In the Linux kernel, the following vulnerability has been resolved: af_unix: Give up GC if MSG_PEEK intervened. Igor Ushakov reported that GC purged the receive queue of an alive socket due to a race with MSG_PEEK with a nice repro. This is the exact same issue previously fixed by commit cbcf01128d0a ("af_unix: fix garbage collect vs MSG_PEEK"). After GC was replaced with the current algorithm, the cited commit removed the locking dance in unix_peek_fds() and reintroduced the same issue. The problem is that MSG_PEEK bumps a file refcount without interacting with GC. Consider an SCC containing sk-A and sk-B, where sk-A is close()d but can be recv()ed via sk-B. The bad thing happens if sk-A is recv()ed with MSG_PEEK from sk-B and sk-B is close()d while GC is checking unix_vertex_dead() for sk-A and sk-B. GC thread User thread --------- ----------- unix_vertex_dead(sk-A) -> true <------. \ `------ recv(sk-B, MSG_PEEK) invalidate !! -> sk-A's file refcount : 1 -> 2 close(sk-B) -> sk-B's file refcount : 2 -> 1 unix_vertex_dead(sk-B) -> true Initially, sk-A's file refcount is 1 by the inflight fd in sk-B recvq. GC thinks sk-A is dead because the file refcount is the same as the number of its inflight fds. However, sk-A's file refcount is bumped silently by MSG_PEEK, which invalidates the previous evaluation. At this moment, sk-B's file refcount is 2; one by the open fd, and one by the inflight fd in sk-A. The subsequent close() releases one refcount by the former. Finally, GC incorrectly concludes that both sk-A and sk-B are dead. One option is to restore the locking dance in unix_peek_fds(), but we can resolve this more elegantly thanks to the new algorithm. The point is that the issue does not occur without the subsequent close() and we actually do not need to synchronise MSG_PEEK with the dead SCC detection. When the issue occurs, close() and GC touch the same file refcount. If GC sees the refcount being decremented by close(), it can just give up garbage-collecting the SCC. Therefore, we only need to signal the race during MSG_PEEK with a proper memory barrier to make it visible to the GC. Let's use seqcount_t to notify GC when MSG_PEEK occurs and let it defer the SCC to the next run. This way no locking is needed on the MSG_PEEK side, and we can avoid imposing a penalty on every MSG_PEEK unnecessarily. Note that we can retry within unix_scc_dead() if MSG_PEEK is detected, but we do not do so to avoid hung task splat from abusive MSG_PEEK calls.

The remote Ubuntu 24.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-8508-1 advisory.

    Several security issues were discovered in the Linux kernel. An attacker could possibly use these to     compromise the system. This update corrects flaws in the following subsystems:

    - ARM64 architecture;

    - S390 architecture;

    - Block layer subsystem;

    - Cryptographic API;

    - DMA engine subsystem;

    - GPU drivers;

    - InfiniBand drivers;

    - Ethernet bonding driver;

    - STMicroelectronics network drivers;

    - Network drivers;

    - NVME drivers;

    - SCSI subsystem;

    - USB over IP driver;

    - File systems infrastructure;

    - Ext4 file system;

    - Network file system (NFS) server daemon;

    - SMB network file system;

    - Kernel thread helper (kthread);

    - Distributed Switch Architecture;

    - IPv6 networking;

    - Netfilter;

    - Tracing infrastructure;

    - Control group (cgroup);

    - Kernel exit() syscall;

    - Scatterlist API;

    - Memory management;

    - B.A.T.M.A.N. meshing protocol;

    - Ethernet bridge;

    - Ceph Core library;

    - IPv4 networking;

    - MAC80211 subsystem;

    - Multipath TCP;

    - Packet sockets;

    - RxRPC session sockets;

    - SMC sockets;

    - TLS protocol;

    - Unix domain sockets;

    - X.25 network layer;

    - AppArmor security module; (CVE-2025-71088, CVE-2025-71090, CVE-2025-71127, CVE-2025-71134,     CVE-2025-71141, CVE-2025-71142, CVE-2025-71144, CVE-2025-71152, CVE-2025-71155, CVE-2026-22984,     CVE-2026-23112, CVE-2026-23231, CVE-2026-23272, CVE-2026-23273, CVE-2026-23274, CVE-2026-23278,     CVE-2026-23351, CVE-2026-23392, CVE-2026-23394, CVE-2026-23427, CVE-2026-23428, CVE-2026-23450,     CVE-2026-23455, CVE-2026-31402, CVE-2026-31418, CVE-2026-31419, CVE-2026-31436, CVE-2026-31448,     CVE-2026-31478, CVE-2026-31504, CVE-2026-31533, CVE-2026-31607, CVE-2026-31635, CVE-2026-31637,     CVE-2026-31649, CVE-2026-31657, CVE-2026-31659, CVE-2026-31668, CVE-2026-31669, CVE-2026-31682,     CVE-2026-31685, CVE-2026-31718, CVE-2026-43011, CVE-2026-43033, CVE-2026-43037, CVE-2026-43038,     CVE-2026-43071, CVE-2026-43077, CVE-2026-43078, CVE-2026-43083, CVE-2026-43114, CVE-2026-43117,     CVE-2026-43125, CVE-2026-43186, CVE-2026-43197, CVE-2026-43304, CVE-2026-43341, CVE-2026-43376,     CVE-2026-43378, CVE-2026-43383, CVE-2026-43384, CVE-2026-43402, CVE-2026-43406, CVE-2026-43407,     CVE-2026-43414, CVE-2026-43493, CVE-2026-43501, CVE-2026-45898, CVE-2026-45966, CVE-2026-45988,     CVE-2026-46028, CVE-2026-46039, CVE-2026-46043, CVE-2026-46115, CVE-2026-46119, CVE-2026-46135,     CVE-2026-46185, CVE-2026-46195, CVE-2026-46243, CVE-2026-46244, CVE-2026-46266, CVE-2026-46289,     CVE-2026-46316, CVE-2026-46325)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 24.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-8499-1 advisory.

    It was discovered that the Linux kernel algif_aead module did not properly handle in-place cryptographic     operations. This flaw is known as Copy Fail. A local attacker could use this to escalate privileges, or     possibly escape a container. (CVE-2026-31431)

    It was discovered that the Linux kernel did not properly handle shared page fragments during socket buffer     operations, collectively known as Dirty Frag. A logic flaw existed in the XFRM ESP-in-TCP subsystem and in     the RxRPC networking subsystem when processing paged fragments. A local attacker could use this to     escalate privileges, or possibly escape a container. (CVE-2026-43284, CVE-2026-43500, CVE-2026-45998,     CVE-2026-46000)

    It was discovered that a logic flaw existed in the XFRM ESP-in-TCP subsystem in the Linux kernel when     handling socket buffer fragments. This flaw is known as Fragnesia. A local attacker could use this to     escalate privileges, or possibly escape a container. (CVE-2026-43503, CVE-2026-46300)

    Qualys discovered that a race condition existed in the ptrace subsystem of the Linux kernel when     privileged processes are exiting. An unprivileged local attacker could use this issue to expose sensitive     information. (CVE-2026-46333)

    Tristan Madani discovered that Ubuntu Linux kernel 6.8, 6.17 and 7.0 contain a memory leak when handling     AppArmor notifications. A local attacker could use this to cause resource exhaustion. (CVE-2026-47326)

    Tristan Madani discovered that Ubuntu Linux kernel 6.8, 6.17 and 7.0 contain a NULL pointer dereference     when handling AppArmor notifications. A local attacker could use this to cause a kernel oops.
    (CVE-2026-47327)

    Tristan Madani discovered that Ubuntu Linux kernel 6.8, 6.17 and 7.0 contained an invalid free when     handling AppArmor notifications. A local attacker could use this to corrupt kernel memory.
    (CVE-2026-47328)

    Tristan Madani discovered that Ubuntu Linux kernel 6.8, 6.17 and 7.0 contained insufficient validation of     AppArmor notification responses. A local attacker could use this to allow crafted responses to be     processed. (CVE-2026-47329)

    Tristan Madani discovered that Ubuntu Linux kernel 6.8, 6.17 and 7.0 used an uninitialized variable when     handling AppArmor notifications. A local attacker could use this to cause incorrect caching of data.
    (CVE-2026-47330)

    Tristan Madani discovered that Ubuntu Linux kernel 6.8 contained a use- after-free (UAF) bug. A local     attacker could use this to cause memory corruption and, theoretically, arbitrary code execution.
    (CVE-2026-47331)

    Tristan Madani discovered that Ubuntu Linux kernel 6.8, 6.17 and 7.0 contained an out-of-bounds (OOB) read     when handling AppArmor notifications. A local attacker could use this to cause information disclosure of     kernel memory. (CVE-2026-47332)

    Tristan Madani discovered that Ubuntu Linux kernel 6.8, 6.17 and 7.0 contained a out-of-bounds (OOB) read     when handling AppArmor notifications. A local attacker could use this to cause kernel memory corruption     and, theoretically, influence processing of AppArmor policies. (CVE-2026-47333)

    Tristan Madani discovered that Ubuntu Linux kernel 6.8, 6.17 and 7.0 contained incorrect holding of locks     when handling AppArmor notifications. A local attacker could use this to cause a kernel panic or deadlock.
    (CVE-2026-47334)

    Tristan Madani discovered that Ubuntu Linux kernel 6.8 contained a NULL pointer dereference when handling     AppArmor notifications. A local attacker could use this to cause a kernel panic. (CVE-2026-47335)

    Tristan Madani discovered that Ubuntu Linux kernel 6.8 used an uninitialized variable when handling     AppArmor AF_INET/AF_INET6 socket mediation. A local attacker could use this to influence processing of     fine- grained network socket mediation. (CVE-2026-47336)

    Tristan Madani and Trevor Lawrence have each independently discovered that Ubuntu Linux kernel 6.8, 6.17     and 7.0 contained a NULL pointer dereference when handling AppArmor network socket mediation. A local     attacker could use this to cause a kernel oops. (CVE-2026-47337)

    Several security issues were discovered in the Linux kernel. An attacker could possibly use these to     compromise the system. This update corrects flaws in the following subsystems:

    - Foo-over-UDP (FOU);

    - ARM64 architecture;

    - MIPS architecture;

    - PowerPC architecture;

    - x86 architecture;

    - Block layer subsystem;

    - Cryptographic API;

    - Intel NPU Driver;

    - ACPI drivers;

    - ATM drivers;

    - Drivers core;

    - Null block device driver;

    - RNBD block device driver;

    - Ublk userspace block driver;

    - Bluetooth drivers;

    - Bus devices;

    - Character device driver;

    - TPM device driver;

    - Clock framework and drivers;

    - Clocksource drivers;

    - Counter interface drivers;

    - CPU idle management framework;

    - Hardware crypto device drivers;

    - DMA engine subsystem;

    - DPLL subsystem;

    - EFI core;

    - GPIO subsystem;

    - GPU drivers;

    - HID subsystem;

    - Hardware monitoring drivers;

    - Intel Trace Hub HW tracing drivers;

    - IIO subsystem;

    - IIO ADC drivers;

    - InfiniBand drivers;

    - On-Chip Interconnect management framework;

    - IOMMU subsystem;

    - IRQ chip drivers;

    - Modular ISDN driver;

    - LED subsystem;

    - Multiple devices driver;

    - Media drivers;

    - Multifunction device drivers;

    - Broadcom VK accelerator driver;

    - UACCE accelerator framework;

    - MMC subsystem;

    - MOST (Media Oriented Systems Transport) drivers;

    - MTD block device drivers;

    - Ethernet bonding driver;

    - Network drivers;

    - Mellanox network drivers;

    - STMicroelectronics network drivers;

    - NTB driver;

    - NVME drivers;

    - PCI subsystem;

    - Performance monitor drivers;

    - PHY drivers;

    - Pin controllers subsystem;

    - x86 platform drivers;

    - i.MX PM domains;

    - Power supply drivers;

    - RapidIO drivers;

    - RAS (Reliability, Availability, Serviceability) subsystem;

    - Remote Processor subsystem;

    - RPMSG subsystem;

    - S/390 drivers;

    - SCSI subsystem;

    - SLIMbus drivers;

    - MediaTek SoC drivers;

    - Texas Instruments SoC drivers;

    - SPI subsystem;

    - Greybus lights staging drivers;

    - Realtek RTL8723BS SDIO drivers;

    - TCM subsystem;

    - UFS subsystem;

    - ChipIdea USB driver;

    - DesignWare USB3 driver;

    - USB over IP driver;

    - vDPA drivers;

    - Virtio Host (VHOST) subsystem;

    - Framebuffer layer;

    - W1 Dallas's 1-wire bus driver;

    - Xen hypervisor drivers;

    - BTRFS file system;

    - File systems infrastructure;

    - Ceph distributed file system;

    - EFI Variable file system;

    - exFAT file system;

    - Ext4 file system;

    - F2FS file system;

    - FAT file system;

    - GFS2 file system;

    - HFS+ file system;

    - JFS file system;

    - Network file system (NFS) client;

    - Network file system (NFS) server daemon;

    - NILFS2 file system;

    - NTFS3 file system;

    - OCFS2 file system;

    - Proc file system;

    - Pstore file system;

    - Diskquota system;

    - SMB network file system;

    - XFS file system;

    - Audit subsystem;

    - Memory Management;

    - Scheduler infrastructure;

    - IPv6 networking;

    - Netfilter;

    - NFC subsystem;

    - Tracing infrastructure;

    - io_uring subsystem;

    - BPF subsystem;

    - Perf events;

    - Kernel kexec() syscall;

    - RCU subsystem;

    - Floating proportions library;

    - Scatterlist API;

    - Memory management;

    - 9P file system network protocol;

    - Asynchronous Transfer Mode (ATM) subsystem;

    - B.A.T.M.A.N. meshing protocol;

    - Bluetooth subsystem;

    - Ethernet bridge;

    - CAN network layer;

    - Ceph Core library;

    - Networking core;

    - IPv4 networking;

    - KCM (Kernel Connection Multiplexor) sockets driver;

    - L2TP protocol;

    - MAC80211 subsystem;

    - Multipath TCP;

    - NET/ROM layer;

    - Packet sockets;

    - RDS protocol;

    - RxRPC session sockets;

    - Network traffic control;

    - SCTP protocol;

    - SMC sockets;

    - Sun RPC protocol;

    - TLS protocol;

    - Unix domain sockets;

    - VMware vSockets driver;

    - Wireless networking;

    - X.25 network layer;

    - XFRM subsystem;

    - AppArmor security module;

    - Simplified Mandatory Access Control Kernel framework;

    - ALSA AC97 driver;

    - Generic PCM loopback sound driver;

    - Creative Sound Blaster X-Fi driver;

    - AMD SoC Alsa drivers;

    - Texas InstrumentS Audio (ASoC/HDA) drivers;

    - SOF drivers;

    - USB sound devices;

    - KVM subsystem; (CVE-2024-50004, CVE-2024-58096, CVE-2024-58097, CVE-2025-37926, CVE-2025-38201,     CVE-2025-38591, CVE-2025-40005, CVE-2025-40039, CVE-2025-40082, CVE-2025-40149, CVE-2025-68351,     CVE-2025-68358, CVE-2025-68365, CVE-2025-68725, CVE-2025-68749, CVE-2025-68803, CVE-2025-68823,     CVE-2025-71160, CVE-2025-71162, CVE-2025-71163, CVE-2025-71180, CVE-2025-71182, CVE-2025-71183,     CVE-2025-71184, CVE-2025-71185, CVE-2025-71186, CVE-2025-71188, CVE-2025-71189, CVE-2025-71190,     CVE-2025-71191, CVE-2025-71192, CVE-2025-71193, CVE-2025-71194, CVE-2025-71195, CVE-2025-71196,     CVE-2025-71197, CVE-2025-71198, CVE-2025-71199, CVE-2025-71200, CVE-2025-71220, CVE-2025-71222,     CVE-2025-71224, CVE-2025-71225, CVE-2025-71229, CVE-2025-71231, CVE-2025-71232, CVE-2025-71233,     CVE-2025-71235, CVE-2025-71236, CVE-2025-71237, CVE-2025-71238, CVE-2025-71239, CVE-2025-71265,     CVE-2025-71266, CVE-2025-71267, CVE-2025-71268, CVE-2025-71272, CVE-2025-71273, CVE-2025-71274,     CVE-2025-71286, CVE-2025-71291, CVE-2025-71292, CVE-2025-71294, CVE-2025-71295, CVE-2025-71297,     CVE-2025-71304, CVE-2025-71305, CVE-2026-22976, CVE-2026-22977, CVE-2026-22978, CVE-2026-22979,     CVE-2026-22980, CVE-2026-22982, CVE-2026-22984, CVE-2026-22990, CVE-2026-22991, CVE-2026-22992,     CVE-2026-22994, CVE-2026-22996, CVE-2026-22997, CVE-2026-22998, CVE-2026-22999, CVE-2026-23000,     CVE-2026-23001, CVE-2026-23003, CVE-2026-23005, CVE-2026-23006, CVE-2026-23010, CVE-2026-23011,     CVE-2026-23019, CVE-2026-23020, CVE-2026-23021, CVE-2026-23025, CVE-2026-23026, CVE-2026-23030,     CVE-2026-23031, CVE-2026-23032, CVE-2026-23033, CVE-2026-23035, CVE-2026-23037, CVE-2026-23038,     CVE-2026-23047, CVE-2026-23049, CVE-2026-23050, CVE-2026-23053, CVE-2026-23054, CVE-2026-23056,     CVE-2026-23057, CVE-2026-23058, CVE-2026-23059, CVE-2026-23061, CVE-2026-23062, CVE-2026-23063,     CVE-2026-23064, CVE-2026-23065, CVE-2026-23068, CVE-2026-23069, CVE-2026-23071, CVE-2026-23073,     CVE-2026-23075, CVE-2026-23076, CVE-2026-23078, CVE-2026-23080, CVE-2026-23083, CVE-2026-23084,     CVE-2026-23085, CVE-2026-23086, CVE-2026-23087, CVE-2026-23088, CVE-2026-23089, CVE-2026-23090,     CVE-2026-23091, CVE-2026-23093, CVE-2026-23094, CVE-2026-23095, CVE-2026-23096, CVE-2026-23097,     CVE-2026-23098, CVE-2026-23099, CVE-2026-23100, CVE-2026-23101, CVE-2026-23102, CVE-2026-23103,     CVE-2026-23105, CVE-2026-23107, CVE-2026-23108, CVE-2026-23110, CVE-2026-23113, CVE-2026-23116,     CVE-2026-23119, CVE-2026-23120, CVE-2026-23121, CVE-2026-23123, CVE-2026-23124, CVE-2026-23125,     CVE-2026-23126, CVE-2026-23128, CVE-2026-23129, CVE-2026-23131, CVE-2026-23133, CVE-2026-23135,     CVE-2026-23136, CVE-2026-23139, CVE-2026-23140, CVE-2026-23141, CVE-2026-23142, CVE-2026-23144,     CVE-2026-23145, CVE-2026-23146, CVE-2026-23148, CVE-2026-23150, CVE-2026-23151, CVE-2026-23156,     CVE-2026-23159, CVE-2026-23160, CVE-2026-23163, CVE-2026-23164, CVE-2026-23166, CVE-2026-23167,     CVE-2026-23168, CVE-2026-23169, CVE-2026-23170, CVE-2026-23172, CVE-2026-23173, CVE-2026-23176,     CVE-2026-23178, CVE-2026-23179, CVE-2026-23180, CVE-2026-23182, CVE-2026-23187, CVE-2026-23190,     CVE-2026-23191, CVE-2026-23193, CVE-2026-23198, CVE-2026-23200, CVE-2026-23202, CVE-2026-23204,     CVE-2026-23205, CVE-2026-23206, CVE-2026-23212, CVE-2026-23213, CVE-2026-23214, CVE-2026-23215,     CVE-2026-23216, CVE-2026-23220, CVE-2026-23221, CVE-2026-23222, CVE-2026-23228, CVE-2026-23229,     CVE-2026-23230, CVE-2026-23233, CVE-2026-23234, CVE-2026-23235, CVE-2026-23236, CVE-2026-23237,     CVE-2026-23238, CVE-2026-23241, CVE-2026-23242, CVE-2026-23243, CVE-2026-23249, CVE-2026-23254,     CVE-2026-23256, CVE-2026-23257, CVE-2026-23258, CVE-2026-23260, CVE-2026-23261, CVE-2026-23262,     CVE-2026-23264, CVE-2026-23266, CVE-2026-23267, CVE-2026-23272, CVE-2026-23274, CVE-2026-23278,     CVE-2026-23351, CVE-2026-23392, CVE-2026-23394, CVE-2026-23428, CVE-2026-23450, CVE-2026-23455,     CVE-2026-31402, CVE-2026-31411, CVE-2026-31418, CVE-2026-31419, CVE-2026-31436, CVE-2026-31448,     CVE-2026-31478, CVE-2026-31504, CVE-2026-31533, CVE-2026-31607, CVE-2026-31637, CVE-2026-31649,     CVE-2026-31657, CVE-2026-31659, CVE-2026-31668, CVE-2026-31669, CVE-2026-31676, CVE-2026-31682,     CVE-2026-31685, CVE-2026-31687, CVE-2026-31693, CVE-2026-43011, CVE-2026-43033, CVE-2026-43037,     CVE-2026-43038, CVE-2026-43071, CVE-2026-43077, CVE-2026-43078, CVE-2026-43114, CVE-2026-43117,     CVE-2026-43123, CVE-2026-43124, CVE-2026-43128, CVE-2026-43130, CVE-2026-43132, CVE-2026-43133,     CVE-2026-43134, CVE-2026-43135, CVE-2026-43136, CVE-2026-43137, CVE-2026-43139, CVE-2026-43140,     CVE-2026-43141, CVE-2026-43143, CVE-2026-43145, CVE-2026-43147, CVE-2026-43148, CVE-2026-43149,     CVE-2026-43150, CVE-2026-43152, CVE-2026-43153, CVE-2026-43156, CVE-2026-43157, CVE-2026-43158,     CVE-2026-43159, CVE-2026-43163, CVE-2026-43167, CVE-2026-43168, CVE-2026-43169, CVE-2026-43170,     CVE-2026-43171, CVE-2026-43173, CVE-2026-43175, CVE-2026-43180, CVE-2026-43182, CVE-2026-43183,     CVE-2026-43184, CVE-2026-43186, CVE-2026-43187, CVE-2026-43189, CVE-2026-43190, CVE-2026-43194,     CVE-2026-43196, CVE-2026-43199, CVE-2026-43200, CVE-2026-43201, CVE-2026-43202, CVE-2026-43203,     CVE-2026-43205, CVE-2026-43206, CVE-2026-43207, CVE-2026-43209, CVE-2026-43211, CVE-2026-43212,     CVE-2026-43214, CVE-2026-43215, CVE-2026-43218, CVE-2026-43221, CVE-2026-43222, CVE-2026-43223,     CVE-2026-43225, CVE-2026-43226, CVE-2026-43227, CVE-2026-43230, CVE-2026-43231, CVE-2026-43232,     CVE-2026-43233, CVE-2026-43236, CVE-2026-43238, CVE-2026-43239, CVE-2026-43241, CVE-2026-43242,     CVE-2026-43244, CVE-2026-43246, CVE-2026-43248, CVE-2026-43249, CVE-2026-43250, CVE-2026-43251,     CVE-2026-43253, CVE-2026-43255, CVE-2026-43256, CVE-2026-43257, CVE-2026-43258, CVE-2026-43261,     CVE-2026-43262, CVE-2026-43264, CVE-2026-43266, CVE-2026-43268, CVE-2026-43269, CVE-2026-43270,     CVE-2026-43271, CVE-2026-43273, CVE-2026-43275, CVE-2026-43277, CVE-2026-43278, CVE-2026-43279,     CVE-2026-43283, CVE-2026-43287, CVE-2026-43288, CVE-2026-43289, CVE-2026-43291, CVE-2026-43295,     CVE-2026-43296, CVE-2026-43297, CVE-2026-43300, CVE-2026-43302, CVE-2026-43304, CVE-2026-43312,     CVE-2026-43313, CVE-2026-43314, CVE-2026-43315, CVE-2026-43316, CVE-2026-43317, CVE-2026-43318,     CVE-2026-43319, CVE-2026-43320, CVE-2026-43341, CVE-2026-43378, CVE-2026-43383, CVE-2026-43384,     CVE-2026-43406, CVE-2026-43407, CVE-2026-43414, CVE-2026-43493, CVE-2026-43494, CVE-2026-43501,     CVE-2026-45847, CVE-2026-45848, CVE-2026-45849, CVE-2026-45851, CVE-2026-45852, CVE-2026-45856,     CVE-2026-45857, CVE-2026-45859, CVE-2026-45860, CVE-2026-45861, CVE-2026-45862, CVE-2026-45864,     CVE-2026-45865, CVE-2026-45866, CVE-2026-45867, CVE-2026-45868, CVE-2026-45869, CVE-2026-45870,     CVE-2026-45871, CVE-2026-45872, CVE-2026-45873, CVE-2026-45875, CVE-2026-45877, CVE-2026-45878,     CVE-2026-45879, CVE-2026-45880, CVE-2026-45881, CVE-2026-45882, CVE-2026-45883, CVE-2026-45884,     CVE-2026-45885, CVE-2026-45886, CVE-2026-45890, CVE-2026-45891, CVE-2026-45893, CVE-2026-45895,     CVE-2026-45902, CVE-2026-45904, CVE-2026-45905, CVE-2026-45910, CVE-2026-45912, CVE-2026-45913,     CVE-2026-45914, CVE-2026-45915, CVE-2026-45916, CVE-2026-45917, CVE-2026-45919, CVE-2026-45921,     CVE-2026-45923, CVE-2026-45928, CVE-2026-45935, CVE-2026-45936, CVE-2026-45938, CVE-2026-45941,     CVE-2026-45946, CVE-2026-45947, CVE-2026-45948, CVE-2026-45954, CVE-2026-45957, CVE-2026-45960,     CVE-2026-45962, CVE-2026-45964, CVE-2026-45965, CVE-2026-45968, CVE-2026-45969, CVE-2026-45970,     CVE-2026-45973, CVE-2026-45974, CVE-2026-45976, CVE-2026-45978, CVE-2026-45981, CVE-2026-45982,     CVE-2026-45983, CVE-2026-45984, CVE-2026-45988, CVE-2026-46028, CVE-2026-46043, CVE-2026-46115,     CVE-2026-46119, CVE-2026-46135, CVE-2026-46185, CVE-2026-46195, CVE-2026-46243, CVE-2026-46244,     CVE-2026-46246, CVE-2026-46247, CVE-2026-46249, CVE-2026-46250, CVE-2026-46251, CVE-2026-46253,     CVE-2026-46254, CVE-2026-46255, CVE-2026-46259, CVE-2026-46261, CVE-2026-46265, CVE-2026-46266,     CVE-2026-46267, CVE-2026-46270, CVE-2026-46289, CVE-2026-46323, CVE-2026-46328)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    crypto: algif_aead - Revert to operating out-of-place(CVE-2026-31431)

    bpf: Fix undefined behavior in interpreter sdiv/smod for INT_MIN(CVE-2026-31525)

    can: bcm: fix locking for bcm_op runtime updates(CVE-2026-23362)

    media: mediatek: vcodec: Use spinlock for context list protection lock(CVE-2025-71140)

    smb: client: Don#39;t log plaintext credentials in cifs_set_cifscreds(CVE-2026-23303)

    media: mc, v4l2: serialize REINIT and REQBUFS with req_queue_mutex(CVE-2026-31473)

    regmap: maple: free entry on mas_store_gfp() failure(CVE-2026-23260)

    ACPI: EC: clean up handlers on probe failure in acpi_ec_setup()(CVE-2026-31426)

    apparmor: replace recursive profile removal with iterative approach(CVE-2026-23404)

    tls: Fix race condition in tls_sw_cancel_work_tx()(CVE-2026-23240)

    macvlan: observe an RCU grace period in macvlan_common_newlink() error path(CVE-2026-23273)

    i40e: Fix preempt count leak in napi poll tracepoint(CVE-2026-23313)

    PM: runtime: Fix a race condition related to device removal(CVE-2026-23452)

    net: bridge: fix nd_tbl NULL dereference when IPv6 is disabled(CVE-2026-23381)

    p data-testid='vuln-description'Rejected reason: This CVE ID has been rejected or withdrawn by its     CVE Numbering Authority./pbr/(CVE-2026-23473)

    net: phy: register phy led_triggers during probe to avoid AB-BA deadlock(CVE-2026-23368)

    net: add proper RCU protection to /proc/net/ptype(CVE-2026-23255)

    ice: Fix memory leak in ice_set_ringparam()(CVE-2026-23389)

    ipv6: add NULL checks for idev in SRv6 paths(CVE-2026-23442)

    tracing: Fix potential deadlock in cpu hotplug with osnoise(CVE-2026-31480)

    ice: change XDP RxQ frag_size from DMA write length to xdp.frame_sz(CVE-2026-23377)

    tls: Purge async_hold in tls_decrypt_async_wait()(CVE-2026-23414)

    icmp: fix NULL pointer dereference in icmp_tag_validation()(CVE-2026-23398)

    apparmor: fix memory leak in verify_header(CVE-2026-23403)

    x86/efi: defer freeing of boot services memory(CVE-2026-23352)

    netfilter: nf_tables: always walk all pending catchall elements(CVE-2026-23278)

    nvme: fix admin queue leak on controller reset(CVE-2026-23360)

    media: dvb-net: fix OOB access in ULE extension header tables(CVE-2026-31405)

    netfilter: xt_IDLETIMER: reject rev0 reuse of ALARM timer labels(CVE-2026-23274)

    net: vxlan: fix nd_tbl NULL dereference when IPv6 is disabled(CVE-2026-23293)

    media: dvb-core: fix wrong reinitialization of ringbuffer on reopen(CVE-2026-23253)

    nvme-fc: release admin tagset if init fails(CVE-2026-23261)

    tcp: secure_seq: add back ports to TS offset(CVE-2026-23247)

    KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE(CVE-2026-23401)

    netfilter: bpf: defer hook memory release until rcu readers are done(CVE-2026-23412)

    apparmor: fix missing bounds check on DEFAULT table in verify_dfa()(CVE-2026-23407)

    ipv6: fix NULL pointer deref in ip6_rt_get_dev_rcu()(CVE-2026-23304)

    ext4: fix iloc.bh leak in ext4_xattr_inode_update_ref(CVE-2026-23145)

    net: gro: fix outer network offset(CVE-2026-23254)

    netfilter: nf_tables: release flowtable after rcu grace period on error(CVE-2026-23392)

    perf: Fix __perf_event_overflow() vs perf_remove_from_context() race(CVE-2026-23271)

    sunrpc: fix cache_request leak in cache_release(CVE-2026-31400)

    RDMA/umad: Reject negative data_len in ib_umad_write(CVE-2026-23243)

    af_unix: Give up GC if MSG_PEEK intervened.(CVE-2026-23394)

    clsact: Fix use-after-free in init/destroy rollback asymmetry(CVE-2026-23413)

    net: ipv6: fix panic when IPv4 route references loopback IPv6 nexthop(CVE-2026-23300)

    apparmor: fix unprivileged local user can do privileged policy management(CVE-2026-23268)

    blktrace: fix __this_cpu_read/write in preemptible context(CVE-2026-23374)

    arm64: io: Extract user memory type in ioremap_prot()(CVE-2026-23346)

    xdp: produce a warning when calculated tailroom is negative(CVE-2026-23343)

    mm: thp: deny THP for files on anonymous inodes(CVE-2026-23375)

    drm/vmwgfx: Return the correct value in vmw_translate_ptr functions(CVE-2026-23317)

    netfilter: nft_set_pipapo: split gc into unlink and reclaim phase(CVE-2026-23351)

    Squashfs: check metadata block offset is within range(CVE-2026-23388)

    net: add xmit recursion limit to tunnel xmit functions(CVE-2026-23276)

    net: sched: avoid qdisc_reset_all_tx_gt() vs dequeue race for lockless qdiscs(CVE-2026-23340)

    scsi: target: Fix recursive locking in __configfs_open_file()(CVE-2026-23292)

    netfilter: nf_tables: unconditionally bump set-gt;nelems before insertion(CVE-2026-23272)

    apparmor: fix differential encoding verification(CVE-2026-23409)

    dmaengine: idxd: Fix leaking event log memory(CVE-2026-31440)

    bpf/bonding: reject vlan+srcmac xmit_hash_policy change when XDP is loaded(CVE-2026-23310)

    apparmor: fix: limit the number of levels of policy namespaces(CVE-2026-23405)

    net: annotate data-races around sk-gt;sk_{data_ready,write_space}(CVE-2026-23302)

    nfnetlink_osf: validate individual option lengths in fingerprints(CVE-2026-23397)

    erofs: add GFP_NOIO in the bio completion if needed(CVE-2026-31467)

    nvme: fix memory allocation in nvme_pr_read_keys()(CVE-2026-23244)

    arm64: Set __nocfi on swsusp_arch_resume()(CVE-2026-23128)

    nf_tables: nft_dynset: fix possible stateful expression memleak in error path(CVE-2026-23399)

    apparmor: fix side-effect bug in match_char() macro usage(CVE-2026-23406)

    NFSD: Defer sub-object cleanup in export put callbacks(CVE-2026-31404)

    audit: add fchmodat2() to change attributes class(CVE-2025-71239)

    netfilter: xt_CT: drop pending enqueued packets on template removal(CVE-2026-23391)

    bpf: Fix a UAF issue in bpf_trampoline_link_cgroup_shim(CVE-2026-23319)

    apparmor: validate DFA start states are in bounds in unpack_pdb(CVE-2026-23269)

    bpf: Fix stack-out-of-bounds write in devmap(CVE-2026-23359)

    spi: fix use-after-free on controller registration failure(CVE-2026-31389)

    apparmor: Fix double free of ns_name in aa_replace_profiles()(CVE-2026-23408)

    spi: fix statistics allocation(CVE-2026-23475)

    smb: client: fix krb5 mount with username option(CVE-2026-31392)

    NFSD: Hold net reference for the lifetime of /proc/fs/nfs/exports fd(CVE-2026-31403)

    apparmor: fix race between freeing data and fs accessing it(CVE-2026-23411)

    apparmor: fix race on rawdata dereference(CVE-2026-23410)

    sched/deadline: Fix missing ENQUEUE_REPLENISH during PI de-boosting(CVE-2026-23371)

    dmaengine: idxd: Fix memory leak when a wq is reset(CVE-2026-31441)

Tenable has extracted the preceding description block directly from the EulerOS kernel security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6355 advisory.

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-6355-1                   security@debian.org     https://www.debian.org/security/                     Salvatore Bonaccorso     June 21, 2026                         https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : linux     CVE ID         : CVE-2025-22069 CVE-2025-68251 CVE-2025-68768 CVE-2025-71289                      CVE-2026-23247 CVE-2026-23272 CVE-2026-23346 CVE-2026-23394                      CVE-2026-23469 CVE-2026-31420 CVE-2026-31486 CVE-2026-31560                      CVE-2026-31613 CVE-2026-31663 CVE-2026-31717 CVE-2026-43116                      CVE-2026-43219 CVE-2026-43245 CVE-2026-43303 CVE-2026-43331                      CVE-2026-45838 CVE-2026-45839 CVE-2026-45840 CVE-2026-45841                      CVE-2026-45842 CVE-2026-45843 CVE-2026-45844 CVE-2026-45845                      CVE-2026-45846 CVE-2026-45850 CVE-2026-45930 CVE-2026-46117                      CVE-2026-46137 CVE-2026-46158 CVE-2026-46160 CVE-2026-46170                      CVE-2026-46203 CVE-2026-46216 CVE-2026-46244 CVE-2026-46274                      CVE-2026-46275 CVE-2026-46315 CVE-2026-46316 CVE-2026-46319                      CVE-2026-46320 CVE-2026-46321 CVE-2026-46322 CVE-2026-46323                      CVE-2026-46331 CVE-2026-52908 CVE-2026-52909 CVE-2026-52910                      CVE-2026-52911

    Several vulnerabilities have been discovered in the Linux kernel that     may lead to a privilege escalation, denial of service or information     leaks.

    For the stable distribution (trixie), these problems have been fixed in     version 6.12.94-1.

    We recommend that you upgrade your linux packages.

    For the detailed security status of linux please refer to its security     tracker page at:
    https://security-tracker.debian.org/tracker/linux

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 22.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-8440-1 advisory.

    Josh Eads, Kristoffer Janke, Eduardo Vela Nava, Tavis Ormandy, and Matteo Rizzo discovered that some AMD     Zen processors did not properly verify the signature of CPU microcode. This flaw is known as EntrySign. A     privileged attacker could possibly use this issue to cause load malicious CPU microcode causing loss of     integrity and confidentiality. (CVE-2024-36347)

    It was discovered that the Linux kernel algif_aead module did not properly handle in-place cryptographic     operations. This flaw is known as Copy Fail. A local attacker could use this to escalate privileges, or     possibly escape a container. (CVE-2026-31431)

    It was discovered that the Linux kernel did not properly handle shared page fragments during socket buffer     operations, collectively known as Dirty Frag. A logic flaw existed in the XFRM ESP-in-TCP subsystem and in     the RxRPC networking subsystem when processing paged fragments. A local attacker could use this to     escalate privileges, or possibly escape a container. (CVE-2026-43284, CVE-2026-43500, CVE-2026-45998,     CVE-2026-46000)

    It was discovered that a logic flaw existed in the XFRM ESP-in-TCP subsystem in the Linux kernel when     handling socket buffer fragments. This flaw is known as Fragnesia. A local attacker could use this to     escalate privileges, or possibly escape a container. (CVE-2026-43503, CVE-2026-46300)

    Qualys discovered that a race condition existed in the ptrace subsystem of the Linux kernel when     privileged processes are exiting. An unprivileged local attacker could use this issue to expose sensitive     information. (CVE-2026-46333)

    Tristan Madani discovered that Ubuntu Linux kernel 6.8, 6.17 and 7.0 contain a memory leak when handling     AppArmor notifications. A local attacker could use this to cause resource exhaustion. (CVE-2026-47326)

    Tristan Madani discovered that Ubuntu Linux kernel 6.8, 6.17 and 7.0 contain a NULL pointer dereference     when handling AppArmor notifications. A local attacker could use this to cause a kernel oops.
    (CVE-2026-47327)

    Tristan Madani discovered that Ubuntu Linux kernel 6.8, 6.17 and 7.0 contained an invalid free when     handling AppArmor notifications. A local attacker could use this to corrupt kernel memory.
    (CVE-2026-47328)

    Tristan Madani discovered that Ubuntu Linux kernel 6.8, 6.17 and 7.0 contained insufficient validation of     AppArmor notification responses. A local attacker could use this to allow crafted responses to be     processed. (CVE-2026-47329)

    Tristan Madani discovered that Ubuntu Linux kernel 6.8, 6.17 and 7.0 used an uninitialized variable when     handling AppArmor notifications. A local attacker could use this to cause incorrect caching of data.
    (CVE-2026-47330)

    Tristan Madani discovered that Ubuntu Linux kernel 6.8 contained a use- after-free (UAF) bug. A local     attacker could use this to cause memory corruption and, theoretically, arbitrary code execution.
    (CVE-2026-47331)

    Tristan Madani discovered that Ubuntu Linux kernel 6.8, 6.17 and 7.0 contained an out-of-bounds (OOB) read     when handling AppArmor notifications. A local attacker could use this to cause information disclosure of     kernel memory. (CVE-2026-47332)

    Tristan Madani discovered that Ubuntu Linux kernel 6.8, 6.17 and 7.0 contained a out-of-bounds (OOB) read     when handling AppArmor notifications. A local attacker could use this to cause kernel memory corruption     and, theoretically, influence processing of AppArmor policies. (CVE-2026-47333)

    Tristan Madani discovered that Ubuntu Linux kernel 6.8, 6.17 and 7.0 contained incorrect holding of locks     when handling AppArmor notifications. A local attacker could use this to cause a kernel panic or deadlock.
    (CVE-2026-47334)

    Tristan Madani discovered that Ubuntu Linux kernel 6.8 contained a NULL pointer dereference when handling     AppArmor notifications. A local attacker could use this to cause a kernel panic. (CVE-2026-47335)

    Tristan Madani discovered that Ubuntu Linux kernel 6.8 used an uninitialized variable when handling     AppArmor AF_INET/AF_INET6 socket mediation. A local attacker could use this to influence processing of     fine- grained network socket mediation. (CVE-2026-47336)

    Tristan Madani and Trevor Lawrence have each independently discovered that Ubuntu Linux kernel 6.8, 6.17     and 7.0 contained a NULL pointer dereference when handling AppArmor network socket mediation. A local     attacker could use this to cause a kernel oops. (CVE-2026-47337)

    Several security issues were discovered in the Linux kernel. An attacker could possibly use these to     compromise the system. This update corrects flaws in the following subsystems:

    - ARM64 architecture;

    - MIPS architecture;

    - PowerPC architecture;

    - x86 architecture;

    - Block layer subsystem;

    - Cryptographic API;

    - Compute Acceleration Framework;

    - ACPI drivers;

    - Drivers core;

    - Network block device driver;

    - Null block device driver;

    - Ublk userspace block driver;

    - Bluetooth drivers;

    - Character device driver;

    - TPM device driver;

    - Clock framework and drivers;

    - Data acquisition framework and drivers;

    - Counter interface drivers;

    - Hardware crypto device drivers;

    - DMA engine subsystem;

    - DPLL subsystem;

    - GPU drivers;

    - HID subsystem;

    - Hardware monitoring drivers;

    - Intel Trace Hub HW tracing drivers;

    - IIO ADC drivers;

    - IIO subsystem;

    - InfiniBand drivers;

    - Input Device core drivers;

    - On-Chip Interconnect management framework;

    - IOMMU subsystem;

    - IRQ chip drivers;

    - Modular ISDN driver;

    - LED subsystem;

    - Macintosh device drivers;

    - Multiple devices driver;

    - Media drivers;

    - UACCE accelerator framework;

    - MMC subsystem;

    - Ethernet bonding driver;

    - Network drivers;

    - Mellanox network drivers;

    - STMicroelectronics network drivers;

    - Ethernet team driver;

    - MediaTek network drivers;

    - NVME drivers;

    - PA-RISC drivers;

    - PHY drivers;

    - Chrome hardware platform drivers;

    - x86 platform drivers;

    - i.MX PM domains;

    - Voltage and Current Regulator drivers;

    - SCSI subsystem;

    - SLIMbus drivers;

    - SPI subsystem;

    - Media Oriented Systems Transport (MOST) driver;

    - Realtek RTL8723BS SDIO drivers;

    - TCM subsystem;

    - USB Host Controller drivers;

    - USB Type-C Connector System Software Interface driver;

    - Backlight driver;

    - W1 Dallas's 1-wire bus driver;

    - Watchdog drivers;

    - Xen hypervisor drivers;

    - BFS file system;

    - BTRFS file system;

    - EFI Variable file system;

    - exFAT file system;

    - Ext4 file system;

    - F2FS file system;

    - FUSE (File system in Userspace);

    - HFS+ file system;

    - File systems infrastructure;

    - Journaling layer for block devices (JBD2);

    - Network file system (NFS) client;

    - Network file system (NFS) server daemon;

    - File system notification infrastructure;

    - NTFS3 file system;

    - OCFS2 file system;

    - SMB network file system;

    - BPF subsystem;

    - Ethernet bridge;

    - Scheduler infrastructure;

    - Netfilter;

    - NFC subsystem;

    - Tracing infrastructure;

    - io_uring subsystem;

    - Perf events;

    - Locking primitives;

    - Shadow Call Stack mechanism;

    - Floating proportions library;

    - Memory management;

    - Bluetooth subsystem;

    - CAIF protocol;

    - CAN network layer;

    - Ceph Core library;

    - Networking core;

    - Ethtool driver;

    - Handshake API;

    - HSR network protocol;

    - IPv4 networking;

    - IPv6 networking;

    - L2TP protocol;

    - MAC80211 subsystem;

    - Multipath TCP;

    - NET/ROM layer;

    - Open vSwitch;

    - Packet sockets;

    - RDS protocol;

    - Rose network layer;

    - RxRPC session sockets;

    - Network traffic control;

    - SCTP protocol;

    - Network sockets;

    - Sun RPC protocol;

    - TLS protocol;

    - Unix domain sockets;

    - VMware vSockets driver;

    - Wireless networking;

    - Integrity Measurement Architecture(IMA) framework;

    - Key management;

    - Simplified Mandatory Access Control Kernel framework;

    - ALSA AC97 driver;

    - Generic PCM loopback sound driver;

    - FireWire sound drivers;

    - HD-audio driver;

    - Turtle Beach Wavefront ALSA driver;

    - Creative Sound Blaster X-Fi driver;

    - AMD SoC Alsa drivers;

    - Texas InstrumentS Audio (ASoC/HDA) drivers;

    - STMicroelectronics SoC drivers;

    - USB sound devices;

    - KVM subsystem; (CVE-2024-50004, CVE-2024-57795, CVE-2024-58096, CVE-2024-58097, CVE-2025-22022,     CVE-2025-22111, CVE-2025-37926, CVE-2025-38022, CVE-2025-38201, CVE-2025-38234, CVE-2025-38591,     CVE-2025-40039, CVE-2025-40082, CVE-2025-40149, CVE-2025-40164, CVE-2025-40325, CVE-2025-68206,     CVE-2025-68254, CVE-2025-68255, CVE-2025-68256, CVE-2025-68257, CVE-2025-68258, CVE-2025-68259,     CVE-2025-68261, CVE-2025-68263, CVE-2025-68264, CVE-2025-68265, CVE-2025-68266, CVE-2025-68291,     CVE-2025-68325, CVE-2025-68332, CVE-2025-68335, CVE-2025-68336, CVE-2025-68337, CVE-2025-68344,     CVE-2025-68345, CVE-2025-68346, CVE-2025-68347, CVE-2025-68349, CVE-2025-68351, CVE-2025-68354,     CVE-2025-68358, CVE-2025-68362, CVE-2025-68363, CVE-2025-68364, CVE-2025-68365, CVE-2025-68366,     CVE-2025-68367, CVE-2025-68369, CVE-2025-68371, CVE-2025-68372, CVE-2025-68374, CVE-2025-68378,     CVE-2025-68379, CVE-2025-68380, CVE-2025-68724, CVE-2025-68725, CVE-2025-68727, CVE-2025-68728,     CVE-2025-68732, CVE-2025-68733, CVE-2025-68740, CVE-2025-68741, CVE-2025-68742, CVE-2025-68744,     CVE-2025-68746, CVE-2025-68749, CVE-2025-68753, CVE-2025-68755, CVE-2025-68756, CVE-2025-68757,     CVE-2025-68758, CVE-2025-68759, CVE-2025-68763, CVE-2025-68764, CVE-2025-68765, CVE-2025-68766,     CVE-2025-68767, CVE-2025-68769, CVE-2025-68770, CVE-2025-68771, CVE-2025-68772, CVE-2025-68773,     CVE-2025-68774, CVE-2025-68775, CVE-2025-68776, CVE-2025-68777, CVE-2025-68778, CVE-2025-68780,     CVE-2025-68782, CVE-2025-68783, CVE-2025-68785, CVE-2025-68786, CVE-2025-68787, CVE-2025-68788,     CVE-2025-68794, CVE-2025-68795, CVE-2025-68796, CVE-2025-68797, CVE-2025-68798, CVE-2025-68799,     CVE-2025-68800, CVE-2025-68801, CVE-2025-68803, CVE-2025-68804, CVE-2025-68806, CVE-2025-68808,     CVE-2025-68809, CVE-2025-68810, CVE-2025-68811, CVE-2025-68813, CVE-2025-68814, CVE-2025-68815,     CVE-2025-68816, CVE-2025-68817, CVE-2025-68818, CVE-2025-68819, CVE-2025-68820, CVE-2025-68821,     CVE-2025-68823, CVE-2025-71064, CVE-2025-71065, CVE-2025-71066, CVE-2025-71067, CVE-2025-71068,     CVE-2025-71069, CVE-2025-71071, CVE-2025-71072, CVE-2025-71075, CVE-2025-71077, CVE-2025-71078,     CVE-2025-71079, CVE-2025-71081, CVE-2025-71082, CVE-2025-71083, CVE-2025-71084, CVE-2025-71085,     CVE-2025-71086, CVE-2025-71087, CVE-2025-71088, CVE-2025-71089, CVE-2025-71091, CVE-2025-71093,     CVE-2025-71094, CVE-2025-71095, CVE-2025-71096, CVE-2025-71097, CVE-2025-71098, CVE-2025-71101,     CVE-2025-71102, CVE-2025-71104, CVE-2025-71105, CVE-2025-71107, CVE-2025-71108, CVE-2025-71109,     CVE-2025-71111, CVE-2025-71112, CVE-2025-71113, CVE-2025-71114, CVE-2025-71116, CVE-2025-71118,     CVE-2025-71119, CVE-2025-71120, CVE-2025-71121, CVE-2025-71122, CVE-2025-71123, CVE-2025-71125,     CVE-2025-71126, CVE-2025-71127, CVE-2025-71130, CVE-2025-71131, CVE-2025-71132, CVE-2025-71133,     CVE-2025-71135, CVE-2025-71136, CVE-2025-71137, CVE-2025-71138, CVE-2025-71140, CVE-2025-71141,     CVE-2025-71143, CVE-2025-71144, CVE-2025-71147, CVE-2025-71148, CVE-2025-71150, CVE-2025-71151,     CVE-2025-71153, CVE-2025-71154, CVE-2025-71160, CVE-2025-71162, CVE-2025-71163, CVE-2025-71180,     CVE-2025-71182, CVE-2025-71183, CVE-2025-71184, CVE-2025-71185, CVE-2025-71186, CVE-2025-71188,     CVE-2025-71189, CVE-2025-71190, CVE-2025-71191, CVE-2025-71192, CVE-2025-71193, CVE-2025-71194,     CVE-2025-71195, CVE-2025-71196, CVE-2025-71197, CVE-2025-71198, CVE-2025-71199, CVE-2025-71200,     CVE-2025-71220, CVE-2025-71222, CVE-2025-71224, CVE-2025-71225, CVE-2025-71268, CVE-2026-22976,     CVE-2026-22977, CVE-2026-22978, CVE-2026-22979, CVE-2026-22980, CVE-2026-22982, CVE-2026-22984,     CVE-2026-22990, CVE-2026-22991, CVE-2026-22992, CVE-2026-22994, CVE-2026-22996, CVE-2026-22997,     CVE-2026-22998, CVE-2026-22999, CVE-2026-23000, CVE-2026-23001, CVE-2026-23003, CVE-2026-23005,     CVE-2026-23006, CVE-2026-23010, CVE-2026-23011, CVE-2026-23019, CVE-2026-23020, CVE-2026-23021,     CVE-2026-23025, CVE-2026-23026, CVE-2026-23030, CVE-2026-23031, CVE-2026-23032, CVE-2026-23033,     CVE-2026-23035, CVE-2026-23037, CVE-2026-23038, CVE-2026-23047, CVE-2026-23049, CVE-2026-23050,     CVE-2026-23053, CVE-2026-23054, CVE-2026-23056, CVE-2026-23057, CVE-2026-23058, CVE-2026-23059,     CVE-2026-23061, CVE-2026-23062, CVE-2026-23063, CVE-2026-23064, CVE-2026-23065, CVE-2026-23068,     CVE-2026-23069, CVE-2026-23071, CVE-2026-23073, CVE-2026-23075, CVE-2026-23076, CVE-2026-23078,     CVE-2026-23080, CVE-2026-23083, CVE-2026-23084, CVE-2026-23085, CVE-2026-23086, CVE-2026-23087,     CVE-2026-23088, CVE-2026-23089, CVE-2026-23090, CVE-2026-23091, CVE-2026-23093, CVE-2026-23094,     CVE-2026-23095, CVE-2026-23096, CVE-2026-23097, CVE-2026-23098, CVE-2026-23099, CVE-2026-23101,     CVE-2026-23102, CVE-2026-23103, CVE-2026-23105, CVE-2026-23107, CVE-2026-23108, CVE-2026-23110,     CVE-2026-23112, CVE-2026-23113, CVE-2026-23116, CVE-2026-23119, CVE-2026-23120, CVE-2026-23121,     CVE-2026-23123, CVE-2026-23124, CVE-2026-23125, CVE-2026-23126, CVE-2026-23128, CVE-2026-23129,     CVE-2026-23131, CVE-2026-23133, CVE-2026-23135, CVE-2026-23136, CVE-2026-23139, CVE-2026-23140,     CVE-2026-23141, CVE-2026-23142, CVE-2026-23144, CVE-2026-23145, CVE-2026-23146, CVE-2026-23148,     CVE-2026-23150, CVE-2026-23151, CVE-2026-23156, CVE-2026-23159, CVE-2026-23160, CVE-2026-23163,     CVE-2026-23164, CVE-2026-23166, CVE-2026-23167, CVE-2026-23168, CVE-2026-23170, CVE-2026-23172,     CVE-2026-23173, CVE-2026-23176, CVE-2026-23178, CVE-2026-23179, CVE-2026-23180, CVE-2026-23182,     CVE-2026-23187, CVE-2026-23190, CVE-2026-23191, CVE-2026-23193, CVE-2026-23198, CVE-2026-23204,     CVE-2026-23205, CVE-2026-23206, CVE-2026-23209, CVE-2026-23212, CVE-2026-23213, CVE-2026-23214,     CVE-2026-23215, CVE-2026-23216, CVE-2026-23231, CVE-2026-23254, CVE-2026-23256, CVE-2026-23257,     CVE-2026-23258, CVE-2026-23260, CVE-2026-23261, CVE-2026-23262, CVE-2026-23264, CVE-2026-23274,     CVE-2026-23351, CVE-2026-23394, CVE-2026-31419, CVE-2026-31504, CVE-2026-31533, CVE-2026-31676,     CVE-2026-43033, CVE-2026-43077, CVE-2026-43078, CVE-2026-43362, CVE-2026-43494, CVE-2026-46028,     CVE-2026-46323)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 24.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-8393-1 advisory.

    It was discovered that the Linux kernel algif_aead module did not properly handle in-place cryptographic     operations. This flaw is known as Copy Fail. A local attacker could use this to escalate privileges, or     possibly escape a container. (CVE-2026-31431)

    It was discovered that the Linux kernel did not properly handle shared page fragments during socket buffer     operations, collectively known as Dirty Frag. A logic flaw existed in the XFRM ESP-in-TCP subsystem and in     the RxRPC networking subsystem when processing paged fragments. A local attacker could use this to     escalate privileges, or possibly escape a container. (CVE-2026-43284, CVE-2026-43500, CVE-2026-45998,     CVE-2026-46000)

    It was discovered that a logic flaw existed in the XFRM ESP-in-TCP subsystem in the Linux kernel when     handling socket buffer fragments. This flaw is known as Fragnesia. A local attacker could use this to     escalate privileges, or possibly escape a container. (CVE-2026-43503, CVE-2026-46300)

    Qualys discovered that a race condition existed in the ptrace subsystem of the Linux kernel when     privileged processes are exiting. An unprivileged local attacker could use this issue to expose sensitive     information. (CVE-2026-46333)

    Tristan Madani discovered that Ubuntu Linux kernel 6.8, 6.17 and 7.0 contain a memory leak when handling     AppArmor notifications. A local attacker could use this to cause resource exhaustion. (CVE-2026-47326)

    Tristan Madani discovered that Ubuntu Linux kernel 6.8, 6.17 and 7.0 contain a NULL pointer dereference     when handling AppArmor notifications. A local attacker could use this to cause a kernel oops.
    (CVE-2026-47327)

    Tristan Madani discovered that Ubuntu Linux kernel 6.8, 6.17 and 7.0 contained an invalid free when     handling AppArmor notifications. A local attacker could use this to corrupt kernel memory.
    (CVE-2026-47328)

    Tristan Madani discovered that Ubuntu Linux kernel 6.8, 6.17 and 7.0 contained insufficient validation of     AppArmor notification responses. A local attacker could use this to allow crafted responses to be     processed. (CVE-2026-47329)

    Tristan Madani discovered that Ubuntu Linux kernel 6.8, 6.17 and 7.0 used an uninitialized variable when     handling AppArmor notifications. A local attacker could use this to cause incorrect caching of data.
    (CVE-2026-47330)

    Tristan Madani discovered that Ubuntu Linux kernel 6.8 contained a use- after-free (UAF) bug. A local     attacker could use this to cause memory corruption and, theoretically, arbitrary code execution.
    (CVE-2026-47331)

    Tristan Madani discovered that Ubuntu Linux kernel 6.8, 6.17 and 7.0 contained an out-of-bounds (OOB) read     when handling AppArmor notifications. A local attacker could use this to cause information disclosure of     kernel memory. (CVE-2026-47332)

    Tristan Madani discovered that Ubuntu Linux kernel 6.8, 6.17 and 7.0 contained a out-of-bounds (OOB) read     when handling AppArmor notifications. A local attacker could use this to cause kernel memory corruption     and, theoretically, influence processing of AppArmor policies. (CVE-2026-47333)

    Tristan Madani discovered that Ubuntu Linux kernel 6.8, 6.17 and 7.0 contained incorrect holding of locks     when handling AppArmor notifications. A local attacker could use this to cause a kernel panic or deadlock.
    (CVE-2026-47334)

    Tristan Madani discovered that Ubuntu Linux kernel 6.8 contained a NULL pointer dereference when handling     AppArmor notifications. A local attacker could use this to cause a kernel panic. (CVE-2026-47335)

    Tristan Madani discovered that Ubuntu Linux kernel 6.8 used an uninitialized variable when handling     AppArmor AF_INET/AF_INET6 socket mediation. A local attacker could use this to influence processing of     fine- grained network socket mediation. (CVE-2026-47336)

    Tristan Madani and Trevor Lawrence have each independently discovered that Ubuntu Linux kernel 6.8, 6.17     and 7.0 contained a NULL pointer dereference when handling AppArmor network socket mediation. A local     attacker could use this to cause a kernel oops. (CVE-2026-47337)

    Several security issues were discovered in the Linux kernel. An attacker could possibly use these to     compromise the system. This update corrects flaws in the following subsystems:

    - ARM64 architecture;

    - x86 architecture;

    - Cryptographic API;

    - Compute Acceleration Framework;

    - Drivers core;

    - Null block device driver;

    - Ublk userspace block driver;

    - Bluetooth drivers;

    - Counter interface drivers;

    - DMA engine subsystem;

    - DPLL subsystem;

    - GPU drivers;

    - HID subsystem;

    - Intel Trace Hub HW tracing drivers;

    - IIO ADC drivers;

    - IIO subsystem;

    - On-Chip Interconnect management framework;

    - IRQ chip drivers;

    - Modular ISDN driver;

    - LED subsystem;

    - Multiple devices driver;

    - UACCE accelerator framework;

    - MMC subsystem;

    - Ethernet bonding driver;

    - Network drivers;

    - Mellanox network drivers;

    - NVME drivers;

    - PHY drivers;

    - x86 platform drivers;

    - i.MX PM domains;

    - SCSI subsystem;

    - SLIMbus drivers;

    - SPI subsystem;

    - TCM subsystem;

    - W1 Dallas's 1-wire bus driver;

    - Xen hypervisor drivers;

    - BTRFS file system;

    - EFI Variable file system;

    - exFAT file system;

    - Ext4 file system;

    - HFS+ file system;

    - Network file system (NFS) client;

    - Network file system (NFS) server daemon;

    - NTFS3 file system;

    - SMB network file system;

    - Scheduler infrastructure;

    - Netfilter;

    - NFC subsystem;

    - Tracing infrastructure;

    - io_uring subsystem;

    - BPF subsystem;

    - Perf events;

    - Floating proportions library;

    - Memory management;

    - Bluetooth subsystem;

    - CAN network layer;

    - Ceph Core library;

    - Networking core;

    - IPv4 networking;

    - IPv6 networking;

    - L2TP protocol;

    - MAC80211 subsystem;

    - NET/ROM layer;

    - Packet sockets;

    - RDS protocol;

    - RxRPC session sockets;

    - Network traffic control;

    - SCTP protocol;

    - TLS protocol;

    - Unix domain sockets;

    - VMware vSockets driver;

    - Wireless networking;

    - ALSA AC97 driver;

    - Generic PCM loopback sound driver;

    - Creative Sound Blaster X-Fi driver;

    - AMD SoC Alsa drivers;

    - Texas InstrumentS Audio (ASoC/HDA) drivers;

    - USB sound devices;

    - KVM subsystem; (CVE-2024-50004, CVE-2024-58096, CVE-2024-58097, CVE-2025-37926, CVE-2025-38201,     CVE-2025-38591, CVE-2025-40039, CVE-2025-40082, CVE-2025-40149, CVE-2025-68351, CVE-2025-68358,     CVE-2025-68365, CVE-2025-68725, CVE-2025-68749, CVE-2025-68803, CVE-2025-68823, CVE-2025-71160,     CVE-2025-71162, CVE-2025-71163, CVE-2025-71180, CVE-2025-71182, CVE-2025-71183, CVE-2025-71184,     CVE-2025-71185, CVE-2025-71186, CVE-2025-71188, CVE-2025-71189, CVE-2025-71190, CVE-2025-71191,     CVE-2025-71192, CVE-2025-71193, CVE-2025-71194, CVE-2025-71195, CVE-2025-71196, CVE-2025-71197,     CVE-2025-71198, CVE-2025-71199, CVE-2025-71200, CVE-2025-71220, CVE-2025-71222, CVE-2025-71224,     CVE-2025-71225, CVE-2025-71268, CVE-2026-22976, CVE-2026-22977, CVE-2026-22978, CVE-2026-22979,     CVE-2026-22980, CVE-2026-22982, CVE-2026-22984, CVE-2026-22990, CVE-2026-22991, CVE-2026-22992,     CVE-2026-22994, CVE-2026-22996, CVE-2026-22997, CVE-2026-22998, CVE-2026-22999, CVE-2026-23000,     CVE-2026-23001, CVE-2026-23003, CVE-2026-23005, CVE-2026-23006, CVE-2026-23010, CVE-2026-23011,     CVE-2026-23019, CVE-2026-23020, CVE-2026-23021, CVE-2026-23025, CVE-2026-23026, CVE-2026-23030,     CVE-2026-23031, CVE-2026-23032, CVE-2026-23033, CVE-2026-23035, CVE-2026-23037, CVE-2026-23038,     CVE-2026-23047, CVE-2026-23049, CVE-2026-23050, CVE-2026-23053, CVE-2026-23054, CVE-2026-23056,     CVE-2026-23057, CVE-2026-23058, CVE-2026-23059, CVE-2026-23061, CVE-2026-23062, CVE-2026-23063,     CVE-2026-23064, CVE-2026-23065, CVE-2026-23068, CVE-2026-23069, CVE-2026-23071, CVE-2026-23073,     CVE-2026-23075, CVE-2026-23076, CVE-2026-23078, CVE-2026-23080, CVE-2026-23083, CVE-2026-23084,     CVE-2026-23085, CVE-2026-23086, CVE-2026-23087, CVE-2026-23088, CVE-2026-23089, CVE-2026-23090,     CVE-2026-23091, CVE-2026-23093, CVE-2026-23094, CVE-2026-23095, CVE-2026-23096, CVE-2026-23097,     CVE-2026-23098, CVE-2026-23099, CVE-2026-23101, CVE-2026-23102, CVE-2026-23103, CVE-2026-23105,     CVE-2026-23107, CVE-2026-23108, CVE-2026-23110, CVE-2026-23113, CVE-2026-23116, CVE-2026-23119,     CVE-2026-23120, CVE-2026-23121, CVE-2026-23123, CVE-2026-23124, CVE-2026-23125, CVE-2026-23126,     CVE-2026-23128, CVE-2026-23129, CVE-2026-23131, CVE-2026-23133, CVE-2026-23135, CVE-2026-23136,     CVE-2026-23139, CVE-2026-23140, CVE-2026-23141, CVE-2026-23142, CVE-2026-23144, CVE-2026-23145,     CVE-2026-23146, CVE-2026-23148, CVE-2026-23150, CVE-2026-23151, CVE-2026-23156, CVE-2026-23159,     CVE-2026-23160, CVE-2026-23163, CVE-2026-23164, CVE-2026-23166, CVE-2026-23167, CVE-2026-23168,     CVE-2026-23170, CVE-2026-23172, CVE-2026-23173, CVE-2026-23176, CVE-2026-23178, CVE-2026-23179,     CVE-2026-23180, CVE-2026-23182, CVE-2026-23187, CVE-2026-23190, CVE-2026-23191, CVE-2026-23193,     CVE-2026-23198, CVE-2026-23200, CVE-2026-23202, CVE-2026-23204, CVE-2026-23205, CVE-2026-23206,     CVE-2026-23212, CVE-2026-23213, CVE-2026-23214, CVE-2026-23215, CVE-2026-23216, CVE-2026-23254,     CVE-2026-23256, CVE-2026-23257, CVE-2026-23258, CVE-2026-23260, CVE-2026-23261, CVE-2026-23262,     CVE-2026-23264, CVE-2026-23274, CVE-2026-23351, CVE-2026-23394, CVE-2026-31419, CVE-2026-31504,     CVE-2026-31533, CVE-2026-31676, CVE-2026-43033, CVE-2026-43077, CVE-2026-43078, CVE-2026-43494,     CVE-2026-46028)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 24.04 LTS / 25.10 host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-8374-1 advisory.

    It was discovered that the Linux kernel algif_aead module did not properly handle in-place cryptographic     operations. This flaw is known as Copy Fail. A local attacker could use this to escalate privileges, or     possibly escape a container. (CVE-2026-31431)

    It was discovered that the Linux kernel did not properly handle shared page fragments during socket buffer     operations, collectively known as Dirty Frag. A logic flaw existed in the XFRM ESP-in-TCP subsystem and in     the RxRPC networking subsystem when processing paged fragments. A local attacker could use this to     escalate privileges, or possibly escape a container. (CVE-2026-43284, CVE-2026-43500, CVE-2026-45998,     CVE-2026-46000)

    It was discovered that a logic flaw existed in the XFRM ESP-in-TCP subsystem in the Linux kernel when     handling socket buffer fragments. This flaw is known as Fragnesia. A local attacker could use this to     escalate privileges, or possibly escape a container. (CVE-2026-43503, CVE-2026-46300)

    Qualys discovered that a race condition existed in the ptrace subsystem of the Linux kernel when     privileged processes are exiting. An unprivileged local attacker could use this issue to expose sensitive     information. (CVE-2026-46333)

    Tristan Madani discovered that Ubuntu Linux kernel 6.8, 6.17 and 7.0 contain a memory leak when handling     AppArmor notifications. A local attacker could use this to cause resource exhaustion. (CVE-2026-47326)

    Tristan Madani discovered that Ubuntu Linux kernel 6.8, 6.17 and 7.0 contain a NULL pointer dereference     when handling AppArmor notifications. A local attacker could use this to cause a kernel oops.
    (CVE-2026-47327)

    Tristan Madani discovered that Ubuntu Linux kernel 6.8, 6.17 and 7.0 contained an invalid free when     handling AppArmor notifications. A local attacker could use this to corrupt kernel memory.
    (CVE-2026-47328)

    Tristan Madani discovered that Ubuntu Linux kernel 6.8, 6.17 and 7.0 contained insufficient validation of     AppArmor notification responses. A local attacker could use this to allow crafted responses to be     processed. (CVE-2026-47329)

    Tristan Madani discovered that Ubuntu Linux kernel 6.8, 6.17 and 7.0 used an uninitialized variable when     handling AppArmor notifications. A local attacker could use this to cause incorrect caching of data.
    (CVE-2026-47330)

    Tristan Madani discovered that Ubuntu Linux kernel 6.8, 6.17 and 7.0 contained an out-of-bounds (OOB) read     when handling AppArmor notifications. A local attacker could use this to cause information disclosure of     kernel memory. (CVE-2026-47332)

    Tristan Madani discovered that Ubuntu Linux kernel 6.8, 6.17 and 7.0 contained a out-of-bounds (OOB) read     when handling AppArmor notifications. A local attacker could use this to cause kernel memory corruption     and, theoretically, influence processing of AppArmor policies. (CVE-2026-47333)

    Tristan Madani discovered that Ubuntu Linux kernel 6.8, 6.17 and 7.0 contained incorrect holding of locks     when handling AppArmor notifications. A local attacker could use this to cause a kernel panic or deadlock.
    (CVE-2026-47334)

    Tristan Madani and Trevor Lawrence have each independently discovered that Ubuntu Linux kernel 6.8, 6.17     and 7.0 contained a NULL pointer dereference when handling AppArmor network socket mediation. A local     attacker could use this to cause a kernel oops. (CVE-2026-47337)

    Several security issues were discovered in the Linux kernel. An attacker could possibly use these to     compromise the system. This update corrects flaws in the following subsystems:

    - S390 architecture;

    - Cryptographic API;

    - GPU drivers;

    - Ethernet bonding driver;

    - Network file system (NFS) server daemon;

    - Distributed Switch Architecture;

    - Netfilter;

    - Control group (cgroup);

    - Kernel kexec() syscall;

    - Memory management;

    - MAC80211 subsystem;

    - Multipath TCP;

    - Packet sockets;

    - RDS protocol;

    - RxRPC session sockets;

    - TLS protocol;

    - Unix domain sockets;

    - AppArmor security module; (CVE-2025-71088, CVE-2025-71090, CVE-2025-71127, CVE-2025-71134,     CVE-2025-71139, CVE-2025-71141, CVE-2025-71142, CVE-2025-71144, CVE-2025-71152, CVE-2025-71155,     CVE-2026-23274, CVE-2026-23351, CVE-2026-23394, CVE-2026-31419, CVE-2026-31504, CVE-2026-31533,     CVE-2026-31676, CVE-2026-43033, CVE-2026-43077, CVE-2026-43078, CVE-2026-43494, CVE-2026-45966,     CVE-2026-46028)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 24.04 LTS / 25.10 host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-8310-1 advisory.

    It was discovered that the Linux kernel algif_aead module did not properly handle in-place cryptographic     operations. This flaw is known as Copy Fail. A local attacker could use this to escalate privileges, or     possibly escape a container. (CVE-2026-31431)

    Several security issues were discovered in the Linux kernel. An attacker could possibly use these to     compromise the system. This update corrects flaws in the following subsystems:

    - S390 architecture;

    - Cryptographic API;

    - GPU drivers;

    - Ethernet bonding driver;

    - Microsoft Azure Network Adapter (MANA) driver;

    - Network file system (NFS) server daemon;

    - Distributed Switch Architecture;

    - Netfilter;

    - Control group (cgroup);

    - Kernel kexec() syscall;

    - Memory management;

    - MAC80211 subsystem;

    - Multipath TCP;

    - Packet sockets;

    - TLS protocol;

    - Unix domain sockets; (CVE-2025-71088, CVE-2025-71090, CVE-2025-71127, CVE-2025-71134, CVE-2025-71139,     CVE-2025-71141, CVE-2025-71142, CVE-2025-71144, CVE-2025-71152, CVE-2025-71155, CVE-2026-23274,     CVE-2026-23351, CVE-2026-23394, CVE-2026-23454, CVE-2026-31419, CVE-2026-31504, CVE-2026-31533,     CVE-2026-43033, CVE-2026-43077, CVE-2026-43078, CVE-2026-43276)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 24.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-8296-1 advisory.

    Several security issues were discovered in the Linux kernel. An attacker could possibly use these to     compromise the system. This update corrects flaws in the following subsystems:

    - ARM64 architecture;

    - x86 architecture;

    - Compute Acceleration Framework;

    - Drivers core;

    - Null block device driver;

    - Ublk userspace block driver;

    - Bluetooth drivers;

    - Counter interface drivers;

    - DMA engine subsystem;

    - DPLL subsystem;

    - GPU drivers;

    - HID subsystem;

    - Intel Trace Hub HW tracing drivers;

    - IIO ADC drivers;

    - IIO subsystem;

    - On-Chip Interconnect management framework;

    - IRQ chip drivers;

    - Modular ISDN driver;

    - LED subsystem;

    - Multiple devices driver;

    - UACCE accelerator framework;

    - MMC subsystem;

    - Ethernet bonding driver;

    - Network drivers;

    - Mellanox network drivers;

    - NVME drivers;

    - PHY drivers;

    - x86 platform drivers;

    - i.MX PM domains;

    - SCSI subsystem;

    - SLIMbus drivers;

    - SPI subsystem;

    - TCM subsystem;

    - W1 Dallas's 1-wire bus driver;

    - Xen hypervisor drivers;

    - BTRFS file system;

    - EFI Variable file system;

    - exFAT file system;

    - Ext4 file system;

    - HFS+ file system;

    - Network file system (NFS) client;

    - Network file system (NFS) server daemon;

    - NTFS3 file system;

    - SMB network file system;

    - Scheduler infrastructure;

    - Netfilter;

    - NFC subsystem;

    - Tracing infrastructure;

    - io_uring subsystem;

    - BPF subsystem;

    - Perf events;

    - Floating proportions library;

    - Memory management;

    - Bluetooth subsystem;

    - CAN network layer;

    - Ceph Core library;

    - Networking core;

    - IPv4 networking;

    - IPv6 networking;

    - L2TP protocol;

    - MAC80211 subsystem;

    - NET/ROM layer;

    - Network traffic control;

    - SCTP protocol;

    - TLS protocol;

    - Unix domain sockets;

    - VMware vSockets driver;

    - Wireless networking;

    - ALSA AC97 driver;

    - Generic PCM loopback sound driver;

    - Creative Sound Blaster X-Fi driver;

    - AMD SoC Alsa drivers;

    - Texas InstrumentS Audio (ASoC/HDA) drivers;

    - USB sound devices;

    - KVM subsystem; (CVE-2024-50004, CVE-2024-58096, CVE-2024-58097, CVE-2025-37926, CVE-2025-38201,     CVE-2025-38591, CVE-2025-40039, CVE-2025-40082, CVE-2025-40149, CVE-2025-68351, CVE-2025-68358,     CVE-2025-68365, CVE-2025-68725, CVE-2025-68749, CVE-2025-68803, CVE-2025-68823, CVE-2025-71160,     CVE-2025-71162, CVE-2025-71163, CVE-2025-71180, CVE-2025-71182, CVE-2025-71183, CVE-2025-71184,     CVE-2025-71185, CVE-2025-71186, CVE-2025-71188, CVE-2025-71189, CVE-2025-71190, CVE-2025-71191,     CVE-2025-71192, CVE-2025-71193, CVE-2025-71194, CVE-2025-71195, CVE-2025-71196, CVE-2025-71197,     CVE-2025-71198, CVE-2025-71199, CVE-2025-71200, CVE-2025-71220, CVE-2025-71222, CVE-2025-71224,     CVE-2025-71225, CVE-2025-71268, CVE-2026-22976, CVE-2026-22977, CVE-2026-22978, CVE-2026-22979,     CVE-2026-22980, CVE-2026-22982, CVE-2026-22984, CVE-2026-22990, CVE-2026-22991, CVE-2026-22992,     CVE-2026-22994, CVE-2026-22996, CVE-2026-22997, CVE-2026-22998, CVE-2026-22999, CVE-2026-23000,     CVE-2026-23001, CVE-2026-23003, CVE-2026-23005, CVE-2026-23006, CVE-2026-23010, CVE-2026-23011,     CVE-2026-23019, CVE-2026-23020, CVE-2026-23021, CVE-2026-23025, CVE-2026-23026, CVE-2026-23030,     CVE-2026-23031, CVE-2026-23032, CVE-2026-23033, CVE-2026-23035, CVE-2026-23037, CVE-2026-23038,     CVE-2026-23047, CVE-2026-23049, CVE-2026-23050, CVE-2026-23053, CVE-2026-23054, CVE-2026-23056,     CVE-2026-23057, CVE-2026-23058, CVE-2026-23059, CVE-2026-23061, CVE-2026-23062, CVE-2026-23063,     CVE-2026-23064, CVE-2026-23065, CVE-2026-23068, CVE-2026-23069, CVE-2026-23071, CVE-2026-23073,     CVE-2026-23075, CVE-2026-23076, CVE-2026-23078, CVE-2026-23080, CVE-2026-23083, CVE-2026-23084,     CVE-2026-23085, CVE-2026-23086, CVE-2026-23087, CVE-2026-23088, CVE-2026-23089, CVE-2026-23090,     CVE-2026-23091, CVE-2026-23093, CVE-2026-23094, CVE-2026-23095, CVE-2026-23096, CVE-2026-23097,     CVE-2026-23098, CVE-2026-23099, CVE-2026-23101, CVE-2026-23102, CVE-2026-23103, CVE-2026-23105,     CVE-2026-23107, CVE-2026-23108, CVE-2026-23110, CVE-2026-23113, CVE-2026-23116, CVE-2026-23119,     CVE-2026-23120, CVE-2026-23121, CVE-2026-23123, CVE-2026-23124, CVE-2026-23125, CVE-2026-23126,     CVE-2026-23128, CVE-2026-23129, CVE-2026-23131, CVE-2026-23133, CVE-2026-23135, CVE-2026-23136,     CVE-2026-23139, CVE-2026-23140, CVE-2026-23141, CVE-2026-23142, CVE-2026-23144, CVE-2026-23145,     CVE-2026-23146, CVE-2026-23148, CVE-2026-23150, CVE-2026-23151, CVE-2026-23156, CVE-2026-23159,     CVE-2026-23160, CVE-2026-23163, CVE-2026-23164, CVE-2026-23166, CVE-2026-23167, CVE-2026-23168,     CVE-2026-23170, CVE-2026-23172, CVE-2026-23173, CVE-2026-23176, CVE-2026-23178, CVE-2026-23179,     CVE-2026-23180, CVE-2026-23182, CVE-2026-23187, CVE-2026-23190, CVE-2026-23191, CVE-2026-23193,     CVE-2026-23198, CVE-2026-23200, CVE-2026-23202, CVE-2026-23204, CVE-2026-23205, CVE-2026-23206,     CVE-2026-23212, CVE-2026-23213, CVE-2026-23214, CVE-2026-23215, CVE-2026-23216, CVE-2026-23254,     CVE-2026-23256, CVE-2026-23257, CVE-2026-23258, CVE-2026-23260, CVE-2026-23261, CVE-2026-23262,     CVE-2026-23264, CVE-2026-23274, CVE-2026-23351, CVE-2026-23394)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 24.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-8289-1 advisory.

    It was discovered that the Linux kernel algif_aead module did not properly handle in-place cryptographic     operations. This flaw is known as Copy Fail. A local attacker could use this to escalate privileges, or     possibly escape a container. (CVE-2026-31431)

    Several security issues were discovered in the Linux kernel. An attacker could possibly use these to     compromise the system. This update corrects flaws in the following subsystems:

    - ARM64 architecture;

    - x86 architecture;

    - Cryptographic API;

    - Compute Acceleration Framework;

    - Drivers core;

    - Null block device driver;

    - Ublk userspace block driver;

    - Bluetooth drivers;

    - Counter interface drivers;

    - DMA engine subsystem;

    - DPLL subsystem;

    - GPU drivers;

    - HID subsystem;

    - Intel Trace Hub HW tracing drivers;

    - IIO ADC drivers;

    - IIO subsystem;

    - On-Chip Interconnect management framework;

    - IRQ chip drivers;

    - Modular ISDN driver;

    - LED subsystem;

    - Multiple devices driver;

    - UACCE accelerator framework;

    - MMC subsystem;

    - Ethernet bonding driver;

    - Network drivers;

    - Mellanox network drivers;

    - NVME drivers;

    - PHY drivers;

    - x86 platform drivers;

    - i.MX PM domains;

    - SCSI subsystem;

    - SLIMbus drivers;

    - SPI subsystem;

    - TCM subsystem;

    - W1 Dallas's 1-wire bus driver;

    - Xen hypervisor drivers;

    - BTRFS file system;

    - EFI Variable file system;

    - exFAT file system;

    - Ext4 file system;

    - HFS+ file system;

    - Network file system (NFS) client;

    - Network file system (NFS) server daemon;

    - NTFS3 file system;

    - SMB network file system;

    - Scheduler infrastructure;

    - Netfilter;

    - NFC subsystem;

    - Tracing infrastructure;

    - io_uring subsystem;

    - BPF subsystem;

    - Perf events;

    - Floating proportions library;

    - Memory management;

    - Bluetooth subsystem;

    - CAN network layer;

    - Ceph Core library;

    - Networking core;

    - IPv4 networking;

    - IPv6 networking;

    - L2TP protocol;

    - MAC80211 subsystem;

    - NET/ROM layer;

    - Packet sockets;

    - Network traffic control;

    - SCTP protocol;

    - TLS protocol;

    - Unix domain sockets;

    - VMware vSockets driver;

    - Wireless networking;

    - ALSA AC97 driver;

    - Generic PCM loopback sound driver;

    - Creative Sound Blaster X-Fi driver;

    - AMD SoC Alsa drivers;

    - Texas InstrumentS Audio (ASoC/HDA) drivers;

    - USB sound devices;

    - KVM subsystem; (CVE-2024-50004, CVE-2024-58096, CVE-2024-58097, CVE-2025-37926, CVE-2025-38201,     CVE-2025-38591, CVE-2025-40039, CVE-2025-40082, CVE-2025-40149, CVE-2025-68351, CVE-2025-68358,     CVE-2025-68365, CVE-2025-68725, CVE-2025-68749, CVE-2025-68803, CVE-2025-68823, CVE-2025-71160,     CVE-2025-71162, CVE-2025-71163, CVE-2025-71180, CVE-2025-71182, CVE-2025-71183, CVE-2025-71184,     CVE-2025-71185, CVE-2025-71186, CVE-2025-71188, CVE-2025-71189, CVE-2025-71190, CVE-2025-71191,     CVE-2025-71192, CVE-2025-71193, CVE-2025-71194, CVE-2025-71195, CVE-2025-71196, CVE-2025-71197,     CVE-2025-71198, CVE-2025-71199, CVE-2025-71200, CVE-2025-71220, CVE-2025-71222, CVE-2025-71224,     CVE-2025-71225, CVE-2025-71268, CVE-2026-22976, CVE-2026-22977, CVE-2026-22978, CVE-2026-22979,     CVE-2026-22980, CVE-2026-22982, CVE-2026-22984, CVE-2026-22990, CVE-2026-22991, CVE-2026-22992,     CVE-2026-22994, CVE-2026-22996, CVE-2026-22997, CVE-2026-22998, CVE-2026-22999, CVE-2026-23000,     CVE-2026-23001, CVE-2026-23003, CVE-2026-23005, CVE-2026-23006, CVE-2026-23010, CVE-2026-23011,     CVE-2026-23019, CVE-2026-23020, CVE-2026-23021, CVE-2026-23025, CVE-2026-23026, CVE-2026-23030,     CVE-2026-23031, CVE-2026-23032, CVE-2026-23033, CVE-2026-23035, CVE-2026-23037, CVE-2026-23038,     CVE-2026-23047, CVE-2026-23049, CVE-2026-23050, CVE-2026-23053, CVE-2026-23054, CVE-2026-23056,     CVE-2026-23057, CVE-2026-23058, CVE-2026-23059, CVE-2026-23061, CVE-2026-23062, CVE-2026-23063,     CVE-2026-23064, CVE-2026-23065, CVE-2026-23068, CVE-2026-23069, CVE-2026-23071, CVE-2026-23073,     CVE-2026-23075, CVE-2026-23076, CVE-2026-23078, CVE-2026-23080, CVE-2026-23083, CVE-2026-23084,     CVE-2026-23085, CVE-2026-23086, CVE-2026-23087, CVE-2026-23088, CVE-2026-23089, CVE-2026-23090,     CVE-2026-23091, CVE-2026-23093, CVE-2026-23094, CVE-2026-23095, CVE-2026-23096, CVE-2026-23097,     CVE-2026-23098, CVE-2026-23099, CVE-2026-23101, CVE-2026-23102, CVE-2026-23103, CVE-2026-23105,     CVE-2026-23107, CVE-2026-23108, CVE-2026-23110, CVE-2026-23113, CVE-2026-23116, CVE-2026-23119,     CVE-2026-23120, CVE-2026-23121, CVE-2026-23123, CVE-2026-23124, CVE-2026-23125, CVE-2026-23126,     CVE-2026-23128, CVE-2026-23129, CVE-2026-23131, CVE-2026-23133, CVE-2026-23135, CVE-2026-23136,     CVE-2026-23139, CVE-2026-23140, CVE-2026-23141, CVE-2026-23142, CVE-2026-23144, CVE-2026-23145,     CVE-2026-23146, CVE-2026-23148, CVE-2026-23150, CVE-2026-23151, CVE-2026-23156, CVE-2026-23159,     CVE-2026-23160, CVE-2026-23163, CVE-2026-23164, CVE-2026-23166, CVE-2026-23167, CVE-2026-23168,     CVE-2026-23170, CVE-2026-23172, CVE-2026-23173, CVE-2026-23176, CVE-2026-23178, CVE-2026-23179,     CVE-2026-23180, CVE-2026-23182, CVE-2026-23187, CVE-2026-23190, CVE-2026-23191, CVE-2026-23193,     CVE-2026-23198, CVE-2026-23200, CVE-2026-23204, CVE-2026-23205, CVE-2026-23206, CVE-2026-23212,     CVE-2026-23213, CVE-2026-23214, CVE-2026-23215, CVE-2026-23216, CVE-2026-23254, CVE-2026-23256,     CVE-2026-23257, CVE-2026-23258, CVE-2026-23260, CVE-2026-23261, CVE-2026-23262, CVE-2026-23264,     CVE-2026-23274, CVE-2026-23351, CVE-2026-23394, CVE-2026-31419, CVE-2026-31504, CVE-2026-31533,     CVE-2026-43033, CVE-2026-43077, CVE-2026-43078)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 25.10 / Pro Realtime 24.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-8277-1 advisory.

    It was discovered that the Linux kernel algif_aead module did not properly handle in-place cryptographic     operations. This flaw is known as Copy Fail. A local attacker could use this to escalate privileges, or     possibly escape a container. (CVE-2026-31431)

    Several security issues were discovered in the Linux kernel. An attacker could possibly use these to     compromise the system. This update corrects flaws in the following subsystems:

    - S390 architecture;

    - Cryptographic API;

    - GPU drivers;

    - Ethernet bonding driver;

    - Network file system (NFS) server daemon;

    - Distributed Switch Architecture;

    - Netfilter;

    - Control group (cgroup);

    - Kernel kexec() syscall;

    - Memory management;

    - MAC80211 subsystem;

    - Multipath TCP;

    - Packet sockets;

    - TLS protocol;

    - Unix domain sockets; (CVE-2025-71088, CVE-2025-71090, CVE-2025-71127, CVE-2025-71134, CVE-2025-71139,     CVE-2025-71141, CVE-2025-71142, CVE-2025-71144, CVE-2025-71152, CVE-2025-71155, CVE-2026-23274,     CVE-2026-23351, CVE-2026-23394, CVE-2026-31419, CVE-2026-31504, CVE-2026-31533, CVE-2026-43033,     CVE-2026-43077, CVE-2026-43078)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 22.04 LTS / 24.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-8278-1 advisory.

    It was discovered that the Linux kernel algif_aead module did not properly handle in-place cryptographic     operations. This flaw is known as Copy Fail. A local attacker could use this to escalate privileges, or     possibly escape a container. (CVE-2026-31431)

    Several security issues were discovered in the Linux kernel. An attacker could possibly use these to     compromise the system. This update corrects flaws in the following subsystems:

    - ARM64 architecture;

    - x86 architecture;

    - Cryptographic API;

    - Compute Acceleration Framework;

    - Drivers core;

    - Null block device driver;

    - Ublk userspace block driver;

    - Bluetooth drivers;

    - Counter interface drivers;

    - DMA engine subsystem;

    - DPLL subsystem;

    - GPU drivers;

    - HID subsystem;

    - Intel Trace Hub HW tracing drivers;

    - IIO ADC drivers;

    - IIO subsystem;

    - On-Chip Interconnect management framework;

    - IRQ chip drivers;

    - Modular ISDN driver;

    - LED subsystem;

    - Multiple devices driver;

    - UACCE accelerator framework;

    - MMC subsystem;

    - Ethernet bonding driver;

    - Network drivers;

    - Mellanox network drivers;

    - NVME drivers;

    - PHY drivers;

    - x86 platform drivers;

    - i.MX PM domains;

    - SCSI subsystem;

    - SLIMbus drivers;

    - SPI subsystem;

    - TCM subsystem;

    - W1 Dallas's 1-wire bus driver;

    - Xen hypervisor drivers;

    - BTRFS file system;

    - EFI Variable file system;

    - exFAT file system;

    - Ext4 file system;

    - HFS+ file system;

    - Network file system (NFS) client;

    - Network file system (NFS) server daemon;

    - NTFS3 file system;

    - SMB network file system;

    - Scheduler infrastructure;

    - Netfilter;

    - NFC subsystem;

    - Tracing infrastructure;

    - io_uring subsystem;

    - BPF subsystem;

    - Perf events;

    - Floating proportions library;

    - Memory management;

    - Bluetooth subsystem;

    - CAN network layer;

    - Ceph Core library;

    - Networking core;

    - IPv4 networking;

    - IPv6 networking;

    - L2TP protocol;

    - MAC80211 subsystem;

    - NET/ROM layer;

    - Packet sockets;

    - Network traffic control;

    - SCTP protocol;

    - TLS protocol;

    - Unix domain sockets;

    - VMware vSockets driver;

    - Wireless networking;

    - ALSA AC97 driver;

    - Generic PCM loopback sound driver;

    - Creative Sound Blaster X-Fi driver;

    - AMD SoC Alsa drivers;

    - Texas InstrumentS Audio (ASoC/HDA) drivers;

    - USB sound devices;

    - KVM subsystem; (CVE-2024-50004, CVE-2024-58096, CVE-2024-58097, CVE-2025-37926, CVE-2025-38201,     CVE-2025-38591, CVE-2025-40039, CVE-2025-40082, CVE-2025-40149, CVE-2025-68351, CVE-2025-68358,     CVE-2025-68365, CVE-2025-68725, CVE-2025-68749, CVE-2025-68803, CVE-2025-68823, CVE-2025-71160,     CVE-2025-71162, CVE-2025-71163, CVE-2025-71180, CVE-2025-71182, CVE-2025-71183, CVE-2025-71184,     CVE-2025-71185, CVE-2025-71186, CVE-2025-71188, CVE-2025-71189, CVE-2025-71190, CVE-2025-71191,     CVE-2025-71192, CVE-2025-71193, CVE-2025-71194, CVE-2025-71195, CVE-2025-71196, CVE-2025-71197,     CVE-2025-71198, CVE-2025-71199, CVE-2025-71200, CVE-2025-71220, CVE-2025-71222, CVE-2025-71224,     CVE-2025-71225, CVE-2025-71268, CVE-2026-22976, CVE-2026-22977, CVE-2026-22978, CVE-2026-22979,     CVE-2026-22980, CVE-2026-22982, CVE-2026-22984, CVE-2026-22990, CVE-2026-22991, CVE-2026-22992,     CVE-2026-22994, CVE-2026-22996, CVE-2026-22997, CVE-2026-22998, CVE-2026-22999, CVE-2026-23000,     CVE-2026-23001, CVE-2026-23003, CVE-2026-23005, CVE-2026-23006, CVE-2026-23010, CVE-2026-23011,     CVE-2026-23019, CVE-2026-23020, CVE-2026-23021, CVE-2026-23025, CVE-2026-23026, CVE-2026-23030,     CVE-2026-23031, CVE-2026-23032, CVE-2026-23033, CVE-2026-23035, CVE-2026-23037, CVE-2026-23038,     CVE-2026-23047, CVE-2026-23049, CVE-2026-23050, CVE-2026-23053, CVE-2026-23054, CVE-2026-23056,     CVE-2026-23057, CVE-2026-23058, CVE-2026-23059, CVE-2026-23061, CVE-2026-23062, CVE-2026-23063,     CVE-2026-23064, CVE-2026-23065, CVE-2026-23068, CVE-2026-23069, CVE-2026-23071, CVE-2026-23073,     CVE-2026-23075, CVE-2026-23076, CVE-2026-23078, CVE-2026-23080, CVE-2026-23083, CVE-2026-23084,     CVE-2026-23085, CVE-2026-23086, CVE-2026-23087, CVE-2026-23088, CVE-2026-23089, CVE-2026-23090,     CVE-2026-23091, CVE-2026-23093, CVE-2026-23094, CVE-2026-23095, CVE-2026-23096, CVE-2026-23097,     CVE-2026-23098, CVE-2026-23099, CVE-2026-23101, CVE-2026-23102, CVE-2026-23103, CVE-2026-23105,     CVE-2026-23107, CVE-2026-23108, CVE-2026-23110, CVE-2026-23113, CVE-2026-23116, CVE-2026-23119,     CVE-2026-23120, CVE-2026-23121, CVE-2026-23123, CVE-2026-23124, CVE-2026-23125, CVE-2026-23126,     CVE-2026-23128, CVE-2026-23129, CVE-2026-23131, CVE-2026-23133, CVE-2026-23135, CVE-2026-23136,     CVE-2026-23139, CVE-2026-23140, CVE-2026-23141, CVE-2026-23142, CVE-2026-23144, CVE-2026-23145,     CVE-2026-23146, CVE-2026-23148, CVE-2026-23150, CVE-2026-23151, CVE-2026-23156, CVE-2026-23159,     CVE-2026-23160, CVE-2026-23163, CVE-2026-23164, CVE-2026-23166, CVE-2026-23167, CVE-2026-23168,     CVE-2026-23170, CVE-2026-23172, CVE-2026-23173, CVE-2026-23176, CVE-2026-23178, CVE-2026-23179,     CVE-2026-23180, CVE-2026-23182, CVE-2026-23187, CVE-2026-23190, CVE-2026-23191, CVE-2026-23193,     CVE-2026-23198, CVE-2026-23200, CVE-2026-23202, CVE-2026-23204, CVE-2026-23205, CVE-2026-23206,     CVE-2026-23212, CVE-2026-23213, CVE-2026-23214, CVE-2026-23215, CVE-2026-23216, CVE-2026-23254,     CVE-2026-23256, CVE-2026-23257, CVE-2026-23258, CVE-2026-23260, CVE-2026-23261, CVE-2026-23262,     CVE-2026-23264, CVE-2026-23274, CVE-2026-23351, CVE-2026-23394, CVE-2026-31419, CVE-2026-31504,     CVE-2026-31533, CVE-2026-43033, CVE-2026-43077, CVE-2026-43078)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1693 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    af_unix: Give up GC if MSG_PEEK intervened. (CVE-2026-23394)

    In the Linux kernel, the following vulnerability has been resolved:

    ipv6: add NULL checks for idev in SRv6 paths (CVE-2026-23442)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: conntrack: add missing netlink policy validations (CVE-2026-31407)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: ipset: drop logically empty buckets in mtype_del (CVE-2026-31418)

    In the Linux kernel, the following vulnerability has been resolved:

    net: skb: fix cross-cache free of KFENCE-allocated skb head (CVE-2026-31429)

    In the Linux kernel, the following vulnerability has been resolved:

    X.509: Fix out-of-bounds access when parsing extensions (CVE-2026-31430)

    In the Linux kernel, the following vulnerability has been resolved:

    ipv4: nexthop: allocate skb dynamically in rtm_get_nexthop() (CVE-2026-31531)

    In the Linux kernel, the following vulnerability has been resolved:

    can: raw: fix ro->uniq use-after-free in raw_rcv() (CVE-2026-31532)

    In the Linux kernel, the following vulnerability has been resolved:

    net/tls: fix use-after-free in -EBUSY error path of tls_do_encryption (CVE-2026-31533)

    In the Linux kernel, the following vulnerability has been resolved:

    mm/userfaultfd: fix hugetlb fault mutex hash calculation (CVE-2026-31575)

    In the Linux kernel, the following vulnerability has been resolved:

    wireguard: device: use exit_rtnl callback instead of manual rtnl_lock in pre_exit (CVE-2026-31579)

    In the Linux kernel, the following vulnerability has been resolved:

    bcache: fix cached_dev.sb_bio use-after-free and crash (CVE-2026-31580)

    In the Linux kernel, the following vulnerability has been resolved:

    mm: blk-cgroup: fix use-after-free in cgwb_release_workfn() (CVE-2026-31586)

    In the Linux kernel, the following vulnerability has been resolved:

    KVM: x86: Use scratch field in MMIO fragment to hold small write values (CVE-2026-31588)

    In the Linux kernel, the following vulnerability has been resolved:

    KVM: SEV: Lock all vCPUs when synchronzing VMSAs for SNP launch finish (CVE-2026-31591)

    In the Linux kernel, the following vulnerability has been resolved:

    KVM: SEV: Protect *all* of sev_mem_enc_register_region() with kvm->lock (CVE-2026-31592)

    In the Linux kernel, the following vulnerability has been resolved:

    KVM: SEV: Reject attempts to sync VMSA of an already-launched/encrypted vCPU (CVE-2026-31593)

    In the Linux kernel, the following vulnerability has been resolved:

    arm64: mm: Handle invalid large leaf mappings correctly (CVE-2026-31600)

    In the Linux kernel, the following vulnerability has been resolved:

    usbip: validate number_of_packets in usbip_pack_ret_submit() (CVE-2026-31607)

    In the Linux kernel, the following vulnerability has been resolved:

    smb: client: fix OOB reads parsing symlink error response (CVE-2026-31613)

    In the Linux kernel, the following vulnerability has been resolved:

    smb: client: fix off-by-8 bounds check in check_wsl_eas() (CVE-2026-31614)

    In the Linux kernel, the following vulnerability has been resolved:

    HID: core: clamp report_size in s32ton() to avoid undefined shift (CVE-2026-31624)

    In the Linux kernel, the following vulnerability has been resolved:

    HID: alps: fix NULL pointer dereference in alps_raw_event() (CVE-2026-31625)

    In the Linux kernel, the following vulnerability has been resolved:

    x86/CPU: Fix FPDSS on Zen1 (CVE-2026-31628)

    In the Linux kernel, the following vulnerability has been resolved:

    rxrpc: fix reference count leak in rxrpc_server_keyring() (CVE-2026-31634)

    In the Linux kernel, the following vulnerability has been resolved:

    rxrpc: reject undecryptable rxkad response tickets (CVE-2026-31637)

    In the Linux kernel, the following vulnerability has been resolved:

    mm: filemap: fix nr_pages calculation overflow in filemap_map_pages() (CVE-2026-31648)

    In the Linux kernel, the following vulnerability has been resolved:

    mm/damon/sysfs: dealloc repeat_call_control if damon_call() fails (CVE-2026-31653)

    In the Linux kernel, the following vulnerability has been resolved:

    drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CVE-2026-31656)

    In the Linux kernel, the following vulnerability has been resolved:

    tipc: fix bc_ackers underflow on duplicate GRP_ACK_MSG (CVE-2026-31662)

    In the Linux kernel, the following vulnerability has been resolved:

    xfrm: hold dev ref until after transport_finish NF_HOOK (CVE-2026-31663)

    In the Linux kernel, the following vulnerability has been resolved:

    xfrm: clear trailing padding in build_polexpire() (CVE-2026-31664)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: nft_ct: fix use-after-free in timeout object destroy (CVE-2026-31665)

    In the Linux kernel, the following vulnerability has been resolved:

    btrfs: fix incorrect return value after changing leaf in lookup_extent_data_ref() (CVE-2026-31666)

    In the Linux kernel, the following vulnerability has been resolved:

    Input: uinput - fix circular locking dependency with ff-core (CVE-2026-31667)

    In the Linux kernel, the following vulnerability has been resolved:

    seg6: separate dst_cache for input and output paths in seg6 lwtunnel (CVE-2026-31668)

    In the Linux kernel, the following vulnerability has been resolved:

    mptcp: fix slab-use-after-free in __inet_lookup_established (CVE-2026-31669)

    In the Linux kernel, the following vulnerability has been resolved:

    xfrm_user: fix info leak in build_report() (CVE-2026-31671)

    In the Linux kernel, the following vulnerability has been resolved:

    af_unix: read UNIX_DIAG_VFS data under unix_state_lock (CVE-2026-31673)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: xt_multiport: validate range encoding in checkentry (CVE-2026-31681)

    In the Linux kernel, the following vulnerability has been resolved:

    net: sched: act_csum: validate nested VLAN headers (CVE-2026-31684)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: ip6t_eui64: reject invalid MAC header for all packets (CVE-2026-31685)

    In the Linux kernel, the following vulnerability has been resolved:

    EDAC/mc: Fix error path ordering in edac_mc_alloc() (CVE-2026-31689)

    In the Linux kernel, the following vulnerability has been resolved:

    igb: remove napi_synchronize() in igb_down() (CVE-2026-31691)

    In the Linux kernel, the following vulnerability has been resolved:

    rtnetlink: add missing netlink_ns_capable() check for peer netns (CVE-2026-31692)

    In the Linux kernel, the following vulnerability has been resolved:

    fuse: reject oversized dirents in page cache (CVE-2026-31694)

    In the Linux kernel, the following vulnerability has been resolved:

    net/packet: fix TOCTOU race on mmap'd vnet_hdr in tpacket_snd() (CVE-2026-31700)

    In the Linux kernel, the following vulnerability has been resolved:

    writeback: Fix use after free in inode_switch_wbs_work_fn() (CVE-2026-31703)

    In the Linux kernel, the following vulnerability has been resolved:

    smb: client: fix OOB read in smb2_ioctl_query_info QUERY_INFO path (CVE-2026-31708)

    In the Linux kernel, the following vulnerability has been resolved:

    fuse: abort on fatal signal during sync init (CVE-2026-31713)

    In the Linux kernel, the following vulnerability has been resolved:

    fs/ntfs3: validate rec->used in journal-replay file record check (CVE-2026-31716)

    In the Linux kernel, the following vulnerability has been resolved:

    crypto: krb5enc - fix async decrypt skipping hash verification (CVE-2026-31719)

    In the Linux kernel, the following vulnerability has been resolved:

    dcache: Limit the minimal number of bucket to two (CVE-2026-43071)

    In the Linux kernel, the following vulnerability has been resolved:

    x86-64: rename misleadingly named '__copy_user_nocache()' function (CVE-2026-43073)

    In the Linux kernel, the following vulnerability has been resolved:

    eventpoll: defer struct eventpoll free to RCU grace period (CVE-2026-43074)

    In the Linux kernel, the following vulnerability has been resolved:

    perf/x86/intel/uncore: Skip discovery table for offline dies (CVE-2026-43079)

    In the Linux kernel, the following vulnerability has been resolved:

    net: ioam6: fix OOB and missing lock (CVE-2026-43083)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: nfnetlink_queue: make hash table per queue (CVE-2026-43084)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator (CVE-2026-43085)

    In the Linux kernel, the following vulnerability has been resolved:

    ipvs: fix NULL deref in ip_vs_add_service error path (CVE-2026-43086)

    In the Linux kernel, the following vulnerability has been resolved:

    xfrm_user: fix info leak in build_mapping() (CVE-2026-43089)

    In the Linux kernel, the following vulnerability has been resolved:

    xfrm: fix refcount leak in xfrm_migrate_policy_find (CVE-2026-43090)

    In the Linux kernel, the following vulnerability has been resolved:

    xfrm: Wait for RCU readers during policy netns exit (CVE-2026-43091)

    In the Linux kernel, the following vulnerability has been resolved:

    xsk: validate MTU against usable frame size on bind (CVE-2026-43092)

    In the Linux kernel, the following vulnerability has been resolved:

    xsk: tighten UMEM headroom validation to account for tailroom and min frame (CVE-2026-43093)

    In the Linux kernel, the following vulnerability has been resolved:

    ixgbevf: add missing negotiate_features op to Hyper-V ops table (CVE-2026-43094)

    In the Linux kernel, the following vulnerability has been resolved:

    ipv4: icmp: fix null-ptr-deref in icmp_build_probe() (CVE-2026-43099)

    In the Linux kernel, the following vulnerability has been resolved:

    bridge: guard local VLAN-0 FDB helpers against NULL vlan group (CVE-2026-43100)

    In the Linux kernel, the following vulnerability has been resolved:

    ipv6: ioam: fix potential NULL dereferences in __ioam6_fill_trace_data() (CVE-2026-43101)

    In the Linux kernel, the following vulnerability has been resolved:

    xfrm: account XFRMA_IF_ID in aevent size calculation (CVE-2026-43107)

    In the Linux kernel, the following vulnerability has been resolved:

    x86: shadow stacks: proper error handling for mmap lock (CVE-2026-43109)

    In the Linux kernel, the following vulnerability has been resolved:

    fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CVE-2026-43112)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CVE-2026-43114)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: ctnetlink: ensure safe access to master conntrack (CVE-2026-43116)

    In the Linux kernel, the following vulnerability has been resolved:

    btrfs: tracepoints: get correct superblock from dentry in event btrfs_sync_file() (CVE-2026-43117)

    In the Linux kernel, the following vulnerability has been resolved:

    btrfs: fix zero size inode with non-zero size after log replay (CVE-2026-43118)

    In the Linux kernel, the following vulnerability has been resolved:xfrm: esp: avoid in-place decrypt on     shared skb frags

    Dirty Frag and other issues in Amazon Linux kernels:https://aws.amazon.com/security/security-     bulletins/2026-027-aws/ (CVE-2026-43284)

    In the Linux kernel, the following vulnerability has been resolved:

    smb: client: require a full NFS mode SID before reading mode bits (CVE-2026-43350)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - af_unix: Give up GC if MSG_PEEK intervened. Igor Ushakov reported that GC purged the receive queue of an     alive socket due to a race with MSG_PEEK with a nice repro. This is the exact same issue previously fixed     by commit cbcf01128d0a (af_unix: fix garbage collect vs MSG_PEEK). After GC was replaced with the     current algorithm, the cited commit removed the locking dance in unix_peek_fds() and reintroduced the same     issue. The problem is that MSG_PEEK bumps a file refcount without interacting with GC. Consider an SCC     containing sk-A and sk-B, where sk-A is close()d but can be recv()ed via sk-B. The bad thing happens if     sk-A is recv()ed with MSG_PEEK from sk-B and sk-B is close()d while GC is checking unix_vertex_dead() for     sk-A and sk-B. GC thread User thread --------- ----------- unix_vertex_dead(sk-A) -> true <------. \     `------ recv(sk-B, MSG_PEEK) invalidate !! -> sk-A's file refcount : 1 -> 2 close(sk-B) -> sk-B's file     refcount : 2 -> 1 unix_vertex_dead(sk-B) -> true Initially, sk-A's file refcount is 1 by the inflight fd     in sk-B recvq. GC thinks sk-A is dead because the file refcount is the same as the number of its inflight     fds. However, sk-A's file refcount is bumped silently by MSG_PEEK, which invalidates the previous     evaluation. At this moment, sk-B's file refcount is 2; one by the open fd, and one by the inflight fd in     sk-A. The subsequent close() releases one refcount by the former. Finally, GC incorrectly concludes that     both sk-A and sk-B are dead. One option is to restore the locking dance in unix_peek_fds(), but we can     resolve this more elegantly thanks to the new algorithm. The point is that the issue does not occur     without the subsequent close() and we actually do not need to synchronise MSG_PEEK with the dead SCC     detection. When the issue occurs, close() and GC touch the same file refcount. If GC sees the refcount     being decremented by close(), it can just give up garbage-collecting the SCC. Therefore, we only need to     signal the race during MSG_PEEK with a proper memory barrier to make it visible to the GC. Let's use     seqcount_t to notify GC when MSG_PEEK occurs and let it defer the SCC to the next run. This way no locking     is needed on the MSG_PEEK side, and we can avoid imposing a penalty on every MSG_PEEK unnecessarily. Note     that we can retry within unix_scc_dead() if MSG_PEEK is detected, but we do not do so to avoid hung task     splat from abusive MSG_PEEK calls. (CVE-2026-23394)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
325425	Ubuntu 24.04 LTS : Linux kernel (NVIDIA) vulnerabilities (USN-8508-1)	Nessus	Ubuntu Local Security Checks	critical
325008	Ubuntu 24.04 LTS : Linux kernel (Xilinx) vulnerabilities (USN-8499-1)	Nessus	Ubuntu Local Security Checks	high
323212	EulerOS 2.0 SP15 : kernel (EulerOS-SA-2026-2485)	Nessus	Huawei Local Security Checks	high
323152	EulerOS 2.0 SP15 : kernel (EulerOS-SA-2026-2444)	Nessus	Huawei Local Security Checks	high
321868	Debian dsa-6355 : ata-modules-6.12.90+deb13-armmp-di - security update	Nessus	Debian Local Security Checks	high
321369	Ubuntu 22.04 LTS : Linux kernel (Azure) vulnerabilities (USN-8440-1)	Nessus	Ubuntu Local Security Checks	high
318847	Ubuntu 24.04 LTS : Linux kernel (Azure FIPS) vulnerabilities (USN-8393-1)	Nessus	Ubuntu Local Security Checks	high
318635	Ubuntu 24.04 LTS / 25.10 : Linux kernel vulnerabilities (USN-8374-1)	Nessus	Ubuntu Local Security Checks	high
317095	Ubuntu 24.04 LTS / 25.10 : Linux kernel (Azure) vulnerabilities (USN-8310-1)	Nessus	Ubuntu Local Security Checks	high
316636	Ubuntu 24.04 LTS : Linux kernel (FIPS) vulnerabilities (USN-8296-1)	Nessus	Ubuntu Local Security Checks	high
316060	Ubuntu 24.04 LTS : Linux kernel (NVIDIA) vulnerabilities (USN-8289-1)	Nessus	Ubuntu Local Security Checks	high
315742	Ubuntu 25.10 / Pro Realtime 24.04 LTS : Linux kernel vulnerabilities (USN-8277-1)	Nessus	Ubuntu Local Security Checks	high
315738	Ubuntu 22.04 LTS / 24.04 LTS : Linux kernel vulnerabilities (USN-8278-1)	Nessus	Ubuntu Local Security Checks	high
313525	Amazon Linux 2023 : bpftool6.18, kernel6.18, kernel6.18-devel (ALAS2023-2026-1693)	Nessus	Amazon Linux Local Security Checks	high
303674	Linux Distros Unpatched Vulnerability : CVE-2026-23394	Nessus	Misc.	medium

Detections

Analytics

CVE-2026-23394

medium

Tenable Plugins

critical

high

high

high

high

high

high

high

high

high

high

high

high

high

medium