In the Linux kernel, the following vulnerability has been resolved: serial: core: fix infinite loop in handle_tx() for PORT_UNKNOWN uart_write_room() and uart_write() behave inconsistently when xmit_buf is NULL (which happens for PORT_UNKNOWN ports that were never properly initialized): - uart_write_room() returns kfifo_avail() which can be > 0 - uart_write() checks xmit_buf and returns 0 if NULL This inconsistency causes an infinite loop in drivers that rely on tty_write_room() to determine if they can write: while (tty_write_room(tty) > 0) { written = tty->ops->write(...); // written is always 0, loop never exits } For example, caif_serial's handle_tx() enters an infinite loop when used with PORT_UNKNOWN serial ports, causing system hangs. Fix by making uart_write_room() also check xmit_buf and return 0 if it's NULL, consistent with uart_write(). Reproducer: https://gist.github.com/mrpre/d9a694cc0e19828ee3bc3b37983fde13

According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    Input: alps - fix use-after-free bugs caused by dev3_register_work(CVE-2025-68822)

    ext4: reject mount if bigalloc with s_first_data_block != 0(CVE-2026-31447)

    tls: Fix race condition in tls_sw_cancel_work_tx()(CVE-2026-23240)

    apparmor: replace recursive profile removal with iterative approach(CVE-2026-23404)

    ethtool: Avoid overflowing userspace buffer on stats query(CVE-2025-68795)

    ipv6: avoid overflows in ip6_datagram_send_ctl()(CVE-2026-31415)

    ceph: add a bunch of missing ceph_path_info initializers(CVE-2026-43408)

    netfilter: nf_conntrack_helper: pass helper to expect cleanup(CVE-2026-43027)

    netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp()(CVE-2026-23457)

    PM: runtime: Fix a race condition related to device removal(CVE-2026-23452)

    net/sched: sch_hfsc: fix divide-by-zero in rtsc_min()(CVE-2026-31423)

    mm: blk-cgroup: fix use-after-free in cgwb_release_workfn()(CVE-2026-31586)

    drm/ioc32: stop speculation on the drm_compat_ioctl path(CVE-2026-31781)

    module: Fix kernel panic when a symbol st_shndx is out of bounds(CVE-2026-31521)

    serial: core: fix infinite loop in handle_tx() for PORT_UNKNOWN(CVE-2026-23472)

    net/tcp-md5: Fix MAC comparison to be constant-time(CVE-2026-43383)

    ext4: avoid infinite loops caused by residual data(CVE-2026-31448)

    smb: client: Don#39;t log plaintext credentials in cifs_set_cifscreds(CVE-2026-23303)

    dmaengine: idxd: Fix memory leak when a wq is reset(CVE-2026-31441)

    bridge: br_nd_send: linearize skb before parsing ND options(CVE-2026-31682)

    net/sched: teql: fix NULL pointer dereference in iptunnel_xmit on TEQL slave xmit(CVE-2026-23277)

    crypto: af_alg - limit RX SG extraction by receive buffer budget(CVE-2026-31677)

    netfilter: xt_CT: drop pending enqueued packets on template removal(CVE-2026-23391)

    apparmor: validate DFA start states are in bounds in unpack_pdb(CVE-2026-23269)

    net: bonding: fix use-after-free in bond_xmit_broadcast()(CVE-2026-31419)

    NFSD: Hold net reference for the lifetime of /proc/fs/nfs/exports fd(CVE-2026-31403)

    ipv4: nexthop: allocate skb dynamically in rtm_get_nexthop()(CVE-2026-31531)

    netfilter: ipset: drop logically empty buckets in mtype_del(CVE-2026-31418)

    dcache: Limit the minimal number of bucket to two(CVE-2026-43071)

    HID: multitouch: Check to ensure report responses match the request(CVE-2026-43047)

    smb: client: fix krb5 mount with username option(CVE-2026-31392)

    net: usb: kaweth: validate USB endpoints(CVE-2026-23312)

    net: usb: cdc_ncm: add ndpoffset to NDP16 nframes bounds check(CVE-2026-23448)

    nvmet: move async event work off nvmet-wq(CVE-2026-31557)

    NFSD: Defer sub-object cleanup in export put callbacks(CVE-2026-31404)

    apparmor: fix side-effect bug in match_char() macro usage(CVE-2026-23406)

    nfnetlink_osf: validate individual option lengths in fingerprints(CVE-2026-23397)

    Squashfs: check metadata block offset is within range(CVE-2026-23388)

    net: add xmit recursion limit to tunnel xmit functions(CVE-2026-23276)

    libceph: Fix potential out-of-bounds access in ceph_handle_auth_reply()(CVE-2026-43407)

    xfs: fix undersized l_iclog_roundoff values(CVE-2026-43365)

    ixgbevf: add missing negotiate_features op to Hyper-V ops table(CVE-2026-43094)

    drm/vmwgfx: Return the correct value in vmw_translate_ptr functions(CVE-2026-23317)

    af_unix: read UNIX_DIAG_VFS data under unix_state_lock(CVE-2026-31673)

    af_key: validate families in pfkey_send_migrate()(CVE-2026-31515)

    smb: client: fix OOB read in smb2_ioctl_query_info QUERY_INFO path(CVE-2026-31708)

    usb: cdns3: gadget: fix NULL pointer dereference in ep_queue(CVE-2026-31755)

    netfilter: nfnetlink_log: account for netlink header size(CVE-2026-31416)

    sunrpc: fix cache_request leak in cache_release(CVE-2026-31400)

    dmaengine: idxd: fix possible wrong descriptor completion in llist_abort_desc()(CVE-2026-31436)

    net: usb: kalmia: validate USB endpoints(CVE-2026-23365)

    ptrace: slightly saner #39;get_dumpable()#39; logic(CVE-2026-46333)

    net: usb: pegasus: validate USB endpoints(CVE-2026-23290)

    bonding: provide a net pointer to __skb_flow_dissect()(CVE-2026-23119)

    KVM: SEV: Drop WARN on large size for KVM_MEMORY_ENCRYPT_REG_REGION(CVE-2026-31590)

    nvme-fc: release admin tagset if init fails(CVE-2026-23261)

    icmp: fix NULL pointer dereference in icmp_tag_validation()(CVE-2026-23398)

    netfilter: nft_ct: fix use-after-free in timeout object destroy(CVE-2026-31665)

    net: correctly handle tunneled traffic on IPV6_CSUM GSO fallback(CVE-2026-43057)

    netfilter: nf_conntrack_expect: skip expectations in other netns via proc(CVE-2026-31496)

    HID: alps: fix NULL pointer dereference in alps_raw_event()(CVE-2026-31625)

    net: usb: pegasus: enable basic endpoint checking(CVE-2026-43156)

    udp: Fix wildcard bind conflict check when using hash2(CVE-2026-31503)

    net/sched: sch_netem: fix out-of-bounds access in packet corruption(CVE-2026-31675)

    net: usb: cdc_ncm: add ndpoffset to NDP32 nframes bounds check(CVE-2026-23447)

    netfilter: ip6t_eui64: reject invalid MAC header for all packets(CVE-2026-31685)

    net: openvswitch: Avoid releasing netdev before teardown completes(CVE-2026-31508)

    net: vxlan: fix nd_tbl NULL dereference when IPv6 is disabled(CVE-2026-23293)

    netfilter: xt_IDLETIMER: reject rev0 reuse of ALARM timer labels(CVE-2026-23274)

    HID: core: Mitigate potential OOB by removing bogus memset()(CVE-2026-43048)

    x86/CPU/AMD: Add RDSEED fix for Zen5(CVE-2025-68313)

    net: ipv6: flowlabel: defer exclusive option free until RCU teardown(CVE-2026-31680)

    mmc: vub300: fix NULL-deref on disconnect(CVE-2026-31651)

    ipv6: add NULL checks for idev in SRv6 paths(CVE-2026-23442)

    openvswitch: defer tunnel netdev_put to RCU release(CVE-2026-31678)

    x86/apic: Disable x2apic on resume if the kernel expects so(CVE-2026-43363)

    netfilter: nf_conntrack_h323: check for zero length in DecodeQ931()(CVE-2026-23455)

    virtio_net: Fix UAF on dst_ops when IFF_XMIT_DST_RELEASE is cleared and napi_tx is false(CVE-2026-31469)

    netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct()(CVE-2026-23458)

    net: consume xmit errors of GSO frames(CVE-2026-43194)

    dmaengine: idxd: Fix not releasing workqueue on .release()(CVE-2026-43064)

    nvdimm/bus: Fix potential use after free in asynchronous initialization(CVE-2026-31399)

    nfsd: fix heap overflow in NFSv4.0 LOCK replay cache(CVE-2026-31402)

    ext4: publish jinode after initialization(CVE-2026-31450)

    net/sched: teql: Fix double-free in teql_master_xmit(CVE-2026-23449)

    media: mc, v4l2: serialize REINIT and REQBUFS with req_queue_mutex(CVE-2026-31473)

    ACPI: EC: clean up handlers on probe failure in acpi_ec_setup()(CVE-2026-31426)

    crypto: af-alg - fix NULL pointer dereference in scatterwalk(CVE-2026-43043)

    netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check()(CVE-2026-31674)

    sched/deadline: Fix missing ENQUEUE_REPLENISH during PI de-boosting(CVE-2026-23371)

    apparmor: fix race on rawdata dereference(CVE-2026-23410)

    apparmor: Fix double free of ns_name in aa_replace_profiles()(CVE-2026-23408)

    e1000/e1000e: Fix leak in DMA error cleanup(CVE-2026-43445)

    futex: Clear stale exiting pointer in futex_lock_pi() retry path(CVE-2026-31555)

    apparmor: fix race between freeing data and fs accessing it(CVE-2026-23411)

    netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case(CVE-2026-23456)

    driver core: platform: use generic driver_override infrastructure(CVE-2026-31527)

    xfs: stop reclaim before pushing AIL during unmount(CVE-2026-31455)

    netfilter: nf_tables: unconditionally bump set-gt;nelems before insertion(CVE-2026-23272)

    ceph: supply snapshot context in ceph_zero_partial_object()(CVE-2026-43273)

    ext4: convert inline data to extents when truncate exceeds inline size(CVE-2026-31452)

    apparmor: fix differential encoding verification(CVE-2026-23409)

    HID: core: clamp report_size in s32ton() to avoid undefined shift(CVE-2026-31624)

    EFI/CPER: don#39;t dump the entire memory region(CVE-2026-43171)

    pstore: ram_core: fix incorrect success return when vmap() fails(CVE-2026-43124)

    USB: usbtmc: Use usb_bulk_msg_killable() with user-specified timeouts(CVE-2026-43429)

    net: sched: avoid qdisc_reset_all_tx_gt() vs dequeue race for lockless qdiscs(CVE-2026-23340)

    scsi: target: Fix recursive locking in __configfs_open_file()(CVE-2026-23292)

    netfilter: ctnetlink: use netlink policy range checks(CVE-2026-31495)

    netfilter: nft_set_pipapo: split gc into unlink and reclaim phase(CVE-2026-23351)

    kprobes: avoid crash when rmmod/insmod after ftrace killed(CVE-2026-43409)

    xfs: avoid dereferencing log items after push callbacks(CVE-2026-31453)

    net: ipv6: fix panic when IPv4 route references loopback IPv6 nexthop(CVE-2026-23300)

    netfilter: x_tables: ensure names are nul-terminated(CVE-2026-43028)

    apparmor: fix: limit the number of levels of policy namespaces(CVE-2026-23405)

    net/sched: cls_fw: fix NULL pointer dereference on shared blocks(CVE-2026-31421)

    openvswitch: validate MPLS set/set_masked payload length(CVE-2026-31679)

    perf: Fix __perf_event_overflow() vs perf_remove_from_context() race(CVE-2026-23271)

    bpf: Fix regsafe() for pointers to packet(CVE-2026-43030)

    tipc: fix bc_ackers underflow on duplicate GRP_ACK_MSG(CVE-2026-31662)

    net/sched: cls_flow: fix NULL pointer dereference on shared blocks(CVE-2026-31422)

    KVM: x86: Use scratch field in MMIO fragment to hold small write values(CVE-2026-31588)

    PCI: Fix pci_slot_trylock() error handling(CVE-2026-43211)

    net: rfkill: prevent unlimited numbers of rfkill events from being created(CVE-2026-31670)

    apparmor: fix unprivileged local user can do privileged policy management(CVE-2026-23268)

    comedi: dt2815: add hardware detection to prevent crash(CVE-2026-31751)

    netfilter: nf_conntrack_sip: fix use of uninitialized rtp_addr in process_sdp(CVE-2026-31427)

    ipv6: fix NULL pointer deref in ip6_rt_get_dev_rcu()(CVE-2026-23304)

    apparmor: fix missing bounds check on DEFAULT table in verify_dfa()(CVE-2026-23407)

    xfs: save ailp before dropping the AIL lock in push callbacks(CVE-2026-31454)

    ext4: avoid allocate block from corrupted group in ext4_mb_find_by_goal()(CVE-2026-43068)

    media: dvb-core: fix wrong reinitialization of ringbuffer on reopen(CVE-2026-23253)

    ext4: validate p_idx bounds in ext4_ext_correct_indexes(CVE-2026-31449)

    netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD(CVE-2026-31428)

    xfrm: prevent policy_hthresh.work from racing with netns teardown(CVE-2026-31516)

    media: dvb-net: fix OOB access in ULE extension header tables(CVE-2026-31405)

    perf/x86/intel/uncore: Fix die ID init and look up bugs(CVE-2026-43344)

    crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption(CVE-2026-43033)

    powerpc, perf: Check that current-gt;mm is alive before getting user callchain(CVE-2026-43416)

    net: phy: register phy led_triggers during probe to avoid AB-BA deadlock(CVE-2026-23368)

    net: bridge: fix nd_tbl NULL dereference when IPv6 is disabled(CVE-2026-23381)

    perf/x86/intel/uncore: Skip discovery table for offline dies(CVE-2026-43079)

    apparmor: fix memory leak in verify_header(CVE-2026-23403)

    nvme-pci: ensure we#39;re polling a polled queue(CVE-2026-31523)

    xfrm: clear trailing padding in build_polexpire()(CVE-2026-31664)

    x86/efi: defer freeing of boot services memory(CVE-2026-23352)

    netfilter: nf_conntrack_expect: use expect-gt;helper(CVE-2026-31414)

    net: add proper RCU protection to /proc/net/ptype(CVE-2026-23255)

    ice: Fix memory leak in ice_set_ringparam()(CVE-2026-23389)

    usb: typec: ucsi: validate connector number in ucsi_notify_common()(CVE-2026-31729)

    ipv6: icmp: clear skb2-gt;cb[] in ip6_err_gen_icmpv6_unreach()(CVE-2026-43038)

    netfilter: nf_conntrack_h323: fix OOB read in decode_choice()(CVE-2026-43233)

    net: skbuff: propagate shared-frag marker through frag-transfer helpers(CVE-2026-43503)

    mailbox: Prevent out-of-bounds access in fw_mbox_index_xlate()(CVE-2026-43281)

    netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop()(CVE-2026-43453)

    xfs: fix freemap adjustments when adding xattrs to leaf blocks(CVE-2026-43158)

    xfs: delete attr leaf freemap entries when empty(CVE-2026-43187)

    netfilter: x_tables: guard option walkers against 1-byte tail reads(CVE-2026-43452)

    crypto: pcrypt - Fix handling of MAY_BACKLOG requests(CVE-2026-43493)

    netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table()(CVE-2026-43450)

    usb: ulpi: fix double free in ulpi_register_interface() error path(CVE-2026-31759)

    net: ipv6: ndisc: fix ndisc_ra_useropt to initialize nduseropt_padX fields to zero to prevent an info-     leak(CVE-2026-43040)

    ip6_tunnel: clear skb2-gt;cb[] in ip4ip6_err()(CVE-2026-43037)

    net: usb: kaweth: remove TX queue manipulation in kaweth_set_rx_mode(CVE-2026-43180)

    usb: usbtmc: Flush anchored URBs in usbtmc_release(CVE-2026-31758)

    netfilter: nft_ct: drop pending enqueued packets on removal(CVE-2026-43060)

Tenable has extracted the preceding description block directly from the EulerOS kernel security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:2068-1 advisory.

    The SUSE Linux Enterprise 12 SP5 kernel was updated to fix various security issues

    The following security issues were fixed:

    - CVE-2022-50053: iavf: Fix reset error handling (bsc#1245038).
    - CVE-2023-20585: x86/CPU: Fix FPDSS on Zen1. (bsc#1243603).
    - CVE-2024-50082: blk-rq-qos: fix crash on rq_qos_wait vs. rq_qos_wake_function race (bsc#1232500     bsc#1262778).
    - CVE-2025-68185: nfs4_setup_readdir(): insufficient locking for ->d_parent->d_inode dereferencing     (bsc#1255135).
    - CVE-2025-71118: ACPICA: Avoid walking the Namespace if start_node is NULL (bsc#1256763).
    - CVE-2025-71238: scsi: qla2xxx: Fix bsg_done() causing double free (bsc#1259186).
    - CVE-2026-23193: scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count()     (bsc#1258414).
    - CVE-2026-23216: scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (bsc#1258447).
    - CVE-2026-23276: net: add xmit recursion limit to tunnel xmit functions (bsc#1260012).
    - CVE-2026-23290: net: usb: pegasus: validate USB endpoints (bsc#1260533).
    - CVE-2026-23292: scsi: target: Fix recursive locking in __configfs_open_file() (bsc#1260500).
    - CVE-2026-23293: net: vxlan: fix nd_tbl NULL dereference when IPv6 is disabled (bsc#1260486).
    - CVE-2026-23312: net: usb: kaweth: validate USB endpoints (bsc#1260561).
    - CVE-2026-23340: net: sched: avoid qdisc_reset_all_tx_gt() vs dequeue race for lockless qdiscs     (bsc#1260523).
    - CVE-2026-23378: act_ife: load meta modules before tcf_idr_check_alloc() (bsc#1260546).
    - CVE-2026-23391: netfilter: xt_CT: drop pending enqueued packets on template removal (bsc#1260566).
    - CVE-2026-23442: ipv6: add NULL checks for idev in SRv6 paths (bsc#1261581).
    - CVE-2026-23449: net/sched: teql: Fix double-free in teql_master_xmit (bsc#1261779).
    - CVE-2026-23455: netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (bsc#1261687).
    - CVE-2026-23456: netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (bsc#1261703).
    - CVE-2026-23457: netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp()     (bsc#1261686).
    - CVE-2026-23458: netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (bsc#1261781).
    - CVE-2026-23461: Bluetooth: L2CAP: Fix use-after-free in l2cap_unregister_user (bsc#1261707).
    - CVE-2026-23462: Bluetooth: HIDP: Fix possible UAF (bsc#1261710).
    - CVE-2026-23468: drm/amdgpu: Limit BO list entry count to prevent resource exhaustion (bsc#1261692).
    - CVE-2026-23472: serial: core: fix infinite loop in handle_tx() for PORT_UNKNOWN (bsc#1261636).
    - CVE-2026-31393: Bluetooth: L2CAP: Validate L2CAP_INFO_RSP payload length before access (bsc#1261719).
    - CVE-2026-31400: sunrpc: fix cache_request leak in cache_release (bsc#1261645).
    - CVE-2026-31402: nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (bsc#1261638).
    - CVE-2026-31403: NFSD: Hold net reference for the lifetime of /proc/fs/nfs/exports fd (bsc#1261796).
    - CVE-2026-31407: netfilter: conntrack: add missing netlink policy validations (bsc#1261632).
    - CVE-2026-31408: Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold     (bsc#1261797).
    - CVE-2026-31411: net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (bsc#1261752).
    - CVE-2026-31416: netfilter: nfnetlink_log: account for netlink header size (bsc#1262100).
    - CVE-2026-31422: net/sched: cls_flow: fix NULL pointer dereference on shared blocks (bsc#1262054).
    - CVE-2026-31423: net/sched: sch_hfsc: fix divide-by-zero in rtsc_min() (bsc#1262063).
    - CVE-2026-31424: netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP     (bsc#1262053).
    - CVE-2026-31425: rds: ib: reject FRMR registration before IB connection is established (bsc#1262074).
    - CVE-2026-31427: netfilter: nf_conntrack_sip: fix use of uninitialized rtp_addr in process_sdp     (bsc#1262086).
    - CVE-2026-31428: netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD (bsc#1262087).
    - CVE-2026-31496: netfilter: nf_conntrack_expect: skip expectations in other netns via proc (bsc#1262673).
    - CVE-2026-31504: net: fix fanout UAF in packet_release() via NETDEV_UP race (bsc#1263085).
    - CVE-2026-31507: net/smc: fix double-free of smc_spd_priv when tee() duplicates splice pipe buffer     (bsc#1263095).
    - CVE-2026-31512: Bluetooth: L2CAP: Validate PDU length before reading SDU length in     l2cap_ecred_data_rcv()       (bsc#1262734).
    - CVE-2026-31524: HID: asus: avoid memory leak in asus_report_fixup() (bsc#1262605).
    - CVE-2026-31602: ALSA: ctxfi: Limit PTP to a single page (bsc#1263723).
    - CVE-2026-31607: usbip: validate number_of_packets in usbip_pack_ret_submit() (bsc#1263600).
    - CVE-2026-31649: net: stmmac: fix integer underflow in chain mode (bsc#1263582).
    - CVE-2026-31667: Input: uinput - fix circular locking dependency with ff-core (bsc#1263139).
    - CVE-2026-31675: net/sched: sch_netem: fix out-of-bounds access in packet corruption (bsc#1263556).
    - CVE-2026-31681: netfilter: xt_multiport: validate range encoding in checkentry (bsc#1263593).
    - CVE-2026-31685: netfilter: ip6t_eui64: reject invalid MAC header for all packets (bsc#1263668).
    - CVE-2026-31700: net/packet: fix TOCTOU race on mmap'd vnet_hdr in tpacket_snd() (bsc#1263882).
    - CVE-2026-31738: vxlan: validate ND option lengths in vxlan_na_create (bsc#1264059).
    - CVE-2026-31787: xen/privcmd: fix double free via VMA splitting (bsc#1262181).
    - CVE-2026-43025: netfilter: ctnetlink: ignore explicit helper on new expectations (bsc#1263931).
    - CVE-2026-43088: net: af_key: zero aligned sockaddr tail in PF_KEY exports (bsc#1264469).
    - CVE-2026-43110: wifi: brcmfmac: validate bsscfg indices in IF events (bsc#1264482).
    - CVE-2026-43126: ALSA: mixer: oss: Add card disconnect checkpoints (bsc#1264634).
    - CVE-2026-43190: netfilter: xt_tcpmss: check remaining length before reading optlen (bsc#1264848).
    - CVE-2026-43255: wifi: libertas: fix WARNING in usb_tx_block (bsc#1264473).
    - CVE-2026-43264: fbdev: of: display_timing: fix refcount leak in of_get_display_timings() (bsc#1264424).
    - CVE-2026-43334: Bluetooth: SMP: force responder MITM requirements before building the pairing response     (bsc#1265090).
    - CVE-2026-43437: ALSA: pcm: fix use-after-free on linked stream runtime in snd_pcm_drain() (bsc#1265126).

    The following non security issues were fixed:

    - list: add 'list_del_init_careful()' to go with 'list_empty_careful()' (bsc#1262778).
    - ocfs2: fix possible deadlock between unlink and dio_end_io_write (bsc#1258718).
    - ocfs2: split transactions in dio completion to avoid credit exhaustion (bsc#1258718).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - serial: core: fix infinite loop in handle_tx() for PORT_UNKNOWN uart_write_room() and uart_write() behave     inconsistently when xmit_buf is NULL (which happens for PORT_UNKNOWN ports that were never properly     initialized): - uart_write_room() returns kfifo_avail() which can be > 0 - uart_write() checks xmit_buf     and returns 0 if NULL This inconsistency causes an infinite loop in drivers that rely on tty_write_room()     to determine if they can write: while (tty_write_room(tty) > 0) { written = tty->ops->write(...); //     written is always 0, loop never exits } For example, caif_serial's handle_tx() enters an infinite loop     when used with PORT_UNKNOWN serial ports, causing system hangs. Fix by making uart_write_room() also check     xmit_buf and return 0 if it's NULL, consistent with uart_write(). Reproducer:
    https://gist.github.com/mrpre/d9a694cc0e19828ee3bc3b37983fde13 (CVE-2026-23472)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
326222	EulerOS 2.0 SP12 : kernel (EulerOS-SA-2026-2535)	Nessus	Huawei Local Security Checks	high
326126	EulerOS 2.0 SP12 : kernel (EulerOS-SA-2026-2595)	Nessus	Huawei Local Security Checks	high
324048	SUSE SLED15: cluster-md-kmp-default / dlm-kmp-default / gfs2-kmp-default / etc (SUSE-SU-2026:2238-1)	Nessus	SuSE Local Security Checks	high
319659	SUSE SLES16 Security Update : kernel (SUSE-SU-2026:21845-1)	Nessus	SuSE Local Security Checks	high
318240	SUSE SLES16 Security Update : kernel (SUSE-SU-2026:21860-1)	Nessus	SuSE Local Security Checks	high
318102	openSUSE 16 Security Update : kernel (openSUSE-SU-2026:20826-1)	Nessus	SuSE Local Security Checks	high
317729	SUSE SLES12 Security Update : kernel (SUSE-SU-2026:2068-1)	Nessus	SuSE Local Security Checks	medium
311340	Amazon Linux 2023 : bpftool6.18, kernel6.18, kernel6.18-devel (ALAS2023-2026-1596)	Nessus	Amazon Linux Local Security Checks	high
304906	Linux Distros Unpatched Vulnerability : CVE-2026-23472	Nessus	Misc.	medium

Detections

Analytics

CVE-2026-23472

medium

Tenable Plugins

high

high

high

high

high

high

medium

high

medium