel memory. (CVE-2026-47332)

    Tristan Madani discovered that Ubuntu Linux kernel 6.8, 6.17 and 7.0 contained a out-of-bounds (OOB) read     when handling AppArmor notifications. A local attacker could use this to cause kernel memory corruption     and, theoretically, influence processing of AppArmor policies. (CVE-2026-47333)

    Tristan Madani discovered that Ubuntu Linux kernel 6.8, 6.17 and 7.0 contained incorrect holding of locks     when handling AppArmor notifications. A local attacker could use this to cause a kernel panic or deadlock.
    (CVE-2026-47334)

    Tristan Madani discovered that Ubuntu Linux kernel 6.8 contained a NULL pointer dereference when handling     AppArmor notifications. A local attacker could use this to cause a kernel panic. (CVE-2026-47335)

    Tristan Madani discovered that Ubuntu Linux kernel 6.8 used an uninitialized variable when handling     AppArmor AF_INET/AF_INET6 socket mediation. A local attacker could use this to influence processing of     fine- grained network socket mediation. (CVE-2026-47336)

    Tristan Madani and Trevor Lawrence have each independently discovered that Ubuntu Linux kernel 6.8, 6.17     and 7.0 contained a NULL pointer dereference when handling AppArmor network socket mediation. A local     attacker could use this to cause a kernel oops. (CVE-2026-47337)

    Several security issues were discovered in the Linux kernel. An attacker could possibly use these to     compromise the system. This update corrects flaws in the following subsystems:

    - ARM64 architecture;

    - MIPS architecture;

    - PowerPC architecture;

    - x86 architecture;

    - Block layer subsystem;

    - Cryptographic API;

    - Compute Acceleration Framework;

    - ACPI drivers;

    - Drivers core;

    - Network block device driver;

    - Null block device driver;

    - Ublk userspace block driver;

    - Bluetooth drivers;

    - Character device driver;

    - TPM device driver;

    - Clock framework and drivers;

    - Data acquisition framework and drivers;

    - Counter interface drivers;

    - Hardware crypto device drivers;

    - DMA engine subsystem;

    - DPLL subsystem;

    - GPU drivers;

    - HID subsystem;

    - Hardware monitoring drivers;

    - Intel Trace Hub HW tracing drivers;

    - IIO ADC drivers;

    - IIO subsystem;

    - InfiniBand drivers;

    - Input Device core drivers;

    - On-Chip Interconnect management framework;

    - IOMMU subsystem;

    - IRQ chip drivers;

    - Modular ISDN driver;

    - LED subsystem;

    - Macintosh device drivers;

    - Multiple devices driver;

    - Media drivers;

    - UACCE accelerator framework;

    - MMC subsystem;

    - Ethernet bonding driver;

    - Network drivers;

    - Mellanox network drivers;

    - STMicroelectronics network drivers;

    - Ethernet team driver;

    - MediaTek network drivers;

    - NVME drivers;

    - PA-RISC drivers;

    - PHY drivers;

    - Chrome hardware platform drivers;

    - x86 platform drivers;

    - i.MX PM domains;

    - Voltage and Current Regulator drivers;

    - SCSI subsystem;

    - SLIMbus drivers;

    - SPI subsystem;

    - Media Oriented Systems Transport (MOST) driver;

    - Realtek RTL8723BS SDIO drivers;

    - TCM subsystem;

    - USB Host Controller drivers;

    - USB Type-C Connector System Software Interface driver;

    - Backlight driver;

    - W1 Dallas's 1-wire bus driver;

    - Watchdog drivers;

    - Xen hypervisor drivers;

    - BFS file system;

    - BTRFS file system;

    - EFI Variable file system;

    - exFAT file system;

    - Ext4 file system;

    - F2FS file system;

    - FUSE (File system in Userspace);

    - HFS+ file system;

    - File systems infrastructure;

    - Journaling layer for block devices (JBD2);

    - Network file system (NFS) client;

    - Network file system (NFS) server daemon;

    - File system notification infrastructure;

    - NTFS3 file system;

    - OCFS2 file system;

    - SMB network file system;

    - BPF subsystem;

    - Ethernet bridge;

    - Scheduler infrastructure;

    - Netfilter;

    - NFC subsystem;

    - Tracing infrastructure;

    - io_uring subsystem;

    - Perf events;

    - Locking primitives;

    - Shadow Call Stack mechanism;

    - Floating proportions library;

    - Memory management;

    - Bluetooth subsystem;

    - CAIF protocol;

    - CAN network layer;

    - Ceph Core library;

    - Networking core;

    - Ethtool driver;

    - Handshake API;

    - HSR network protocol;

    - IPv4 networking;

    - IPv6 networking;

    - L2TP protocol;

    - MAC80211 subsystem;

    - Multipath TCP;

    - NET/ROM layer;

    - Open vSwitch;

    - Packet sockets;

    - RDS protocol;

    - Rose network layer;

    - RxRPC session sockets;

    - Network traffic control;

    - SCTP protocol;

    - Network sockets;

    - Sun RPC protocol;

    - TLS protocol;

    - Unix domain sockets;

    - VMware vSockets driver;

    - Wireless networking;

    - Integrity Measurement Architecture(IMA) framework;

    - Key management;

    - Simplified Mandatory Access Control Kernel framework;

    - ALSA AC97 driver;

    - Generic PCM loopback sound driver;

    - FireWire sound drivers;

    - HD-audio driver;

    - Turtle Beach Wavefront ALSA driver;

    - Creative Sound Blaster X-Fi driver;

    - AMD SoC Alsa drivers;

    - Texas InstrumentS Audio (ASoC/HDA) drivers;

    - STMicroelectronics SoC drivers;

    - USB sound devices;

    - KVM subsystem; (CVE-2024-50004, CVE-2024-57795, CVE-2024-58096, CVE-2024-58097, CVE-2025-22022,     CVE-2025-22111, CVE-2025-37926, CVE-2025-38022, CVE-2025-38201, CVE-2025-38234, CVE-2025-38591,     CVE-2025-40039, CVE-2025-40082, CVE-2025-40149, CVE-2025-40164, CVE-2025-40325, CVE-2025-68206,     CVE-2025-68254, CVE-2025-68255, CVE-2025-68256, CVE-2025-68257, CVE-2025-68258, CVE-2025-68259,     CVE-2025-68261, CVE-2025-68263, CVE-2025-68264, CVE-2025-68265, CVE-2025-68266, CVE-2025-68291,     CVE-2025-68325, CVE-2025-68332, CVE-2025-68335, CVE-2025-68336, CVE-2025-68337, CVE-2025-68344,     CVE-2025-68345, CVE-2025-68346, CVE-2025-68347, CVE-2025-68349, CVE-2025-68351, CVE-2025-68354,     CVE-2025-68358, CVE-2025-68362, CVE-2025-68363, CVE-2025-68364, CVE-2025-68365, CVE-2025-68366,     CVE-2025-68367, CVE-2025-68369, CVE-2025-68371, CVE-2025-68372, CVE-2025-68374, CVE-2025-68378,     CVE-2025-68379, CVE-2025-68380, CVE-2025-68724, CVE-2025-68725, CVE-2025-68727, CVE-2025-68728,     CVE-2025-68732, CVE-2025-68733, CVE-2025-68740, CVE-2025-68741, CVE-2025-68742, CVE-2025-68744,     CVE-2025-68746, CVE-2025-68749, CVE-2025-68753, CVE-2025-68755, CVE-2025-68756, CVE-2025-68757,     CVE-2025-68758, CVE-2025-68759, CVE-2025-68763, CVE-2025-68764, CVE-2025-68765, CVE-2025-68766,     CVE-2025-68767, CVE-2025-68769, CVE-2025-68770, CVE-2025-68771, CVE-2025-68772, CVE-2025-68773,     CVE-2025-68774, CVE-2025-68775, CVE-2025-68776, CVE-2025-68777, CVE-2025-68778, CVE-2025-68780,     CVE-2025-68782, CVE-2025-68783, CVE-2025-68785, CVE-2025-68786, CVE-2025-68787, CVE-2025-68788,     CVE-2025-68794, CVE-2025-68795, CVE-2025-68796, CVE-2025-68797, CVE-2025-68798, CVE-2025-68799,     CVE-2025-68800, CVE-2025-68801, CVE-2025-68803, CVE-2025-68804, CVE-2025-68806, CVE-2025-68808,     CVE-2025-68809, CVE-2025-68810, CVE-2025-68811, CVE-2025-68813, CVE-2025-68814, CVE-2025-68815,     CVE-2025-68816, CVE-2025-68817, CVE-2025-68818, CVE-2025-68819, CVE-2025-68820, CVE-2025-68821,     CVE-2025-68823, CVE-2025-71064, CVE-2025-71065, CVE-2025-71066, CVE-2025-71067, CVE-2025-71068,     CVE-2025-71069, CVE-2025-71071, CVE-2025-71072, CVE-2025-71075, CVE-2025-71077, CVE-2025-71078,     CVE-2025-71079, CVE-2025-71081, CVE-2025-71082, CVE-2025-71083, CVE-2025-71084, CVE-2025-71085,     CVE-2025-71086, CVE-2025-71087, CVE-2025-71088, CVE-2025-71089, CVE-2025-71091, CVE-2025-71093,     CVE-2025-71094, CVE-2025-71095, CVE-2025-71096, CVE-2025-71097, CVE-2025-71098, CVE-2025-71101,     CVE-2025-71102, CVE-2025-71104, CVE-2025-71105, CVE-2025-71107, CVE-2025-71108, CVE-2025-71109,     CVE-2025-71111, CVE-2025-71112, CVE-2025-71113, CVE-2025-71114, CVE-2025-71116, CVE-2025-71118,     CVE-2025-71119, CVE-2025-71120, CVE-2025-71121, CVE-2025-71122, CVE-2025-71123, CVE-2025-71125,     CVE-2025-71126, CVE-2025-71127, CVE-2025-71130, CVE-2025-71131, CVE-2025-71132, CVE-2025-71133,     CVE-2025-71135, CVE-2025-71136, CVE-2025-71137, CVE-2025-71138, CVE-2025-71140, CVE-2025-71141,     CVE-2025-71143, CVE-2025-71144, CVE-2025-71147, CVE-2025-71148, CVE-2025-71150, CVE-2025-71151,     CVE-2025-71153, CVE-2025-71154, CVE-2025-71160, CVE-2025-71162, CVE-2025-71163, CVE-2025-71180,     CVE-2025-71182, CVE-2025-71183, CVE-2025-71184, CVE-2025-71185, CVE-2025-71186, CVE-2025-71188,     CVE-2025-71189, CVE-2025-71190, CVE-2025-71191, CVE-2025-71192, CVE-2025-71193, CVE-2025-71194,     CVE-2025-71195, CVE-2025-71196, CVE-2025-71197, CVE-2025-71198, CVE-2025-71199, CVE-2025-71200,     CVE-2025-71220, CVE-2025-71222, CVE-2025-71224, CVE-2025-71225, CVE-2025-71268, CVE-2026-22976,     CVE-2026-22977, CVE-2026-22978, CVE-2026-22979, CVE-2026-22980, CVE-2026-22982, CVE-2026-22984,     CVE-2026-22990, CVE-2026-22991, CVE-2026-22992, CVE-2026-22994, CVE-2026-22996, CVE-2026-22997,     CVE-2026-22998, CVE-2026-22999, CVE-2026-23000, CVE-2026-23001, CVE-2026-23003, CVE-2026-23005,     CVE-2026-23006, CVE-2026-23010, CVE-2026-23011, CVE-2026-23019, CVE-2026-23020, CVE-2026-23021,     CVE-2026-23025, CVE-2026-23026, CVE-2026-23030, CVE-2026-23031, CVE-2026-23032, CVE-2026-23033,     CVE-2026-23035, CVE-2026-23037, CVE-2026-23038, CVE-2026-23047, CVE-2026-23049, CVE-2026-23050,     CVE-2026-23053, CVE-2026-23054, CVE-2026-23056, CVE-2026-23057, CVE-2026-23058, CVE-2026-23059,     CVE-2026-23061, CVE-2026-23062, CVE-2026-23063, CVE-2026-23064, CVE-2026-23065, CVE-2026-23068,     CVE-2026-23069, CVE-2026-23071, CVE-2026-23073, CVE-2026-23075, CVE-2026-23076, CVE-2026-23078,     CVE-2026-23080, CVE-2026-23083, CVE-2026-23084, CVE-2026-23085, CVE-2026-23086, CVE-2026-23087,     CVE-2026-23088, CVE-2026-23089, CVE-2026-23090, CVE-2026-23091, CVE-2026-23093, CVE-2026-23094,     CVE-2026-23095, CVE-2026-23096, CVE-2026-23097, CVE-2026-23098, CVE-2026-23099, CVE-2026-23101,     CVE-2026-23102, CVE-2026-23103, CVE-2026-23105, CVE-2026-23107, CVE-2026-23108, CVE-2026-23110,     CVE-2026-23112, CVE-2026-23113, CVE-2026-23116, CVE-2026-23119, CVE-2026-23120, CVE-2026-23121,     CVE-2026-23123, CVE-2026-23124, CVE-2026-23125, CVE-2026-23126, CVE-2026-23128, CVE-2026-23129,     CVE-2026-23131, CVE-2026-23133, CVE-2026-23135, CVE-2026-23136, CVE-2026-23139, CVE-2026-23140,     CVE-2026-23141, CVE-2026-23142, CVE-2026-23144, CVE-2026-23145, CVE-2026-23146, CVE-2026-23148,     CVE-2026-23150, CVE-2026-23151, CVE-2026-23156, CVE-2026-23159, CVE-2026-23160, CVE-2026-23163,     CVE-2026-23164, CVE-2026-23166, CVE-2026-23167, CVE-2026-23168, CVE-2026-23170, CVE-2026-23172,     CVE-2026-23173, CVE-2026-23176, CVE-2026-23178, CVE-2026-23179, CVE-2026-23180, CVE-2026-23182,     CVE-2026-23187, CVE-2026-23190, CVE-2026-23191, CVE-2026-23193, CVE-2026-23198, CVE-2026-23204,     CVE-2026-23205, CVE-2026-23206, CVE-2026-23209, CVE-2026-23212, CVE-2026-23213, CVE-2026-23214,     CVE-2026-23215, CVE-2026-23216, CVE-2026-23231, CVE-2026-23254, CVE-2026-23256, CVE-2026-23257,     CVE-2026-23258, CVE-2026-23260, CVE-2026-23261, CVE-2026-23262, CVE-2026-23264, CVE-2026-23274,     CVE-2026-23351, CVE-2026-23394, CVE-2026-31419, CVE-2026-31504, CVE-2026-31533, CVE-2026-31676,     CVE-2026-43033, CVE-2026-43077, CVE-2026-43078, CVE-2026-43362, CVE-2026-43494, CVE-2026-46028,     CVE-2026-46323)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 24.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-8393-1 advisory.

    It was discovered that the Linux kernel algif_aead module did not properly handle in-place cryptographic     operations. This flaw is known as Copy Fail. A local attacker could use this to escalate privileges, or     possibly escape a container. (CVE-2026-31431)

    It was discovered that the Linux kernel did not properly handle shared page fragments during socket buffer     operations, collectively known as Dirty Frag. A logic flaw existed in the XFRM ESP-in-TCP subsystem and in     the RxRPC networking subsystem when processing paged fragments. A local attacker could use this to     escalate privileges, or possibly escape a container. (CVE-2026-43284, CVE-2026-43500, CVE-2026-45998,     CVE-2026-46000)

    It was discovered that a logic flaw existed in the XFRM ESP-in-TCP subsystem in the Linux kernel when     handling socket buffer fragments. This flaw is known as Fragnesia. A local attacker could use this to     escalate privileges, or possibly escape a container. (CVE-2026-43503, CVE-2026-46300)

    Qualys discovered that a race condition existed in the ptrace subsystem of the Linux kernel when     privileged processes are exiting. An unprivileged local attacker could use this issue to expose sensitive     information. (CVE-2026-46333)

    Tristan Madani discovered that Ubuntu Linux kernel 6.8, 6.17 and 7.0 contain a memory leak when handling     AppArmor notifications. A local attacker could use this to cause resource exhaustion. (CVE-2026-47326)

    Tristan Madani discovered that Ubuntu Linux kernel 6.8, 6.17 and 7.0 contain a NULL pointer dereference     when handling AppArmor notifications. A local attacker could use this to cause a kernel oops.
    (CVE-2026-47327)

    Tristan Madani discovered that Ubuntu Linux kernel 6.8, 6.17 and 7.0 contained an invalid free when     handling AppArmor notifications. A local attacker could use this to corrupt kernel memory.
    (CVE-2026-47328)

    Tristan Madani discovered that Ubuntu Linux kernel 6.8, 6.17 and 7.0 contained insufficient validation of     AppArmor notification responses. A local attacker could use this to allow crafted responses to be     processed. (CVE-2026-47329)

    Tristan Madani discovered that Ubuntu Linux kernel 6.8, 6.17 and 7.0 used an uninitialized variable when     handling AppArmor notifications. A local attacker could use this to cause incorrect caching of data.
    (CVE-2026-47330)

    Tristan Madani discovered that Ubuntu Linux kernel 6.8 contained a use- after-free (UAF) bug. A local     attacker could use this to cause memory corruption and, theoretically, arbitrary code execution.
    (CVE-2026-47331)

    Tristan Madani discovered that Ubuntu Linux kernel 6.8, 6.17 and 7.0 contained an out-of-bounds (OOB) read     when handling AppArmor notifications. A local attacker could use this to cause information disclosure of     kernel memory. (CVE-2026-47332)

    Tristan Madani discovered that Ubuntu Linux kernel 6.8, 6.17 and 7.0 contained a out-of-bounds (OOB) read     when handling AppArmor notifications. A local attacker could use this to cause kernel memory corruption     and, theoretically, influence processing of AppArmor policies. (CVE-2026-47333)

    Tristan Madani discovered that Ubuntu Linux kernel 6.8, 6.17 and 7.0 contained incorrect holding of locks     when handling AppArmor notifications. A local attacker could use this to cause a kernel panic or deadlock.
    (CVE-2026-47334)

    Tristan Madani discovered that Ubuntu Linux kernel 6.8 contained a NULL pointer dereference when handling     AppArmor notifications. A local attacker could use this to cause a kernel panic. (CVE-2026-47335)

    Tristan Madani discovered that Ubuntu Linux kernel 6.8 used an uninitialized variable when handling     AppArmor AF_INET/AF_INET6 socket mediation. A local attacker could use this to influence processing of     fine- grained network socket mediation. (CVE-2026-47336)

    Tristan Madani and Trevor Lawrence have each independently discovered that Ubuntu Linux kernel 6.8, 6.17     and 7.0 contained a NULL pointer dereference when handling AppArmor network socket mediation. A local     attacker could use this to cause a kernel oops. (CVE-2026-47337)

    Several security issues were discovered in the Linux kernel. An attacker could possibly use these to     compromise the system. This update corrects flaws in the following subsystems:

    - ARM64 architecture;

    - x86 architecture;

    - Cryptographic API;

    - Compute Acceleration Framework;

    - Drivers core;

    - Null block device driver;

    - Ublk userspace block driver;

    - Bluetooth drivers;

    - Counter interface drivers;

    - DMA engine subsystem;

    - DPLL subsystem;

    - GPU drivers;

    - HID subsystem;

    - Intel Trace Hub HW tracing drivers;

    - IIO ADC drivers;

    - IIO subsystem;

    - On-Chip Interconnect management framework;

    - IRQ chip drivers;

    - Modular ISDN driver;

    - LED subsystem;

    - Multiple devices driver;

    - UACCE accelerator framework;

    - MMC subsystem;

    - Ethernet bonding driver;

    - Network drivers;

    - Mellanox network drivers;

    - NVME drivers;

    - PHY drivers;

    - x86 platform drivers;

    - i.MX PM domains;

    - SCSI subsystem;

    - SLIMbus drivers;

    - SPI subsystem;

    - TCM subsystem;

    - W1 Dallas's 1-wire bus driver;

    - Xen hypervisor drivers;

    - BTRFS file system;

    - EFI Variable file system;

    - exFAT file system;

    - Ext4 file system;

    - HFS+ file system;

    - Network file system (NFS) client;

    - Network file system (NFS) server daemon;

    - NTFS3 file system;

    - SMB network file system;

    - Scheduler infrastructure;

    - Netfilter;

    - NFC subsystem;

    - Tracing infrastructure;

    - io_uring subsystem;

    - BPF subsystem;

    - Perf events;

    - Floating proportions library;

    - Memory management;

    - Bluetooth subsystem;

    - CAN network layer;

    - Ceph Core library;

    - Networking core;

    - IPv4 networking;

    - IPv6 networking;

    - L2TP protocol;

    - MAC80211 subsystem;

    - NET/ROM layer;

    - Packet sockets;

    - RDS protocol;

    - RxRPC session sockets;

    - Network traffic control;

    - SCTP protocol;

    - TLS protocol;

    - Unix domain sockets;

    - VMware vSockets driver;

    - Wireless networking;

    - ALSA AC97 driver;

    - Generic PCM loopback sound driver;

    - Creative Sound Blaster X-Fi driver;

    - AMD SoC Alsa drivers;

    - Texas InstrumentS Audio (ASoC/HDA) drivers;

    - USB sound devices;

    - KVM subsystem; (CVE-2024-50004, CVE-2024-58096, CVE-2024-58097, CVE-2025-37926, CVE-2025-38201,     CVE-2025-38591, CVE-2025-40039, CVE-2025-40082, CVE-2025-40149, CVE-2025-68351, CVE-2025-68358,     CVE-2025-68365, CVE-2025-68725, CVE-2025-68749, CVE-2025-68803, CVE-2025-68823, CVE-2025-71160,     CVE-2025-71162, CVE-2025-71163, CVE-2025-71180, CVE-2025-71182, CVE-2025-71183, CVE-2025-71184,     CVE-2025-71185, CVE-2025-71186, CVE-2025-71188, CVE-2025-71189, CVE-2025-71190, CVE-2025-71191,     CVE-2025-71192, CVE-2025-71193, CVE-2025-71194, CVE-2025-71195, CVE-2025-71196, CVE-2025-71197,     CVE-2025-71198, CVE-2025-71199, CVE-2025-71200, CVE-2025-71220, CVE-2025-71222, CVE-2025-71224,     CVE-2025-71225, CVE-2025-71268, CVE-2026-22976, CVE-2026-22977, CVE-2026-22978, CVE-2026-22979,     CVE-2026-22980, CVE-2026-22982, CVE-2026-22984, CVE-2026-22990, CVE-2026-22991, CVE-2026-22992,     CVE-2026-22994, CVE-2026-22996, CVE-2026-22997, CVE-2026-22998, CVE-2026-22999, CVE-2026-23000,     CVE-2026-23001, CVE-2026-23003, CVE-2026-23005, CVE-2026-23006, CVE-2026-23010, CVE-2026-23011,     CVE-2026-23019, CVE-2026-23020, CVE-2026-23021, CVE-2026-23025, CVE-2026-23026, CVE-2026-23030,     CVE-2026-23031, CVE-2026-23032, CVE-2026-23033, CVE-2026-23035, CVE-2026-23037, CVE-2026-23038,     CVE-2026-23047, CVE-2026-23049, CVE-2026-23050, CVE-2026-23053, CVE-2026-23054, CVE-2026-23056,     CVE-2026-23057, CVE-2026-23058, CVE-2026-23059, CVE-2026-23061, CVE-2026-23062, CVE-2026-23063,     CVE-2026-23064, CVE-2026-23065, CVE-2026-23068, CVE-2026-23069, CVE-2026-23071, CVE-2026-23073,     CVE-2026-23075, CVE-2026-23076, CVE-2026-23078, CVE-2026-23080, CVE-2026-23083, CVE-2026-23084,     CVE-2026-23085, CVE-2026-23086, CVE-2026-23087, CVE-2026-23088, CVE-2026-23089, CVE-2026-23090,     CVE-2026-23091, CVE-2026-23093, CVE-2026-23094, CVE-2026-23095, CVE-2026-23096, CVE-2026-23097,     CVE-2026-23098, CVE-2026-23099, CVE-2026-23101, CVE-2026-23102, CVE-2026-23103, CVE-2026-23105,     CVE-2026-23107, CVE-2026-23108, CVE-2026-23110, CVE-2026-23113, CVE-2026-23116, CVE-2026-23119,     CVE-2026-23120, CVE-2026-23121, CVE-2026-23123, CVE-2026-23124, CVE-2026-23125, CVE-2026-23126,     CVE-2026-23128, CVE-2026-23129, CVE-2026-23131, CVE-2026-23133, CVE-2026-23135, CVE-2026-23136,     CVE-2026-23139, CVE-2026-23140, CVE-2026-23141, CVE-2026-23142, CVE-2026-23144, CVE-2026-23145,     CVE-2026-23146, CVE-2026-23148, CVE-2026-23150, CVE-2026-23151, CVE-2026-23156, CVE-2026-23159,     CVE-2026-23160, CVE-2026-23163, CVE-2026-23164, CVE-2026-23166, CVE-2026-23167, CVE-2026-23168,     CVE-2026-23170, CVE-2026-23172, CVE-2026-23173, CVE-2026-23176, CVE-2026-23178, CVE-2026-23179,     CVE-2026-23180, CVE-2026-23182, CVE-2026-23187, CVE-2026-23190, CVE-2026-23191, CVE-2026-23193,     CVE-2026-23198, CVE-2026-23200, CVE-2026-23202, CVE-2026-23204, CVE-2026-23205, CVE-2026-23206,     CVE-2026-23212, CVE-2026-23213, CVE-2026-23214, CVE-2026-23215, CVE-2026-23216, CVE-2026-23254,     CVE-2026-23256, CVE-2026-23257, CVE-2026-23258, CVE-2026-23260, CVE-2026-23261, CVE-2026-23262,     CVE-2026-23264, CVE-2026-23274, CVE-2026-23351, CVE-2026-23394, CVE-2026-31419, CVE-2026-31504,     CVE-2026-31533, CVE-2026-31676, CVE-2026-43033, CVE-2026-43077, CVE-2026-43078, CVE-2026-43494,     CVE-2026-46028)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 24.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-8296-1 advisory.

    Several security issues were discovered in the Linux kernel. An attacker could possibly use these to     compromise the system. This update corrects flaws in the following subsystems:

    - ARM64 architecture;

    - x86 architecture;

    - Compute Acceleration Framework;

    - Drivers core;

    - Null block device driver;

    - Ublk userspace block driver;

    - Bluetooth drivers;

    - Counter interface drivers;

    - DMA engine subsystem;

    - DPLL subsystem;

    - GPU drivers;

    - HID subsystem;

    - Intel Trace Hub HW tracing drivers;

    - IIO ADC drivers;

    - IIO subsystem;

    - On-Chip Interconnect management framework;

    - IRQ chip drivers;

    - Modular ISDN driver;

    - LED subsystem;

    - Multiple devices driver;

    - UACCE accelerator framework;

    - MMC subsystem;

    - Ethernet bonding driver;

    - Network drivers;

    - Mellanox network drivers;

    - NVME drivers;

    - PHY drivers;

    - x86 platform drivers;

    - i.MX PM domains;

    - SCSI subsystem;

    - SLIMbus drivers;

    - SPI subsystem;

    - TCM subsystem;

    - W1 Dallas's 1-wire bus driver;

    - Xen hypervisor drivers;

    - BTRFS file system;

    - EFI Variable file system;

    - exFAT file system;

    - Ext4 file system;

    - HFS+ file system;

    - Network file system (NFS) client;

    - Network file system (NFS) server daemon;

    - NTFS3 file system;

    - SMB network file system;

    - Scheduler infrastructure;

    - Netfilter;

    - NFC subsystem;

    - Tracing infrastructure;

    - io_uring subsystem;

    - BPF subsystem;

    - Perf events;

    - Floating proportions library;

    - Memory management;

    - Bluetooth subsystem;

    - CAN network layer;

    - Ceph Core library;

    - Networking core;

    - IPv4 networking;

    - IPv6 networking;

    - L2TP protocol;

    - MAC80211 subsystem;

    - NET/ROM layer;

    - Network traffic control;

    - SCTP protocol;

    - TLS protocol;

    - Unix domain sockets;

    - VMware vSockets driver;

    - Wireless networking;

    - ALSA AC97 driver;

    - Generic PCM loopback sound driver;

    - Creative Sound Blaster X-Fi driver;

    - AMD SoC Alsa drivers;

    - Texas InstrumentS Audio (ASoC/HDA) drivers;

    - USB sound devices;

    - KVM subsystem; (CVE-2024-50004, CVE-2024-58096, CVE-2024-58097, CVE-2025-37926, CVE-2025-38201,     CVE-2025-38591, CVE-2025-40039, CVE-2025-40082, CVE-2025-40149, CVE-2025-68351, CVE-2025-68358,     CVE-2025-68365, CVE-2025-68725, CVE-2025-68749, CVE-2025-68803, CVE-2025-68823, CVE-2025-71160,     CVE-2025-71162, CVE-2025-71163, CVE-2025-71180, CVE-2025-71182, CVE-2025-71183, CVE-2025-71184,     CVE-2025-71185, CVE-2025-71186, CVE-2025-71188, CVE-2025-71189, CVE-2025-71190, CVE-2025-71191,     CVE-2025-71192, CVE-2025-71193, CVE-2025-71194, CVE-2025-71195, CVE-2025-71196, CVE-2025-71197,     CVE-2025-71198, CVE-2025-71199, CVE-2025-71200, CVE-2025-71220, CVE-2025-71222, CVE-2025-71224,     CVE-2025-71225, CVE-2025-71268, CVE-2026-22976, CVE-2026-22977, CVE-2026-22978, CVE-2026-22979,     CVE-2026-22980, CVE-2026-22982, CVE-2026-22984, CVE-2026-22990, CVE-2026-22991, CVE-2026-22992,     CVE-2026-22994, CVE-2026-22996, CVE-2026-22997, CVE-2026-22998, CVE-2026-22999, CVE-2026-23000,     CVE-2026-23001, CVE-2026-23003, CVE-2026-23005, CVE-2026-23006, CVE-2026-23010, CVE-2026-23011,     CVE-2026-23019, CVE-2026-23020, CVE-2026-23021, CVE-2026-23025, CVE-2026-23026, CVE-2026-23030,     CVE-2026-23031, CVE-2026-23032, CVE-2026-23033, CVE-2026-23035, CVE-2026-23037, CVE-2026-23038,     CVE-2026-23047, CVE-2026-23049, CVE-2026-23050, CVE-2026-23053, CVE-2026-23054, CVE-2026-23056,     CVE-2026-23057, CVE-2026-23058, CVE-2026-23059, CVE-2026-23061, CVE-2026-23062, CVE-2026-23063,     CVE-2026-23064, CVE-2026-23065, CVE-2026-23068, CVE-2026-23069, CVE-2026-23071, CVE-2026-23073,     CVE-2026-23075, CVE-2026-23076, CVE-2026-23078, CVE-2026-23080, CVE-2026-23083, CVE-2026-23084,     CVE-2026-23085, CVE-2026-23086, CVE-2026-23087, CVE-2026-23088, CVE-2026-23089, CVE-2026-23090,     CVE-2026-23091, CVE-2026-23093, CVE-2026-23094, CVE-2026-23095, CVE-2026-23096, CVE-2026-23097,     CVE-2026-23098, CVE-2026-23099, CVE-2026-23101, CVE-2026-23102, CVE-2026-23103, CVE-2026-23105,     CVE-2026-23107, CVE-2026-23108, CVE-2026-23110, CVE-2026-23113, CVE-2026-23116, CVE-2026-23119,     CVE-2026-23120, CVE-2026-23121, CVE-2026-23123, CVE-2026-23124, CVE-2026-23125, CVE-2026-23126,     CVE-2026-23128, CVE-2026-23129, CVE-2026-23131, CVE-2026-23133, CVE-2026-23135, CVE-2026-23136,     CVE-2026-23139, CVE-2026-23140, CVE-2026-23141, CVE-2026-23142, CVE-2026-23144, CVE-2026-23145,     CVE-2026-23146, CVE-2026-23148, CVE-2026-23150, CVE-2026-23151, CVE-2026-23156, CVE-2026-23159,     CVE-2026-23160, CVE-2026-23163, CVE-2026-23164, CVE-2026-23166, CVE-2026-23167, CVE-2026-23168,     CVE-2026-23170, CVE-2026-23172, CVE-2026-23173, CVE-2026-23176, CVE-2026-23178, CVE-2026-23179,     CVE-2026-23180, CVE-2026-23182, CVE-2026-23187, CVE-2026-23190, CVE-2026-23191, CVE-2026-23193,     CVE-2026-23198, CVE-2026-23200, CVE-2026-23202, CVE-2026-23204, CVE-2026-23205, CVE-2026-23206,     CVE-2026-23212, CVE-2026-23213, CVE-2026-23214, CVE-2026-23215, CVE-2026-23216, CVE-2026-23254,     CVE-2026-23256, CVE-2026-23257, CVE-2026-23258, CVE-2026-23260, CVE-2026-23261, CVE-2026-23262,     CVE-2026-23264, CVE-2026-23274, CVE-2026-23351, CVE-2026-23394)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 24.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-8289-1 advisory.

    It was discovered that the Linux kernel algif_aead module did not properly handle in-place cryptographic     operations. This flaw is known as Copy Fail. A local attacker could use this to escalate privileges, or     possibly escape a container. (CVE-2026-31431)

    Several security issues were discovered in the Linux kernel. An attacker could possibly use these to     compromise the system. This update corrects flaws in the following subsystems:

    - ARM64 architecture;

    - x86 architecture;

    - Cryptographic API;

    - Compute Acceleration Framework;

    - Drivers core;

    - Null block device driver;

    - Ublk userspace block driver;

    - Bluetooth drivers;

    - Counter interface drivers;

    - DMA engine subsystem;

    - DPLL subsystem;

    - GPU drivers;

    - HID subsystem;

    - Intel Trace Hub HW tracing drivers;

    - IIO ADC drivers;

    - IIO subsystem;

    - On-Chip Interconnect management framework;

    - IRQ chip drivers;

    - Modular ISDN driver;

    - LED subsystem;

    - Multiple devices driver;

    - UACCE accelerator framework;

    - MMC subsystem;

    - Ethernet bonding driver;

    - Network drivers;

    - Mellanox network drivers;

    - NVME drivers;

    - PHY drivers;

    - x86 platform drivers;

    - i.MX PM domains;

    - SCSI subsystem;

    - SLIMbus drivers;

    - SPI subsystem;

    - TCM subsystem;

    - W1 Dallas's 1-wire bus driver;

    - Xen hypervisor drivers;

    - BTRFS file system;

    - EFI Variable file system;

    - exFAT file system;

    - Ext4 file system;

    - HFS+ file system;

    - Network file system (NFS) client;

    - Network file system (NFS) server daemon;

    - NTFS3 file system;

    - SMB network file system;

    - Scheduler infrastructure;

    - Netfilter;

    - NFC subsystem;

    - Tracing infrastructure;

    - io_uring subsystem;

    - BPF subsystem;

    - Perf events;

    - Floating proportions library;

    - Memory management;

    - Bluetooth subsystem;

    - CAN network layer;

    - Ceph Core library;

    - Networking core;

    - IPv4 networking;

    - IPv6 networking;

    - L2TP protocol;

    - MAC80211 subsystem;

    - NET/ROM layer;

    - Packet sockets;

    - Network traffic control;

    - SCTP protocol;

    - TLS protocol;

    - Unix domain sockets;

    - VMware vSockets driver;

    - Wireless networking;

    - ALSA AC97 driver;

    - Generic PCM loopback sound driver;

    - Creative Sound Blaster X-Fi driver;

    - AMD SoC Alsa drivers;

    - Texas InstrumentS Audio (ASoC/HDA) drivers;

    - USB sound devices;

    - KVM subsystem; (CVE-2024-50004, CVE-2024-58096, CVE-2024-58097, CVE-2025-37926, CVE-2025-38201,     CVE-2025-38591, CVE-2025-40039, CVE-2025-40082, CVE-2025-40149, CVE-2025-68351, CVE-2025-68358,     CVE-2025-68365, CVE-2025-68725, CVE-2025-68749, CVE-2025-68803, CVE-2025-68823, CVE-2025-71160,     CVE-2025-71162, CVE-2025-71163, CVE-2025-71180, CVE-2025-71182, CVE-2025-71183, CVE-2025-71184,     CVE-2025-71185, CVE-2025-71186, CVE-2025-71188, CVE-2025-71189, CVE-2025-71190, CVE-2025-71191,     CVE-2025-71192, CVE-2025-71193, CVE-2025-71194, CVE-2025-71195, CVE-2025-71196, CVE-2025-71197,     CVE-2025-71198, CVE-2025-71199, CVE-2025-71200, CVE-2025-71220, CVE-2025-71222, CVE-2025-71224,     CVE-2025-71225, CVE-2025-71268, CVE-2026-22976, CVE-2026-22977, CVE-2026-22978, CVE-2026-22979,     CVE-2026-22980, CVE-2026-22982, CVE-2026-22984, CVE-2026-22990, CVE-2026-22991, CVE-2026-22992,     CVE-2026-22994, CVE-2026-22996, CVE-2026-22997, CVE-2026-22998, CVE-2026-22999, CVE-2026-23000,     CVE-2026-23001, CVE-2026-23003, CVE-2026-23005, CVE-2026-23006, CVE-2026-23010, CVE-2026-23011,     CVE-2026-23019, CVE-2026-23020, CVE-2026-23021, CVE-2026-23025, CVE-2026-23026, CVE-2026-23030,     CVE-2026-23031, CVE-2026-23032, CVE-2026-23033, CVE-2026-23035, CVE-2026-23037, CVE-2026-23038,     CVE-2026-23047, CVE-2026-23049, CVE-2026-23050, CVE-2026-23053, CVE-2026-23054, CVE-2026-23056,     CVE-2026-23057, CVE-2026-23058, CVE-2026-23059, CVE-2026-23061, CVE-2026-23062, CVE-2026-23063,     CVE-2026-23064, CVE-2026-23065, CVE-2026-23068, CVE-2026-23069, CVE-2026-23071, CVE-2026-23073,     CVE-2026-23075, CVE-2026-23076, CVE-2026-23078, CVE-2026-23080, CVE-2026-23083, CVE-2026-23084,     CVE-2026-23085, CVE-2026-23086, CVE-2026-23087, CVE-2026-23088, CVE-2026-23089, CVE-2026-23090,     CVE-2026-23091, CVE-2026-23093, CVE-2026-23094, CVE-2026-23095, CVE-2026-23096, CVE-2026-23097,     CVE-2026-23098, CVE-2026-23099, CVE-2026-23101, CVE-2026-23102, CVE-2026-23103, CVE-2026-23105,     CVE-2026-23107, CVE-2026-23108, CVE-2026-23110, CVE-2026-23113, CVE-2026-23116, CVE-2026-23119,     CVE-2026-23120, CVE-2026-23121, CVE-2026-23123, CVE-2026-23124, CVE-2026-23125, CVE-2026-23126,     CVE-2026-23128, CVE-2026-23129, CVE-2026-23131, CVE-2026-23133, CVE-2026-23135, CVE-2026-23136,     CVE-2026-23139, CVE-2026-23140, CVE-2026-23141, CVE-2026-23142, CVE-2026-23144, CVE-2026-23145,     CVE-2026-23146, CVE-2026-23148, CVE-2026-23150, CVE-2026-23151, CVE-2026-23156, CVE-2026-23159,     CVE-2026-23160, CVE-2026-23163, CVE-2026-23164, CVE-2026-23166, CVE-2026-23167, CVE-2026-23168,     CVE-2026-23170, CVE-2026-23172, CVE-2026-23173, CVE-2026-23176, CVE-2026-23178, CVE-2026-23179,     CVE-2026-23180, CVE-2026-23182, CVE-2026-23187, CVE-2026-23190, CVE-2026-23191, CVE-2026-23193,     CVE-2026-23198, CVE-2026-23200, CVE-2026-23204, CVE-2026-23205, CVE-2026-23206, CVE-2026-23212,     CVE-2026-23213, CVE-2026-23214, CVE-2026-23215, CVE-2026-23216, CVE-2026-23254, CVE-2026-23256,     CVE-2026-23257, CVE-2026-23258, CVE-2026-23260, CVE-2026-23261, CVE-2026-23262, CVE-2026-23264,     CVE-2026-23274, CVE-2026-23351, CVE-2026-23394, CVE-2026-31419, CVE-2026-31504, CVE-2026-31533,     CVE-2026-43033, CVE-2026-43077, CVE-2026-43078)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 22.04 LTS / 24.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-8278-1 advisory.

    It was discovered that the Linux kernel algif_aead module did not properly handle in-place cryptographic     operations. This flaw is known as Copy Fail. A local attacker could use this to escalate privileges, or     possibly escape a container. (CVE-2026-31431)

    Several security issues were discovered in the Linux kernel. An attacker could possibly use these to     compromise the system. This update corrects flaws in the following subsystems:

    - ARM64 architecture;

    - x86 architecture;

    - Cryptographic API;

    - Compute Acceleration Framework;

    - Drivers core;

    - Null block device driver;

    - Ublk userspace block driver;

    - Bluetooth drivers;

    - Counter interface drivers;

    - DMA engine subsystem;

    - DPLL subsystem;

    - GPU drivers;

    - HID subsystem;

    - Intel Trace Hub HW tracing drivers;

    - IIO ADC drivers;

    - IIO subsystem;

    - On-Chip Interconnect management framework;

    - IRQ chip drivers;

    - Modular ISDN driver;

    - LED subsystem;

    - Multiple devices driver;

    - UACCE accelerator framework;

    - MMC subsystem;

    - Ethernet bonding driver;

    - Network drivers;

    - Mellanox network drivers;

    - NVME drivers;

    - PHY drivers;

    - x86 platform drivers;

    - i.MX PM domains;

    - SCSI subsystem;

    - SLIMbus drivers;

    - SPI subsystem;

    - TCM subsystem;

    - W1 Dallas's 1-wire bus driver;

    - Xen hypervisor drivers;

    - BTRFS file system;

    - EFI Variable file system;

    - exFAT file system;

    - Ext4 file system;

    - HFS+ file system;

    - Network file system (NFS) client;

    - Network file system (NFS) server daemon;

    - NTFS3 file system;

    - SMB network file system;

    - Scheduler infrastructure;

    - Netfilter;

    - NFC subsystem;

    - Tracing infrastructure;

    - io_uring subsystem;

    - BPF subsystem;

    - Perf events;

    - Floating proportions library;

    - Memory management;

    - Bluetooth subsystem;

    - CAN network layer;

    - Ceph Core library;

    - Networking core;

    - IPv4 networking;

    - IPv6 networking;

    - L2TP protocol;

    - MAC80211 subsystem;

    - NET/ROM layer;

    - Packet sockets;

    - Network traffic control;

    - SCTP protocol;

    - TLS protocol;

    - Unix domain sockets;

    - VMware vSockets driver;

    - Wireless networking;

    - ALSA AC97 driver;

    - Generic PCM loopback sound driver;

    - Creative Sound Blaster X-Fi driver;

    - AMD SoC Alsa drivers;

    - Texas InstrumentS Audio (ASoC/HDA) drivers;

    - USB sound devices;

    - KVM subsystem; (CVE-2024-50004, CVE-2024-58096, CVE-2024-58097, CVE-2025-37926, CVE-2025-38201,     CVE-2025-38591, CVE-2025-40039, CVE-2025-40082, CVE-2025-40149, CVE-2025-68351, CVE-2025-68358,     CVE-2025-68365, CVE-2025-68725, CVE-2025-68749, CVE-2025-68803, CVE-2025-68823, CVE-2025-71160,     CVE-2025-71162, CVE-2025-71163, CVE-2025-71180, CVE-2025-71182, CVE-2025-71183, CVE-2025-71184,     CVE-2025-71185, CVE-2025-71186, CVE-2025-71188, CVE-2025-71189, CVE-2025-71190, CVE-2025-71191,     CVE-2025-71192, CVE-2025-71193, CVE-2025-71194, CVE-2025-71195, CVE-2025-71196, CVE-2025-71197,     CVE-2025-71198, CVE-2025-71199, CVE-2025-71200, CVE-2025-71220, CVE-2025-71222, CVE-2025-71224,     CVE-2025-71225, CVE-2025-71268, CVE-2026-22976, CVE-2026-22977, CVE-2026-22978, CVE-2026-22979,     CVE-2026-22980, CVE-2026-22982, CVE-2026-22984, CVE-2026-22990, CVE-2026-22991, CVE-2026-22992,     CVE-2026-22994, CVE-2026-22996, CVE-2026-22997, CVE-2026-22998, CVE-2026-22999, CVE-2026-23000,     CVE-2026-23001, CVE-2026-23003, CVE-2026-23005, CVE-2026-23006, CVE-2026-23010, CVE-2026-23011,     CVE-2026-23019, CVE-2026-23020, CVE-2026-23021, CVE-2026-23025, CVE-2026-23026, CVE-2026-23030,     CVE-2026-23031, CVE-2026-23032, CVE-2026-23033, CVE-2026-23035, CVE-2026-23037, CVE-2026-23038,     CVE-2026-23047, CVE-2026-23049, CVE-2026-23050, CVE-2026-23053, CVE-2026-23054, CVE-2026-23056,     CVE-2026-23057, CVE-2026-23058, CVE-2026-23059, CVE-2026-23061, CVE-2026-23062, CVE-2026-23063,     CVE-2026-23064, CVE-2026-23065, CVE-2026-23068, CVE-2026-23069, CVE-2026-23071, CVE-2026-23073,     CVE-2026-23075, CVE-2026-23076, CVE-2026-23078, CVE-2026-23080, CVE-2026-23083, CVE-2026-23084,     CVE-2026-23085, CVE-2026-23086, CVE-2026-23087, CVE-2026-23088, CVE-2026-23089, CVE-2026-23090,     CVE-2026-23091, CVE-2026-23093, CVE-2026-23094, CVE-2026-23095, CVE-2026-23096, CVE-2026-23097,     CVE-2026-23098, CVE-2026-23099, CVE-2026-23101, CVE-2026-23102, CVE-2026-23103, CVE-2026-23105,     CVE-2026-23107, CVE-2026-23108, CVE-2026-23110, CVE-2026-23113, CVE-2026-23116, CVE-2026-23119,     CVE-2026-23120, CVE-2026-23121, CVE-2026-23123, CVE-2026-23124, CVE-2026-23125, CVE-2026-23126,     CVE-2026-23128, CVE-2026-23129, CVE-2026-23131, CVE-2026-23133, CVE-2026-23135, CVE-2026-23136,     CVE-2026-23139, CVE-2026-23140, CVE-2026-23141, CVE-2026-23142, CVE-2026-23144, CVE-2026-23145,     CVE-2026-23146, CVE-2026-23148, CVE-2026-23150, CVE-2026-23151, CVE-2026-23156, CVE-2026-23159,     CVE-2026-23160, CVE-2026-23163, CVE-2026-23164, CVE-2026-23166, CVE-2026-23167, CVE-2026-23168,     CVE-2026-23170, CVE-2026-23172, CVE-2026-23173, CVE-2026-23176, CVE-2026-23178, CVE-2026-23179,     CVE-2026-23180, CVE-2026-23182, CVE-2026-23187, CVE-2026-23190, CVE-2026-23191, CVE-2026-23193,     CVE-2026-23198, CVE-2026-23200, CVE-2026-23202, CVE-2026-23204, CVE-2026-23205, CVE-2026-23206,     CVE-2026-23212, CVE-2026-23213, CVE-2026-23214, CVE-2026-23215, CVE-2026-23216, CVE-2026-23254,     CVE-2026-23256, CVE-2026-23257, CVE-2026-23258, CVE-2026-23260, CVE-2026-23261, CVE-2026-23262,     CVE-2026-23264, CVE-2026-23274, CVE-2026-23351, CVE-2026-23394, CVE-2026-31419, CVE-2026-31504,     CVE-2026-31533, CVE-2026-43033, CVE-2026-43077, CVE-2026-43078)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1514 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    btrfs: fix reservation leak in some error paths when inserting inline extent (CVE-2025-71268)

    In the Linux kernel, the following vulnerability has been resolved:

    btrfs: do not free data reservation in fallback from inline due to -ENOSPC (CVE-2025-71269)

    In the Linux kernel, the following vulnerability has been resolved:

    smack: /smack/doi: accept previously used values (CVE-2025-71304)

    In the Linux kernel, the following vulnerability has been resolved:

    fs/ntfs3: Initialize new folios before use (CVE-2025-71311)

    In the Linux kernel, the following vulnerability has been resolved:

    RDMA/umad: Reject negative data_len in ib_umad_write (CVE-2026-23243)

    In the Linux kernel, the following vulnerability has been resolved:

    net: gro: fix outer network offset (CVE-2026-23254)

    In the Linux kernel, the following vulnerability has been resolved:

    net: add proper RCU protection to /proc/net/ptype (CVE-2026-23255)

    In the Linux kernel, the following vulnerability has been resolved:

    io_uring/rw: free potentially allocated iovec on cache put failure (CVE-2026-23259)

    In the Linux kernel, the following vulnerability has been resolved:

    regmap: maple: free entry on mas_store_gfp() failure (CVE-2026-23260)

    In the Linux kernel, the following vulnerability has been resolved:

    io_uring/zcrx: fix page array leak (CVE-2026-23263)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: nft_set_rbtree: validate open interval overlap (CVE-2026-23333)

    In the Linux kernel, the following vulnerability has been resolved:

    tracing/dma: Cap dma_map_sg tracepoint arrays to prevent buffer overflow (CVE-2026-23390)

    In the Linux kernel, the following vulnerability has been resolved:

    smb: client: make use of smbdirect_socket.recv_io.credits.available (CVE-2026-31535)

    In the Linux kernel, the following vulnerability has been resolved:

    smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (CVE-2026-31539)

    In the Linux kernel, the following vulnerability has been resolved:

    driver core: enforce device_lock for driver_match_device() (CVE-2026-31688)

    In the Linux kernel, the following vulnerability has been resolved:

    ACPI: processor: Update cpuidle driver check in __acpi_processor_start() (CVE-2026-43122)

    In the Linux kernel, the following vulnerability has been resolved:

    cpufreq: intel_pstate: Fix NULL pointer dereference in update_cpu_qos_request() (CVE-2026-43401)

    In the Linux kernel, the following vulnerability has been resolved:

    net: remove WARN_ON_ONCE when accessing forward path array (CVE-2026-45847)

    In the Linux kernel, the following vulnerability has been resolved:

    efi: Fix reservation of unaccepted memory table (CVE-2026-45851)

    In the Linux kernel, the following vulnerability has been resolved:

    ata: libata-scsi: avoid Non-NCQ command starvation (CVE-2026-45855)

    In the Linux kernel, the following vulnerability has been resolved:

    RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CVE-2026-45856)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: don't zero the entire extent if EXT4_EXT_DATA_PARTIAL_VALID1 (CVE-2026-45858)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: nfnetlink_queue: do shared-unconfirmed check before segmentation (CVE-2026-45859)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: nf_conncount: increase the connection clean up limit to 64 (CVE-2026-45860)

    In the Linux kernel, the following vulnerability has been resolved:

    iommu/vt-d: Flush cache for PASID table before using it (CVE-2026-45862)

    In the Linux kernel, the following vulnerability has been resolved:

    fs/ntfs3: prevent infinite loops caused by the next valid being the same (CVE-2026-45864)

    In the Linux kernel, the following vulnerability has been resolved:

    SUNRPC: auth_gss: fix memory leaks in XDR decoding error paths (CVE-2026-45870)

    In the Linux kernel, the following vulnerability has been resolved:

    scsi: smartpqi: Fix memory leak in pqi_report_phys_luns() (CVE-2026-45872)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: nft_set_rbtree: check for partial overlaps in anonymous sets (CVE-2026-45873)

    In the Linux kernel, the following vulnerability has been resolved:

    arm64/gcs: Fix error handling in arch_set_shadow_stack_status() (CVE-2026-45876)

    In the Linux kernel, the following vulnerability has been resolved:

    PCI/P2PDMA: Release per-CPU pgmap ref when vm_insert_page() fails (CVE-2026-45880)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf: Fix bpf_xdp_store_bytes proto for read-only arg (CVE-2026-45886)

    In the Linux kernel, the following vulnerability has been resolved:

    af_unix: Fix memleak of newsk in unix_stream_connect(). (CVE-2026-45887)

    In the Linux kernel, the following vulnerability has been resolved:

    md/raid1: fix memory leak in raid1_run() (CVE-2026-45888)

    In the Linux kernel, the following vulnerability has been resolved:

    mptcp: do not account for OoO in mptcp_rcvbuf_grow() (CVE-2026-45889)

    In the Linux kernel, the following vulnerability has been resolved:

    xen-netback: reject zero-queue configuration from guest (CVE-2026-45890)

    In the Linux kernel, the following vulnerability has been resolved:

    iommu/vt-d: Clear Present bit before tearing down PASID entry (CVE-2026-45894)

    In the Linux kernel, the following vulnerability has been resolved:

    quota: fix livelock between quotactl and freeze_super (CVE-2026-45895)

    In the Linux kernel, the following vulnerability has been resolved:

    RDMA/iwcm: Fix workqueue list corruption by removing work_list (CVE-2026-45898)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: drop extent cache when splitting extent fails (CVE-2026-45899)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf: Fix memory access flags in helper prototypes (CVE-2026-45903)

    In the Linux kernel, the following vulnerability has been resolved:

    xfrm: fix ip_rt_bug race in icmp_route_lookup reverse path (CVE-2026-45905)

    In the Linux kernel, the following vulnerability has been resolved:

    net/mlx5e: Fix deadlocks between devlink and netdev instance locks (CVE-2026-45907)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: don't cache extent during splitting extent (CVE-2026-45912)

    In the Linux kernel, the following vulnerability has been resolved:

    net: bridge: mcast: always update mdb_n_entries for vlan contexts (CVE-2026-45913)

    In the Linux kernel, the following vulnerability has been resolved:

    fat: avoid parent link count underflow in rmdir (CVE-2026-45915)

    In the Linux kernel, the following vulnerability has been resolved:

    ipvs: do not keep dest_dst if dev is going down (CVE-2026-45917)

    In the Linux kernel, the following vulnerability has been resolved:

    ovpn: tcp - don't deref NULL sk_socket member after tcp_close() (CVE-2026-45918)

    In the Linux kernel, the following vulnerability has been resolved:

    sched/rt: Skip currently executing CPU in rto_next_cpu() (CVE-2026-45919)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: fix dirtyclusters double decrement on fs shutdown (CVE-2026-45920)

    In the Linux kernel, the following vulnerability has been resolved:

    RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (CVE-2026-45922)

    In the Linux kernel, the following vulnerability has been resolved:

    thermal/of: Fix reference leak in thermal_of_cm_lookup() (CVE-2026-45925)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf: Require frozen map for calculating map hash (CVE-2026-45927)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf: Fix tcx/netkit detach permissions when prog fd isn't given (CVE-2026-45932)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf: Preserve id of register in sync_linked_regs() (CVE-2026-45933)

    In the Linux kernel, the following vulnerability has been resolved:

    btrfs: fix EEXIST abort due to non-consecutive gaps in chunk allocation (CVE-2026-45934)

    In the Linux kernel, the following vulnerability has been resolved:

    fs/ntfs3: Fix slab-out-of-bounds read in DeleteIndexEntryRoot (CVE-2026-45935)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: fix e4b bitmap inconsistency reports (CVE-2026-45942)

    In the Linux kernel, the following vulnerability has been resolved:

    erofs: fix inline data read failure for ztailpacking pclusters (CVE-2026-45943)

    In the Linux kernel, the following vulnerability has been resolved:

    iommu/vt-d: Clear Present bit before tearing down context entry (CVE-2026-45944)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: fix memory leak in ext4_ext_shift_extents() (CVE-2026-45948)

    In the Linux kernel, the following vulnerability has been resolved:

    hwrng: core - use RCU and work_struct to fix race condition (CVE-2026-45949)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf: Fix a potential use-after-free of BTF object (CVE-2026-45951)

    In the Linux kernel, the following vulnerability has been resolved:

    md/raid5: fix IO hang with degraded array with llbitmap (CVE-2026-45953)

    In the Linux kernel, the following vulnerability has been resolved:

    md/md-llbitmap: fix percpu_ref not resurrected on suspend timeout (CVE-2026-45955)

    In the Linux kernel, the following vulnerability has been resolved:

    rcu: Fix rcu_read_unlock() deadloop due to softirq (CVE-2026-45957)

    In the Linux kernel, the following vulnerability has been resolved:

    SUNRPC: fix gss_auth kref leak in gss_alloc_msg error path (CVE-2026-45964)

    In the Linux kernel, the following vulnerability has been resolved:

    cpuidle: Skip governor when only one idle state is available (CVE-2026-45968)

    In the Linux kernel, the following vulnerability has been resolved:

    bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CVE-2026-45970)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf: Limit bpf program signature size (CVE-2026-45971)

    In the Linux kernel, the following vulnerability has been resolved:

    RDMA/mlx5: Fix UMR hang in LAG error state unload (CVE-2026-45973)

    In the Linux kernel, the following vulnerability has been resolved:

    btrfs: fix invalid leaf access in btrfs_quota_enable() if ref key not found (CVE-2026-45974)

    In the Linux kernel, the following vulnerability has been resolved:

    ACPICA: Fix NULL pointer dereference in acpi_ev_address_space_dispatch() (CVE-2026-45982)

    In the Linux kernel, the following vulnerability has been resolved:

    nfsd: never defer requests during idmap lookup (CVE-2026-45983)

    In the Linux kernel, the following vulnerability has been resolved:

    btrfs: fix block_group_tree dirty_list corruption (CVE-2026-46251)

    In the Linux kernel, the following vulnerability has been resolved:

    pstore/ram: fix buffer overflow in persistent_ram_save_old() (CVE-2026-46253)

    In the Linux kernel, the following vulnerability has been resolved:

    NFS/localio: prevent direct reclaim recursion into NFS via nfs_writepages (CVE-2026-46256)

    In the Linux kernel, the following vulnerability has been resolved:

    procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CVE-2026-46259)

    In the Linux kernel, the following vulnerability has been resolved:

    inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (CVE-2026-46266)

    In the Linux kernel, the following vulnerability has been resolved:

    dm: fix unlocked test for dm_suspended_md (CVE-2026-46327)

    In the Linux kernel, the following vulnerability has been resolved:

    apparmor: fix rlimit for posix cpu timers (CVE-2026-46328)

    In the Linux kernel, the following vulnerability has been resolved:

    erofs: handle end of filesystem properly for file-backed mounts (CVE-2026-46329)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1487 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    md: suspend array while updating raid_disks via sysfs (CVE-2025-71225)

    In the Linux kernel, the following vulnerability has been resolved:

    btrfs: fix reservation leak in some error paths when inserting inline extent (CVE-2025-71268)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CVE-2026-23111)

    In the Linux kernel, the following vulnerability has been resolved:

    net: fix segmentation of forwarding fraglist GRO (CVE-2026-23154)

    In the Linux kernel, the following vulnerability has been resolved:

    efivarfs: fix error propagation in efivar_entry_get() (CVE-2026-23156)

    In the Linux kernel, the following vulnerability has been resolved:

    perf: sched: Fix perf crash with new is_user_task() helper (CVE-2026-23159)

    In the Linux kernel, the following vulnerability has been resolved:

    mm/shmem, swap: fix race of truncate and swap entry split (CVE-2026-23161)

    In the Linux kernel, the following vulnerability has been resolved:

    flex_proportions: make fprop_new_period() hardirq safe (CVE-2026-23168)

    In the Linux kernel, the following vulnerability has been resolved:

    mptcp: fix race in mptcp_pm_nl_flush_addrs_doit() (CVE-2026-23169)

    In the Linux kernel, the following vulnerability has been resolved:

    net/mlx5e: TC, delete flows only for existing peers (CVE-2026-23173)

    In the Linux kernel, the following vulnerability has been resolved:

    mm, shmem: prevent infinite loop on truncate race (CVE-2026-23177)

    In the Linux kernel, the following vulnerability has been resolved:

    ceph: fix NULL pointer dereference in ceph_mds_auth_match() (CVE-2026-23189)

    In the Linux kernel, the following vulnerability has been resolved:

    scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CVE-2026-23193)

    In the Linux kernel, the following vulnerability has been resolved:

    KVM: Don't clobber irqfd routing type when deassigning irqfd (CVE-2026-23198)

    In the Linux kernel, the following vulnerability has been resolved:

    procfs: avoid fetching build ID while holding VMA lock (CVE-2026-23199)

    In the Linux kernel, the following vulnerability has been resolved:

    ipv6: Fix ECMP sibling count mismatch when clearing RTF_ADDRCONF (CVE-2026-23200)

    In the Linux kernel, the following vulnerability has been resolved:

    ceph: fix oops due to invalid pointer for kfree() in parse_longname() (CVE-2026-23201)

    In the Linux kernel, the following vulnerability has been resolved:

    spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (CVE-2026-23202)

    In the Linux kernel, the following vulnerability has been resolved:

    net/sched: cls_u32: use skb_header_pointer_careful() (CVE-2026-23204)

    In the Linux kernel, the following vulnerability has been resolved:

    smb/client: fix memory leak in smb2_open_file() (CVE-2026-23205)

    In the Linux kernel, the following vulnerability has been resolved:

    macvlan: fix error recovery in macvlan_common_newlink() (CVE-2026-23209)

    In the Linux kernel, the following vulnerability has been resolved:

    bonding: annotate data-races around slave->last_rx (CVE-2026-23212)

    In the Linux kernel, the following vulnerability has been resolved:

    btrfs: reject new transactions if the fs is fully read-only (CVE-2026-23214)

    In the Linux kernel, the following vulnerability has been resolved:

    x86/vmware: Fix hypercall clobbers (CVE-2026-23215)

    In the Linux kernel, the following vulnerability has been resolved:

    scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CVE-2026-23216)

    In the Linux kernel, the following vulnerability has been resolved:

    mm/slab: Add alloc_tagging_slab_free_hook for memcg_alloc_abort_single (CVE-2026-23219)

    In the Linux kernel, the following vulnerability has been resolved: xfs: fix UAF in     xchk_btree_check_block_owner We cannot dereference bs->cur when trying to determine if bs->cur aliases     bs->sc->sa.{bno,rmap}_cur after the latter has been freed. Fix this by sampling before type before any     freeing could happen. The correct temporal ordering was broken when we removed xfs_btnum_t.
    (CVE-2026-23223)

    In the Linux kernel, the following vulnerability has been resolved: erofs: fix UAF issue for file-backed     mounts w/ directio option [ 9.269940][ T3222] Call trace: [ 9.269948][ T3222]     ext4_file_read_iter+0xac/0x108 [ 9.269979][ T3222] vfs_iocb_iter_read+0xac/0x198 [ 9.269993][ T3222]     erofs_fileio_rq_submit+0x12c/0x180 [ 9.270008][ T3222] erofs_fileio_submit_bio+0x14/0x24 [ 9.270030][     T3222] z_erofs_runqueue+0x834/0x8ac [ 9.270054][ T3222] z_erofs_read_folio+0x120/0x220 [ 9.270083][ T3222]     filemap_read_folio+0x60/0x120 [ 9.270102][ T3222] filemap_fault+0xcac/0x1060 [ 9.270119][ T3222]     do_pte_missing+0x2d8/0x1554 [ 9.270131][ T3222] handle_mm_fault+0x5ec/0x70c [ 9.270142][ T3222]     do_page_fault+0x178/0x88c [ 9.270167][ T3222] do_translation_fault+0x38/0x54 [ 9.270183][ T3222]     do_mem_abort+0x54/0xac [ 9.270208][ T3222] el0_da+0x44/0x7c [ 9.270227][ T3222]     el0t_64_sync_handler+0x5c/0xf4 [ 9.270253][ T3222] el0t_64_sync+0x1bc/0x1c0 EROFS may encounter above     panic when enabling file-backed mount w/ directio mount option, the root cause is it may suffer UAF in     below race condition: - z_erofs_read_folio wq s_dio_done_wq - z_erofs_runqueue - erofs_fileio_submit_bio -     erofs_fileio_rq_submit - vfs_iocb_iter_read - ext4_file_read_iter - ext4_dio_read_iter - iomap_dio_rw :
    bio was submitted and return -EIOCBQUEUED - dio_aio_complete_work - dio_complete - dio->iocb->ki_complete     (erofs_fileio_ki_complete()) - kfree(rq) : it frees iocb, iocb.ki_filp can be UAF in file_accessed(). -     file_accessed : access NULL file point Introduce a reference count in struct erofs_fileio_rq, and     initialize it as two, both erofs_fileio_ki_complete() and erofs_fileio_rq_submit() will decrease reference     count, the last one decreasing the reference count to zero will free rq. (CVE-2026-23224)

    In the Linux kernel, the following vulnerability has been resolved: smb: client: split cached_fid     bitfields to avoid shared-byte RMW races is_open, has_lease and on_list are stored in the same bitfield     byte in struct cached_fid but are updated in different code paths that may run concurrently. Bitfield     assignments generate byte read-modify-write operations (e.g. `orb $mask, addr` on x86_64), so updating one     flag can restore stale values of the others. A possible interleaving is: CPU1: load old byte (has_lease=1,     on_list=1) CPU2: clear both flags (store 0) CPU1: RMW store (old | IS_OPEN) -> reintroduces cleared bits     To avoid this class of races, convert these flags to separate bool fields. (CVE-2026-23230)

    In the Linux kernel, the following vulnerability has been resolved:

    net: gro: fix outer network offset (CVE-2026-23254)

    In the Linux kernel, the following vulnerability has been resolved:

    regmap: maple: free entry on mas_store_gfp() failure (CVE-2026-23260)

    In the Linux kernel, the following vulnerability has been resolved:

    driver core: enforce device_lock for driver_match_device() (CVE-2026-31688)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - regmap: maple: free entry on mas_store_gfp() failure regcache_maple_write() allocates a new block     ('entry') to merge adjacent ranges and then stores it with mas_store_gfp(). When mas_store_gfp() fails,     the new 'entry' remains allocated and is never freed, leaking memory. Free 'entry' on the failure path; on     success continue freeing the replaced neighbor blocks ('lower', 'upper'). (CVE-2026-23260)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
360569	Rocky Linux 9.6 [TuxCare] Security Update: kernel / kernel-abi-stablelists / kernel-core / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1786352940)	Nessus	Rocky Linux Local Security Checks	Local	high
360481	AlmaLinux 9.6 [TuxCare] Security Update: kernel / kernel-abi-stablelists / kernel-core / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1786352940)	Nessus	Alma Linux Local Security Checks	Local	high
325292	Oracle Linux 10 / 9 : Unbreakable Enterprise kernel (ELSA-2026-50372)	Nessus	Oracle Linux Local Security Checks	Local	high
325008	Ubuntu 24.04 LTS : Linux kernel (Xilinx) vulnerabilities (USN-8499-1)	Nessus	Ubuntu Local Security Checks	Local	high
324048	SUSE SLED15 / SLES15 : Security update for the Linux Kernel (SUSE-SU-2026:2238-1)	Nessus	SuSE Local Security Checks	Local	high
323212	EulerOS 2.0 SP15 : kernel (EulerOS-SA-2026-2485)	Nessus	Huawei Local Security Checks	Local	high
323152	EulerOS 2.0 SP15 : kernel (EulerOS-SA-2026-2444)	Nessus	Huawei Local Security Checks	Local	high
321369	Ubuntu 22.04 LTS : Linux kernel (Azure) vulnerabilities (USN-8440-1)	Nessus	Ubuntu Local Security Checks	Local	high
319659	SUSE SLES16 Security Update : kernel (SUSE-SU-2026:21845-1)	Nessus	SuSE Local Security Checks	Local	high
318847	Ubuntu 24.04 LTS : Linux kernel (Azure FIPS) vulnerabilities (USN-8393-1)	Nessus	Ubuntu Local Security Checks	Local	high
318240	SUSE SLES16 Security Update : kernel (SUSE-SU-2026:21860-1)	Nessus	SuSE Local Security Checks	Local	high
318102	openSUSE 16 Security Update : kernel (openSUSE-SU-2026:20826-1)	Nessus	SuSE Local Security Checks	Local	high
316636	Ubuntu 24.04 LTS : Linux kernel (FIPS) vulnerabilities (USN-8296-1)	Nessus	Ubuntu Local Security Checks	Local	high
316060	Ubuntu 24.04 LTS : Linux kernel (NVIDIA) vulnerabilities (USN-8289-1)	Nessus	Ubuntu Local Security Checks	Local	high
315738	Ubuntu 22.04 LTS / 24.04 LTS : Linux kernel vulnerabilities (USN-8278-1)	Nessus	Ubuntu Local Security Checks	Local	high
304298	Amazon Linux 2023 : bpftool6.18, kernel6.18, kernel6.18-devel (ALAS2023-2026-1514)	Nessus	Amazon Linux Local Security Checks	Local	high
304272	Amazon Linux 2023 : bpftool6.12, kernel6.12, kernel6.12-devel (ALAS2023-2026-1487)	Nessus	Amazon Linux Local Security Checks	Local	high
302929	Linux Distros Unpatched Vulnerability : CVE-2026-23260	Nessus	Misc.	Local	medium

Detections

Analytics

CVE-2026-23260

medium

Tenable Plugins

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

medium