In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync hci_le_big_create_sync() uses DEFINE_FLEX to allocate a struct hci_cp_le_big_create_sync on the stack with room for 0x11 (17) BIS entries. However, conn->num_bis can hold up to HCI_MAX_ISO_BIS (31) entries — validated against ISO_MAX_NUM_BIS (0x1f) in the caller hci_conn_big_create_sync(). When conn->num_bis is between 18 and 31, the memcpy that copies conn->bis into cp->bis writes up to 14 bytes past the stack buffer, corrupting adjacent stack memory. This is trivially reproducible: binding an ISO socket with bc_num_bis = ISO_MAX_NUM_BIS (31) and calling listen() will eventually trigger hci_le_big_create_sync() from the HCI command sync worker, causing a KASAN-detectable stack-out-of-bounds write: BUG: KASAN: stack-out-of-bounds in hci_le_big_create_sync+0x256/0x3b0 Write of size 31 at addr ffffc90000487b48 by task kworker/u9:0/71 Fix this by changing the DEFINE_FLEX count from the incorrect 0x11 to HCI_MAX_ISO_BIS, which matches the maximum number of BIS entries that conn->bis can actually carry.

The remote Oracle Linux 10 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-50372 advisory.

    - net/sched: fix pedit partial COW leading to page cache corruption (Rajat Gupta)   {CVE-2026-46331}
    - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Christian Brauner)  [Orabug: 39668743]     {CVE-2026-46242}
    - net: skbuff: fix missing zerocopy reference in pskb_carve helpers (Minh Nguyen)  [Orabug: 39656679]     {CVE-2026-52943}
    - arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Rutland)  [Orabug: 39548792]     {CVE-2025-10263}
    - openvswitch: vport: fix self-deadlock on release of tunnel ports (Ilya Maximets) {CVE-2026-46165}
    - iommu/amd: serialize sequence allocation under concurrent TLB invalidations (Ankit Soni)     {CVE-2026-43220}
    - usb: ulpi: fix memory leak on ulpi_register() error paths (Felix Gu) {CVE-2026-46109}
    - smb: client: reject userspace cifs.spnego descriptions (Asim Viladi Oglu Manizada)  [Orabug: 39463671]     {CVE-2026-46243}
    - net: skbuff: propagate shared-frag marker through frag-transfer helpers (Hyunwoo Kim) [Orabug:
    39368826,39441323] {CVE-2026-43503,CVE-2026-46300}
    - net: skbuff: preserve shared-frag marker during coalescing (William Bowling) [Orabug: 39368826]     {CVE-2026-46300}
    - netfilter: reject zero shift in nft_bitwise (Kai Ma) [Orabug: 39452464] {CVE-2026-46101}
    - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Andrea Mayer) [Orabug: 39452457]     {CVE-2026-46099}
    - ALSA: caiaq: fix usb_dev refcount leak on probe failure (Deepanshu Kartikey) [Orabug: 39452739]     {CVE-2026-46048}
    - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Greg Kroah-Hartman) [Orabug: 39426003]     {CVE-2026-43501}
    - ALSA: caiaq: Fix potentially leftover ep1_in_urb at error path (Takashi Iwai) [Orabug: 39452746]     {CVE-2026-45992}
    - net: bonding: fix use-after-free in bond_xmit_broadcast() (Xiang Mei) [Orabug: 39205989]     {CVE-2026-31419}
    - crypto: authencesn - reject short ahash digests during instance creation (Yucheng Lu) [Orabug: 39452231]     {CVE-2026-46033}
    - spi: fix resource leaks on device setup failure (Johan Hovold) [Orabug: 39452400] {CVE-2026-46083}
    - net: qrtr: ns: Limit the total number of nodes (Manivannan Sadhasivam) [Orabug: 39452123]     {CVE-2026-46003}
    - net: bridge: use a stable FDB dst snapshot in RCU readers (Zhengchuan Liang) [Orabug: 39452411]     {CVE-2026-46086}
    - net: qrtr: ns: Limit the maximum number of lookups (Manivannan Sadhasivam) [Orabug: 39452207]     {CVE-2026-46026}
    - net: qrtr: ns: Limit the maximum server registration per node (Manivannan Sadhasivam) [Orabug: 39410851]     {CVE-2026-43491}
    - RDMA/mana_ib: Disable RX steering on RSS QP destroy (Long Li) [Orabug: 39452406] {CVE-2026-46084}
    - media: rc: igorplugusb: heed coherency rules (Oliver Neukum) [Orabug: 39452432] {CVE-2026-46091}
    - wifi: mwifiex: fix use-after-free in mwifiex_adapter_cleanup() (Daniel Hodges) [Orabug: 39452343]     {CVE-2026-46069}
    - thermal: core: Fix thermal zone governor cleanup issues (Rafael J. Wysocki) [Orabug: 39452186]     {CVE-2026-46021}
    - smb: client: validate the whole DACL before rewriting it in cifsacl (Michael Bommarito) [Orabug:
    39300611] {CVE-2026-31709}
    - scsi: sd: fix missing put_disk() when device_add(&disk_dev) fails (Yang Xiuwei) [Orabug: 39452100]     {CVE-2026-45997}
    - rtmutex: Use waiter::task instead of current in remove_waiter() (Keenan Dong) [Orabug: 39425998]     {CVE-2026-43499}
    - ceph: only d_add() negative dentries when they are unhashed (Max Kellermann) [Orabug: 39452291]     {CVE-2026-46052}
    - dm mirror: fix integer overflow in create_dirty_log() (Junrui Luo) [Orabug: 39452196] {CVE-2026-46023}
    - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (Shuvam Pandey) [Orabug: 39452304]     {CVE-2026-46056}
    - tcp: call sk_data_ready() after listener migration (Zhenzhong Wu) [Orabug: 39452159] {CVE-2026-46015}
    - inotify: fix watch count leak when fsnotify_add_inode_mark_locked() fails (Chia-Ming Chang) [Orabug:
    39452250] {CVE-2026-46040}
    - md/raid5: validate payload size before accessing journal metadata (Junrui Luo) [Orabug: 39452349]     {CVE-2026-46070}
    - md/raid5: fix soft lockup in retry_aligned_read() (Chia-Ming Chang) [Orabug: 39452287] {CVE-2026-46051}
    - ext4: fix missing brelse() in ext4_xattr_inode_dec_ref_all() (Sohei Koyama) [Orabug: 39452269]     {CVE-2026-46046}
    - ext4: fix bounds check in check_xattrs() to prevent out-of-bounds access (Deepanshu Kartikey) [Orabug:
    39452442] {CVE-2026-46094}
    - io_uring/poll: fix multishot recv missing EOF on wakeup race (Jens Axboe) {CVE-2026-23473}
    - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Kevin Cheng) [Orabug: 39452372]     {CVE-2026-46076}
    - KVM: SVM: Inject #UD for INVLPGA if EFER.SVME=0 (Kevin Cheng) [Orabug: 39452394] {CVE-2026-46082}
    - KVM: nSVM: Sync interrupt shadow to cached vmcb12 after VMRUN of L2 (Yosry Ahmed) [Orabug: 39452061]     {CVE-2026-45987}
    - xfs: fix a resource leak in xfs_alloc_buftarg() (Haoxiang Li) [Orabug: 39452131] {CVE-2026-46005}
    - libceph: Prevent potential null-ptr-deref in ceph_handle_auth_reply() (Raphael Zimmer) [Orabug:
    39452201] {CVE-2026-46024}
    - ipv4: icmp: validate reply type before using icmp_pointers (Ruide Cao) [Orabug: 39452243]     {CVE-2026-46037}
    - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Hkbinbin) [Orabug: 39452259]     {CVE-2026-46043}
    - net: qrtr: ns: Free the node during ctrl_cmd_bye() (Manivannan Sadhasivam) [Orabug: 39452246]     {CVE-2026-46038}
    - rxrpc: Fix rxkad crypto unalignment handling (David Howells) [Orabug: 39452728] {CVE-2026-46085}
    - ALSA: caiaq: Handle probe errors properly (Takashi Iwai) [Orabug: 39452126] {CVE-2026-46004}
    - rbd: fix null-ptr-deref when device_add_disk() fails (Dawei Feng) [Orabug: 39452385] {CVE-2026-46079}
    - md/raid10: fix deadlock with check operation and nowait requests (Josh Hunt) [Orabug: 39452284]     {CVE-2026-46050}
    - jbd2: fix deadlock in jbd2_journal_cancel_revoke() (Zhang Yi) [Orabug: 39452318] {CVE-2026-46061}
    - erofs: fix the out-of-bounds nameoff handling for trailing dirents (Gao Xiang) [Orabug: 39452380]     {CVE-2026-46078}
    - ALSA: ctxfi: Add fallback to default RSR for S/PDIF (Harin Lee) [Orabug: 39452280] {CVE-2026-46049}
    - ext2: reject inodes with zero i_nlink and valid mode in ext2_iget() (Vasiliy Kovalev) [Orabug: 39452119]     {CVE-2026-46002}
    - net: qrtr: ns: Fix use-after-free in driver remove() (Manivannan Sadhasivam) [Orabug: 39452274]     {CVE-2026-46047}
    - net: strparser: fix skb_head leak in strp_abort_strp() (Luxiao Xu) [Orabug: 39452468] {CVE-2026-46102}
    - ALSA: control: Validate buf_len before strnlen() in snd_ctl_elem_init_enum_names() (Ziqing Chen)     [Orabug: 39452416] {CVE-2026-46088}
    - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Herbert Xu) [Orabug: 39410863] {CVE-2026-43493}
    - wifi: rtw88: check for PCI upstream bridge existence (Fedor Pchelkin) [Orabug: 39452437]     {CVE-2026-46092}
    - zram: do not forget to endio for partial discard requests (Sergey Senozhatsky) [Orabug: 39452420]     {CVE-2026-46089}
    - ocfs2: split transactions in dio completion to avoid credit exhaustion (Heming Zhao) [Orabug: 39452388]     {CVE-2026-46080}
    - drm/amdgpu: Limit BO list entry count to prevent resource exhaustion (Jesse Zhang) [Orabug: 39167551]     {CVE-2026-23468}
    - padata: Fix pd UAF once and for all (Herbert Xu) [Orabug: 38335055] {CVE-2025-38584}
    - drm/nouveau: fix u32 overflow in pushbuf reloc bounds check (Greg Kroah-Hartman) [Orabug: 39452133]     {CVE-2026-46006}
    - ALSA: usb-audio: stop parsing UAC2 rates at MAX_NR_RATES (Cassio Gabriel) [Orabug: 39452170]     {CVE-2026-46018}
    - Buffer overflow in drivers/xen/sys-hypervisor.c (Juergen Gross) [Orabug: 39305898] {CVE-2026-31786}
    - xen/privcmd: fix double free via VMA splitting (Juergen Gross) [Orabug: 39305908] {CVE-2026-31787}
    - rxrpc: Fix missing validation of ticket length in non-XDR key preparsing (Anderson Nascimento) [Orabug:
    39300563] {CVE-2026-31696}
    - crypto: ccp: Don't attempt to copy ID to userspace if PSP command failed (Sean Christopherson)     {CVE-2026-31697}
    - crypto: ccp: Don't attempt to copy PDH cert to userspace if PSP command failed (Sean Christopherson)     {CVE-2026-31698}
    - crypto: ccp: Don't attempt to copy CSR to userspace if PSP command failed (Sean Christopherson)     {CVE-2026-31699}
    - net/packet: fix TOCTOU race on mmap'd vnet_hdr in tpacket_snd() (Bingquan Chen) {CVE-2026-31700}
    - ALSA: caiaq: take a reference on the USB device in create_card() (Berk Cem Goksel) [Orabug: 39300586]     {CVE-2026-31701}
    - smb: client: fix OOB read in smb2_ioctl_query_info QUERY_INFO path (Michael Bommarito) [Orabug:
    39300607] {CVE-2026-31708}
    - smb: client: require a full NFS mode SID before reading mode bits (Michael Bommarito) [Orabug: 39343707]     {CVE-2026-43350}
    - fuse: reject oversized dirents in page cache (Samuel Page) [Orabug: 39300556] {CVE-2026-31694}
    - mm/pagewalk: fix race between concurrent split and refault (Max Boone) [Orabug: 39250782]     {CVE-2026-31456}
    - wifi: mac80211: always free skb on ieee80211_tx_prepare_skb() failure (Felix Fietkau) [Orabug: 39167472]     {CVE-2026-23444}
    - mm/userfaultfd: fix hugetlb fault mutex hash calculation (Jianhui Zhou) [Orabug: 39273453]     {CVE-2026-31575}
    - ipv6: add NULL checks for idev in SRv6 paths (Heminhong) [Orabug: 39167467] {CVE-2026-23442}
    - ocfs2: fix out-of-bounds write in ocfs2_write_end_inline (Joseph Qi) [Orabug: 39331090] {CVE-2026-43075}
    - ocfs2: validate inline data i_size during inode read (Deepanshu Kartikey) [Orabug: 39331097]     {CVE-2026-43076}
    - media: as102: fix to not free memory after the device is registered in as102_usb_probe() (Jeongjun Park)     [Orabug: 39273467] {CVE-2026-31578}
    - bcache: fix cached_dev.sb_bio use-after-free and crash (Mingzhe Zou) [Orabug: 39273481] {CVE-2026-31580}
    - ALSA: 6fire: fix use-after-free on disconnect (Berk Cem Goksel) [Orabug: 39273486] {CVE-2026-31581}
    - media: em28xx: fix use-after-free in em28xx_v4l2_open() (Abhishek Kumar) [Orabug: 39273493]     {CVE-2026-31583}
    - mm: blk-cgroup: fix use-after-free in cgwb_release_workfn() (Breno Leitao) [Orabug: 39273507]     {CVE-2026-31586}
    - KVM: x86: Use scratch field in MMIO fragment to hold small write values (Sean Christopherson) [Orabug:
    39273521] {CVE-2026-31588}
    - x86-64: rename misleadingly named '__copy_user_nocache()' function (Linus Torvalds) [Orabug: 39323162]     {CVE-2026-43073}
    - kernel: be more careful about dup_mmap() failures and uprobe registering (Liam R. Howlett)     {CVE-2025-21709}
    - gpiolib: fix race condition for gdev->srcu (Pawel Narewski) [Orabug: 38887677] {CVE-2026-22986}
    - KVM: SEV: Drop WARN on large size for KVM_MEMORY_ENCRYPT_REG_REGION (Sean Christopherson) [Orabug:
    39273529] {CVE-2026-31590}
    - KVM: SEV: Reject attempts to sync VMSA of an already-launched/encrypted vCPU (Sean Christopherson)     [Orabug: 39273553] {CVE-2026-31593}
    - ocfs2: handle invalid dinode in ocfs2_group_extend (Zhengyuan Huang) [Orabug: 39273569] {CVE-2026-31596}
    - ocfs2: fix use-after-free in ocfs2_fault() when VM_FAULT_RETRY (Tejas Bharambe) [Orabug: 39273578]     {CVE-2026-31597}
    - ocfs2: fix possible deadlock between unlink and dio_end_io_write (Joseph Qi) [Orabug: 39273586]     {CVE-2026-31598}
    - dcache: Limit the minimal number of bucket to two (Zhihao Cheng) [Orabug: 39323133] {CVE-2026-43071}
    - ALSA: ctxfi: Limit PTP to a single page (Harin Lee) [Orabug: 39273608] {CVE-2026-31602}
    - wifi: rtw88: fix device leak on probe failure (Johan Hovold) [Orabug: 39273620] {CVE-2026-31604}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-27789 advisory.

    - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392]     {CVE-2026-46331}
    - scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414}
    - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102]     {CVE-2026-46135}
    - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158]     {CVE-2026-46117}
    - exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173}
    - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941]     {CVE-2026-43279}
    - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984}
    - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984}
    - bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260}
    - wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121]     {CVE-2026-46125}
    - RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145}
    - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057]     {CVE-2026-46152}
    - wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025]     {CVE-2026-46166}
    - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359]     {CVE-2026-46056}
    - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506]     {CVE-2026-31669}
    - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525]     {CVE-2026-31474}
    - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot)     [RHEL-172858] {CVE-2026-31772}
    - xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787}
    - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037}
    - net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539]     {CVE-2026-31508}
    - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181}
    - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408]     {CVE-2026-43501}
    - RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852}
    - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843]     {CVE-2026-43116}
    - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993]     {CVE-2026-43125}
    - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125}
    - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581}
    - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056}
    - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot)     [RHEL-165564] {CVE-2026-23216}
    - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068]     {CVE-2026-31419}
    - smb: client: reject userspace cifs.spnego descriptions (Paulo Alcantara) [RHEL-178944] {CVE-2026-46243}
    - Buffer overflow in drivers/xen/sys-hypervisor.c (Vitaly Kuznetsov) [RHEL-172510] {CVE-2026-31786}
    - smb: client: fix OOB reads parsing symlink error response (CKI Backport Bot) [RHEL-171471]     {CVE-2026-31613}
    - netfilter: xt_tcpmss: check remaining length before reading optlen (CKI Backport Bot) [RHEL-174216]     {CVE-2026-43190}
    - wifi: brcmfmac: validate bsscfg indices in IF events (CKI Backport Bot) [RHEL-173848] {CVE-2026-43110}
    - Bluetooth: SCO: fix race conditions in sco_sock_connect() (CKI Backport Bot) [RHEL-172599]     {CVE-2026-43023}
    - Bluetooth: MGMT: validate LTK enc_size on load (CKI Backport Bot) [RHEL-172572] {CVE-2026-43020}
    - proc: fix type confusion in pde_set_flags() (Abhi Das) [RHEL-163343] {CVE-2025-38653}
    - proc: fix missing pde_set_flags() for net proc files (Abhi Das) [RHEL-163343] {CVE-2025-38653}
    - proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (CKI Backport Bot)     [RHEL-163343] {CVE-2025-38653}
    - mm/page_alloc: clear page->private in free_pages_prepare() (Rafael Aquini) [RHEL-174750]     {CVE-2026-43303}
    - smb: client: validate the whole DACL before rewriting it in cifsacl (Paulo Alcantara) [RHEL-172821]     {CVE-2026-31709}
    - Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (David Marlin)     [RHEL-165063] {CVE-2026-31408}
    - xfs: fix freemap adjustments when adding xattrs to leaf blocks (CKI Backport Bot) [RHEL-174058]     {CVE-2026-43158}
    - xfs: delete attr leaf freemap entries when empty (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158}
    - HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CKI Backport Bot) [RHEL-172740]     {CVE-2026-43051}
    - netfilter: nf_conntrack_helper: pass helper to expect cleanup (CKI Backport Bot) [RHEL-172620]     {CVE-2026-43027}
    - netfilter: ip6t_eui64: reject invalid MAC header for all packets (CKI Backport Bot) [RHEL-171155]     {CVE-2026-31685}
    - net: sched: act_csum: validate nested VLAN headers (CKI Backport Bot) [RHEL-171138] {CVE-2026-31684}
    - nbd: defer config unlock in nbd_genl_connect (Jeff Moyer) [RHEL-166950] {CVE-2025-68366}
    - x86/mm: flush IOMMU before freeing kernel page table pages (Jerry Snitselaar) [RHEL-167100]     {CVE-2025-71089}
    - iommu/sva: add kernel page table IOTLB flush notification (Jerry Snitselaar) [RHEL-167100]     {CVE-2025-71089}
    - netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CKI Backport Bot) [RHEL-166987]     {CVE-2026-23455}
    - crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot)     [RHEL-166927] {CVE-2025-68724}
    - ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (Bruno Meneguele) [RHEL-169734]     {CVE-2025-68183}
    - netfilter: nf_tables: release flowtable after rcu grace period on error (CKI Backport Bot) [RHEL-160461]     {CVE-2026-23392}
    - net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176064]     {CVE-2026-46300}
    - net: move skb_gro_receive_list from udp to core (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300}
    - net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176064]     {CVE-2026-46300}
    - ptrace: slightly saner 'get_dumpable()' logic (Ricardo Robaina) [RHEL-176454] {CVE-2026-46333}
    - md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174091] {CVE-2026-43163}
    - RDMA/umem: Fix double dma_buf_unpin in failure path (CKI Backport Bot) [RHEL-174020] {CVE-2026-43128}
    - usbip: validate number_of_packets in usbip_pack_ret_submit() (CKI Backport Bot) [RHEL-171430]     {CVE-2026-31607}
    - can: raw: fix ro->uniq use-after-free in raw_rcv() (CKI Backport Bot) [RHEL-170759] {CVE-2026-31532}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:27288 advisory.

    * kernel: can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CVE-2026-31474)
      * kernel: mptcp: fix slab-use-after-free in __inet_lookup_established (CVE-2026-31669)
      * kernel: rxrpc: Fix RxGK token loading to check bounds (CVE-2026-31641)
      * kernel: xen/privcmd: fix double free via VMA splitting (CVE-2026-31787)
      * kernel: Buffer overflow in drivers/xen/sys-hypervisor.c (CVE-2026-31786)
      * kernel: net: mana: fix use-after-free in add_adev() error path (CVE-2026-43056)
      * kernel: Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CVE-2026-31772)
      * kernel: bnxt_en: Fix RSS context delete logic (CVE-2026-43260)
      * kernel: crypto: caam - fix overflow on long hmac keys (CVE-2026-43330)
      * kernel: net/sched: act_pedit: extend the writable skb range per key (CVE-2026-46331)
      * kernel: Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CVE-2026-46056)
      * kernel: wifi: mac80211: drop stray 'static' from fast-RX rx_result (CVE-2026-46152)
      * kernel: wifi: mac80211: remove station if connection prep fails (CVE-2026-46125)
      * kernel: exit: prevent preemption of oopsing TASK_DEAD task (CVE-2026-46173)
      * kernel: wifi: mac80211: use safe list iteration in radar detect work (CVE-2026-46166)


    Bug Fix(es) and Enhancement(s):

      * AlmaLinux10.0 - s390/ap: Expose ap_bindings_complete_count counter via sysfs [almalinux-10.2.z]     (JIRA:AlmaLinux-166047)
      * AlmaLinux9.5 crash due to lpfc NULL ndlp->vport [almalinux-10.2.z] (JIRA:AlmaLinux-171774)
      * objtool static_call check blocks build of out-of-tree livepatch modules on AlmaLinux 10.2 GA kernels ?     missing upstream revert f495054bd12e (JIRA:AlmaLinux-178495)
      * ibmveth Adapter Freeze with Small MSS [almalinux-10.2.z] (JIRA:AlmaLinux-179723)
      * rbd: eliminate a race in lock_dwork draining on unmap [almalinux-10.2.z] (JIRA:AlmaLinux-183127)
      * AlmaLinux10.0 - s390/mm: Add missing secure storage access fixups [almalinux-10.2.z]     (JIRA:AlmaLinux-183319)
      * [AlmaLinux10.2.z] Enable Pretimeout Watchdog Panic Functionality on x86 (JIRA:AlmaLinux-182299)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:27789 advisory.

    * kernel: can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CVE-2026-31474)

    * kernel: mptcp: fix slab-use-after-free in __inet_lookup_established (CVE-2026-31669)

    * kernel: xen/privcmd: fix double free via VMA splitting (CVE-2026-31787)

    * kernel: Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CVE-2026-31772)

    * kernel: bnxt_en: Fix RSS context delete logic (CVE-2026-43260)

    * kernel: ALSA: usb-audio: Add sanity check for OOB writes at silencing (CVE-2026-43279)

    * kernel: scsi: qla2xxx: Completely fix fcport double free (CVE-2026-43414)

    * kernel: net/sched: act_pedit: extend the writable skb range per key (CVE-2026-46331)

    * kernel: gfs2: Fix use-after-free in iomap inline data write path (CVE-2026-45984)

    * kernel: Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CVE-2026-46056)

    * kernel: wifi: mac80211: drop stray 'static' from fast-RX rx_result (CVE-2026-46152)

    * kernel: RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CVE-2026-46117)

    * kernel: RDMA/mana: Validate rx_hash_key_len (CVE-2026-46145)

    * kernel: wifi: mac80211: remove station if connection prep fails (CVE-2026-46125)

    * kernel: exit: prevent preemption of oopsing TASK_DEAD task (CVE-2026-46173)

    * kernel: wifi: mac80211: use safe list iteration in radar detect work (CVE-2026-46166)

    * kernel: nvmet-tcp: fix race between ICReq handling and queue teardown (CVE-2026-46135)

    Bug Fix(es) and Enhancement(s):

    * Rocky Linux9.4 - s390/ap: Expose ap_bindings_complete_count counter via sysfs [rhel-9.8.z] (JIRA:Rocky     Linux-166048)

    * [Rocky Linux 9.8] Hung tasks during both suspend and hibernate operations on systems with Intel E810     NICs [rhel-9.8.z] (JIRA:Rocky Linux-175699)

    * DPLL: Add support for pin operational state [rhel-9.8.z] (JIRA:Rocky Linux-175820)

    * DPLL: Add support for fractional frequency offset between pin and device [rhel-9.8.z] (JIRA:Rocky     Linux-175823)

    * ibmveth Adapter Freeze with Small MSS [rhel-9.8.z] (JIRA:Rocky Linux-178308)

    * Rocky Linux9.4 - s390/mm: Add missing secure storage access fixups [rhel-9.8.z] (JIRA:Rocky     Linux-183317)

    * rbd: eliminate a race in lock_dwork draining on unmap [rhel-9.8.z] (JIRA:Rocky Linux-183130)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:27789 advisory.

    * kernel: can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CVE-2026-31474)
      * kernel: mptcp: fix slab-use-after-free in __inet_lookup_established (CVE-2026-31669)
      * kernel: xen/privcmd: fix double free via VMA splitting (CVE-2026-31787)
      * kernel: Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CVE-2026-31772)
      * kernel: bnxt_en: Fix RSS context delete logic (CVE-2026-43260)
      * kernel: ALSA: usb-audio: Add sanity check for OOB writes at silencing (CVE-2026-43279)
      * kernel: scsi: qla2xxx: Completely fix fcport double free (CVE-2026-43414)
      * kernel: net/sched: act_pedit: extend the writable skb range per key (CVE-2026-46331)
      * kernel: gfs2: Fix use-after-free in iomap inline data write path (CVE-2026-45984)
      * kernel: Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CVE-2026-46056)
      * kernel: wifi: mac80211: drop stray 'static' from fast-RX rx_result (CVE-2026-46152)
      * kernel: RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CVE-2026-46117)
      * kernel: RDMA/mana: Validate rx_hash_key_len (CVE-2026-46145)
      * kernel: wifi: mac80211: remove station if connection prep fails (CVE-2026-46125)
      * kernel: exit: prevent preemption of oopsing TASK_DEAD task (CVE-2026-46173)
      * kernel: wifi: mac80211: use safe list iteration in radar detect work (CVE-2026-46166)
      * kernel: nvmet-tcp: fix race between ICReq handling and queue teardown (CVE-2026-46135)


    Bug Fix(es) and Enhancement(s):

      * AlmaLinux9.4 - s390/ap: Expose ap_bindings_complete_count counter via sysfs [almalinux-9.8.z]     (JIRA:AlmaLinux-166048)
      * [AlmaLinux 9.8] Hung tasks during both suspend and hibernate operations on systems with Intel E810     NICs [almalinux-9.8.z] (JIRA:AlmaLinux-175699)
      * DPLL: Add support for pin operational state [almalinux-9.8.z] (JIRA:AlmaLinux-175820)
      * DPLL: Add support for fractional frequency offset between pin and device [almalinux-9.8.z]     (JIRA:AlmaLinux-175823)
      * ibmveth Adapter Freeze with Small MSS [almalinux-9.8.z] (JIRA:AlmaLinux-178308)
      * AlmaLinux9.4 - s390/mm: Add missing secure storage access fixups [almalinux-9.8.z]     (JIRA:AlmaLinux-183317)
      * rbd: eliminate a race in lock_dwork draining on unmap [almalinux-9.8.z] (JIRA:AlmaLinux-183130)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:27789 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CVE-2026-31474)

    * kernel: mptcp: fix slab-use-after-free in __inet_lookup_established (CVE-2026-31669)

    * kernel: xen/privcmd: fix double free via VMA splitting (CVE-2026-31787)

    * kernel: Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CVE-2026-31772)

    * kernel: bnxt_en: Fix RSS context delete logic (CVE-2026-43260)

    * kernel: ALSA: usb-audio: Add sanity check for OOB writes at silencing (CVE-2026-43279)

    * kernel: scsi: qla2xxx: Completely fix fcport double free (CVE-2026-43414)

    * kernel: net/sched: act_pedit: extend the writable skb range per key (CVE-2026-46331)

    * kernel: gfs2: Fix use-after-free in iomap inline data write path (CVE-2026-45984)

    * kernel: Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CVE-2026-46056)

    * kernel: wifi: mac80211: drop stray 'static' from fast-RX rx_result (CVE-2026-46152)

    * kernel: RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CVE-2026-46117)

    * kernel: RDMA/mana: Validate rx_hash_key_len (CVE-2026-46145)

    * kernel: wifi: mac80211: remove station if connection prep fails (CVE-2026-46125)

    * kernel: exit: prevent preemption of oopsing TASK_DEAD task (CVE-2026-46173)

    * kernel: wifi: mac80211: use safe list iteration in radar detect work (CVE-2026-46166)

    * kernel: nvmet-tcp: fix race between ICReq handling and queue teardown (CVE-2026-46135)

    Bug Fix(es) and Enhancement(s):

    * RHEL9.4 - s390/ap: Expose ap_bindings_complete_count counter via sysfs [rhel-9.8.z] (JIRA:RHEL-166048)

    * [RHEL 9.8] Hung tasks during both suspend and hibernate operations on systems with Intel E810 NICs     [rhel-9.8.z] (JIRA:RHEL-175699)

    * DPLL: Add support for pin operational state [rhel-9.8.z] (JIRA:RHEL-175820)

    * DPLL: Add support for fractional frequency offset between pin and device [rhel-9.8.z] (JIRA:RHEL-175823)

    * ibmveth Adapter Freeze with Small MSS [rhel-9.8.z] (JIRA:RHEL-178308)

    * RHEL9.4 - s390/mm: Add missing secure storage access fixups [rhel-9.8.z] (JIRA:RHEL-183317)

    * rbd: eliminate a race in lock_dwork draining on unmap [rhel-9.8.z] (JIRA:RHEL-183130)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:27288 advisory.

    * kernel: can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CVE-2026-31474)

    * kernel: mptcp: fix slab-use-after-free in __inet_lookup_established (CVE-2026-31669)

    * kernel: rxrpc: Fix RxGK token loading to check bounds (CVE-2026-31641)

    * kernel: xen/privcmd: fix double free via VMA splitting (CVE-2026-31787)

    * kernel: Buffer overflow in drivers/xen/sys-hypervisor.c (CVE-2026-31786)

    * kernel: net: mana: fix use-after-free in add_adev() error path (CVE-2026-43056)

    * kernel: Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CVE-2026-31772)

    * kernel: bnxt_en: Fix RSS context delete logic (CVE-2026-43260)

    * kernel: crypto: caam - fix overflow on long hmac keys (CVE-2026-43330)

    * kernel: net/sched: act_pedit: extend the writable skb range per key (CVE-2026-46331)

    * kernel: Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CVE-2026-46056)

    * kernel: wifi: mac80211: drop stray 'static' from fast-RX rx_result (CVE-2026-46152)

    * kernel: wifi: mac80211: remove station if connection prep fails (CVE-2026-46125)

    * kernel: exit: prevent preemption of oopsing TASK_DEAD task (CVE-2026-46173)

    * kernel: wifi: mac80211: use safe list iteration in radar detect work (CVE-2026-46166)

    Bug Fix(es) and Enhancement(s):

    * Rocky Linux10.0 - s390/ap: Expose ap_bindings_complete_count counter via sysfs [rhel-10.2.z] (JIRA:Rocky     Linux-166047)

    * Rocky Linux9.5 crash due to lpfc NULL ndlp->vport [rhel-10.2.z] (JIRA:Rocky Linux-171774)

    * objtool static_call check blocks build of out-of-tree livepatch modules on Rocky Linux 10.2 GA kernels ?     missing upstream revert f495054bd12e (JIRA:Rocky Linux-178495)

    * ibmveth Adapter Freeze with Small MSS [rhel-10.2.z] (JIRA:Rocky Linux-179723)

    * rbd: eliminate a race in lock_dwork draining on unmap [rhel-10.2.z] (JIRA:Rocky Linux-183127)

    * Rocky Linux10.0 - s390/mm: Add missing secure storage access fixups [rhel-10.2.z] (JIRA:Rocky     Linux-183319)

    * [Rocky Linux10.2.z] Enable Pretimeout Watchdog Panic Functionality on x86 (JIRA:Rocky Linux-182299)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:27288 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CVE-2026-31474)

    * kernel: mptcp: fix slab-use-after-free in __inet_lookup_established (CVE-2026-31669)

    * kernel: rxrpc: Fix RxGK token loading to check bounds (CVE-2026-31641)

    * kernel: xen/privcmd: fix double free via VMA splitting (CVE-2026-31787)

    * kernel: Buffer overflow in drivers/xen/sys-hypervisor.c (CVE-2026-31786)

    * kernel: net: mana: fix use-after-free in add_adev() error path (CVE-2026-43056)

    * kernel: Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CVE-2026-31772)

    * kernel: bnxt_en: Fix RSS context delete logic (CVE-2026-43260)

    * kernel: crypto: caam - fix overflow on long hmac keys (CVE-2026-43330)

    * kernel: net/sched: act_pedit: extend the writable skb range per key (CVE-2026-46331)

    * kernel: Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CVE-2026-46056)

    * kernel: wifi: mac80211: drop stray 'static' from fast-RX rx_result (CVE-2026-46152)

    * kernel: wifi: mac80211: remove station if connection prep fails (CVE-2026-46125)

    * kernel: exit: prevent preemption of oopsing TASK_DEAD task (CVE-2026-46173)

    * kernel: wifi: mac80211: use safe list iteration in radar detect work (CVE-2026-46166)

    Bug Fix(es) and Enhancement(s):

    * RHEL10.0 - s390/ap: Expose ap_bindings_complete_count counter via sysfs [rhel-10.2.z] (JIRA:RHEL-166047)

    * RHEL9.5 crash due to lpfc NULL ndlp->vport [rhel-10.2.z] (JIRA:RHEL-171774)

    * objtool static_call check blocks build of out-of-tree livepatch modules on RHEL 10.2 GA kernels ?     missing upstream revert f495054bd12e (JIRA:RHEL-178495)

    * ibmveth Adapter Freeze with Small MSS [rhel-10.2.z] (JIRA:RHEL-179723)

    * rbd: eliminate a race in lock_dwork draining on unmap [rhel-10.2.z] (JIRA:RHEL-183127)

    * RHEL10.0 - s390/mm: Add missing secure storage access fixups [rhel-10.2.z] (JIRA:RHEL-183319)

    * [RHEL10.2.z] Enable Pretimeout Watchdog Panic Functionality on x86 (JIRA:RHEL-182299)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the linux package has been released.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync hci_le_big_create_sync() uses     DEFINE_FLEX to allocate a struct hci_cp_le_big_create_sync on the stack with room for 0x11 (17) BIS     entries. However, conn->num_bis can hold up to HCI_MAX_ISO_BIS (31) entries  validated against     ISO_MAX_NUM_BIS (0x1f) in the caller hci_conn_big_create_sync(). When conn->num_bis is between 18 and 31,     the memcpy that copies conn->bis into cp->bis writes up to 14 bytes past the stack buffer, corrupting     adjacent stack memory. This is trivially reproducible: binding an ISO socket with bc_num_bis =     ISO_MAX_NUM_BIS (31) and calling listen() will eventually trigger hci_le_big_create_sync() from the HCI     command sync worker, causing a KASAN-detectable stack-out-of-bounds write: BUG: KASAN: stack-out-of-bounds     in hci_le_big_create_sync+0x256/0x3b0 Write of size 31 at addr ffffc90000487b48 by task kworker/u9:0/71     Fix this by changing the DEFINE_FLEX count from the incorrect 0x11 to HCI_MAX_ISO_BIS, which matches the     maximum number of BIS entries that conn->bis can actually carry. (CVE-2026-31772)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
325292	Oracle Linux 10 / 9 : Unbreakable Enterprise kernel (ELSA-2026-50372)	Nessus	Oracle Linux Local Security Checks	high
323118	Oracle Linux 9 : kernel (ELSA-2026-27789)	Nessus	Oracle Linux Local Security Checks	high
323100	AlmaLinux 10 : kernel (ALSA-2026:27288)	Nessus	Alma Linux Local Security Checks	high
322776	RockyLinux 9 : kernel (RLSA-2026:27789)	Nessus	Rocky Linux Local Security Checks	high
322284	AlmaLinux 9 : kernel (ALSA-2026:27789)	Nessus	Alma Linux Local Security Checks	high
321964	RHEL 9 : kernel (RHSA-2026:27789)	Nessus	Red Hat Local Security Checks	high
321956	RockyLinux 10 : kernel (RLSA-2026:27288)	Nessus	Rocky Linux Local Security Checks	high
321829	RHEL 10 : kernel (RHSA-2026:27288)	Nessus	Red Hat Local Security Checks	high
318365	Photon OS 5.0: Linux PHSA-2026-5.0-0849	Nessus	PhotonOS Local Security Checks	high
311708	Linux Distros Unpatched Vulnerability : CVE-2026-31772	Nessus	Misc.	high

Detections

Analytics

CVE-2026-31772

high

Tenable Plugins

high

high

high

high

high

high

high

high

high

high