In the Linux kernel, the following vulnerability has been resolved: net: add xmit recursion limit to tunnel xmit functions Tunnel xmit functions (iptunnel_xmit, ip6tunnel_xmit) lack their own recursion limit. When a bond device in broadcast mode has GRE tap interfaces as slaves, and those GRE tunnels route back through the bond, multicast/broadcast traffic triggers infinite recursion between bond_xmit_broadcast() and ip_tunnel_xmit()/ip6_tnl_xmit(), causing kernel stack overflow. The existing XMIT_RECURSION_LIMIT (8) in the no-qdisc path is not sufficient because tunnel recursion involves route lookups and full IP output, consuming much more stack per level. Use a lower limit of 4 (IP_TUNNEL_RECURSION_LIMIT) to prevent overflow. Add recursion detection using dev_xmit_recursion helpers directly in iptunnel_xmit() and ip6tunnel_xmit() to cover all IPv4/IPv6 tunnel paths including UDP encapsulated tunnels (VXLAN, Geneve, etc.). Move dev_xmit_recursion helpers from net/core/dev.h to public header include/linux/netdevice.h so they can be used by tunnel code. BUG: KASAN: stack-out-of-bounds in blake2s.constprop.0+0xe7/0x160 Write of size 32 at addr ffff88810033fed0 by task kworker/0:1/11 Workqueue: mld mld_ifc_work Call Trace: <TASK> __build_flow_key.constprop.0 (net/ipv4/route.c:515) ip_rt_update_pmtu (net/ipv4/route.c:1073) iptunnel_xmit (net/ipv4/ip_tunnel_core.c:84) ip_tunnel_xmit (net/ipv4/ip_tunnel.c:847) gre_tap_xmit (net/ipv4/ip_gre.c:779) dev_hard_start_xmit (net/core/dev.c:3887) sch_direct_xmit (net/sched/sch_generic.c:347) __dev_queue_xmit (net/core/dev.c:4802) bond_dev_queue_xmit (drivers/net/bonding/bond_main.c:312) bond_xmit_broadcast (drivers/net/bonding/bond_main.c:5279) bond_start_xmit (drivers/net/bonding/bond_main.c:5530) dev_hard_start_xmit (net/core/dev.c:3887) __dev_queue_xmit (net/core/dev.c:4841) ip_finish_output2 (net/ipv4/ip_output.c:237) ip_output (net/ipv4/ip_output.c:438) iptunnel_xmit (net/ipv4/ip_tunnel_core.c:86) gre_tap_xmit (net/ipv4/ip_gre.c:779) dev_hard_start_xmit (net/core/dev.c:3887) sch_direct_xmit (net/sched/sch_generic.c:347) __dev_queue_xmit (net/core/dev.c:4802) bond_dev_queue_xmit (drivers/net/bonding/bond_main.c:312) bond_xmit_broadcast (drivers/net/bonding/bond_main.c:5279) bond_start_xmit (drivers/net/bonding/bond_main.c:5530) dev_hard_start_xmit (net/core/dev.c:3887) __dev_queue_xmit (net/core/dev.c:4841) ip_finish_output2 (net/ipv4/ip_output.c:237) ip_output (net/ipv4/ip_output.c:438) iptunnel_xmit (net/ipv4/ip_tunnel_core.c:86) ip_tunnel_xmit (net/ipv4/ip_tunnel.c:847) gre_tap_xmit (net/ipv4/ip_gre.c:779) dev_hard_start_xmit (net/core/dev.c:3887) sch_direct_xmit (net/sched/sch_generic.c:347) __dev_queue_xmit (net/core/dev.c:4802) bond_dev_queue_xmit (drivers/net/bonding/bond_main.c:312) bond_xmit_broadcast (drivers/net/bonding/bond_main.c:5279) bond_start_xmit (drivers/net/bonding/bond_main.c:5530) dev_hard_start_xmit (net/core/dev.c:3887) __dev_queue_xmit (net/core/dev.c:4841) mld_sendpack mld_ifc_work process_one_work worker_thread </TASK>

According to the versions of the kernel packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

    iommu/sva: invalidate stale IOTLB entries for kernel address space(CVE-2025-71202)

    iommu: disable SVA when CONFIG_X86 is set(CVE-2025-71089)

    tls: Fix race condition in tls_sw_cancel_work_tx()(CVE-2026-23240)

    apparmor: replace recursive profile removal with iterative approach(CVE-2026-23404)

    macvlan: observe an RCU grace period in macvlan_common_newlink() error path(CVE-2026-23273)

    mm/hugetlb: fix hugetlb_pmd_shared()(CVE-2026-23100)

    leds: led-class: Only Add LED to leds_list when it is fully ready(CVE-2026-23101)

    smb: client: Don#39;t log plaintext credentials in cifs_set_cifscreds(CVE-2026-23303)

    net/sched: teql: fix NULL pointer dereference in iptunnel_xmit on TEQL slave xmit(CVE-2026-23277)

    crypto: algif_aead - Revert to operating out-of-place(CVE-2026-31431)

    netfilter: xt_CT: drop pending enqueued packets on template removal(CVE-2026-23391)

    apparmor: validate DFA start states are in bounds in unpack_pdb(CVE-2026-23269)

    net: usb: kaweth: validate USB endpoints(CVE-2026-23312)

    NFSD: Defer sub-object cleanup in export put callbacks(CVE-2026-31404)

    apparmor: fix side-effect bug in match_char() macro usage(CVE-2026-23406)

    nfnetlink_osf: validate individual option lengths in fingerprints(CVE-2026-23397)

    crypto: virtio - Add spinlock protection with virtqueue notification(CVE-2026-23229)

    Squashfs: check metadata block offset is within range(CVE-2026-23388)

    net: add xmit recursion limit to tunnel xmit functions(CVE-2026-23276)

    RDMA/umad: Reject negative data_len in ib_umad_write(CVE-2026-23243)

    net: annotate data-races around sk-gt;sk_{data_ready,write_space}(CVE-2026-23302)

    drm/vmwgfx: Return the correct value in vmw_translate_ptr functions(CVE-2026-23317)

    net: usb: kalmia: validate USB endpoints(CVE-2026-23365)

    tcp: secure_seq: add back ports to TS offset(CVE-2026-23247)

    net: usb: pegasus: validate USB endpoints(CVE-2026-23290)

    bonding: provide a net pointer to __skb_flow_dissect()(CVE-2026-23119)

    nvme-fc: release admin tagset if init fails(CVE-2026-23261)

    sctp: move SCTP_CMD_ASSOC_SHKEY right after SCTP_CMD_PEER_INIT(CVE-2026-23125)

    icmp: fix NULL pointer dereference in icmp_tag_validation()(CVE-2026-23398)

    net: vxlan: fix nd_tbl NULL dereference when IPv6 is disabled(CVE-2026-23293)

    netfilter: xt_IDLETIMER: reject rev0 reuse of ALARM timer labels(CVE-2026-23274)

    vsock/virtio: fix potential underflow in virtio_transport_get_credit()(CVE-2026-23069)

    platform/x86: classmate-laptop: Add missing NULL pointer checks(CVE-2026-23237)

    ipv6: add NULL checks for idev in SRv6 paths(CVE-2026-23442)

    scsi: qla2xxx: Fix bsg_done() causing double free(CVE-2025-71238)

    vsock/virtio: cap TX credit to local buffer size(CVE-2026-23086)

    sched/deadline: Fix missing ENQUEUE_REPLENISH during PI de-boosting(CVE-2026-23371)

    apparmor: fix race on rawdata dereference(CVE-2026-23410)

    apparmor: Fix double free of ns_name in aa_replace_profiles()(CVE-2026-23408)

    apparmor: fix race between freeing data and fs accessing it(CVE-2026-23411)

    netfilter: nf_tables: unconditionally bump set-gt;nelems before insertion(CVE-2026-23272)

    apparmor: fix differential encoding verification(CVE-2026-23409)

    net: sched: avoid qdisc_reset_all_tx_gt() vs dequeue race for lockless qdiscs(CVE-2026-23340)

    scsi: target: Fix recursive locking in __configfs_open_file()(CVE-2026-23292)

    netfilter: nft_set_pipapo: split gc into unlink and reclaim phase(CVE-2026-23351)

    net: ipv6: fix panic when IPv4 route references loopback IPv6 nexthop(CVE-2026-23300)

    apparmor: fix: limit the number of levels of policy namespaces(CVE-2026-23405)

    perf: Fix __perf_event_overflow() vs perf_remove_from_context() race(CVE-2026-23271)

    blktrace: fix __this_cpu_read/write in preemptible context(CVE-2026-23374)

    apparmor: fix unprivileged local user can do privileged policy management(CVE-2026-23268)

    ipv6: fix NULL pointer deref in ip6_rt_get_dev_rcu()(CVE-2026-23304)

    apparmor: fix missing bounds check on DEFAULT table in verify_dfa()(CVE-2026-23407)

    ext4: fix iloc.bh leak in ext4_xattr_inode_update_ref(CVE-2026-23145)

    media: dvb-core: fix wrong reinitialization of ringbuffer on reopen(CVE-2026-23253)

    net: phy: register phy led_triggers during probe to avoid AB-BA deadlock(CVE-2026-23368)

    net: bridge: fix nd_tbl NULL dereference when IPv6 is disabled(CVE-2026-23381)

    apparmor: fix memory leak in verify_header(CVE-2026-23403)

    x86/efi: defer freeing of boot services memory(CVE-2026-23352)

    net: add proper RCU protection to /proc/net/ptype(CVE-2026-23255)

    ice: Fix memory leak in ice_set_ringparam()(CVE-2026-23389)

    bonding: limit BOND_MODE_8023AD to Ethernet devices(CVE-2026-23099)

    uacce: ensure safe queue release with state management(CVE-2026-23063)

    uacce: implement mremap in uacce_vm_ops to return -EPERM(CVE-2026-23056)

    macvlan: fix error recovery in macvlan_common_newlink()(CVE-2026-23209)

    regmap: Fix race condition in hwspinlock irqsave routine(CVE-2026-23071)

    net/sched: Enforce that teql can only be used as root qdisc(CVE-2026-23074)

    scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count()(CVE-2026-23216)

    net/sched: qfq: Use cl_is_active to determine whether class is active in qfq_rm_from_ag(CVE-2026-23105)

    nvmet-tcp: fixup hang in nvmet_tcp_listen_data_ready()(CVE-2026-23179)

    scsi: qla2xxx: Delay module unload while fabric scan in progress(CVE-2025-71235)

    tracing: Add recursion protection in kernel stack trace recording(CVE-2026-23138)

    scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count()(CVE-2026-23193)

    bonding: annotate data-races around slave-gt;last_rx(CVE-2026-23212)

    be2net: Fix NULL pointer dereference in be_cmd_get_mac_from_list(CVE-2026-23084)

    net/sched: cls_u32: use skb_header_pointer_careful()(CVE-2026-23204)

    scsi: qla2xxx: Validate sp before freeing associated memory(CVE-2025-71236)

    nvmet-tcp: add bounds checks in nvmet_tcp_build_pdu_iovec(CVE-2026-23112)

    scsi: qla2xxx: Free sp in error path to fix system crash(CVE-2025-71232)

    net: fix segmentation of forwarding fraglist GRO(CVE-2026-23154)

    crypto: authencesn - reject too-short AAD (assoclenlt;8) to match ESP/ESN spec(CVE-2026-23060)

    l2tp: avoid one data-race in l2tp_tunnel_del_work()(CVE-2026-23120)

    KVM: Don#39;t clobber irqfd routing type when deassigning irqfd(CVE-2026-23198)

    netdevsim: fix a race issue related to the operation on bpf_bound_progs list(CVE-2026-23126)

Tenable has extracted the preceding description block directly from the EulerOS Virtualization kernel security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    iommu/sva: invalidate stale IOTLB entries for kernel address space(CVE-2025-71202)

    iommu: disable SVA when CONFIG_X86 is set(CVE-2025-71089)

    tls: Fix race condition in tls_sw_cancel_work_tx()(CVE-2026-23240)

    apparmor: replace recursive profile removal with iterative approach(CVE-2026-23404)

    macvlan: observe an RCU grace period in macvlan_common_newlink() error path(CVE-2026-23273)

    mm/hugetlb: fix hugetlb_pmd_shared()(CVE-2026-23100)

    leds: led-class: Only Add LED to leds_list when it is fully ready(CVE-2026-23101)

    smb: client: Don#39;t log plaintext credentials in cifs_set_cifscreds(CVE-2026-23303)

    net/sched: teql: fix NULL pointer dereference in iptunnel_xmit on TEQL slave xmit(CVE-2026-23277)

    crypto: algif_aead - Revert to operating out-of-place(CVE-2026-31431)

    netfilter: xt_CT: drop pending enqueued packets on template removal(CVE-2026-23391)

    apparmor: validate DFA start states are in bounds in unpack_pdb(CVE-2026-23269)

    net: usb: kaweth: validate USB endpoints(CVE-2026-23312)

    NFSD: Defer sub-object cleanup in export put callbacks(CVE-2026-31404)

    apparmor: fix side-effect bug in match_char() macro usage(CVE-2026-23406)

    nfnetlink_osf: validate individual option lengths in fingerprints(CVE-2026-23397)

    crypto: virtio - Add spinlock protection with virtqueue notification(CVE-2026-23229)

    Squashfs: check metadata block offset is within range(CVE-2026-23388)

    net: add xmit recursion limit to tunnel xmit functions(CVE-2026-23276)

    RDMA/umad: Reject negative data_len in ib_umad_write(CVE-2026-23243)

    net: annotate data-races around sk-gt;sk_{data_ready,write_space}(CVE-2026-23302)

    drm/vmwgfx: Return the correct value in vmw_translate_ptr functions(CVE-2026-23317)

    net: usb: kalmia: validate USB endpoints(CVE-2026-23365)

    tcp: secure_seq: add back ports to TS offset(CVE-2026-23247)

    net: usb: pegasus: validate USB endpoints(CVE-2026-23290)

    bonding: provide a net pointer to __skb_flow_dissect()(CVE-2026-23119)

    nvme-fc: release admin tagset if init fails(CVE-2026-23261)

    sctp: move SCTP_CMD_ASSOC_SHKEY right after SCTP_CMD_PEER_INIT(CVE-2026-23125)

    icmp: fix NULL pointer dereference in icmp_tag_validation()(CVE-2026-23398)

    net: vxlan: fix nd_tbl NULL dereference when IPv6 is disabled(CVE-2026-23293)

    netfilter: xt_IDLETIMER: reject rev0 reuse of ALARM timer labels(CVE-2026-23274)

    vsock/virtio: fix potential underflow in virtio_transport_get_credit()(CVE-2026-23069)

    platform/x86: classmate-laptop: Add missing NULL pointer checks(CVE-2026-23237)

    ipv6: add NULL checks for idev in SRv6 paths(CVE-2026-23442)

    scsi: qla2xxx: Fix bsg_done() causing double free(CVE-2025-71238)

    vsock/virtio: cap TX credit to local buffer size(CVE-2026-23086)

    sched/deadline: Fix missing ENQUEUE_REPLENISH during PI de-boosting(CVE-2026-23371)

    apparmor: fix race on rawdata dereference(CVE-2026-23410)

    apparmor: Fix double free of ns_name in aa_replace_profiles()(CVE-2026-23408)

    apparmor: fix race between freeing data and fs accessing it(CVE-2026-23411)

    netfilter: nf_tables: unconditionally bump set-gt;nelems before insertion(CVE-2026-23272)

    apparmor: fix differential encoding verification(CVE-2026-23409)

    net: sched: avoid qdisc_reset_all_tx_gt() vs dequeue race for lockless qdiscs(CVE-2026-23340)

    scsi: target: Fix recursive locking in __configfs_open_file()(CVE-2026-23292)

    netfilter: nft_set_pipapo: split gc into unlink and reclaim phase(CVE-2026-23351)

    net: ipv6: fix panic when IPv4 route references loopback IPv6 nexthop(CVE-2026-23300)

    apparmor: fix: limit the number of levels of policy namespaces(CVE-2026-23405)

    perf: Fix __perf_event_overflow() vs perf_remove_from_context() race(CVE-2026-23271)

    blktrace: fix __this_cpu_read/write in preemptible context(CVE-2026-23374)

    apparmor: fix unprivileged local user can do privileged policy management(CVE-2026-23268)

    ipv6: fix NULL pointer deref in ip6_rt_get_dev_rcu()(CVE-2026-23304)

    apparmor: fix missing bounds check on DEFAULT table in verify_dfa()(CVE-2026-23407)

    ext4: fix iloc.bh leak in ext4_xattr_inode_update_ref(CVE-2026-23145)

    media: dvb-core: fix wrong reinitialization of ringbuffer on reopen(CVE-2026-23253)

    net: phy: register phy led_triggers during probe to avoid AB-BA deadlock(CVE-2026-23368)

    net: bridge: fix nd_tbl NULL dereference when IPv6 is disabled(CVE-2026-23381)

    apparmor: fix memory leak in verify_header(CVE-2026-23403)

    x86/efi: defer freeing of boot services memory(CVE-2026-23352)

    net: add proper RCU protection to /proc/net/ptype(CVE-2026-23255)

    ice: Fix memory leak in ice_set_ringparam()(CVE-2026-23389)

    bonding: limit BOND_MODE_8023AD to Ethernet devices(CVE-2026-23099)

    uacce: ensure safe queue release with state management(CVE-2026-23063)

    uacce: implement mremap in uacce_vm_ops to return -EPERM(CVE-2026-23056)

    macvlan: fix error recovery in macvlan_common_newlink()(CVE-2026-23209)

    regmap: Fix race condition in hwspinlock irqsave routine(CVE-2026-23071)

    net/sched: Enforce that teql can only be used as root qdisc(CVE-2026-23074)

    scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count()(CVE-2026-23216)

    net/sched: qfq: Use cl_is_active to determine whether class is active in qfq_rm_from_ag(CVE-2026-23105)

    nvmet-tcp: fixup hang in nvmet_tcp_listen_data_ready()(CVE-2026-23179)

    scsi: qla2xxx: Delay module unload while fabric scan in progress(CVE-2025-71235)

    tracing: Add recursion protection in kernel stack trace recording(CVE-2026-23138)

    scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count()(CVE-2026-23193)

    bonding: annotate data-races around slave-gt;last_rx(CVE-2026-23212)

    be2net: Fix NULL pointer dereference in be_cmd_get_mac_from_list(CVE-2026-23084)

    net/sched: cls_u32: use skb_header_pointer_careful()(CVE-2026-23204)

    scsi: qla2xxx: Validate sp before freeing associated memory(CVE-2025-71236)

    nvmet-tcp: add bounds checks in nvmet_tcp_build_pdu_iovec(CVE-2026-23112)

    scsi: qla2xxx: Free sp in error path to fix system crash(CVE-2025-71232)

    net: fix segmentation of forwarding fraglist GRO(CVE-2026-23154)

    crypto: authencesn - reject too-short AAD (assoclenlt;8) to match ESP/ESN spec(CVE-2026-23060)

    l2tp: avoid one data-race in l2tp_tunnel_del_work()(CVE-2026-23120)

    KVM: Don#39;t clobber irqfd routing type when deassigning irqfd(CVE-2026-23198)

    netdevsim: fix a race issue related to the operation on bpf_bound_progs list(CVE-2026-23126)

Tenable has extracted the preceding description block directly from the EulerOS kernel security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    crypto: algif_aead - Revert to operating out-of-place(CVE-2026-31431)

    nfsd: fix RELEASE_LOCKOWNER(CVE-2024-26629)

    bonding: limit BOND_MODE_8023AD to Ethernet devices(CVE-2026-23099)

    iommu: disable SVA when CONFIG_X86 is set(CVE-2025-71089)

    tls: Fix race condition in tls_sw_cancel_work_tx()(CVE-2026-23240)

    apparmor: replace recursive profile removal with iterative approach(CVE-2026-23404)

    macvlan: observe an RCU grace period in macvlan_common_newlink() error path(CVE-2026-23273)

    mm/hugetlb: fix hugetlb_pmd_shared()(CVE-2026-23100)

    ethtool: Avoid overflowing userspace buffer on stats query(CVE-2025-68795)

    uacce: ensure safe queue release with state management(CVE-2026-23063)

    leds: led-class: Only Add LED to leds_list when it is fully ready(CVE-2026-23101)

    smb: client: Don#39;t log plaintext credentials in cifs_set_cifscreds(CVE-2026-23303)

    uacce: implement mremap in uacce_vm_ops to return -EPERM(CVE-2026-23056)

    net/sched: teql: fix NULL pointer dereference in iptunnel_xmit on TEQL slave xmit(CVE-2026-23277)

    netfilter: xt_CT: drop pending enqueued packets on template removal(CVE-2026-23391)

    apparmor: validate DFA start states are in bounds in unpack_pdb(CVE-2026-23269)

    macvlan: fix error recovery in macvlan_common_newlink()(CVE-2026-23209)

    regmap: Fix race condition in hwspinlock irqsave routine(CVE-2026-23071)

    net: usb: kaweth: validate USB endpoints(CVE-2026-23312)

    NFSD: Defer sub-object cleanup in export put callbacks(CVE-2026-31404)

    apparmor: fix side-effect bug in match_char() macro usage(CVE-2026-23406)

    nfnetlink_osf: validate individual option lengths in fingerprints(CVE-2026-23397)

    Squashfs: check metadata block offset is within range(CVE-2026-23388)

    uacce: fix isolate sysfs check condition(CVE-2026-23094)

    net: add xmit recursion limit to tunnel xmit functions(CVE-2026-23276)

    net/sched: Enforce that teql can only be used as root qdisc(CVE-2026-23074)

    scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count()(CVE-2026-23216)

    RDMA/umad: Reject negative data_len in ib_umad_write(CVE-2026-23243)

    drm/vmwgfx: Return the correct value in vmw_translate_ptr functions(CVE-2026-23317)

    RDMA/core: Check for the presence of LS_NLA_TYPE_DGID correctly(CVE-2025-71096)

    net/sched: qfq: Use cl_is_active to determine whether class is active in qfq_rm_from_ag(CVE-2026-23105)

    net: usb: kalmia: validate USB endpoints(CVE-2026-23365)

    net: usb: pegasus: validate USB endpoints(CVE-2026-23290)

    bonding: provide a net pointer to __skb_flow_dissect()(CVE-2026-23119)

    nvmet-tcp: fixup hang in nvmet_tcp_listen_data_ready()(CVE-2026-23179)

    nvme-fc: release admin tagset if init fails(CVE-2026-23261)

    sctp: move SCTP_CMD_ASSOC_SHKEY right after SCTP_CMD_PEER_INIT(CVE-2026-23125)

    icmp: fix NULL pointer dereference in icmp_tag_validation()(CVE-2026-23398)

    net: usb: pegasus: fix memory leak in update_eth_regs_async()(CVE-2026-23021)

    scsi: qla2xxx: Delay module unload while fabric scan in progress(CVE-2025-71235)

    netfilter: xt_IDLETIMER: reject rev0 reuse of ALARM timer labels(CVE-2026-23274)

    x86/CPU/AMD: Add RDSEED fix for Zen5(CVE-2025-68313)

    vsock/virtio: fix potential underflow in virtio_transport_get_credit()(CVE-2026-23069)

    ip6_gre: make ip6gre_header() robust(CVE-2025-71098)

    platform/x86: classmate-laptop: Add missing NULL pointer checks(CVE-2026-23237)

    net/sched: sch_qfq: Fix NULL deref when deactivating inactive aggregate in qfq_reset(CVE-2026-22976)

    tracing: Add recursion protection in kernel stack trace recording(CVE-2026-23138)

    scsi: qla2xxx: Fix bsg_done() causing double free(CVE-2025-71238)

    vsock/virtio: cap TX credit to local buffer size(CVE-2026-23086)

    netfilter: nf_tables: avoid chain re-validation if possible(CVE-2025-71160)

    io_uring/io-wq: check IO_WQ_BIT_EXIT inside work run loop(CVE-2026-23113)

    apparmor: fix race on rawdata dereference(CVE-2026-23410)

    scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count()(CVE-2026-23193)

    apparmor: Fix double free of ns_name in aa_replace_profiles()(CVE-2026-23408)

    apparmor: fix race between freeing data and fs accessing it(CVE-2026-23411)

    bonding: annotate data-races around slave-gt;last_rx(CVE-2026-23212)

    be2net: Fix NULL pointer dereference in be_cmd_get_mac_from_list(CVE-2026-23084)

    inet: frags: flush pending skbs in fqdir_pre_exit()(CVE-2025-68768)

    netfilter: nf_tables: unconditionally bump set-gt;nelems before insertion(CVE-2026-23272)

    apparmor: fix differential encoding verification(CVE-2026-23409)

    net/sched: cls_u32: use skb_header_pointer_careful()(CVE-2026-23204)

    net: sched: avoid qdisc_reset_all_tx_gt() vs dequeue race for lockless qdiscs(CVE-2026-23340)

    scsi: target: Fix recursive locking in __configfs_open_file()(CVE-2026-23292)

    netfilter: nft_set_pipapo: split gc into unlink and reclaim phase(CVE-2026-23351)

    net: ipv6: fix panic when IPv4 route references loopback IPv6 nexthop(CVE-2026-23300)

    apparmor: fix: limit the number of levels of policy namespaces(CVE-2026-23405)

    scsi: qla2xxx: Validate sp before freeing associated memory(CVE-2025-71236)

    nvmet-tcp: add bounds checks in nvmet_tcp_build_pdu_iovec(CVE-2026-23112)

    perf: Fix __perf_event_overflow() vs perf_remove_from_context() race(CVE-2026-23271)

    scsi: qla2xxx: Free sp in error path to fix system crash(CVE-2025-71232)

    apparmor: fix unprivileged local user can do privileged policy management(CVE-2026-23268)

    ipv6: fix NULL pointer deref in ip6_rt_get_dev_rcu()(CVE-2026-23304)

    apparmor: fix missing bounds check on DEFAULT table in verify_dfa()(CVE-2026-23407)

    ext4: fix iloc.bh leak in ext4_xattr_inode_update_ref(CVE-2026-23145)

    media: dvb-core: fix wrong reinitialization of ringbuffer on reopen(CVE-2026-23253)

    net: fix segmentation of forwarding fraglist GRO(CVE-2026-23154)

    Input: alps - fix use-after-free bugs caused by dev3_register_work(CVE-2025-68822)

    net: phy: register phy led_triggers during probe to avoid AB-BA deadlock(CVE-2026-23368)

    crypto: authencesn - reject too-short AAD (assoclenlt;8) to match ESP/ESN spec(CVE-2026-23060)

    net: bridge: fix nd_tbl NULL dereference when IPv6 is disabled(CVE-2026-23381)

    apparmor: fix memory leak in verify_header(CVE-2026-23403)

    x86/efi: defer freeing of boot services memory(CVE-2026-23352)

    l2tp: avoid one data-race in l2tp_tunnel_del_work()(CVE-2026-23120)

    KVM: Don#39;t clobber irqfd routing type when deassigning irqfd(CVE-2026-23198)

    netdevsim: fix a race issue related to the operation on bpf_bound_progs list(CVE-2026-23126)

    net: add proper RCU protection to /proc/net/ptype(CVE-2026-23255)

    ice: Fix memory leak in ice_set_ringparam()(CVE-2026-23389)

Tenable has extracted the preceding description block directly from the EulerOS kernel security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:2068-1 advisory.

    The SUSE Linux Enterprise 12 SP5 kernel was updated to fix various security issues

    The following security issues were fixed:

    - CVE-2022-50053: iavf: Fix reset error handling (bsc#1245038).
    - CVE-2023-20585: x86/CPU: Fix FPDSS on Zen1. (bsc#1243603).
    - CVE-2024-50082: blk-rq-qos: fix crash on rq_qos_wait vs. rq_qos_wake_function race (bsc#1232500     bsc#1262778).
    - CVE-2025-68185: nfs4_setup_readdir(): insufficient locking for ->d_parent->d_inode dereferencing     (bsc#1255135).
    - CVE-2025-71118: ACPICA: Avoid walking the Namespace if start_node is NULL (bsc#1256763).
    - CVE-2025-71238: scsi: qla2xxx: Fix bsg_done() causing double free (bsc#1259186).
    - CVE-2026-23193: scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count()     (bsc#1258414).
    - CVE-2026-23216: scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (bsc#1258447).
    - CVE-2026-23276: net: add xmit recursion limit to tunnel xmit functions (bsc#1260012).
    - CVE-2026-23290: net: usb: pegasus: validate USB endpoints (bsc#1260533).
    - CVE-2026-23292: scsi: target: Fix recursive locking in __configfs_open_file() (bsc#1260500).
    - CVE-2026-23293: net: vxlan: fix nd_tbl NULL dereference when IPv6 is disabled (bsc#1260486).
    - CVE-2026-23312: net: usb: kaweth: validate USB endpoints (bsc#1260561).
    - CVE-2026-23340: net: sched: avoid qdisc_reset_all_tx_gt() vs dequeue race for lockless qdiscs     (bsc#1260523).
    - CVE-2026-23378: act_ife: load meta modules before tcf_idr_check_alloc() (bsc#1260546).
    - CVE-2026-23391: netfilter: xt_CT: drop pending enqueued packets on template removal (bsc#1260566).
    - CVE-2026-23442: ipv6: add NULL checks for idev in SRv6 paths (bsc#1261581).
    - CVE-2026-23449: net/sched: teql: Fix double-free in teql_master_xmit (bsc#1261779).
    - CVE-2026-23455: netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (bsc#1261687).
    - CVE-2026-23456: netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (bsc#1261703).
    - CVE-2026-23457: netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp()     (bsc#1261686).
    - CVE-2026-23458: netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (bsc#1261781).
    - CVE-2026-23461: Bluetooth: L2CAP: Fix use-after-free in l2cap_unregister_user (bsc#1261707).
    - CVE-2026-23462: Bluetooth: HIDP: Fix possible UAF (bsc#1261710).
    - CVE-2026-23468: drm/amdgpu: Limit BO list entry count to prevent resource exhaustion (bsc#1261692).
    - CVE-2026-23472: serial: core: fix infinite loop in handle_tx() for PORT_UNKNOWN (bsc#1261636).
    - CVE-2026-31393: Bluetooth: L2CAP: Validate L2CAP_INFO_RSP payload length before access (bsc#1261719).
    - CVE-2026-31400: sunrpc: fix cache_request leak in cache_release (bsc#1261645).
    - CVE-2026-31402: nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (bsc#1261638).
    - CVE-2026-31403: NFSD: Hold net reference for the lifetime of /proc/fs/nfs/exports fd (bsc#1261796).
    - CVE-2026-31407: netfilter: conntrack: add missing netlink policy validations (bsc#1261632).
    - CVE-2026-31408: Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold     (bsc#1261797).
    - CVE-2026-31411: net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (bsc#1261752).
    - CVE-2026-31416: netfilter: nfnetlink_log: account for netlink header size (bsc#1262100).
    - CVE-2026-31422: net/sched: cls_flow: fix NULL pointer dereference on shared blocks (bsc#1262054).
    - CVE-2026-31423: net/sched: sch_hfsc: fix divide-by-zero in rtsc_min() (bsc#1262063).
    - CVE-2026-31424: netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP     (bsc#1262053).
    - CVE-2026-31425: rds: ib: reject FRMR registration before IB connection is established (bsc#1262074).
    - CVE-2026-31427: netfilter: nf_conntrack_sip: fix use of uninitialized rtp_addr in process_sdp     (bsc#1262086).
    - CVE-2026-31428: netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD (bsc#1262087).
    - CVE-2026-31496: netfilter: nf_conntrack_expect: skip expectations in other netns via proc (bsc#1262673).
    - CVE-2026-31504: net: fix fanout UAF in packet_release() via NETDEV_UP race (bsc#1263085).
    - CVE-2026-31507: net/smc: fix double-free of smc_spd_priv when tee() duplicates splice pipe buffer     (bsc#1263095).
    - CVE-2026-31512: Bluetooth: L2CAP: Validate PDU length before reading SDU length in     l2cap_ecred_data_rcv()       (bsc#1262734).
    - CVE-2026-31524: HID: asus: avoid memory leak in asus_report_fixup() (bsc#1262605).
    - CVE-2026-31602: ALSA: ctxfi: Limit PTP to a single page (bsc#1263723).
    - CVE-2026-31607: usbip: validate number_of_packets in usbip_pack_ret_submit() (bsc#1263600).
    - CVE-2026-31649: net: stmmac: fix integer underflow in chain mode (bsc#1263582).
    - CVE-2026-31667: Input: uinput - fix circular locking dependency with ff-core (bsc#1263139).
    - CVE-2026-31675: net/sched: sch_netem: fix out-of-bounds access in packet corruption (bsc#1263556).
    - CVE-2026-31681: netfilter: xt_multiport: validate range encoding in checkentry (bsc#1263593).
    - CVE-2026-31685: netfilter: ip6t_eui64: reject invalid MAC header for all packets (bsc#1263668).
    - CVE-2026-31700: net/packet: fix TOCTOU race on mmap'd vnet_hdr in tpacket_snd() (bsc#1263882).
    - CVE-2026-31738: vxlan: validate ND option lengths in vxlan_na_create (bsc#1264059).
    - CVE-2026-31787: xen/privcmd: fix double free via VMA splitting (bsc#1262181).
    - CVE-2026-43025: netfilter: ctnetlink: ignore explicit helper on new expectations (bsc#1263931).
    - CVE-2026-43088: net: af_key: zero aligned sockaddr tail in PF_KEY exports (bsc#1264469).
    - CVE-2026-43110: wifi: brcmfmac: validate bsscfg indices in IF events (bsc#1264482).
    - CVE-2026-43126: ALSA: mixer: oss: Add card disconnect checkpoints (bsc#1264634).
    - CVE-2026-43190: netfilter: xt_tcpmss: check remaining length before reading optlen (bsc#1264848).
    - CVE-2026-43255: wifi: libertas: fix WARNING in usb_tx_block (bsc#1264473).
    - CVE-2026-43264: fbdev: of: display_timing: fix refcount leak in of_get_display_timings() (bsc#1264424).
    - CVE-2026-43334: Bluetooth: SMP: force responder MITM requirements before building the pairing response     (bsc#1265090).
    - CVE-2026-43437: ALSA: pcm: fix use-after-free on linked stream runtime in snd_pcm_drain() (bsc#1265126).

    The following non security issues were fixed:

    - list: add 'list_del_init_careful()' to go with 'list_empty_careful()' (bsc#1262778).
    - ocfs2: fix possible deadlock between unlink and dio_end_io_write (bsc#1258718).
    - ocfs2: split transactions in dio completion to avoid credit exhaustion (bsc#1258718).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1594 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: ctnetlink: remove refcounting in expectation dumpers (CVE-2025-39764)

    In the Linux kernel, the following vulnerability has been resolved:

    ipv6: use RCU in ip6_xmit() (CVE-2025-40135)

    In the Linux kernel, the following vulnerability has been resolved:

    blk-throttle: fix access race during throttle policy activation (CVE-2025-40147)

    In the Linux kernel, the following vulnerability has been resolved:

    binfmt_misc: restore write access before closing files opened by open_exec() (CVE-2025-68239)

    In the Linux kernel, the following vulnerability has been resolved:

    dm-verity: disable recursive forward error correction (CVE-2025-71161)

    In the Linux kernel, the following vulnerability has been resolved:

    dst: fix races in rt6_uncached_list_del() and rt_del_uncached_list() (CVE-2026-23004)

    In the Linux kernel, the following vulnerability has been resolved:

    tracing: Add recursion protection in kernel stack trace recording (CVE-2026-23138)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: xt_IDLETIMER: reject rev0 reuse of ALARM timer labels (CVE-2026-23274)

    In the Linux kernel, the following vulnerability has been resolved:

    net: add xmit recursion limit to tunnel xmit functions (CVE-2026-23276)

    In the Linux kernel, the following vulnerability has been resolved:

    net/sched: teql: fix NULL pointer dereference in iptunnel_xmit on TEQL slave xmit (CVE-2026-23277)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: nf_tables: always walk all pending catchall elements (CVE-2026-23278)

    In the Linux kernel, the following vulnerability has been resolved:

    mptcp: pm: in-kernel: always mark signal+subflow endp as used (CVE-2026-23321)

    In the Linux kernel, the following vulnerability has been resolved:

    net: phy: register phy led_triggers during probe to avoid AB-BA deadlock (CVE-2026-23368)

    In the Linux kernel, the following vulnerability has been resolved:

    mm: thp: deny THP for files on anonymous inodes (CVE-2026-23375)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: xt_CT: drop pending enqueued packets on template removal (CVE-2026-23391)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: nf_tables: release flowtable after rcu grace period on error (CVE-2026-23392)

    In the Linux kernel, the following vulnerability has been resolved:

    nfnetlink_osf: validate individual option lengths in fingerprints (CVE-2026-23397)

    In the Linux kernel, the following vulnerability has been resolved:

    icmp: fix NULL pointer dereference in icmp_tag_validation() (CVE-2026-23398)

    In the Linux kernel, the following vulnerability has been resolved:

    nf_tables: nft_dynset: fix possible stateful expression memleak in error path (CVE-2026-23399)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: bpf: defer hook memory release until rcu readers are done (CVE-2026-23412)

    In the Linux kernel, the following vulnerability has been resolved:

    clsact: Fix use-after-free in init/destroy rollback asymmetry (CVE-2026-23413)

    In the Linux kernel, the following vulnerability has been resolved:

    udp_tunnel: fix NULL deref caused by udp_sock_create6 when CONFIG_IPV6=n (CVE-2026-23439)

    In the Linux kernel, the following vulnerability has been resolved:

    net/mlx5e: Fix race condition during IPSec ESN update (CVE-2026-23440)

    In the Linux kernel, the following vulnerability has been resolved:

    net/mlx5e: Prevent concurrent access to IPSec ASO context (CVE-2026-23441)

    In the Linux kernel, the following vulnerability has been resolved:

    ACPI: processor: Fix previous acpi_processor_errata_piix4() fix (CVE-2026-23443)

    In the Linux kernel, the following vulnerability has been resolved:

    igc: fix page fault in XDP TX timestamps handling (CVE-2026-23445)

    In the Linux kernel, the following vulnerability has been resolved:

    net/sched: teql: Fix double-free in teql_master_xmit (CVE-2026-23449)

    In the Linux kernel, the following vulnerability has been resolved:

    PM: runtime: Fix a race condition related to device removal (CVE-2026-23452)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CVE-2026-23455)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (CVE-2026-23456)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (CVE-2026-23457)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (CVE-2026-23458)

    In the Linux kernel, the following vulnerability has been resolved:

    btrfs: log new dentries when logging parent dir of a conflicting inode (CVE-2026-23465)

    In the Linux kernel, the following vulnerability has been resolved:

    spi: fix statistics allocation (CVE-2026-23475)

    In the Linux kernel, the following vulnerability has been resolved:

    spi: fix use-after-free on controller registration failure (CVE-2026-31389)

    In the Linux kernel, the following vulnerability has been resolved:

    smb: client: fix krb5 mount with username option (CVE-2026-31392)

    In the Linux kernel, the following vulnerability has been resolved:

    nvdimm/bus: Fix potential use after free in asynchronous initialization (CVE-2026-31399)

    In the Linux kernel, the following vulnerability has been resolved:

    sunrpc: fix cache_request leak in cache_release (CVE-2026-31400)

    In the Linux kernel, the following vulnerability has been resolved:

    HID: bpf: prevent buffer overflow in hid_hw_request (CVE-2026-31401)

    In the Linux kernel, the following vulnerability has been resolved:

    nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (CVE-2026-31402)

    In the Linux kernel, the following vulnerability has been resolved:

    NFSD: Hold net reference for the lifetime of /proc/fs/nfs/exports fd (CVE-2026-31403)

    In the Linux kernel, the following vulnerability has been resolved:

    drm/i915/gt: Check set_default_submission() before deferencing (CVE-2026-31540)

    In the Linux kernel, the following vulnerability has been resolved:

    net: bonding: fix NULL deref in bond_debug_rlb_hash_show (CVE-2026-31546)

    In the Linux kernel, the following vulnerability has been resolved:

    xen/privcmd: restrict usage in unprivileged domU (CVE-2026-31788)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: nft_ct: drop pending enqueued packets on removal (CVE-2026-43060)

    In the Linux kernel, the following vulnerability has been resolved:

    serial: 8250: Fix TX deadlock when using DMA (CVE-2026-43061)

    In the Linux kernel, the following vulnerability has been resolved:

    mptcp: pm: in-kernel: always set ID as avail when rm endp (CVE-2026-43252)

    In the Linux kernel, the following vulnerability has been resolved:

    btrfs: fix transaction abort on set received ioctl due to item overflow (CVE-2026-43359)

    In the Linux kernel, the following vulnerability has been resolved:

    btrfs: fix transaction abort on file creation due to name hash collision (CVE-2026-43360)

    In the Linux kernel, the following vulnerability has been resolved:

    btrfs: fix transaction abort when snapshotting received subvolumes (CVE-2026-43361)

    In the Linux kernel, the following vulnerability has been resolved:

    smb: client: fix in-place encryption corruption in SMB2_write() (CVE-2026-43362)

    In the Linux kernel, the following vulnerability has been resolved:

    x86/apic: Disable x2apic on resume if the kernel expects so (CVE-2026-43363)

    In the Linux kernel, the following vulnerability has been resolved:

    xfs: fix undersized l_iclog_roundoff values (CVE-2026-43365)

    In the Linux kernel, the following vulnerability has been resolved:

    io_uring/kbuf: check if target buffer list is still legacy on recycle (CVE-2026-43366)

    In the Linux kernel, the following vulnerability has been resolved:

    drm/i915: Fix potential overflow of shmem scatterlist length (CVE-2026-43368)

    In the Linux kernel, the following vulnerability has been resolved:

    net: nexthop: fix percpu use-after-free in remove_nh_grp_entry (CVE-2026-43374)

    In the Linux kernel, the following vulnerability has been resolved:

    net/tcp-md5: Fix MAC comparison to be constant-time (CVE-2026-43383)

    In the Linux kernel, the following vulnerability has been resolved:

    net/tcp-ao: Fix MAC comparison to be constant-time (CVE-2026-43384)

    In the Linux kernel, the following vulnerability has been resolved:

    sched_ext: Fix starvation of scx_enable() under fair-class saturation (CVE-2026-43392)

    In the Linux kernel, the following vulnerability has been resolved:

    btrfs: fix chunk map leak in btrfs_map_block() after btrfs_chunk_map_num_copies() (CVE-2026-43393)

    In the Linux kernel, the following vulnerability has been resolved:

    nfsd: Fix cred ref leak in nfsd_nl_listener_set_doit(). (CVE-2026-43394)

    In the Linux kernel, the following vulnerability has been resolved:

    nsfs: tighten permission checks for ns iteration ioctls (CVE-2026-43403)

    In the Linux kernel, the following vulnerability has been resolved:

    libceph: Use u32 for non-negative values in ceph_monmap_decode() (CVE-2026-43405)

    In the Linux kernel, the following vulnerability has been resolved:

    libceph: prevent potential out-of-bounds reads in process_message_header() (CVE-2026-43406)

    In the Linux kernel, the following vulnerability has been resolved:

    libceph: Fix potential out-of-bounds access in ceph_handle_auth_reply() (CVE-2026-43407)

    In the Linux kernel, the following vulnerability has been resolved:

    ceph: add a bunch of missing ceph_path_info initializers (CVE-2026-43408)

    In the Linux kernel, the following vulnerability has been resolved:

    kprobes: avoid crash when rmmod/insmod after ftrace killed (CVE-2026-43409)

    In the Linux kernel, the following vulnerability has been resolved:

    tipc: fix divide-by-zero in tipc_sk_filter_connect() (CVE-2026-43411)

    In the Linux kernel, the following vulnerability has been resolved:

    ceph: fix memory leaks in ceph_mdsc_build_path() (CVE-2026-43419)

    In the Linux kernel, the following vulnerability has been resolved:

    ceph: fix i_nlink underrun during async unlink (CVE-2026-43420)

    In the Linux kernel, the following vulnerability has been resolved:

    usb: class: cdc-wdm: fix reordering issue in read code path (CVE-2026-43427)

    In the Linux kernel, the following vulnerability has been resolved:

    USB: core: Limit the length of unkillable synchronous timeouts (CVE-2026-43428)

    In the Linux kernel, the following vulnerability has been resolved:

    usb: xhci: Fix memory leak in xhci_disable_slot() (CVE-2026-43432)

    In the Linux kernel, the following vulnerability has been resolved:

    sched_ext: Remove redundant css_put() in scx_cgroup_init() (CVE-2026-43438)

    In the Linux kernel, the following vulnerability has been resolved:

    cgroup: fix race between task migration and iteration (CVE-2026-43439)

    In the Linux kernel, the following vulnerability has been resolved:

    net: bonding: Fix nd_tbl NULL dereference when IPv6 is disabled (CVE-2026-43441)

    In the Linux kernel, the following vulnerability has been resolved:

    e1000/e1000e: Fix leak in DMA error cleanup (CVE-2026-43445)

    In the Linux kernel, the following vulnerability has been resolved:

    nvme-pci: Fix race bug in nvme_poll_irqdisable() (CVE-2026-43448)

    In the Linux kernel, the following vulnerability has been resolved:

    nvme-pci: Fix slab-out-of-bounds in nvme_dbbuf_set (CVE-2026-43449)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CVE-2026-43450)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (CVE-2026-43451)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: x_tables: guard option walkers against 1-byte tail reads (CVE-2026-43452)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop() (CVE-2026-43453)

    In the Linux kernel, the following vulnerability has been resolved:

    bonding: fix type confusion in bond_setup_by_slave() (CVE-2026-43456)

    In the Linux kernel, the following vulnerability has been resolved:

    net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (CVE-2026-43466)

    In the Linux kernel, the following vulnerability has been resolved:

    net/mlx5: Fix crash when moving to switchdev mode (CVE-2026-43467)

    In the Linux kernel, the following vulnerability has been resolved:

    net/mlx5: Fix deadlock between devlink lock and esw->wq (CVE-2026-43468)

    In the Linux kernel, the following vulnerability has been resolved:

    nfs: return EISDIR on nfs3_proc_create if d_alias is a dir (CVE-2026-43470)

    In the Linux kernel, the following vulnerability has been resolved:

    unshare: fix unshare_fs() handling (CVE-2026-43472)

    In the Linux kernel, the following vulnerability has been resolved:

    scsi: mpi3mr: Add NULL checks when resetting request and reply queues (CVE-2026-43473)

    In the Linux kernel, the following vulnerability has been resolved:

    scsi: storvsc: Fix scheduling while atomic on PREEMPT_RT (CVE-2026-43475)

    In the Linux kernel, the following vulnerability has been resolved:

    sched_ext: Disable preemption between scx_claim_exit() and kicking helper work (CVE-2026-43482)

    In the Linux kernel, the following vulnerability has been resolved:

    KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (CVE-2026-43483)

    In the Linux kernel, the following vulnerability has been resolved:

    arm64: contpte: fix set_access_flags() no-op check for SMMU/ATS faults (CVE-2026-43486)

    In the Linux kernel, the following vulnerability has been resolved:

    ata: libata-core: Disable LPM on ST1000DM010-2EP102 (CVE-2026-43487)

    In the Linux kernel, the following vulnerability has been resolved:

    usb: xhci: Prevent interrupt storm on host controller error (HCE) (CVE-2026-43488)

    In the Linux kernel, the following vulnerability has been resolved:

    erofs: fix inline data read failure for ztailpacking pclusters (CVE-2026-45943)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6238 advisory.

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-6238-1                   security@debian.org     https://www.debian.org/security/                     Salvatore Bonaccorso     April 30, 2026                        https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : linux     CVE ID         : CVE-2024-14027 CVE-2025-21709 CVE-2025-22116 CVE-2025-22117                      CVE-2025-38426 CVE-2025-38627 CVE-2025-39764 CVE-2025-40005                      CVE-2025-40135 CVE-2025-40147 CVE-2025-40150 CVE-2025-40219                      CVE-2025-68175 CVE-2025-68239 CVE-2025-68334 CVE-2025-68736                      CVE-2025-71152 CVE-2025-71161 CVE-2025-71221 CVE-2025-71239                      CVE-2025-71265 CVE-2025-71266 CVE-2025-71267 CVE-2025-71269                      CVE-2026-22981 CVE-2026-22985 CVE-2026-22986 CVE-2026-22993                      CVE-2026-23004 CVE-2026-23066 CVE-2026-23070 CVE-2026-23104                      CVE-2026-23138 CVE-2026-23157 CVE-2026-23207 CVE-2026-23210                      CVE-2026-23226 CVE-2026-23227 CVE-2026-23231 CVE-2026-23239                      CVE-2026-23240 CVE-2026-23242 CVE-2026-23243 CVE-2026-23244                      CVE-2026-23245 CVE-2026-23246 CVE-2026-23249 CVE-2026-23250                      CVE-2026-23251 CVE-2026-23252 CVE-2026-23253 CVE-2026-23255                      CVE-2026-23270 CVE-2026-23271 CVE-2026-23273 CVE-2026-23274                      CVE-2026-23276 CVE-2026-23277 CVE-2026-23278 CVE-2026-23279                      CVE-2026-23281 CVE-2026-23284 CVE-2026-23285 CVE-2026-23286                      CVE-2026-23287 CVE-2026-23289 CVE-2026-23290 CVE-2026-23291                      CVE-2026-23292 CVE-2026-23293 CVE-2026-23296 CVE-2026-23297                      CVE-2026-23298 CVE-2026-23300 CVE-2026-23302 CVE-2026-23303                      CVE-2026-23304 CVE-2026-23306 CVE-2026-23307 CVE-2026-23308                      CVE-2026-23310 CVE-2026-23312 CVE-2026-23313 CVE-2026-23315                      CVE-2026-23316 CVE-2026-23317 CVE-2026-23318 CVE-2026-23319                      CVE-2026-23321 CVE-2026-23324 CVE-2026-23325 CVE-2026-23330                      CVE-2026-23334 CVE-2026-23335 CVE-2026-23336 CVE-2026-23339                      CVE-2026-23340 CVE-2026-23343 CVE-2026-23347 CVE-2026-23351                      CVE-2026-23352 CVE-2026-23354 CVE-2026-23356 CVE-2026-23357                      CVE-2026-23359 CVE-2026-23360 CVE-2026-23361 CVE-2026-23362                      CVE-2026-23363 CVE-2026-23364 CVE-2026-23365 CVE-2026-23367                      CVE-2026-23368 CVE-2026-23369 CVE-2026-23370 CVE-2026-23372                      CVE-2026-23373 CVE-2026-23374 CVE-2026-23375 CVE-2026-23378                      CVE-2026-23379 CVE-2026-23380 CVE-2026-23381 CVE-2026-23382                      CVE-2026-23383 CVE-2026-23386 CVE-2026-23387 CVE-2026-23388                      CVE-2026-23389 CVE-2026-23391 CVE-2026-23392 CVE-2026-23393                      CVE-2026-23395 CVE-2026-23396 CVE-2026-23397 CVE-2026-23398                      CVE-2026-23399 CVE-2026-23401 CVE-2026-23412 CVE-2026-23413                      CVE-2026-23414 CVE-2026-23417 CVE-2026-23419 CVE-2026-23420                      CVE-2026-23422 CVE-2026-23426 CVE-2026-23427 CVE-2026-23428                      CVE-2026-23434 CVE-2026-23438 CVE-2026-23439 CVE-2026-23440                      CVE-2026-23441 CVE-2026-23442 CVE-2026-23444 CVE-2026-23445                      CVE-2026-23446 CVE-2026-23447 CVE-2026-23448 CVE-2026-23449                      CVE-2026-23450 CVE-2026-23452 CVE-2026-23454 CVE-2026-23455                      CVE-2026-23456 CVE-2026-23457 CVE-2026-23458 CVE-2026-23460                      CVE-2026-23461 CVE-2026-23462 CVE-2026-23463 CVE-2026-23464                      CVE-2026-23465 CVE-2026-23466 CVE-2026-23470 CVE-2026-23474                      CVE-2026-23475 CVE-2026-31389 CVE-2026-31391 CVE-2026-31392                      CVE-2026-31393 CVE-2026-31394 CVE-2026-31396 CVE-2026-31399                      CVE-2026-31400 CVE-2026-31401 CVE-2026-31402 CVE-2026-31403                      CVE-2026-31405 CVE-2026-31406 CVE-2026-31407 CVE-2026-31408                      CVE-2026-31409 CVE-2026-31410 CVE-2026-31411 CVE-2026-31412                      CVE-2026-31414 CVE-2026-31415 CVE-2026-31416 CVE-2026-31417                      CVE-2026-31418 CVE-2026-31421 CVE-2026-31422 CVE-2026-31423                      CVE-2026-31424 CVE-2026-31425 CVE-2026-31426 CVE-2026-31427                      CVE-2026-31428 CVE-2026-31429 CVE-2026-31430 CVE-2026-31431                      CVE-2026-31432 CVE-2026-31433 CVE-2026-31434 CVE-2026-31436                      CVE-2026-31438 CVE-2026-31439 CVE-2026-31440 CVE-2026-31441                      CVE-2026-31446 CVE-2026-31447 CVE-2026-31448 CVE-2026-31449                      CVE-2026-31450 CVE-2026-31451 CVE-2026-31452 CVE-2026-31453                      CVE-2026-31454 CVE-2026-31455 CVE-2026-31458 CVE-2026-31462                      CVE-2026-31464 CVE-2026-31466 CVE-2026-31467 CVE-2026-31469                      CVE-2026-31470 CVE-2026-31473 CVE-2026-31474 CVE-2026-31476                      CVE-2026-31477 CVE-2026-31478 CVE-2026-31479 CVE-2026-31480                      CVE-2026-31482 CVE-2026-31483 CVE-2026-31485 CVE-2026-31487                      CVE-2026-31488 CVE-2026-31489 CVE-2026-31492 CVE-2026-31494                      CVE-2026-31495 CVE-2026-31496 CVE-2026-31497 CVE-2026-31498                      CVE-2026-31500 CVE-2026-31502 CVE-2026-31503 CVE-2026-31504                      CVE-2026-31505 CVE-2026-31506 CVE-2026-31507 CVE-2026-31508                      CVE-2026-31509 CVE-2026-31510 CVE-2026-31511 CVE-2026-31512                      CVE-2026-31515 CVE-2026-31516 CVE-2026-31518 CVE-2026-31519                      CVE-2026-31520 CVE-2026-31521 CVE-2026-31522 CVE-2026-31523                      CVE-2026-31524 CVE-2026-31525 CVE-2026-31527 CVE-2026-31528                      CVE-2026-31530 CVE-2026-31531 CVE-2026-31532 CVE-2026-31533                      CVE-2026-31540 CVE-2026-31542 CVE-2026-31545 CVE-2026-31546                      CVE-2026-31548 CVE-2026-31549 CVE-2026-31550 CVE-2026-31551                      CVE-2026-31552 CVE-2026-31554 CVE-2026-31555 CVE-2026-31556                      CVE-2026-31557 CVE-2026-31558 CVE-2026-31559 CVE-2026-31561                      CVE-2026-31563 CVE-2026-31565 CVE-2026-31566 CVE-2026-31570                      CVE-2026-31575 CVE-2026-31576 CVE-2026-31577 CVE-2026-31578                      CVE-2026-31580 CVE-2026-31581 CVE-2026-31582 CVE-2026-31583                      CVE-2026-31584 CVE-2026-31585 CVE-2026-31586 CVE-2026-31587                      CVE-2026-31588 CVE-2026-31590 CVE-2026-31593 CVE-2026-31594                      CVE-2026-31595 CVE-2026-31596 CVE-2026-31597 CVE-2026-31598                      CVE-2026-31599 CVE-2026-31602 CVE-2026-31603 CVE-2026-31604                      CVE-2026-31605 CVE-2026-31606 CVE-2026-31607 CVE-2026-31610                      CVE-2026-31611 CVE-2026-31612 CVE-2026-31614 CVE-2026-31615                      CVE-2026-31616 CVE-2026-31617 CVE-2026-31618 CVE-2026-31619                      CVE-2026-31622 CVE-2026-31623 CVE-2026-31624 CVE-2026-31625                      CVE-2026-31626 CVE-2026-31627 CVE-2026-31628 CVE-2026-31629                      CVE-2026-31634 CVE-2026-31637 CVE-2026-31638 CVE-2026-31639                      CVE-2026-31642 CVE-2026-31644 CVE-2026-31645 CVE-2026-31646                      CVE-2026-31647 CVE-2026-31648 CVE-2026-31649 CVE-2026-31651                      CVE-2026-31655 CVE-2026-31656 CVE-2026-31657 CVE-2026-31658                      CVE-2026-31659 CVE-2026-31660 CVE-2026-31661 CVE-2026-31662                      CVE-2026-31664 CVE-2026-31665 CVE-2026-31666 CVE-2026-31667                      CVE-2026-31668 CVE-2026-31669 CVE-2026-31670 CVE-2026-31671                      CVE-2026-31672 CVE-2026-31673 CVE-2026-31674 CVE-2026-31675                      CVE-2026-31676 CVE-2026-31677 CVE-2026-31678 CVE-2026-31679                      CVE-2026-31680 CVE-2026-31681 CVE-2026-31682 CVE-2026-31683                      CVE-2026-31684 CVE-2026-31685 CVE-2026-31686 CVE-2026-31689                      CVE-2026-31693 CVE-2026-31786 CVE-2026-31787 CVE-2026-31788

    Several vulnerabilities have been discovered in the Linux kernel that     may lead to a privilege escalation, denial of service or information     leaks.

    For the stable distribution (trixie), these problems have been fixed in     version 6.12.85-1.

    We recommend that you upgrade your linux packages.

    For the detailed security status of linux please refer to its security     tracker page at:
    https://security-tracker.debian.org/tracker/linux

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - net: add xmit recursion limit to tunnel xmit functions Tunnel xmit functions (iptunnel_xmit,     ip6tunnel_xmit) lack their own recursion limit. When a bond device in broadcast mode has GRE tap     interfaces as slaves, and those GRE tunnels route back through the bond, multicast/broadcast traffic     triggers infinite recursion between bond_xmit_broadcast() and ip_tunnel_xmit()/ip6_tnl_xmit(), causing     kernel stack overflow. The existing XMIT_RECURSION_LIMIT (8) in the no-qdisc path is not sufficient     because tunnel recursion involves route lookups and full IP output, consuming much more stack per level.
    Use a lower limit of 4 (IP_TUNNEL_RECURSION_LIMIT) to prevent overflow. Add recursion detection using     dev_xmit_recursion helpers directly in iptunnel_xmit() and ip6tunnel_xmit() to cover all IPv4/IPv6 tunnel     paths including UDP encapsulated tunnels (VXLAN, Geneve, etc.). Move dev_xmit_recursion helpers from     net/core/dev.h to public header include/linux/netdevice.h so they can be used by tunnel code. BUG: KASAN:
    stack-out-of-bounds in blake2s.constprop.0+0xe7/0x160 Write of size 32 at addr ffff88810033fed0 by task     kworker/0:1/11 Workqueue: mld mld_ifc_work Call Trace: <TASK> __build_flow_key.constprop.0     (net/ipv4/route.c:515) ip_rt_update_pmtu (net/ipv4/route.c:1073) iptunnel_xmit     (net/ipv4/ip_tunnel_core.c:84) ip_tunnel_xmit (net/ipv4/ip_tunnel.c:847) gre_tap_xmit     (net/ipv4/ip_gre.c:779) dev_hard_start_xmit (net/core/dev.c:3887) sch_direct_xmit     (net/sched/sch_generic.c:347) __dev_queue_xmit (net/core/dev.c:4802) bond_dev_queue_xmit     (drivers/net/bonding/bond_main.c:312) bond_xmit_broadcast (drivers/net/bonding/bond_main.c:5279)     bond_start_xmit (drivers/net/bonding/bond_main.c:5530) dev_hard_start_xmit (net/core/dev.c:3887)
    __dev_queue_xmit (net/core/dev.c:4841) ip_finish_output2 (net/ipv4/ip_output.c:237) ip_output     (net/ipv4/ip_output.c:438) iptunnel_xmit (net/ipv4/ip_tunnel_core.c:86) gre_tap_xmit     (net/ipv4/ip_gre.c:779) dev_hard_start_xmit (net/core/dev.c:3887) sch_direct_xmit     (net/sched/sch_generic.c:347) __dev_queue_xmit (net/core/dev.c:4802) bond_dev_queue_xmit     (drivers/net/bonding/bond_main.c:312) bond_xmit_broadcast (drivers/net/bonding/bond_main.c:5279)     bond_start_xmit (drivers/net/bonding/bond_main.c:5530) dev_hard_start_xmit (net/core/dev.c:3887)
    __dev_queue_xmit (net/core/dev.c:4841) ip_finish_output2 (net/ipv4/ip_output.c:237) ip_output     (net/ipv4/ip_output.c:438) iptunnel_xmit (net/ipv4/ip_tunnel_core.c:86) ip_tunnel_xmit     (net/ipv4/ip_tunnel.c:847) gre_tap_xmit (net/ipv4/ip_gre.c:779) dev_hard_start_xmit (net/core/dev.c:3887)     sch_direct_xmit (net/sched/sch_generic.c:347) __dev_queue_xmit (net/core/dev.c:4802) bond_dev_queue_xmit     (drivers/net/bonding/bond_main.c:312) bond_xmit_broadcast (drivers/net/bonding/bond_main.c:5279)     bond_start_xmit (drivers/net/bonding/bond_main.c:5530) dev_hard_start_xmit (net/core/dev.c:3887)
    __dev_queue_xmit (net/core/dev.c:4841) mld_sendpack mld_ifc_work process_one_work worker_thread </TASK>     (CVE-2026-23276)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
320742	EulerOS Virtualization 2.13.0 : kernel (EulerOS-SA-2026-2400)	Nessus	Huawei Local Security Checks	high
320698	EulerOS Virtualization 2.13.1 : kernel (EulerOS-SA-2026-2371)	Nessus	Huawei Local Security Checks	high
320255	EulerOS 2.0 SP13 : kernel (EulerOS-SA-2026-2293)	Nessus	Huawei Local Security Checks	high
320254	EulerOS 2.0 SP13 : kernel (EulerOS-SA-2026-2336)	Nessus	Huawei Local Security Checks	high
319993	EulerOS 2.0 SP11 : kernel (EulerOS-SA-2026-2209)	Nessus	Huawei Local Security Checks	high
319967	EulerOS 2.0 SP11 : kernel (EulerOS-SA-2026-2247)	Nessus	Huawei Local Security Checks	high
319659	SUSE SLES16 Security Update : kernel (SUSE-SU-2026:21845-1)	Nessus	SuSE Local Security Checks	high
318240	SUSE SLES16 Security Update : kernel (SUSE-SU-2026:21860-1)	Nessus	SuSE Local Security Checks	high
318102	openSUSE 16 Security Update : kernel (openSUSE-SU-2026:20826-1)	Nessus	SuSE Local Security Checks	high
317729	SUSE SLES12 Security Update : kernel (SUSE-SU-2026:2068-1)	Nessus	SuSE Local Security Checks	medium
311340	Amazon Linux 2023 : bpftool6.18, kernel6.18, kernel6.18-devel (ALAS2023-2026-1596)	Nessus	Amazon Linux Local Security Checks	high
311335	Amazon Linux 2023 : bpftool6.12, kernel6.12, kernel6.12-devel (ALAS2023-2026-1594)	Nessus	Amazon Linux Local Security Checks	high
311299	Debian dsa-6238 : ata-modules-6.12.74+deb13+1-armmp-di - security update	Nessus	Debian Local Security Checks	high
303182	Linux Distros Unpatched Vulnerability : CVE-2026-23276	Nessus	Misc.	medium

Detections

Analytics

CVE-2026-23276

medium

Tenable Plugins

high

high

high

high

high

high

high

high

high

medium

high

high

high

medium