In the Linux kernel, the following vulnerability has been resolved: smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available The logic off managing recv credits by counting posted recv_io and granted credits is racy. That's because the peer might already consumed a credit, but between receiving the incoming recv at the hardware and processing the completion in the 'recv_done' functions we likely have a window where we grant credits, which don't really exist. So we better have a decicated counter for the available credits, which will be incremented when we posted new recv buffers and drained when we grant the credits to the peer.

The Rocky Linux 10.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-2026_67471 advisory.

    * kernel: tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock() (CVE-2025-40149)

    * kernel: Linux kernel: Denial of Service in qla2xxx SCSI driver due to improper command handling after     chip reset (CVE-2025-68745)

    * kernel: drm/xe: Open-code GGTT MMIO access protection (CVE-2026-23466)

    * kernel: drm/xe: always keep track of remap prev/next (CVE-2026-31479)

    * kernel: drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CVE-2026-31566)

    * kernel: xfrm: hold dev ref until after transport_finish NF_HOOK (CVE-2026-31663)

    * kernel: drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CVE-2026-31656)

    * kernel: smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (CVE-2026-31539)

    * kernel: vhost: move vdpa group bound check to vhost_vdpa (CVE-2026-43248)

    * kernel: drm/i915: Fix potential overflow of shmem scatterlist length (CVE-2026-43368)

    * kernel: drm/amdgpu: Fix use-after-free race in VM acquire (CVE-2026-43370)

    * kernel: scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CVE-2026-46149)

    * kernel: sctp: purge outqueue on stale COOKIE-ECHO handling (CVE-2026-52924)

    * kernel: netfilter: require Ethernet MAC header before using eth_hdr() (CVE-2026-53131)

    * kernel: sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (CVE-2026-53246)

    * kernel: xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (CVE-2026-53239)

    * kernel: af_unix: Set gc_in_progress to true in unix_gc() (CVE-2026-53361)

    * kernel: scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CVE-2026-63889)

    * kernel: ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate() (CVE-2026-63921)

    * kernel: xfrm: input: hold netns during deferred transport reinjection (CVE-2026-63919)

    * kernel: ip6: vti: Use ip6_tnl.net in vti6_changelink() (CVE-2026-63917)

    * kernel: lsm: hold cred_guard_mutex for lsm_set_self_attr() (CVE-2026-64111)

    * kernel: drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (CVE-2026-68264)

    * kernel: xfrm: fix stale skb->prev after async crypto steals a GSO segment (CVE-2026-68426)

    * kernel: scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CVE-2026-74556)

    Bug Fix(es) and Enhancement(s):

    * [rhel-10.2.z]- Backport MSHV patches for hypervisor OOM handling  (JIRA:Rocky Linux-245035)

    * RHIVOS - [backport] S32G Driver Enablement - ADC (JIRA:Rocky Linux-255233)

    * [Rocky Linux10.2z] watchdog: System can panic during reboot when pretimeout is disabled (0) (JIRA:Rocky     Linux-255348)

    * [usb/xhci] kdump on Arrow Lake systems hangs system with dracut-initqueue Timed out errors [Rocky     Linux-10.2.z] (JIRA:Rocky Linux-256731)

    * RHIVOS - [backport] S32G Driver Update - ADC, I2C, and eDMA (JIRA:Rocky Linux-256890)

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-2026_71700 advisory.

    * kernel: fbcon: Set fb_display[i]->mode to NULL when the mode is released (CVE-2025-40323)

    * kernel: smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (CVE-2026-31539)

    * kernel: drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (CVE-2026-46230)

    * kernel: drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CVE-2026-46204)

    * kernel: drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (CVE-2026-46199)

    * kernel: drm/amdgpu/userq: fix access to stale wptr mapping (CVE-2026-46311)

    * kernel: netfilter: nf_queue: hold bridge skb->dev while queued (CVE-2026-52912)

    * kernel: accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CVE-2026-53203)

    * kernel: drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CVE-2026-53290)

    * kernel: drm/virtio: use uninterruptible resv lock for plane updates (CVE-2026-64098)

    * kernel: Linux kernel: PPPoE memory corruption via stale pointer (CVE-2026-68121)

    * kernel: drm/amdgpu/vce: fix integer overflow in image size (CVE-2026-68108)

    * kernel: drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CVE-2026-68257)

    * kernel: drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CVE-2026-68267)

    * kernel: drm/xe: Hold a dma-buf reference for imported BOs (CVE-2026-68266)

    * kernel: drm/amdgpu: Fix context pstate override handling (CVE-2026-68273)

    * kernel: Linux kernel IPVS: Denial of Service due to stale memory references (CVE-2026-80714)

    Bug Fix(es) and Enhancement(s):

    * MADVISE i/o size in Rocky Linux 9 additionally limited by read_ahead_kb - Was addressed in Rocky Linux8     via Rocky Linux-22476 [rhel-9.8.z] (JIRA:Rocky Linux-260938)

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:71700 advisory.

    * kernel: fbcon: Set fb_display[i]->mode to NULL when the mode is released (CVE-2025-40323)
      * kernel: smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (CVE-2026-31539)
      * kernel: drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (CVE-2026-46230)
      * kernel: drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CVE-2026-46204)
      * kernel: drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (CVE-2026-46199)
      * kernel: drm/amdgpu/userq: fix access to stale wptr mapping (CVE-2026-46311)
      * kernel: netfilter: nf_queue: hold bridge skb->dev while queued (CVE-2026-52912)
      * kernel: accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CVE-2026-53203)
      * kernel: drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CVE-2026-53290)
      * kernel: drm/virtio: use uninterruptible resv lock for plane updates (CVE-2026-64098)
      * kernel: Linux kernel: PPPoE memory corruption via stale pointer (CVE-2026-68121)
      * kernel: drm/amdgpu/vce: fix integer overflow in image size (CVE-2026-68108)
      * kernel: drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CVE-2026-68257)
      * kernel: drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CVE-2026-68267)
      * kernel: drm/xe: Hold a dma-buf reference for imported BOs (CVE-2026-68266)
      * kernel: drm/amdgpu: Fix context pstate override handling (CVE-2026-68273)
      * kernel: Linux kernel IPVS: Denial of Service due to stale memory references (CVE-2026-80714)


    Bug Fix(es) and Enhancement(s):

      * MADVISE i/o size in AlmaLinux 9 additionally limited by read_ahead_kb - Was addressed in AlmaLinux8     via AlmaLinux-22476 [almalinux-9.8.z] (JIRA:AlmaLinux-260938)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-71700 advisory.

    - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121}
    - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561]     {CVE-2026-31539}
    - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714}
    - drm/amdgpu/userq: fix access to stale wptr mapping (Jose Exposito) [RHEL-225416] {CVE-2026-46311}
    - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266}
    - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273}
    - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964]     {CVE-2026-68267}
    - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833]     {CVE-2026-68257}
    - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328]     {CVE-2026-64098}
    - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (Jose Exposito) [RHEL-225299] {CVE-2026-46230}
    - fbcon: Set fb_display[i]->mode to NULL when the mode is released (Jose Exposito) [RHEL-250107]     {CVE-2025-40323}
    - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108}
    - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378]     {CVE-2026-53290}
    - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204}
    - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (Jose Exposito) [RHEL-225443] {CVE-2026-46199}
    - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:71700 advisory.

    * kernel: fbcon: Set fb_display[i]->mode to NULL when the mode is released (CVE-2025-40323)

    * kernel: smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (CVE-2026-31539)

    * kernel: drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (CVE-2026-46230)

    * kernel: drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CVE-2026-46204)

    * kernel: drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (CVE-2026-46199)

    * kernel: drm/amdgpu/userq: fix access to stale wptr mapping (CVE-2026-46311)

    * kernel: netfilter: nf_queue: hold bridge skb->dev while queued (CVE-2026-52912)

    * kernel: accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CVE-2026-53203)

    * kernel: drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CVE-2026-53290)

    * kernel: drm/virtio: use uninterruptible resv lock for plane updates (CVE-2026-64098)

    * kernel: Linux kernel: PPPoE memory corruption via stale pointer (CVE-2026-68121)

    * kernel: drm/amdgpu/vce: fix integer overflow in image size (CVE-2026-68108)

    * kernel: drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CVE-2026-68257)

    * kernel: drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CVE-2026-68267)

    * kernel: drm/xe: Hold a dma-buf reference for imported BOs (CVE-2026-68266)

    * kernel: drm/amdgpu: Fix context pstate override handling (CVE-2026-68273)

    * kernel: Linux kernel IPVS: Denial of Service due to stale memory references (CVE-2026-80714)

    Bug Fix(es) and Enhancement(s):

    * MADVISE i/o size in Rocky Linux 9 additionally limited by read_ahead_kb - Was addressed in Rocky Linux8     via Rocky Linux-22476 [rhel-9.8.z] (JIRA:Rocky Linux-260938)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:71700 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: fbcon: Set fb_display[i]->mode to NULL when the mode is released (CVE-2025-40323)

    * kernel: smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (CVE-2026-31539)

    * kernel: drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (CVE-2026-46230)

    * kernel: drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CVE-2026-46204)

    * kernel: drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (CVE-2026-46199)

    * kernel: drm/amdgpu/userq: fix access to stale wptr mapping (CVE-2026-46311)

    * kernel: netfilter: nf_queue: hold bridge skb->dev while queued (CVE-2026-52912)

    * kernel: accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CVE-2026-53203)

    * kernel: drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CVE-2026-53290)

    * kernel: drm/virtio: use uninterruptible resv lock for plane updates (CVE-2026-64098)

    * kernel: Linux kernel: PPPoE memory corruption via stale pointer (CVE-2026-68121)

    * kernel: drm/amdgpu/vce: fix integer overflow in image size (CVE-2026-68108)

    * kernel: drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CVE-2026-68257)

    * kernel: drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CVE-2026-68267)

    * kernel: drm/xe: Hold a dma-buf reference for imported BOs (CVE-2026-68266)

    * kernel: drm/amdgpu: Fix context pstate override handling (CVE-2026-68273)

    * kernel: Linux kernel IPVS: Denial of Service due to stale memory references (CVE-2026-80714)

    Bug Fix(es) and Enhancement(s):

    * MADVISE i/o size in RHEL 9 additionally limited by read_ahead_kb - Was addressed in RHEL8 via RHEL-22476     [rhel-9.8.z] (JIRA:RHEL-260938)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:67471 advisory.

    * kernel: tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock() (CVE-2025-40149)
      * kernel: Linux kernel: Denial of Service in qla2xxx SCSI driver due to improper command handling after     chip reset (CVE-2025-68745)
      * kernel: drm/xe: Open-code GGTT MMIO access protection (CVE-2026-23466)
      * kernel: drm/xe: always keep track of remap prev/next (CVE-2026-31479)
      * kernel: drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CVE-2026-31566)
      * kernel: xfrm: hold dev ref until after transport_finish NF_HOOK (CVE-2026-31663)
      * kernel: drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CVE-2026-31656)
      * kernel: smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (CVE-2026-31539)
      * kernel: vhost: move vdpa group bound check to vhost_vdpa (CVE-2026-43248)
      * kernel: drm/i915: Fix potential overflow of shmem scatterlist length (CVE-2026-43368)
      * kernel: drm/amdgpu: Fix use-after-free race in VM acquire (CVE-2026-43370)
      * kernel: scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CVE-2026-46149)
      * kernel: sctp: purge outqueue on stale COOKIE-ECHO handling (CVE-2026-52924)
      * kernel: netfilter: require Ethernet MAC header before using eth_hdr() (CVE-2026-53131)
      * kernel: sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (CVE-2026-53246)
      * kernel: xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (CVE-2026-53239)
      * kernel: af_unix: Set gc_in_progress to true in unix_gc() (CVE-2026-53361)
      * kernel: scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CVE-2026-63889)
      * kernel: ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate() (CVE-2026-63921)
      * kernel: xfrm: input: hold netns during deferred transport reinjection (CVE-2026-63919)
      * kernel: ip6: vti: Use ip6_tnl.net in vti6_changelink() (CVE-2026-63917)
      * kernel: lsm: hold cred_guard_mutex for lsm_set_self_attr() (CVE-2026-64111)
      * kernel: drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (CVE-2026-68264)
      * kernel: xfrm: fix stale skb->prev after async crypto steals a GSO segment (CVE-2026-68426)
      * kernel: scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CVE-2026-74556)


    Bug Fix(es) and Enhancement(s):

      * [almalinux-10.2.z]- Backport MSHV patches for hypervisor OOM handling (JIRA:AlmaLinux-245035)
      * RHIVOS - [backport] S32G Driver Enablement - ADC (JIRA:AlmaLinux-255233)
      * [AlmaLinux10.2z] watchdog: System can panic during reboot when pretimeout is disabled (0)     (JIRA:AlmaLinux-255348)
      * [usb/xhci] kdump on Arrow Lake systems hangs system with dracut-initqueue Timed out errors     [AlmaLinux-10.2.z] (JIRA:AlmaLinux-256731)
      * RHIVOS - [backport] S32G Driver Update - ADC, I2C, and eDMA (JIRA:AlmaLinux-256890)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-674710 advisory.

    - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559]     {CVE-2026-31539}
    - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot)     [RHEL-254596] {CVE-2026-74556}
    - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (Mika Penttila) [RHEL-222461]     {CVE-2026-23466}
    - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222401] {CVE-2026-43370}
    - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222474]     {CVE-2026-43368}
    - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222424]     {CVE-2026-31656}
    - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221279]     {CVE-2026-31566}
    - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222307] {CVE-2026-31479}
    - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222461] {CVE-2026-23466}
    - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (Mika Penttila) [RHEL-236579] {CVE-2026-68264}
    - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663}
    - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663}
    - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663}
    - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227502]     {CVE-2026-63919}
    - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236113]     {CVE-2026-68426}
    - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426}
    - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca)     [RHEL-228006] {CVE-2026-53239}
    - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231756] {CVE-2026-63917}
    - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228943] {CVE-2026-63921}
    - af_unix: Set gc_in_progress to true in unix_gc(). (Davide Caratti) [RHEL-227544] {CVE-2026-53361}
    - af_unix: Give up GC if MSG_PEEK intervened. (Davide Caratti) [RHEL-227544] {CVE-2026-23394}
    - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190194]     {CVE-2026-53246}
    - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235912] {CVE-2025-68745}
    - lsm: hold cred_guard_mutex for lsm_set_self_attr() (Ricardo Robaina) [RHEL-226807] {CVE-2026-64111}
    - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-231909]     {CVE-2025-40149}
    - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230672]     {CVE-2026-53131}
    - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228717]     {CVE-2026-63889}
    - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot)     [RHEL-225792] {CVE-2026-46149}
    - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188199] {CVE-2026-52924}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:67471 advisory.

    * kernel: tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock() (CVE-2025-40149)

    * kernel: Linux kernel: Denial of Service in qla2xxx SCSI driver due to improper command handling after     chip reset (CVE-2025-68745)

    * kernel: drm/xe: Open-code GGTT MMIO access protection (CVE-2026-23466)

    * kernel: drm/xe: always keep track of remap prev/next (CVE-2026-31479)

    * kernel: drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CVE-2026-31566)

    * kernel: xfrm: hold dev ref until after transport_finish NF_HOOK (CVE-2026-31663)

    * kernel: drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CVE-2026-31656)

    * kernel: smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (CVE-2026-31539)

    * kernel: vhost: move vdpa group bound check to vhost_vdpa (CVE-2026-43248)

    * kernel: drm/i915: Fix potential overflow of shmem scatterlist length (CVE-2026-43368)

    * kernel: drm/amdgpu: Fix use-after-free race in VM acquire (CVE-2026-43370)

    * kernel: scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CVE-2026-46149)

    * kernel: sctp: purge outqueue on stale COOKIE-ECHO handling (CVE-2026-52924)

    * kernel: netfilter: require Ethernet MAC header before using eth_hdr() (CVE-2026-53131)

    * kernel: sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (CVE-2026-53246)

    * kernel: xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (CVE-2026-53239)

    * kernel: af_unix: Set gc_in_progress to true in unix_gc() (CVE-2026-53361)

    * kernel: scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CVE-2026-63889)

    * kernel: ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate() (CVE-2026-63921)

    * kernel: xfrm: input: hold netns during deferred transport reinjection (CVE-2026-63919)

    * kernel: ip6: vti: Use ip6_tnl.net in vti6_changelink() (CVE-2026-63917)

    * kernel: lsm: hold cred_guard_mutex for lsm_set_self_attr() (CVE-2026-64111)

    * kernel: drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (CVE-2026-68264)

    * kernel: xfrm: fix stale skb->prev after async crypto steals a GSO segment (CVE-2026-68426)

    * kernel: scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CVE-2026-74556)

    Bug Fix(es) and Enhancement(s):

    * [rhel-10.2.z]- Backport MSHV patches for hypervisor OOM handling  (JIRA:Rocky Linux-245035)

    * RHIVOS - [backport] S32G Driver Enablement - ADC (JIRA:Rocky Linux-255233)

    * [Rocky Linux10.2z] watchdog: System can panic during reboot when pretimeout is disabled (0) (JIRA:Rocky     Linux-255348)

    * [usb/xhci] kdump on Arrow Lake systems hangs system with dracut-initqueue Timed out errors [Rocky     Linux-10.2.z] (JIRA:Rocky Linux-256731)

    * RHIVOS - [backport] S32G Driver Update - ADC, I2C, and eDMA (JIRA:Rocky Linux-256890)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:67471 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock() (CVE-2025-40149)

    * kernel: Linux kernel: Denial of Service in qla2xxx SCSI driver due to improper command handling after     chip reset (CVE-2025-68745)

    * kernel: drm/xe: Open-code GGTT MMIO access protection (CVE-2026-23466)

    * kernel: drm/xe: always keep track of remap prev/next (CVE-2026-31479)

    * kernel: drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CVE-2026-31566)

    * kernel: xfrm: hold dev ref until after transport_finish NF_HOOK (CVE-2026-31663)

    * kernel: drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CVE-2026-31656)

    * kernel: smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (CVE-2026-31539)

    * kernel: vhost: move vdpa group bound check to vhost_vdpa (CVE-2026-43248)

    * kernel: drm/i915: Fix potential overflow of shmem scatterlist length (CVE-2026-43368)

    * kernel: drm/amdgpu: Fix use-after-free race in VM acquire (CVE-2026-43370)

    * kernel: scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CVE-2026-46149)

    * kernel: sctp: purge outqueue on stale COOKIE-ECHO handling (CVE-2026-52924)

    * kernel: netfilter: require Ethernet MAC header before using eth_hdr() (CVE-2026-53131)

    * kernel: sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (CVE-2026-53246)

    * kernel: xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (CVE-2026-53239)

    * kernel: af_unix: Set gc_in_progress to true in unix_gc() (CVE-2026-53361)

    * kernel: scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CVE-2026-63889)

    * kernel: ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate() (CVE-2026-63921)

    * kernel: xfrm: input: hold netns during deferred transport reinjection (CVE-2026-63919)

    * kernel: ip6: vti: Use ip6_tnl.net in vti6_changelink() (CVE-2026-63917)

    * kernel: lsm: hold cred_guard_mutex for lsm_set_self_attr() (CVE-2026-64111)

    * kernel: drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (CVE-2026-68264)

    * kernel: xfrm: fix stale skb->prev after async crypto steals a GSO segment (CVE-2026-68426)

    * kernel: scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CVE-2026-74556)

    Bug Fix(es) and Enhancement(s):

    * [rhel-10.2.z]- Backport MSHV patches for hypervisor OOM handling  (JIRA:RHEL-245035)

    * RHIVOS - [backport] S32G Driver Enablement - ADC (JIRA:RHEL-255233)

    * [RHEL10.2z] watchdog: System can panic during reboot when pretimeout is disabled (0) (JIRA:RHEL-255348)

    * [usb/xhci] kdump on Arrow Lake systems hangs system with dracut-initqueue Timed out errors [RHEL-10.2.z]     (JIRA:RHEL-256731)

    * RHIVOS - [backport] S32G Driver Update - ADC, I2C, and eDMA (JIRA:RHEL-256890)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - In the Linux kernel, the following vulnerability has been resolved: smb: smbdirect: introduce     smbdirect_socket.recv_io.credits.available The logic off managing recv credits by counting posted recv_io     and granted credits is racy. That's because the peer might already consumed a credit, but between     receiving the incoming recv at the hardware and processing the completion in the 'recv_done' functions we     likely have a window where we grant credits, which don't really exist. So we better have a decicated     counter for the available credits, which will be incremented when we posted new recv buffers and drained     when we grant the credits to the peer. (CVE-2026-31539)

Note that Nessus relies on the presence of the package as reported by the vendor.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1514 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    btrfs: fix reservation leak in some error paths when inserting inline extent (CVE-2025-71268)

    In the Linux kernel, the following vulnerability has been resolved:

    btrfs: do not free data reservation in fallback from inline due to -ENOSPC (CVE-2025-71269)

    In the Linux kernel, the following vulnerability has been resolved:

    smack: /smack/doi: accept previously used values (CVE-2025-71304)

    In the Linux kernel, the following vulnerability has been resolved:

    fs/ntfs3: Initialize new folios before use (CVE-2025-71311)

    In the Linux kernel, the following vulnerability has been resolved:

    RDMA/umad: Reject negative data_len in ib_umad_write (CVE-2026-23243)

    In the Linux kernel, the following vulnerability has been resolved:

    net: gro: fix outer network offset (CVE-2026-23254)

    In the Linux kernel, the following vulnerability has been resolved:

    net: add proper RCU protection to /proc/net/ptype (CVE-2026-23255)

    In the Linux kernel, the following vulnerability has been resolved:

    io_uring/rw: free potentially allocated iovec on cache put failure (CVE-2026-23259)

    In the Linux kernel, the following vulnerability has been resolved:

    regmap: maple: free entry on mas_store_gfp() failure (CVE-2026-23260)

    In the Linux kernel, the following vulnerability has been resolved:

    io_uring/zcrx: fix page array leak (CVE-2026-23263)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: nft_set_rbtree: validate open interval overlap (CVE-2026-23333)

    In the Linux kernel, the following vulnerability has been resolved:

    tracing/dma: Cap dma_map_sg tracepoint arrays to prevent buffer overflow (CVE-2026-23390)

    In the Linux kernel, the following vulnerability has been resolved:

    smb: client: make use of smbdirect_socket.recv_io.credits.available (CVE-2026-31535)

    In the Linux kernel, the following vulnerability has been resolved:

    smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (CVE-2026-31539)

    In the Linux kernel, the following vulnerability has been resolved:

    driver core: enforce device_lock for driver_match_device() (CVE-2026-31688)

    In the Linux kernel, the following vulnerability has been resolved:

    ACPI: processor: Update cpuidle driver check in __acpi_processor_start() (CVE-2026-43122)

    In the Linux kernel, the following vulnerability has been resolved:

    cpufreq: intel_pstate: Fix NULL pointer dereference in update_cpu_qos_request() (CVE-2026-43401)

    In the Linux kernel, the following vulnerability has been resolved:

    net: remove WARN_ON_ONCE when accessing forward path array (CVE-2026-45847)

    In the Linux kernel, the following vulnerability has been resolved:

    efi: Fix reservation of unaccepted memory table (CVE-2026-45851)

    In the Linux kernel, the following vulnerability has been resolved:

    ata: libata-scsi: avoid Non-NCQ command starvation (CVE-2026-45855)

    In the Linux kernel, the following vulnerability has been resolved:

    RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CVE-2026-45856)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: don't zero the entire extent if EXT4_EXT_DATA_PARTIAL_VALID1 (CVE-2026-45858)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: nfnetlink_queue: do shared-unconfirmed check before segmentation (CVE-2026-45859)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: nf_conncount: increase the connection clean up limit to 64 (CVE-2026-45860)

    In the Linux kernel, the following vulnerability has been resolved:

    iommu/vt-d: Flush cache for PASID table before using it (CVE-2026-45862)

    In the Linux kernel, the following vulnerability has been resolved:

    fs/ntfs3: prevent infinite loops caused by the next valid being the same (CVE-2026-45864)

    In the Linux kernel, the following vulnerability has been resolved:

    SUNRPC: auth_gss: fix memory leaks in XDR decoding error paths (CVE-2026-45870)

    In the Linux kernel, the following vulnerability has been resolved:

    scsi: smartpqi: Fix memory leak in pqi_report_phys_luns() (CVE-2026-45872)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: nft_set_rbtree: check for partial overlaps in anonymous sets (CVE-2026-45873)

    In the Linux kernel, the following vulnerability has been resolved:

    arm64/gcs: Fix error handling in arch_set_shadow_stack_status() (CVE-2026-45876)

    In the Linux kernel, the following vulnerability has been resolved:

    PCI/P2PDMA: Release per-CPU pgmap ref when vm_insert_page() fails (CVE-2026-45880)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf: Fix bpf_xdp_store_bytes proto for read-only arg (CVE-2026-45886)

    In the Linux kernel, the following vulnerability has been resolved:

    af_unix: Fix memleak of newsk in unix_stream_connect(). (CVE-2026-45887)

    In the Linux kernel, the following vulnerability has been resolved:

    md/raid1: fix memory leak in raid1_run() (CVE-2026-45888)

    In the Linux kernel, the following vulnerability has been resolved:

    mptcp: do not account for OoO in mptcp_rcvbuf_grow() (CVE-2026-45889)

    In the Linux kernel, the following vulnerability has been resolved:

    xen-netback: reject zero-queue configuration from guest (CVE-2026-45890)

    In the Linux kernel, the following vulnerability has been resolved:

    iommu/vt-d: Clear Present bit before tearing down PASID entry (CVE-2026-45894)

    In the Linux kernel, the following vulnerability has been resolved:

    quota: fix livelock between quotactl and freeze_super (CVE-2026-45895)

    In the Linux kernel, the following vulnerability has been resolved:

    RDMA/iwcm: Fix workqueue list corruption by removing work_list (CVE-2026-45898)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: drop extent cache when splitting extent fails (CVE-2026-45899)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf: Fix memory access flags in helper prototypes (CVE-2026-45903)

    In the Linux kernel, the following vulnerability has been resolved:

    xfrm: fix ip_rt_bug race in icmp_route_lookup reverse path (CVE-2026-45905)

    In the Linux kernel, the following vulnerability has been resolved:

    net/mlx5e: Fix deadlocks between devlink and netdev instance locks (CVE-2026-45907)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: don't cache extent during splitting extent (CVE-2026-45912)

    In the Linux kernel, the following vulnerability has been resolved:

    net: bridge: mcast: always update mdb_n_entries for vlan contexts (CVE-2026-45913)

    In the Linux kernel, the following vulnerability has been resolved:

    fat: avoid parent link count underflow in rmdir (CVE-2026-45915)

    In the Linux kernel, the following vulnerability has been resolved:

    ipvs: do not keep dest_dst if dev is going down (CVE-2026-45917)

    In the Linux kernel, the following vulnerability has been resolved:

    ovpn: tcp - don't deref NULL sk_socket member after tcp_close() (CVE-2026-45918)

    In the Linux kernel, the following vulnerability has been resolved:

    sched/rt: Skip currently executing CPU in rto_next_cpu() (CVE-2026-45919)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: fix dirtyclusters double decrement on fs shutdown (CVE-2026-45920)

    In the Linux kernel, the following vulnerability has been resolved:

    RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (CVE-2026-45922)

    In the Linux kernel, the following vulnerability has been resolved:

    thermal/of: Fix reference leak in thermal_of_cm_lookup() (CVE-2026-45925)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf: Require frozen map for calculating map hash (CVE-2026-45927)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf: Fix tcx/netkit detach permissions when prog fd isn't given (CVE-2026-45932)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf: Preserve id of register in sync_linked_regs() (CVE-2026-45933)

    In the Linux kernel, the following vulnerability has been resolved:

    btrfs: fix EEXIST abort due to non-consecutive gaps in chunk allocation (CVE-2026-45934)

    In the Linux kernel, the following vulnerability has been resolved:

    fs/ntfs3: Fix slab-out-of-bounds read in DeleteIndexEntryRoot (CVE-2026-45935)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: fix e4b bitmap inconsistency reports (CVE-2026-45942)

    In the Linux kernel, the following vulnerability has been resolved:

    erofs: fix inline data read failure for ztailpacking pclusters (CVE-2026-45943)

    In the Linux kernel, the following vulnerability has been resolved:

    iommu/vt-d: Clear Present bit before tearing down context entry (CVE-2026-45944)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: fix memory leak in ext4_ext_shift_extents() (CVE-2026-45948)

    In the Linux kernel, the following vulnerability has been resolved:

    hwrng: core - use RCU and work_struct to fix race condition (CVE-2026-45949)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf: Fix a potential use-after-free of BTF object (CVE-2026-45951)

    In the Linux kernel, the following vulnerability has been resolved:

    md/raid5: fix IO hang with degraded array with llbitmap (CVE-2026-45953)

    In the Linux kernel, the following vulnerability has been resolved:

    md/md-llbitmap: fix percpu_ref not resurrected on suspend timeout (CVE-2026-45955)

    In the Linux kernel, the following vulnerability has been resolved:

    rcu: Fix rcu_read_unlock() deadloop due to softirq (CVE-2026-45957)

    In the Linux kernel, the following vulnerability has been resolved:

    SUNRPC: fix gss_auth kref leak in gss_alloc_msg error path (CVE-2026-45964)

    In the Linux kernel, the following vulnerability has been resolved:

    cpuidle: Skip governor when only one idle state is available (CVE-2026-45968)

    In the Linux kernel, the following vulnerability has been resolved:

    bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CVE-2026-45970)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf: Limit bpf program signature size (CVE-2026-45971)

    In the Linux kernel, the following vulnerability has been resolved:

    RDMA/mlx5: Fix UMR hang in LAG error state unload (CVE-2026-45973)

    In the Linux kernel, the following vulnerability has been resolved:

    btrfs: fix invalid leaf access in btrfs_quota_enable() if ref key not found (CVE-2026-45974)

    In the Linux kernel, the following vulnerability has been resolved:

    ACPICA: Fix NULL pointer dereference in acpi_ev_address_space_dispatch() (CVE-2026-45982)

    In the Linux kernel, the following vulnerability has been resolved:

    nfsd: never defer requests during idmap lookup (CVE-2026-45983)

    In the Linux kernel, the following vulnerability has been resolved:

    btrfs: fix block_group_tree dirty_list corruption (CVE-2026-46251)

    In the Linux kernel, the following vulnerability has been resolved:

    pstore/ram: fix buffer overflow in persistent_ram_save_old() (CVE-2026-46253)

    In the Linux kernel, the following vulnerability has been resolved:

    NFS/localio: prevent direct reclaim recursion into NFS via nfs_writepages (CVE-2026-46256)

    In the Linux kernel, the following vulnerability has been resolved:

    procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CVE-2026-46259)

    In the Linux kernel, the following vulnerability has been resolved:

    inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (CVE-2026-46266)

    In the Linux kernel, the following vulnerability has been resolved:

    dm: fix unlocked test for dm_suspended_md (CVE-2026-46327)

    In the Linux kernel, the following vulnerability has been resolved:

    apparmor: fix rlimit for posix cpu timers (CVE-2026-46328)

    In the Linux kernel, the following vulnerability has been resolved:

    erofs: handle end of filesystem properly for file-backed mounts (CVE-2026-46329)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
355280	Rocky Linux 10.2 [CIQ] Security Update: kernel / kernel-64k / kernel-64k-core / kernel-64k-debug / etc Multiple Vulnerabilities (crlsa-2026_67471)	Nessus	Rocky Linux Local Security Checks	Local	high
354229	Rocky Linux 9 [CIQ] Security Update: kernel / kernel-64k / kernel-64k-core / kernel-64k-debug / etc Multiple Vulnerabilities (crlsa-2026_71700)	Nessus	Rocky Linux Local Security Checks	Local	critical
351154	AlmaLinux 9 : kernel (ALSA-2026:71700)	Nessus	Alma Linux Local Security Checks	Local	critical
350941	Oracle Linux 9 : kernel (ELSA-2026-71700)	Nessus	Oracle Linux Local Security Checks	Local	critical
350785	RockyLinux 9 : kernel (RLSA-2026:71700)	Nessus	Rocky Linux Local Security Checks	Local	critical
350192	RHEL 9 : kernel (RHSA-2026:71700)	Nessus	Red Hat Local Security Checks	Local	critical
346879	AlmaLinux 10 : kernel (ALSA-2026:67471)	Nessus	Alma Linux Local Security Checks	Local	high
346426	Oracle Linux 10 : ELSA-2026-67471-0: / kernel (ELSA-2026-674710)	Nessus	Oracle Linux Local Security Checks	Local	high
346311	RockyLinux 10 : kernel (RLSA-2026:67471)	Nessus	Rocky Linux Local Security Checks	Local	high
345863	RHEL 10 : kernel (RHSA-2026:67471)	Nessus	Red Hat Local Security Checks	Local	high
310163	Linux Distros Unpatched Vulnerability : CVE-2026-31539	Nessus	Misc.	Local	high
304298	Amazon Linux 2023 : bpftool6.18, kernel6.18, kernel6.18-devel (ALAS2023-2026-1514)	Nessus	Amazon Linux Local Security Checks	Local	high

Detections

Analytics

CVE-2026-31539

high

Tenable Plugins

high

critical

critical

critical

critical

critical

high

high

high

high

high

high