In the Linux kernel, the following vulnerability has been resolved: HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq The wacom_intuos_bt_irq() function processes Bluetooth HID reports without sufficient bounds checking. A maliciously crafted short report can trigger an out-of-bounds read when copying data into the wacom structure. Specifically, report 0x03 requires at least 22 bytes to safely read the processed data and battery status, while report 0x04 (which falls through to 0x03) requires 32 bytes. Add explicit length checks for these report IDs and log a warning if a short report is received.

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:21556 advisory.

    * kernel: proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al     (CVE-2025-38653)
      * kernel: ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (CVE-2025-68183)
      * kernel: nbd: defer config unlock in nbd_genl_connect (CVE-2025-68366)
      * kernel: crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CVE-2025-68724)
      * kernel: iommu: disable SVA when CONFIG_X86 is set (CVE-2025-71089)
      * kernel: netfilter: nf_tables: release flowtable after rcu grace period on error (CVE-2026-23392)
      * kernel: netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CVE-2026-23455)
      * kernel: Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold     (CVE-2026-31408)
      * kernel: net: sched: act_csum: validate nested VLAN headers (CVE-2026-31684)
      * kernel: netfilter: ip6t_eui64: reject invalid MAC header for all packets (CVE-2026-31685)
      * kernel: netfilter: nf_conntrack_helper: pass helper to expect cleanup (CVE-2026-43027)
      * kernel: Bluetooth: MGMT: validate LTK enc_size on load (CVE-2026-43020)
      * kernel: HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CVE-2026-43051)
      * kernel: smb: client: validate the whole DACL before rewriting it in cifsacl (CVE-2026-31709)
      * kernel: Bluetooth: SCO: fix race conditions in sco_sock_connect() (CVE-2026-43023)
      * kernel: wifi: brcmfmac: validate bsscfg indices in IF events (CVE-2026-43110)
      * kernel: netfilter: xt_tcpmss: check remaining length before reading optlen (CVE-2026-43190)
      * kernel: xfs: fix freemap adjustments when adding xattrs to leaf blocks (CVE-2026-43158)
      * kernel: mm/page_alloc: clear page->private in free_pages_prepare() (CVE-2026-43303)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:21557 advisory.

    * kernel: can: j1939: j1939_session_new(): fix skb reference counting (CVE-2024-56645)

    * kernel: ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (CVE-2025-68183)

    * kernel: mm: thp: deny THP for files on anonymous inodes (CVE-2026-23375)

    * kernel: netfilter: nf_tables: release flowtable after rcu grace period on error (CVE-2026-23392)

    * kernel: netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CVE-2026-23455)

    * kernel: net: sched: act_csum: validate nested VLAN headers (CVE-2026-31684)

    * kernel: netfilter: ip6t_eui64: reject invalid MAC header for all packets (CVE-2026-31685)

    * kernel: netfilter: nf_conntrack_helper: pass helper to expect cleanup (CVE-2026-43027)

    * kernel: io_uring/rsrc: reject zero-length fixed buffer import (CVE-2026-43006)

    * kernel: Bluetooth: MGMT: validate LTK enc_size on load (CVE-2026-43020)

    * kernel: HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CVE-2026-43051)

    * kernel: Bluetooth: SCO: fix race conditions in sco_sock_connect() (CVE-2026-43023)

    * kernel: netfilter: ctnetlink: ensure safe access to master conntrack (CVE-2026-43116)

    * kernel: wifi: brcmfmac: validate bsscfg indices in IF events (CVE-2026-43110)

    * kernel: netfilter: xt_tcpmss: check remaining length before reading optlen (CVE-2026-43190)

    * kernel: Linux kernel dpaa2-switch: Kernel memory corruption via out-of-bounds write (CVE-2026-43205)

    * kernel: xfs: fix freemap adjustments when adding xattrs to leaf blocks (CVE-2026-43158)

    * kernel: mm/page_alloc: clear page->private in free_pages_prepare() (CVE-2026-43303)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-751:40 advisory.

    * kernel: Bluetooth: MGMT: Fix possible UAFs (CVE-2025-39981)
      * kernel: ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (CVE-2025-68183)
      * kernel: ALSA: firewire-motu: fix buffer overflow in hwdep read for DSP events (CVE-2025-68347)
      * kernel: libceph: make decode_pool() more resilient against corrupted osdmaps (CVE-2025-71116)
      * kernel: Linux kernel: Denial of service and memory corruption in RDMA umad (CVE-2026-23243)
      * kernel: Linux kernel: Use-after-free in traffic control (act_ct) may lead to denial of service or     privilege escalation (CVE-2026-23270)
      * kernel: netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CVE-2026-23455)
      * kernel: Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold     (CVE-2026-31408)
      * kernel: can: raw: fix ro->uniq use-after-free in raw_rcv() (CVE-2026-31532)
      * kernel: net: sched: act_csum: validate nested VLAN headers (CVE-2026-31684)
      * kernel: netfilter: ip6t_eui64: reject invalid MAC header for all packets (CVE-2026-31685)
      * kernel: netfilter: nf_conntrack_helper: pass helper to expect cleanup (CVE-2026-43027)
      * kernel: Bluetooth: MGMT: validate LTK enc_size on load (CVE-2026-43020)
      * kernel: HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CVE-2026-43051)
      * kernel: smb: client: validate the whole DACL before rewriting it in cifsacl (CVE-2026-31709)
      * kernel: md/bitmap: fix GPF in write_page caused by resize race (CVE-2026-43163)
      * kernel: netfilter: xt_tcpmss: check remaining length before reading optlen (CVE-2026-43190)
      * kernel: xfs: fix freemap adjustments when adding xattrs to leaf blocks (CVE-2026-43158)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-21706 advisory.

    - smb: client: validate the whole DACL before rewriting it in cifsacl (Paulo Alcantara) [RHEL-172815]     {CVE-2026-31709}
    - netfilter: xt_tcpmss: check remaining length before reading optlen (CKI Backport Bot) [RHEL-174212]     {CVE-2026-43190}
    - md/bitmap: fix GPF in write_page caused by resize race (CKI Backport Bot) [RHEL-174088] {CVE-2026-43163}
    - xfs: fix freemap adjustments when adding xattrs to leaf blocks (CKI Backport Bot) [RHEL-174045]     {CVE-2026-43158}
    - xfs: delete attr leaf freemap entries when empty (CKI Backport Bot) [RHEL-174045] {CVE-2026-43158}
    - can: raw: fix ro->uniq use-after-free in raw_rcv() (Davide Caratti) [RHEL-170753] {CVE-2026-31532}
    - can: af_can: export can_sock_destruct() (Davide Caratti) [RHEL-170753] {CVE-2026-31532}
    - HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CKI Backport Bot) [RHEL-172734]     {CVE-2026-43051}
    - netfilter: nf_conntrack_helper: pass helper to expect cleanup (CKI Backport Bot) [RHEL-172614]     {CVE-2026-43027}
    - Bluetooth: MGMT: validate LTK enc_size on load (CKI Backport Bot) [RHEL-172566] {CVE-2026-43020}
    - Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (David Marlin)     [RHEL-165057] {CVE-2026-31408}
    - Bluetooth: SCO: Fix UAF on sco_sock_timeout (David Marlin) [RHEL-165057] {CVE-2026-31408}
    - Bluetooth: Fix use-after-free bugs caused by sco_sock_timeout (David Marlin) [RHEL-165057]     {CVE-2026-31408}
    - Bluetooth: Init sk_peer_* on bt_sock_alloc (David Marlin) [RHEL-165057] {CVE-2026-31408}
    - Bluetooth: Consolidate code around sk_alloc into a helper function (David Marlin) [RHEL-165057]     {CVE-2026-31408}
    - netfilter: ip6t_eui64: reject invalid MAC header for all packets (CKI Backport Bot) [RHEL-171149]     {CVE-2026-31685}
    - net: sched: act_csum: validate nested VLAN headers (CKI Backport Bot) [RHEL-171132] {CVE-2026-31684}
    - ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (Bruno Meneguele) [RHEL-166886]     {CVE-2025-68183}
    - netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CKI Backport Bot) [RHEL-166981]     {CVE-2026-23455}
    - ALSA: firewire-motu: fix buffer overflow in hwdep read for DSP events (CKI Backport Bot) [RHEL-166960]     {CVE-2025-68347}
    - RDMA/umad: Reject negative data_len in ib_umad_write (Kamal Heib) [RHEL-156872] {CVE-2026-23243}
    - Bluetooth: MGMT: Fix possible UAFs (David Marlin) [RHEL-122890] {CVE-2025-39981}
    - Bluetooth: hci_sync: fix set_local_name race condition (David Marlin) [RHEL-122890] {CVE-2025-39981}
    - Bluetooth: MGMT: Fix UAF on mgmt_remove_adv_monitor_complete (David Marlin) [RHEL-122890]     {CVE-2025-39981}
    - Bluetooth: MGMT: Fix possible deadlocks (David Marlin) [RHEL-122890] {CVE-2025-39981}
    - Bluetooth: MGMT: Fix slab-use-after-free Read in set_powered_sync (David Marlin) [RHEL-122890]     {CVE-2025-39981}
    - Bluetooth: mgmt: remove NULL check in mgmt_set_connectable_complete() (David Marlin) [RHEL-122890]     {CVE-2025-39981}
    - Bluetooth: hci_sync: Refactor remove Adv Monitor (David Marlin) [RHEL-122890] {CVE-2025-39981}
    - Bluetooth: hci_sync: Refactor add Adv Monitor (David Marlin) [RHEL-122890] {CVE-2025-39981}
    - Bluetooth: msft: Clear tracked devices on resume (David Marlin) [RHEL-122890] {CVE-2025-39981}
    - Bluetooth: mgmt: Add MGMT Adv Monitor Device Found/Lost events (David Marlin) [RHEL-122890]     {CVE-2025-39981}
    - Bluetooth: msft: Handle MSFT Monitor Device Event (David Marlin) [RHEL-122890] {CVE-2025-39981}
    - net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (CKI Backport Bot)     [RHEL-157322] {CVE-2026-23270}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4606 advisory.

    -------------------------------------------------------------------------     Debian LTS Advisory DLA-4606-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                        Ben Hutchings     May 29, 2026                                  https://wiki.debian.org/LTS
    -------------------------------------------------------------------------

    Package        : linux     Version        : 5.10.257-1     CVE ID         : CVE-2024-56584 CVE-2025-39748 CVE-2025-39764 CVE-2025-40219                      CVE-2025-40261 CVE-2025-68206 CVE-2025-71274 CVE-2025-71292                      CVE-2025-71304 CVE-2026-23100 CVE-2026-23112 CVE-2026-23227                      CVE-2026-23242 CVE-2026-23243 CVE-2026-23245 CVE-2026-23253                      CVE-2026-23273 CVE-2026-23274 CVE-2026-23277 CVE-2026-23279                      CVE-2026-23281 CVE-2026-23286 CVE-2026-23289 CVE-2026-23290                      CVE-2026-23291 CVE-2026-23293 CVE-2026-23298 CVE-2026-23300                      CVE-2026-23303 CVE-2026-23304 CVE-2026-23307 CVE-2026-23312                      CVE-2026-23318 CVE-2026-23336 CVE-2026-23339 CVE-2026-23351                      CVE-2026-23352 CVE-2026-23356 CVE-2026-23357 CVE-2026-23362                      CVE-2026-23365 CVE-2026-23367 CVE-2026-23368 CVE-2026-23372                      CVE-2026-23379 CVE-2026-23381 CVE-2026-23382 CVE-2026-23388                      CVE-2026-23391 CVE-2026-23395 CVE-2026-23396 CVE-2026-23397                      CVE-2026-23398 CVE-2026-23420 CVE-2026-23434 CVE-2026-23439                      CVE-2026-23446 CVE-2026-23452 CVE-2026-23455 CVE-2026-23456                      CVE-2026-23457 CVE-2026-23458 CVE-2026-23460 CVE-2026-23462                      CVE-2026-23463 CVE-2026-23474 CVE-2026-31391 CVE-2026-31393                      CVE-2026-31396 CVE-2026-31399 CVE-2026-31400 CVE-2026-31402                      CVE-2026-31403 CVE-2026-31405 CVE-2026-31411 CVE-2026-31415                      CVE-2026-31416 CVE-2026-31417 CVE-2026-31418 CVE-2026-31421                      CVE-2026-31422 CVE-2026-31423 CVE-2026-31424 CVE-2026-31425                      CVE-2026-31427 CVE-2026-31428 CVE-2026-31447 CVE-2026-31450                      CVE-2026-31452 CVE-2026-31454 CVE-2026-31455 CVE-2026-31466                      CVE-2026-31469 CVE-2026-31473 CVE-2026-31485 CVE-2026-31494                      CVE-2026-31495 CVE-2026-31497 CVE-2026-31498 CVE-2026-31504                      CVE-2026-31507 CVE-2026-31508 CVE-2026-31509 CVE-2026-31510                      CVE-2026-31512 CVE-2026-31515 CVE-2026-31518 CVE-2026-31523                      CVE-2026-31524 CVE-2026-31545 CVE-2026-31546 CVE-2026-31550                      CVE-2026-31552 CVE-2026-31555 CVE-2026-31570 CVE-2026-31628                      CVE-2026-31649 CVE-2026-31651 CVE-2026-31658 CVE-2026-31659                      CVE-2026-31660 CVE-2026-31661 CVE-2026-31662 CVE-2026-31665                      CVE-2026-31667 CVE-2026-31668 CVE-2026-31670 CVE-2026-31671                      CVE-2026-31672 CVE-2026-31674 CVE-2026-31679 CVE-2026-31680                      CVE-2026-31682 CVE-2026-31683 CVE-2026-31720 CVE-2026-31721                      CVE-2026-31726 CVE-2026-31728 CVE-2026-31737 CVE-2026-31738                      CVE-2026-31747 CVE-2026-31748 CVE-2026-31749 CVE-2026-31751                      CVE-2026-31752 CVE-2026-31758 CVE-2026-31759 CVE-2026-31761                      CVE-2026-31762 CVE-2026-31763 CVE-2026-31770 CVE-2026-31773                      CVE-2026-31778 CVE-2026-31780 CVE-2026-31781 CVE-2026-31786                      CVE-2026-31787 CVE-2026-31788 CVE-2026-43011 CVE-2026-43014                      CVE-2026-43015 CVE-2026-43020 CVE-2026-43024 CVE-2026-43026                      CVE-2026-43027 CVE-2026-43028 CVE-2026-43030 CVE-2026-43032                      CVE-2026-43035 CVE-2026-43037 CVE-2026-43038 CVE-2026-43040                      CVE-2026-43041 CVE-2026-43043 CVE-2026-43047 CVE-2026-43050                      CVE-2026-43051 CVE-2026-43060 CVE-2026-43061 CVE-2026-43062                      CVE-2026-43066 CVE-2026-43068 CVE-2026-43069 CVE-2026-43077                      CVE-2026-43078 CVE-2026-43124 CVE-2026-43130 CVE-2026-43132                      CVE-2026-43134 CVE-2026-43135 CVE-2026-43136 CVE-2026-43139                      CVE-2026-43140 CVE-2026-43141 CVE-2026-43147 CVE-2026-43149                      CVE-2026-43152 CVE-2026-43156 CVE-2026-43158 CVE-2026-43159                      CVE-2026-43163 CVE-2026-43168 CVE-2026-43171 CVE-2026-43180                      CVE-2026-43183 CVE-2026-43184 CVE-2026-43187 CVE-2026-43190                      CVE-2026-43194 CVE-2026-43196 CVE-2026-43202 CVE-2026-43203                      CVE-2026-43206 CVE-2026-43207 CVE-2026-43209 CVE-2026-43211                      CVE-2026-43218 CVE-2026-43223 CVE-2026-43226 CVE-2026-43227                      CVE-2026-43230 CVE-2026-43231 CVE-2026-43232 CVE-2026-43233                      CVE-2026-43236 CVE-2026-43241 CVE-2026-43242 CVE-2026-43246                      CVE-2026-43251 CVE-2026-43255 CVE-2026-43257 CVE-2026-43261                      CVE-2026-43264 CVE-2026-43266 CVE-2026-43268 CVE-2026-43269                      CVE-2026-43270 CVE-2026-43273 CVE-2026-43277 CVE-2026-43283                      CVE-2026-43287 CVE-2026-43289 CVE-2026-43295 CVE-2026-43296                      CVE-2026-43314 CVE-2026-43316 CVE-2026-43327 CVE-2026-43328                      CVE-2026-43334 CVE-2026-43336 CVE-2026-43339 CVE-2026-43340                      CVE-2026-43342 CVE-2026-43343 CVE-2026-43355 CVE-2026-43357                      CVE-2026-43363 CVE-2026-43370 CVE-2026-43373 CVE-2026-43381                      CVE-2026-43382 CVE-2026-43383 CVE-2026-43386 CVE-2026-43387                      CVE-2026-43407 CVE-2026-43411 CVE-2026-43420 CVE-2026-43424                      CVE-2026-43425 CVE-2026-43426 CVE-2026-43427 CVE-2026-43428                      CVE-2026-43429 CVE-2026-43430 CVE-2026-43432 CVE-2026-43437                      CVE-2026-43439 CVE-2026-43445 CVE-2026-43449 CVE-2026-43450                      CVE-2026-43451 CVE-2026-43452 CVE-2026-43453 CVE-2026-43458                      CVE-2026-43459 CVE-2026-43466 CVE-2026-43472 CVE-2026-43475                      CVE-2026-43480 CVE-2026-43503 CVE-2026-45848 CVE-2026-45852                      CVE-2026-45856 CVE-2026-45857 CVE-2026-45860 CVE-2026-45862                      CVE-2026-45866 CVE-2026-45867 CVE-2026-45868 CVE-2026-45869                      CVE-2026-45870 CVE-2026-45871 CVE-2026-45873 CVE-2026-45875                      CVE-2026-45879 CVE-2026-45883 CVE-2026-45885 CVE-2026-45890                      CVE-2026-45899 CVE-2026-45904 CVE-2026-45912 CVE-2026-45914                      CVE-2026-45915 CVE-2026-45916 CVE-2026-45919 CVE-2026-45920                      CVE-2026-45923 CVE-2026-45936 CVE-2026-45941 CVE-2026-45948                      CVE-2026-45954 CVE-2026-45956 CVE-2026-45958 CVE-2026-45960                      CVE-2026-45964 CVE-2026-45965 CVE-2026-45968 CVE-2026-45970                      CVE-2026-45974 CVE-2026-45978 CVE-2026-45981 CVE-2026-45983                      CVE-2026-45984 CVE-2026-45985 CVE-2026-46028 CVE-2026-46174                      CVE-2026-46300

    Several vulnerabilities have been discovered in the Linux kernel that     may lead to a privilege escalation, denial of service or information     leaks.

    For Debian 11 bullseye, these problems have been fixed in version     5.10.257-1.  This version additionally includes many more bug fixes     from stable updates 5.10.252-5.10.257.

    We recommend that you upgrade your linux packages.

    For the detailed security status of linux please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/linux

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS     Attachment:
    signature.asc     Description: PGP signature

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:21706 advisory.

    * kernel: Bluetooth: MGMT: Fix possible UAFs (CVE-2025-39981)

    * kernel: ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (CVE-2025-68183)

    * kernel: ALSA: firewire-motu: fix buffer overflow in hwdep read for DSP events (CVE-2025-68347)

    * kernel: libceph: make decode_pool() more resilient against corrupted osdmaps (CVE-2025-71116)

    * kernel: Linux kernel: Denial of service and memory corruption in RDMA umad (CVE-2026-23243)

    * kernel: Linux kernel: Use-after-free in traffic control (act_ct) may lead to denial of service or     privilege escalation (CVE-2026-23270)

    * kernel: netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CVE-2026-23455)

    * kernel: Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (CVE-2026-31408)

    * kernel: can: raw: fix ro->uniq use-after-free in raw_rcv() (CVE-2026-31532)

    * kernel: net: sched: act_csum: validate nested VLAN headers (CVE-2026-31684)

    * kernel: netfilter: ip6t_eui64: reject invalid MAC header for all packets (CVE-2026-31685)

    * kernel: netfilter: nf_conntrack_helper: pass helper to expect cleanup (CVE-2026-43027)

    * kernel: Bluetooth: MGMT: validate LTK enc_size on load (CVE-2026-43020)

    * kernel: HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CVE-2026-43051)

    * kernel: smb: client: validate the whole DACL before rewriting it in cifsacl (CVE-2026-31709)

    * kernel: md/bitmap: fix GPF in write_page caused by resize race (CVE-2026-43163)

    * kernel: netfilter: xt_tcpmss: check remaining length before reading optlen (CVE-2026-43190)

    * kernel: xfs: fix freemap adjustments when adding xattrs to leaf blocks (CVE-2026-43158)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:21745 advisory.

    * kernel: Bluetooth: MGMT: Fix possible UAFs (CVE-2025-39981)

    * kernel: ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (CVE-2025-68183)

    * kernel: ALSA: firewire-motu: fix buffer overflow in hwdep read for DSP events (CVE-2025-68347)

    * kernel: libceph: make decode_pool() more resilient against corrupted osdmaps (CVE-2025-71116)

    * kernel: Linux kernel: Denial of service and memory corruption in RDMA umad (CVE-2026-23243)

    * kernel: Linux kernel: Use-after-free in traffic control (act_ct) may lead to denial of service or     privilege escalation (CVE-2026-23270)

    * kernel: netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CVE-2026-23455)

    * kernel: Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (CVE-2026-31408)

    * kernel: can: raw: fix ro->uniq use-after-free in raw_rcv() (CVE-2026-31532)

    * kernel: net: sched: act_csum: validate nested VLAN headers (CVE-2026-31684)

    * kernel: netfilter: ip6t_eui64: reject invalid MAC header for all packets (CVE-2026-31685)

    * kernel: netfilter: nf_conntrack_helper: pass helper to expect cleanup (CVE-2026-43027)

    * kernel: Bluetooth: MGMT: validate LTK enc_size on load (CVE-2026-43020)

    * kernel: HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CVE-2026-43051)

    * kernel: smb: client: validate the whole DACL before rewriting it in cifsacl (CVE-2026-31709)

    * kernel: md/bitmap: fix GPF in write_page caused by resize race (CVE-2026-43163)

    * kernel: netfilter: xt_tcpmss: check remaining length before reading optlen (CVE-2026-43190)

    * kernel: xfs: fix freemap adjustments when adding xattrs to leaf blocks (CVE-2026-43158)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:21556 advisory.

    * kernel: proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al     (CVE-2025-38653)

    * kernel: ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (CVE-2025-68183)

    * kernel: nbd: defer config unlock in nbd_genl_connect (CVE-2025-68366)

    * kernel: crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CVE-2025-68724)

    * kernel: iommu: disable SVA when CONFIG_X86 is set (CVE-2025-71089)

    * kernel: netfilter: nf_tables: release flowtable after rcu grace period on error (CVE-2026-23392)

    * kernel: netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CVE-2026-23455)

    * kernel: Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (CVE-2026-31408)

    * kernel: net: sched: act_csum: validate nested VLAN headers (CVE-2026-31684)

    * kernel: netfilter: ip6t_eui64: reject invalid MAC header for all packets (CVE-2026-31685)

    * kernel: netfilter: nf_conntrack_helper: pass helper to expect cleanup (CVE-2026-43027)

    * kernel: Bluetooth: MGMT: validate LTK enc_size on load (CVE-2026-43020)

    * kernel: HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CVE-2026-43051)

    * kernel: smb: client: validate the whole DACL before rewriting it in cifsacl (CVE-2026-31709)

    * kernel: Bluetooth: SCO: fix race conditions in sco_sock_connect() (CVE-2026-43023)

    * kernel: wifi: brcmfmac: validate bsscfg indices in IF events (CVE-2026-43110)

    * kernel: netfilter: xt_tcpmss: check remaining length before reading optlen (CVE-2026-43190)

    * kernel: xfs: fix freemap adjustments when adding xattrs to leaf blocks (CVE-2026-43158)

    * kernel: mm/page_alloc: clear page->private in free_pages_prepare() (CVE-2026-43303)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:21745 advisory.

    * kernel: Bluetooth: MGMT: Fix possible UAFs (CVE-2025-39981)
      * kernel: ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (CVE-2025-68183)
      * kernel: ALSA: firewire-motu: fix buffer overflow in hwdep read for DSP events (CVE-2025-68347)
      * kernel: libceph: make decode_pool() more resilient against corrupted osdmaps (CVE-2025-71116)
      * kernel: Linux kernel: Denial of service and memory corruption in RDMA umad (CVE-2026-23243)
      * kernel: Linux kernel: Use-after-free in traffic control (act_ct) may lead to denial of service or     privilege escalation (CVE-2026-23270)
      * kernel: netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CVE-2026-23455)
      * kernel: Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold     (CVE-2026-31408)
      * kernel: can: raw: fix ro->uniq use-after-free in raw_rcv() (CVE-2026-31532)
      * kernel: net: sched: act_csum: validate nested VLAN headers (CVE-2026-31684)
      * kernel: netfilter: ip6t_eui64: reject invalid MAC header for all packets (CVE-2026-31685)
      * kernel: netfilter: nf_conntrack_helper: pass helper to expect cleanup (CVE-2026-43027)
      * kernel: Bluetooth: MGMT: validate LTK enc_size on load (CVE-2026-43020)
      * kernel: HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CVE-2026-43051)
      * kernel: smb: client: validate the whole DACL before rewriting it in cifsacl (CVE-2026-31709)
      * kernel: md/bitmap: fix GPF in write_page caused by resize race (CVE-2026-43163)
      * kernel: netfilter: xt_tcpmss: check remaining length before reading optlen (CVE-2026-43190)
      * kernel: xfs: fix freemap adjustments when adding xattrs to leaf blocks (CVE-2026-43158)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:21706 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: Bluetooth: MGMT: Fix possible UAFs (CVE-2025-39981)

    * kernel: ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (CVE-2025-68183)

    * kernel: ALSA: firewire-motu: fix buffer overflow in hwdep read for DSP events (CVE-2025-68347)

    * kernel: libceph: make decode_pool() more resilient against corrupted osdmaps (CVE-2025-71116)

    * kernel: Linux kernel: Denial of service and memory corruption in RDMA umad (CVE-2026-23243)

    * kernel: Linux kernel: Use-after-free in traffic control (act_ct) may lead to denial of service or     privilege escalation (CVE-2026-23270)

    * kernel: netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CVE-2026-23455)

    * kernel: Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (CVE-2026-31408)

    * kernel: can: raw: fix ro->uniq use-after-free in raw_rcv() (CVE-2026-31532)

    * kernel: net: sched: act_csum: validate nested VLAN headers (CVE-2026-31684)

    * kernel: netfilter: ip6t_eui64: reject invalid MAC header for all packets (CVE-2026-31685)

    * kernel: netfilter: nf_conntrack_helper: pass helper to expect cleanup (CVE-2026-43027)

    * kernel: Bluetooth: MGMT: validate LTK enc_size on load (CVE-2026-43020)

    * kernel: HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CVE-2026-43051)

    * kernel: smb: client: validate the whole DACL before rewriting it in cifsacl (CVE-2026-31709)

    * kernel: md/bitmap: fix GPF in write_page caused by resize race (CVE-2026-43163)

    * kernel: netfilter: xt_tcpmss: check remaining length before reading optlen (CVE-2026-43190)

    * kernel: xfs: fix freemap adjustments when adding xattrs to leaf blocks (CVE-2026-43158)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:21745 advisory.

    The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with     extremely high determinism requirements.

    Security Fix(es):

    * kernel: Bluetooth: MGMT: Fix possible UAFs (CVE-2025-39981)

    * kernel: ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (CVE-2025-68183)

    * kernel: ALSA: firewire-motu: fix buffer overflow in hwdep read for DSP events (CVE-2025-68347)

    * kernel: libceph: make decode_pool() more resilient against corrupted osdmaps (CVE-2025-71116)

    * kernel: Linux kernel: Denial of service and memory corruption in RDMA umad (CVE-2026-23243)

    * kernel: Linux kernel: Use-after-free in traffic control (act_ct) may lead to denial of service or     privilege escalation (CVE-2026-23270)

    * kernel: netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CVE-2026-23455)

    * kernel: Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (CVE-2026-31408)

    * kernel: can: raw: fix ro->uniq use-after-free in raw_rcv() (CVE-2026-31532)

    * kernel: net: sched: act_csum: validate nested VLAN headers (CVE-2026-31684)

    * kernel: netfilter: ip6t_eui64: reject invalid MAC header for all packets (CVE-2026-31685)

    * kernel: netfilter: nf_conntrack_helper: pass helper to expect cleanup (CVE-2026-43027)

    * kernel: Bluetooth: MGMT: validate LTK enc_size on load (CVE-2026-43020)

    * kernel: HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CVE-2026-43051)

    * kernel: smb: client: validate the whole DACL before rewriting it in cifsacl (CVE-2026-31709)

    * kernel: md/bitmap: fix GPF in write_page caused by resize race (CVE-2026-43163)

    * kernel: netfilter: xt_tcpmss: check remaining length before reading optlen (CVE-2026-43190)

    * kernel: xfs: fix freemap adjustments when adding xattrs to leaf blocks (CVE-2026-43158)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:21556 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al     (CVE-2025-38653)

    * kernel: ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (CVE-2025-68183)

    * kernel: nbd: defer config unlock in nbd_genl_connect (CVE-2025-68366)

    * kernel: crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CVE-2025-68724)

    * kernel: iommu: disable SVA when CONFIG_X86 is set (CVE-2025-71089)

    * kernel: netfilter: nf_tables: release flowtable after rcu grace period on error (CVE-2026-23392)

    * kernel: netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CVE-2026-23455)

    * kernel: Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (CVE-2026-31408)

    * kernel: net: sched: act_csum: validate nested VLAN headers (CVE-2026-31684)

    * kernel: netfilter: ip6t_eui64: reject invalid MAC header for all packets (CVE-2026-31685)

    * kernel: netfilter: nf_conntrack_helper: pass helper to expect cleanup (CVE-2026-43027)

    * kernel: Bluetooth: MGMT: validate LTK enc_size on load (CVE-2026-43020)

    * kernel: HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CVE-2026-43051)

    * kernel: smb: client: validate the whole DACL before rewriting it in cifsacl (CVE-2026-31709)

    * kernel: Bluetooth: SCO: fix race conditions in sco_sock_connect() (CVE-2026-43023)

    * kernel: wifi: brcmfmac: validate bsscfg indices in IF events (CVE-2026-43110)

    * kernel: netfilter: xt_tcpmss: check remaining length before reading optlen (CVE-2026-43190)

    * kernel: xfs: fix freemap adjustments when adding xattrs to leaf blocks (CVE-2026-43158)

    * kernel: mm/page_alloc: clear page->private in free_pages_prepare() (CVE-2026-43303)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:21706 advisory.

    * kernel: Bluetooth: MGMT: Fix possible UAFs (CVE-2025-39981)
      * kernel: ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (CVE-2025-68183)
      * kernel: ALSA: firewire-motu: fix buffer overflow in hwdep read for DSP events (CVE-2025-68347)
      * kernel: libceph: make decode_pool() more resilient against corrupted osdmaps (CVE-2025-71116)
      * kernel: Linux kernel: Denial of service and memory corruption in RDMA umad (CVE-2026-23243)
      * kernel: Linux kernel: Use-after-free in traffic control (act_ct) may lead to denial of service or     privilege escalation (CVE-2026-23270)
      * kernel: netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CVE-2026-23455)
      * kernel: Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold     (CVE-2026-31408)
      * kernel: can: raw: fix ro->uniq use-after-free in raw_rcv() (CVE-2026-31532)
      * kernel: net: sched: act_csum: validate nested VLAN headers (CVE-2026-31684)
      * kernel: netfilter: ip6t_eui64: reject invalid MAC header for all packets (CVE-2026-31685)
      * kernel: netfilter: nf_conntrack_helper: pass helper to expect cleanup (CVE-2026-43027)
      * kernel: Bluetooth: MGMT: validate LTK enc_size on load (CVE-2026-43020)
      * kernel: HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CVE-2026-43051)
      * kernel: smb: client: validate the whole DACL before rewriting it in cifsacl (CVE-2026-31709)
      * kernel: md/bitmap: fix GPF in write_page caused by resize race (CVE-2026-43163)
      * kernel: netfilter: xt_tcpmss: check remaining length before reading optlen (CVE-2026-43190)
      * kernel: xfs: fix freemap adjustments when adding xattrs to leaf blocks (CVE-2026-43158)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:21557 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: can: j1939: j1939_session_new(): fix skb reference counting (CVE-2024-56645)

    * kernel: ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (CVE-2025-68183)

    * kernel: mm: thp: deny THP for files on anonymous inodes (CVE-2026-23375)

    * kernel: netfilter: nf_tables: release flowtable after rcu grace period on error (CVE-2026-23392)

    * kernel: netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CVE-2026-23455)

    * kernel: net: sched: act_csum: validate nested VLAN headers (CVE-2026-31684)

    * kernel: netfilter: ip6t_eui64: reject invalid MAC header for all packets (CVE-2026-31685)

    * kernel: netfilter: nf_conntrack_helper: pass helper to expect cleanup (CVE-2026-43027)

    * kernel: io_uring/rsrc: reject zero-length fixed buffer import (CVE-2026-43006)

    * kernel: Bluetooth: MGMT: validate LTK enc_size on load (CVE-2026-43020)

    * kernel: HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CVE-2026-43051)

    * kernel: Bluetooth: SCO: fix race conditions in sco_sock_connect() (CVE-2026-43023)

    * kernel: netfilter: ctnetlink: ensure safe access to master conntrack (CVE-2026-43116)

    * kernel: wifi: brcmfmac: validate bsscfg indices in IF events (CVE-2026-43110)

    * kernel: netfilter: xt_tcpmss: check remaining length before reading optlen (CVE-2026-43190)

    * kernel: Linux kernel dpaa2-switch: Kernel memory corruption via out-of-bounds write (CVE-2026-43205)

    * kernel: xfs: fix freemap adjustments when adding xattrs to leaf blocks (CVE-2026-43158)

    * kernel: mm/page_alloc: clear page->private in free_pages_prepare() (CVE-2026-43303)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the kernel-5.14.0-704.el9 build changelog.

  - In the Linux kernel, the following vulnerability has been resolved: iommu: disable SVA when CONFIG_X86 is     set Patch series Fix stale IOTLB entries for kernel address space, v7. This proposes a fix for a     security vulnerability related to IOMMU Shared Virtual Addressing (SVA). In an SVA context, an IOMMU can     cache kernel page table entries. When a kernel page table page is freed and reallocated for another     purpose, the IOMMU might still hold stale, incorrect entries. This can be exploited to cause a use-after-     free or write-after-free condition, potentially leading to privilege escalation or data corruption. This     solution introduces a deferred freeing mechanism for kernel page table pages, which provides a safe window     to notify the IOMMU to invalidate its caches before the page is reused. This patch (of 8): In the IOMMU     Shared Virtual Addressing (SVA) context, the IOMMU hardware shares and walks the CPU's page tables. The     x86 architecture maps the kernel's virtual address space into the upper portion of every process's page     table. Consequently, in an SVA context, the IOMMU hardware can walk and cache kernel page table entries.
    The Linux kernel currently lacks a notification mechanism for kernel page table changes, specifically when     page table pages are freed and reused. The IOMMU driver is only notified of changes to user virtual     address mappings. This can cause the IOMMU's internal caches to retain stale entries for kernel VA. Use-     After-Free (UAF) and Write-After-Free (WAF) conditions arise when kernel page table pages are freed and     later reallocated. The IOMMU could misinterpret the new data as valid page table entries. The IOMMU might     then walk into attacker-controlled memory, leading to arbitrary physical memory DMA access or privilege     escalation. This is also a Write-After-Free issue, as the IOMMU will potentially continue to write     Accessed and Dirty bits to the freed memory while attempting to walk the stale page tables. Currently, SVA     contexts are unprivileged and cannot access kernel mappings. However, the IOMMU will still walk kernel-     only page tables all the way down to the leaf entries, where it realizes the mapping is for the kernel and     errors out. This means the IOMMU still caches these intermediate page table entries, making the described     vulnerability a real concern. Disable SVA on x86 architecture until the IOMMU can receive notification to     flush the paging cache before freeing the CPU kernel page table pages. (CVE-2025-71089)

  - In the Linux kernel, the following vulnerability has been resolved: md: init bioset in mddev_init IO     operations may be needed before md_run(), such as updating metadata after writing sysfs. Without bioset,     this triggers a NULL pointer dereference as below: BUG: kernel NULL pointer dereference, address:
    0000000000000020 Call Trace: md_update_sb+0x658/0xe00 new_level_store+0xc5/0x120 md_attr_store+0xc9/0x1e0     sysfs_kf_write+0x6f/0xa0 kernfs_fop_write_iter+0x141/0x2a0 vfs_write+0x1fc/0x5a0 ksys_write+0x79/0x180
    __x64_sys_write+0x1d/0x30 x64_sys_call+0x2818/0x2880 do_syscall_64+0xa9/0x580     entry_SYSCALL_64_after_hwframe+0x4b/0x53 Reproducer ``` mdadm -CR /dev/md0 -l1 -n2 /dev/sd[cd] echo     inactive > /sys/block/md0/md/array_state echo 10 > /sys/block/md0/md/new_level ``` mddev_init() can only     be called once per mddev, no need to test if bioset has been initialized anymore. (CVE-2025-68368)

  - In the Linux kernel, the following vulnerability has been resolved: md: avoid repeated calls to     del_gendisk There is a uaf problem which is found by case 23rdev-lifetime: Oops: general protection fault,     probably for non-canonical address 0xdead000000000122 RIP: 0010:bdi_unregister+0x4b/0x170 Call Trace:
    <TASK> __del_gendisk+0x356/0x3e0 mddev_unlock+0x351/0x360 rdev_attr_store+0x217/0x280     kernfs_fop_write_iter+0x14a/0x210 vfs_write+0x29e/0x550 ksys_write+0x74/0xf0 do_syscall_64+0xbb/0x380     entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7ff5250a177e The sequence is: 1. rdev remove path     gets reconfig_mutex 2. rdev remove path release reconfig_mutex in mddev_unlock 3. md stop calls do_md_stop     and sets MD_DELETED 4. rdev remove path calls del_gendisk because MD_DELETED is set 5. md stop path     release reconfig_mutex and calls del_gendisk again So there is a race condition we should resolve. This     patch adds a flag MD_DO_DELETE to avoid the race condition. (CVE-2025-68373)

  - In the Linux kernel, the following vulnerability has been resolved: md: fix rcu protection in     md_wakeup_thread We attempted to use RCU to protect the pointer 'thread', but directly passed the value     when calling md_wakeup_thread(). This means that the RCU pointer has been acquired before rcu_read_lock(),     which renders rcu_read_lock() ineffective and could lead to a use-after-free. (CVE-2025-68374)

  - In the Linux kernel, the following vulnerability has been resolved: md/raid5: fix possible null-pointer     dereferences in raid5_store_group_thread_cnt() The variable mddev->private is first assigned to conf and     then checked: conf = mddev->private; if (!conf) ... If conf is NULL, then mddev->private is also NULL. In     this case, null-pointer dereferences can occur when calling raid5_quiesce(): raid5_quiesce(mddev, true);
    raid5_quiesce(mddev, false); since mddev->private is assigned to conf again in raid5_quiesce(), and conf     is dereferenced in several places, for example: conf->quiesce = 0; wake_up(&conf->wait_for_quiescent); To     fix this issue, the function should unlock mddev and return before invoking raid5_quiesce() when conf is     NULL, following the existing pattern in raid5_change_consistency_policy(). (CVE-2025-71135)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of kernel installed on the remote host is prior to 5.10.253-252.1015. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.10-2026-118 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: nft_ct: add seqadj extension for natted connections (CVE-2025-68206)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: xt_IDLETIMER: reject rev0 reuse of ALARM timer labels (CVE-2026-23274)

    In the Linux kernel, the following vulnerability has been resolved:

    net/sched: teql: fix NULL pointer dereference in iptunnel_xmit on TEQL slave xmit (CVE-2026-23277)

    In the Linux kernel, the following vulnerability has been resolved:

    net: usb: pegasus: validate USB endpoints (CVE-2026-23290)

    In the Linux kernel, the following vulnerability has been resolved:

    net: vxlan: fix nd_tbl NULL dereference when IPv6 is disabled (CVE-2026-23293)

    In the Linux kernel, the following vulnerability has been resolved:

    net: ipv6: fix panic when IPv4 route references loopback IPv6 nexthop (CVE-2026-23300)

    In the Linux kernel, the following vulnerability has been resolved:

    smb: client: Don't log plaintext credentials in cifs_set_cifscreds (CVE-2026-23303)

    In the Linux kernel, the following vulnerability has been resolved:

    ipv6: fix NULL pointer deref in ip6_rt_get_dev_rcu() (CVE-2026-23304)

    In the Linux kernel, the following vulnerability has been resolved:

    net: usb: kaweth: validate USB endpoints (CVE-2026-23312)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (CVE-2026-23351)

    In the Linux kernel, the following vulnerability has been resolved:

    x86/efi: defer freeing of boot services memory (CVE-2026-23352)

    In the Linux kernel, the following vulnerability has been resolved:

    drbd: fix LOGIC BUG in drbd_al_begin_io_nonblock() (CVE-2026-23356)

    In the Linux kernel, the following vulnerability has been resolved:

    can: bcm: fix locking for bcm_op runtime updates (CVE-2026-23362)

    In the Linux kernel, the following vulnerability has been resolved:

    net: usb: kalmia: validate USB endpoints (CVE-2026-23365)

    In the Linux kernel, the following vulnerability has been resolved:

    net: phy: register phy led_triggers during probe to avoid AB-BA deadlock (CVE-2026-23368)

    In the Linux kernel, the following vulnerability has been resolved:

    net: bridge: fix nd_tbl NULL dereference when IPv6 is disabled (CVE-2026-23381)

    In the Linux kernel, the following vulnerability has been resolved:

    HID: Add HID_CLAIMED_INPUT guards in raw_event callbacks missing them (CVE-2026-23382)

    In the Linux kernel, the following vulnerability has been resolved:

    Squashfs: check metadata block offset is within range (CVE-2026-23388)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: xt_CT: drop pending enqueued packets on template removal (CVE-2026-23391)

    In the Linux kernel, the following vulnerability has been resolved:

    nfnetlink_osf: validate individual option lengths in fingerprints (CVE-2026-23397)

    In the Linux kernel, the following vulnerability has been resolved:

    icmp: fix NULL pointer dereference in icmp_tag_validation() (CVE-2026-23398)

    In the Linux kernel, the following vulnerability has been resolved:

    udp_tunnel: fix NULL deref caused by udp_sock_create6 when CONFIG_IPV6=n (CVE-2026-23439)

    In the Linux kernel, the following vulnerability has been resolved:

    PM: runtime: Fix a race condition related to device removal (CVE-2026-23452)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CVE-2026-23455)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (CVE-2026-23456)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (CVE-2026-23457)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (CVE-2026-23458)

    In the Linux kernel, the following vulnerability has been resolved:

    nvdimm/bus: Fix potential use after free in asynchronous initialization (CVE-2026-31399)

    In the Linux kernel, the following vulnerability has been resolved:

    sunrpc: fix cache_request leak in cache_release (CVE-2026-31400)

    In the Linux kernel, the following vulnerability has been resolved:

    nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (CVE-2026-31402)

    In the Linux kernel, the following vulnerability has been resolved:

    NFSD: Hold net reference for the lifetime of /proc/fs/nfs/exports fd (CVE-2026-31403)

    In the Linux kernel, the following vulnerability has been resolved:

    ipv6: avoid overflows in ip6_datagram_send_ctl() (CVE-2026-31415)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: nfnetlink_log: account for netlink header size (CVE-2026-31416)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: ipset: drop logically empty buckets in mtype_del (CVE-2026-31418)

    In the Linux kernel, the following vulnerability has been resolved:

    net/sched: cls_fw: fix NULL pointer dereference on shared blocks (CVE-2026-31421)

    In the Linux kernel, the following vulnerability has been resolved:

    net/sched: cls_flow: fix NULL pointer dereference on shared blocks (CVE-2026-31422)

    In the Linux kernel, the following vulnerability has been resolved:

    net/sched: sch_hfsc: fix divide-by-zero in rtsc_min() (CVE-2026-31423)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP (CVE-2026-31424)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: nf_conntrack_sip: fix use of uninitialized rtp_addr in process_sdp (CVE-2026-31427)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD (CVE-2026-31428)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: reject mount if bigalloc with s_first_data_block != 0 (CVE-2026-31447)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: publish jinode after initialization (CVE-2026-31450)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: convert inline data to extents when truncate exceeds inline size (CVE-2026-31452)

    In the Linux kernel, the following vulnerability has been resolved:

    xfs: save ailp before dropping the AIL lock in push callbacks (CVE-2026-31454)

    In the Linux kernel, the following vulnerability has been resolved:

    xfs: stop reclaim before pushing AIL during unmount (CVE-2026-31455)

    In the Linux kernel, the following vulnerability has been resolved:

    mm/huge_memory: fix folio isn't locked in softleaf_to_folio() (CVE-2026-31466)

    In the Linux kernel, the following vulnerability has been resolved:

    virtio_net: Fix UAF on dst_ops when IFF_XMIT_DST_RELEASE is cleared and napi_tx is false (CVE-2026-31469)

    In the Linux kernel, the following vulnerability has been resolved:

    media: mc, v4l2: serialize REINIT and REQBUFS with req_queue_mutex (CVE-2026-31473)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: ctnetlink: use netlink policy range checks (CVE-2026-31495)

    In the Linux kernel, the following vulnerability has been resolved:

    net: fix fanout UAF in packet_release() via NETDEV_UP race (CVE-2026-31504)

    In the Linux kernel, the following vulnerability has been resolved:

    net: openvswitch: Avoid releasing netdev before teardown completes (CVE-2026-31508)

    In the Linux kernel, the following vulnerability has been resolved:

    af_key: validate families in pfkey_send_migrate() (CVE-2026-31515)

    In the Linux kernel, the following vulnerability has been resolved:

    esp: fix skb leak with espintcp and async crypto (CVE-2026-31518)

    In the Linux kernel, the following vulnerability has been resolved:

    nvme-pci: ensure we're polling a polled queue (CVE-2026-31523)

    In the Linux kernel, the following vulnerability has been resolved:

    HID: asus: avoid memory leak in asus_report_fixup() (CVE-2026-31524)

    In the Linux kernel, the following vulnerability has been resolved:

    net: bonding: fix NULL deref in bond_debug_rlb_hash_show (CVE-2026-31546)

    In the Linux kernel, the following vulnerability has been resolved:

    futex: Clear stale exiting pointer in futex_lock_pi() retry path (CVE-2026-31555)

    In the Linux kernel, the following vulnerability has been resolved:

    can: gw: fix OOB heap access in cgw_csum_crc8_rel() (CVE-2026-31570)

    In the Linux kernel, the following vulnerability has been resolved:

    x86/CPU: Fix FPDSS on Zen1 (CVE-2026-31628)

    In the Linux kernel, the following vulnerability has been resolved:

    mmc: vub300: fix NULL-deref on disconnect (CVE-2026-31651)

    In the Linux kernel, the following vulnerability has been resolved:

    tipc: fix bc_ackers underflow on duplicate GRP_ACK_MSG (CVE-2026-31662)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: nft_ct: fix use-after-free in timeout object destroy (CVE-2026-31665)

    In the Linux kernel, the following vulnerability has been resolved:

    Input: uinput - fix circular locking dependency with ff-core (CVE-2026-31667)

    In the Linux kernel, the following vulnerability has been resolved:

    seg6: separate dst_cache for input and output paths in seg6 lwtunnel (CVE-2026-31668)

    In the Linux kernel, the following vulnerability has been resolved:

    net: rfkill: prevent unlimited numbers of rfkill events from being created (CVE-2026-31670)

    In the Linux kernel, the following vulnerability has been resolved:

    xfrm_user: fix info leak in build_report() (CVE-2026-31671)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (CVE-2026-31674)

    In the Linux kernel, the following vulnerability has been resolved:

    openvswitch: validate MPLS set/set_masked payload length (CVE-2026-31679)

    In the Linux kernel, the following vulnerability has been resolved:

    net: ipv6: flowlabel: defer exclusive option free until RCU teardown (CVE-2026-31680)

    In the Linux kernel, the following vulnerability has been resolved:

    bridge: br_nd_send: linearize skb before parsing ND options (CVE-2026-31682)

    In the Linux kernel, the following vulnerability has been resolved:

    vxlan: validate ND option lengths in vxlan_na_create (CVE-2026-31738)

    In the Linux kernel, the following vulnerability has been resolved:

    bridge: br_nd_send: validate ND option lengths (CVE-2026-31752)

    In the Linux kernel, the following vulnerability has been resolved:

    usb: usbtmc: Flush anchored URBs in usbtmc_release (CVE-2026-31758)

    In the Linux kernel, the following vulnerability has been resolved:

    usb: ulpi: fix double free in ulpi_register_interface() error path (CVE-2026-31759)

    In the Linux kernel, the following vulnerability has been resolved:

    drm/ioc32: stop speculation on the drm_compat_ioctl path (CVE-2026-31781)

    In the Linux kernel, the following vulnerability has been resolved:

    xen/privcmd: restrict usage in unprivileged domU (CVE-2026-31788)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: nf_tables: reject immediate NF_QUEUE verdict (CVE-2026-43024)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (CVE-2026-43026)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: nf_conntrack_helper: pass helper to expect cleanup (CVE-2026-43027)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: x_tables: ensure names are nul-terminated (CVE-2026-43028)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf: Fix regsafe() for pointers to packet (CVE-2026-43030)

    In the Linux kernel, the following vulnerability has been resolved:

    net: sched: cls_api: fix tc_chain_fill_node to initialize tcm_info to zero to prevent an info-leak     (CVE-2026-43035)

    In the Linux kernel, the following vulnerability has been resolved:

    ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (CVE-2026-43037)

    In the Linux kernel, the following vulnerability has been resolved:

    ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (CVE-2026-43038)

    In the Linux kernel, the following vulnerability has been resolved:

    net: ipv6: ndisc: fix ndisc_ra_useropt to initialize nduseropt_padX fields to zero to prevent an info-leak     (CVE-2026-43040)

    In the Linux kernel, the following vulnerability has been resolved:

    crypto: af-alg - fix NULL pointer dereference in scatterwalk (CVE-2026-43043)

    In the Linux kernel, the following vulnerability has been resolved:

    HID: multitouch: Check to ensure report responses match the request (CVE-2026-43047)

    In the Linux kernel, the following vulnerability has been resolved:

    HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CVE-2026-43051)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: nft_ct: drop pending enqueued packets on removal (CVE-2026-43060)

    In the Linux kernel, the following vulnerability has been resolved:

    serial: 8250: Fix TX deadlock when using DMA (CVE-2026-43061)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: fix iloc.bh leak in ext4_fc_replay_inode() error paths (CVE-2026-43066)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: avoid allocate block from corrupted group in ext4_mb_find_by_goal() (CVE-2026-43068)

    In the Linux kernel, the following vulnerability has been resolved:xfrm: esp: avoid in-place decrypt on     shared skb frags

    Dirty Frag and other issues in Amazon Linux kernels:https://aws.amazon.com/security/security-     bulletins/2026-027-aws/ (CVE-2026-43284)

    In the Linux kernel, the following vulnerability has been resolved:

    cpufreq: governor: fix double free in cpufreq_dbs_governor_init() error path (CVE-2026-43328)

    In the Linux kernel, the following vulnerability has been resolved:

    lib/crypto: chacha: Zeroize permuted_state before it leaves scope (CVE-2026-43336)

    In the Linux kernel, the following vulnerability has been resolved:

    ipv6: prevent possible UaF in addrconf_permanent_addr() (CVE-2026-43339)

    In the Linux kernel, the following vulnerability has been resolved:

    x86/apic: Disable x2apic on resume if the kernel expects so (CVE-2026-43363)

    In the Linux kernel, the following vulnerability has been resolved:

    net/tcp-md5: Fix MAC comparison to be constant-time (CVE-2026-43383)

    In the Linux kernel, the following vulnerability has been resolved:

    libceph: Fix potential out-of-bounds access in ceph_handle_auth_reply() (CVE-2026-43407)

    In the Linux kernel, the following vulnerability has been resolved:

    tipc: fix divide-by-zero in tipc_sk_filter_connect() (CVE-2026-43411)

    In the Linux kernel, the following vulnerability has been resolved:

    ceph: fix i_nlink underrun during async unlink (CVE-2026-43420)

    In the Linux kernel, the following vulnerability has been resolved:

    usb: image: mdc800: kill download URB on timeout (CVE-2026-43425)

    In the Linux kernel, the following vulnerability has been resolved:

    usb: class: cdc-wdm: fix reordering issue in read code path (CVE-2026-43427)

    In the Linux kernel, the following vulnerability has been resolved:

    USB: core: Limit the length of unkillable synchronous timeouts (CVE-2026-43428)

    In the Linux kernel, the following vulnerability has been resolved:

    USB: usbtmc: Use usb_bulk_msg_killable() with user-specified timeouts (CVE-2026-43429)

    In the Linux kernel, the following vulnerability has been resolved:

    usb: xhci: Fix memory leak in xhci_disable_slot() (CVE-2026-43432)

    In the Linux kernel, the following vulnerability has been resolved:

    cgroup: fix race between task migration and iteration (CVE-2026-43439)

    In the Linux kernel, the following vulnerability has been resolved:

    e1000/e1000e: Fix leak in DMA error cleanup (CVE-2026-43445)

    In the Linux kernel, the following vulnerability has been resolved:

    nvme-pci: Fix slab-out-of-bounds in nvme_dbbuf_set (CVE-2026-43449)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CVE-2026-43450)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (CVE-2026-43451)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: x_tables: guard option walkers against 1-byte tail reads (CVE-2026-43452)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop() (CVE-2026-43453)

    In the Linux kernel, the following vulnerability has been resolved:

    ASoC: soc-core: flush delayed work before removing DAIs and widgets (CVE-2026-43459)

    In the Linux kernel, the following vulnerability has been resolved:

    net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (CVE-2026-43466)

    In the Linux kernel, the following vulnerability has been resolved:

    unshare: fix unshare_fs() handling (CVE-2026-43472)

    In the Linux kernel, the following vulnerability has been resolved:

    scsi: storvsc: Fix scheduling while atomic on PREEMPT_RT (CVE-2026-43475)

    In the Linux kernel, the following vulnerability has been resolved:

    rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (CVE-2026-43500)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4561 advisory.

    -------------------------------------------------------------------------     Debian LTS Advisory DLA-4561-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                        Ben Hutchings     May 02, 2026                                  https://wiki.debian.org/LTS
    -------------------------------------------------------------------------

    Package        : linux-6.1     Version        : 6.1.170-1~deb11u1     CVE ID         : CVE-2023-53228 CVE-2023-53510 CVE-2023-53545 CVE-2024-47736                      CVE-2024-47809 CVE-2024-49998 CVE-2024-50298 CVE-2024-56719                      CVE-2025-21676 CVE-2025-21682 CVE-2025-37945 CVE-2025-37980                      CVE-2025-38105 CVE-2025-38162 CVE-2025-38192 CVE-2025-38250                      CVE-2025-38303 CVE-2025-38436 CVE-2025-38626 CVE-2025-38659                      CVE-2025-38704 CVE-2025-39748 CVE-2025-39764 CVE-2025-39863                      CVE-2025-40005 CVE-2025-40016 CVE-2025-40135 CVE-2025-40219                      CVE-2025-40242 CVE-2025-40261 CVE-2025-40358 CVE-2025-68206                      CVE-2025-68239 CVE-2025-68265 CVE-2025-71067 CVE-2025-71161                      CVE-2025-71221 CVE-2025-71265 CVE-2025-71266 CVE-2025-71267                      CVE-2025-71269 CVE-2026-23100 CVE-2026-23113 CVE-2026-23141                      CVE-2026-23154 CVE-2026-23157 CVE-2026-23204 CVE-2026-23227                      CVE-2026-23231 CVE-2026-23242 CVE-2026-23243 CVE-2026-23245                      CVE-2026-23253 CVE-2026-23270 CVE-2026-23271 CVE-2026-23273                      CVE-2026-23274 CVE-2026-23277 CVE-2026-23279 CVE-2026-23281                      CVE-2026-23284 CVE-2026-23286 CVE-2026-23287 CVE-2026-23289                      CVE-2026-23290 CVE-2026-23291 CVE-2026-23292 CVE-2026-23293                      CVE-2026-23296 CVE-2026-23298 CVE-2026-23300 CVE-2026-23303                      CVE-2026-23304 CVE-2026-23306 CVE-2026-23307 CVE-2026-23312                      CVE-2026-23315 CVE-2026-23317 CVE-2026-23318 CVE-2026-23319                      CVE-2026-23321 CVE-2026-23324 CVE-2026-23335 CVE-2026-23336                      CVE-2026-23339 CVE-2026-23340 CVE-2026-23343 CVE-2026-23351                      CVE-2026-23352 CVE-2026-23356 CVE-2026-23357 CVE-2026-23359                      CVE-2026-23362 CVE-2026-23364 CVE-2026-23365 CVE-2026-23367                      CVE-2026-23368 CVE-2026-23370 CVE-2026-23372 CVE-2026-23378                      CVE-2026-23379 CVE-2026-23381 CVE-2026-23382 CVE-2026-23388                      CVE-2026-23391 CVE-2026-23392 CVE-2026-23395 CVE-2026-23396                      CVE-2026-23397 CVE-2026-23398 CVE-2026-23401 CVE-2026-23414                      CVE-2026-23420 CVE-2026-23422 CVE-2026-23426 CVE-2026-23428                      CVE-2026-23434 CVE-2026-23438 CVE-2026-23439 CVE-2026-23446                      CVE-2026-23449 CVE-2026-23450 CVE-2026-23452 CVE-2026-23454                      CVE-2026-23455 CVE-2026-23456 CVE-2026-23457 CVE-2026-23458                      CVE-2026-23460 CVE-2026-23462 CVE-2026-23463 CVE-2026-23474                      CVE-2026-23475 CVE-2026-31389 CVE-2026-31391 CVE-2026-31392                      CVE-2026-31393 CVE-2026-31396 CVE-2026-31399 CVE-2026-31400                      CVE-2026-31402 CVE-2026-31403 CVE-2026-31405 CVE-2026-31408                      CVE-2026-31409 CVE-2026-31411 CVE-2026-31412 CVE-2026-31414                      CVE-2026-31415 CVE-2026-31416 CVE-2026-31417 CVE-2026-31418                      CVE-2026-31421 CVE-2026-31422 CVE-2026-31423 CVE-2026-31424                      CVE-2026-31425 CVE-2026-31426 CVE-2026-31427 CVE-2026-31428                      CVE-2026-31431 CVE-2026-31433 CVE-2026-31434 CVE-2026-31441                      CVE-2026-31446 CVE-2026-31447 CVE-2026-31448 CVE-2026-31450                      CVE-2026-31452 CVE-2026-31453 CVE-2026-31454 CVE-2026-31455                      CVE-2026-31464 CVE-2026-31466 CVE-2026-31467 CVE-2026-31469                      CVE-2026-31473 CVE-2026-31476 CVE-2026-31477 CVE-2026-31478                      CVE-2026-31480 CVE-2026-31483 CVE-2026-31485 CVE-2026-31492                      CVE-2026-31494 CVE-2026-31495 CVE-2026-31496 CVE-2026-31497                      CVE-2026-31498 CVE-2026-31503 CVE-2026-31504 CVE-2026-31507                      CVE-2026-31508 CVE-2026-31509 CVE-2026-31510 CVE-2026-31512                      CVE-2026-31515 CVE-2026-31518 CVE-2026-31519 CVE-2026-31520                      CVE-2026-31521 CVE-2026-31522 CVE-2026-31523 CVE-2026-31524                      CVE-2026-31533 CVE-2026-31540 CVE-2026-31545 CVE-2026-31546                      CVE-2026-31548 CVE-2026-31549 CVE-2026-31550 CVE-2026-31551                      CVE-2026-31552 CVE-2026-31555 CVE-2026-31563 CVE-2026-31565                      CVE-2026-31566 CVE-2026-31570 CVE-2026-31628 CVE-2026-31634                      CVE-2026-31649 CVE-2026-31651 CVE-2026-31656 CVE-2026-31657                      CVE-2026-31658 CVE-2026-31659 CVE-2026-31660 CVE-2026-31661                      CVE-2026-31662 CVE-2026-31664 CVE-2026-31665 CVE-2026-31667                      CVE-2026-31668 CVE-2026-31669 CVE-2026-31670 CVE-2026-31671                      CVE-2026-31672 CVE-2026-31674 CVE-2026-31678 CVE-2026-31679                      CVE-2026-31680 CVE-2026-31682 CVE-2026-31683 CVE-2026-31689                      CVE-2026-31695 CVE-2026-31720 CVE-2026-31721 CVE-2026-31726                      CVE-2026-31728 CVE-2026-31737 CVE-2026-31738 CVE-2026-31747                      CVE-2026-31748 CVE-2026-31749 CVE-2026-31751 CVE-2026-31752                      CVE-2026-31754 CVE-2026-31755 CVE-2026-31756 CVE-2026-31758                      CVE-2026-31759 CVE-2026-31761 CVE-2026-31762 CVE-2026-31763                      CVE-2026-31768 CVE-2026-31770 CVE-2026-31773 CVE-2026-31776                      CVE-2026-31778 CVE-2026-31779 CVE-2026-31780 CVE-2026-31781                      CVE-2026-31786 CVE-2026-31787 CVE-2026-31788 CVE-2026-43011                      CVE-2026-43013 CVE-2026-43014 CVE-2026-43015 CVE-2026-43017                      CVE-2026-43018 CVE-2026-43020 CVE-2026-43023 CVE-2026-43024                      CVE-2026-43025 CVE-2026-43026 CVE-2026-43027 CVE-2026-43028                      CVE-2026-43030 CVE-2026-43032 CVE-2026-43033 CVE-2026-43035                      CVE-2026-43037 CVE-2026-43038 CVE-2026-43040 CVE-2026-43041                      CVE-2026-43043 CVE-2026-43046 CVE-2026-43047 CVE-2026-43050                      CVE-2026-43051 CVE-2026-43054 CVE-2026-43057

    Several vulnerabilities have been discovered in the Linux kernel that     may lead to a privilege escalation, denial of service or information     leaks.

    For Debian 11 bullseye, these problems have been fixed in version     6.1.170-1~deb11u1.

    We recommend that you upgrade your linux-6.1 packages.

    For the detailed security status of linux-6.1 please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/linux-6.1

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS     Attachment:
    signature.asc     Description: PGP signature

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq The wacom_intuos_bt_irq() function processes     Bluetooth HID reports without sufficient bounds checking. A maliciously crafted short report can trigger     an out-of-bounds read when copying data into the wacom structure. Specifically, report 0x03 requires at     least 22 bytes to safely read the processed data and battery status, while report 0x04 (which falls     through to 0x03) requires 32 bytes. Add explicit length checks for these report IDs and log a warning if a     short report is received. (CVE-2026-43051)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote Debian 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6243 advisory.

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-6243-1                   security@debian.org     https://www.debian.org/security/                     Salvatore Bonaccorso     May 01, 2026                          https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : linux     CVE ID         : CVE-2023-53228 CVE-2023-53510 CVE-2023-53545 CVE-2024-47736                      CVE-2024-47809 CVE-2024-49998 CVE-2024-50298 CVE-2024-56719                      CVE-2025-21676 CVE-2025-21682 CVE-2025-37945 CVE-2025-37980                      CVE-2025-38105 CVE-2025-38162 CVE-2025-38192 CVE-2025-38250                      CVE-2025-38303 CVE-2025-38436 CVE-2025-38626 CVE-2025-38659                      CVE-2025-38704 CVE-2025-39748 CVE-2025-39764 CVE-2025-39863                      CVE-2025-40005 CVE-2025-40016 CVE-2025-40135 CVE-2025-40219                      CVE-2025-40242 CVE-2025-40261 CVE-2025-40358 CVE-2025-68206                      CVE-2025-68239 CVE-2025-68265 CVE-2025-71067 CVE-2025-71161                      CVE-2025-71221 CVE-2025-71265 CVE-2025-71266 CVE-2025-71267                      CVE-2025-71269 CVE-2026-23100 CVE-2026-23113 CVE-2026-23141                      CVE-2026-23154 CVE-2026-23157 CVE-2026-23204 CVE-2026-23227                      CVE-2026-23231 CVE-2026-23242 CVE-2026-23243 CVE-2026-23245                      CVE-2026-23253 CVE-2026-23270 CVE-2026-23271 CVE-2026-23273                      CVE-2026-23274 CVE-2026-23277 CVE-2026-23279 CVE-2026-23281                      CVE-2026-23284 CVE-2026-23286 CVE-2026-23287 CVE-2026-23289                      CVE-2026-23290 CVE-2026-23291 CVE-2026-23292 CVE-2026-23293                      CVE-2026-23296 CVE-2026-23298 CVE-2026-23300 CVE-2026-23303                      CVE-2026-23304 CVE-2026-23306 CVE-2026-23307 CVE-2026-23312                      CVE-2026-23315 CVE-2026-23317 CVE-2026-23318 CVE-2026-23319                      CVE-2026-23321 CVE-2026-23324 CVE-2026-23335 CVE-2026-23336                      CVE-2026-23339 CVE-2026-23340 CVE-2026-23343 CVE-2026-23351                      CVE-2026-23352 CVE-2026-23356 CVE-2026-23357 CVE-2026-23359                      CVE-2026-23362 CVE-2026-23364 CVE-2026-23365 CVE-2026-23367                      CVE-2026-23368 CVE-2026-23370 CVE-2026-23372 CVE-2026-23378                      CVE-2026-23379 CVE-2026-23381 CVE-2026-23382 CVE-2026-23388                      CVE-2026-23391 CVE-2026-23392 CVE-2026-23395 CVE-2026-23396                      CVE-2026-23397 CVE-2026-23398 CVE-2026-23401 CVE-2026-23414                      CVE-2026-23420 CVE-2026-23422 CVE-2026-23426 CVE-2026-23428                      CVE-2026-23434 CVE-2026-23438 CVE-2026-23439 CVE-2026-23446                      CVE-2026-23449 CVE-2026-23450 CVE-2026-23452 CVE-2026-23454                      CVE-2026-23455 CVE-2026-23456 CVE-2026-23457 CVE-2026-23458                      CVE-2026-23460 CVE-2026-23462 CVE-2026-23463 CVE-2026-23474                      CVE-2026-23475 CVE-2026-31389 CVE-2026-31391 CVE-2026-31392                      CVE-2026-31393 CVE-2026-31396 CVE-2026-31399 CVE-2026-31400                      CVE-2026-31402 CVE-2026-31403 CVE-2026-31405 CVE-2026-31408                      CVE-2026-31409 CVE-2026-31411 CVE-2026-31412 CVE-2026-31414                      CVE-2026-31415 CVE-2026-31416 CVE-2026-31417 CVE-2026-31418                      CVE-2026-31421 CVE-2026-31422 CVE-2026-31423 CVE-2026-31424                      CVE-2026-31425 CVE-2026-31426 CVE-2026-31427 CVE-2026-31428                      CVE-2026-31431 CVE-2026-31433 CVE-2026-31434 CVE-2026-31441                      CVE-2026-31446 CVE-2026-31447 CVE-2026-31448 CVE-2026-31450                      CVE-2026-31452 CVE-2026-31453 CVE-2026-31454 CVE-2026-31455                      CVE-2026-31464 CVE-2026-31466 CVE-2026-31467 CVE-2026-31469                      CVE-2026-31473 CVE-2026-31476 CVE-2026-31477 CVE-2026-31478                      CVE-2026-31480 CVE-2026-31483 CVE-2026-31485 CVE-2026-31492                      CVE-2026-31494 CVE-2026-31495 CVE-2026-31496 CVE-2026-31497                      CVE-2026-31498 CVE-2026-31503 CVE-2026-31504 CVE-2026-31507                      CVE-2026-31508 CVE-2026-31509 CVE-2026-31510 CVE-2026-31512                      CVE-2026-31515 CVE-2026-31518 CVE-2026-31519 CVE-2026-31520                      CVE-2026-31521 CVE-2026-31522 CVE-2026-31523 CVE-2026-31524                      CVE-2026-31533 CVE-2026-31540 CVE-2026-31545 CVE-2026-31546                      CVE-2026-31548 CVE-2026-31549 CVE-2026-31550 CVE-2026-31551                      CVE-2026-31552 CVE-2026-31555 CVE-2026-31563 CVE-2026-31565                      CVE-2026-31566 CVE-2026-31570 CVE-2026-31628 CVE-2026-31634                      CVE-2026-31649 CVE-2026-31651 CVE-2026-31656 CVE-2026-31657                      CVE-2026-31658 CVE-2026-31659 CVE-2026-31660 CVE-2026-31661                      CVE-2026-31662 CVE-2026-31664 CVE-2026-31665 CVE-2026-31667                      CVE-2026-31668 CVE-2026-31669 CVE-2026-31670 CVE-2026-31671                      CVE-2026-31672 CVE-2026-31674 CVE-2026-31678 CVE-2026-31679                      CVE-2026-31680 CVE-2026-31682 CVE-2026-31683 CVE-2026-31689                      CVE-2026-31695 CVE-2026-31720 CVE-2026-31721 CVE-2026-31726                      CVE-2026-31728 CVE-2026-31737 CVE-2026-31738 CVE-2026-31747                      CVE-2026-31748 CVE-2026-31749 CVE-2026-31751 CVE-2026-31752                      CVE-2026-31754 CVE-2026-31755 CVE-2026-31756 CVE-2026-31758                      CVE-2026-31759 CVE-2026-31761 CVE-2026-31762 CVE-2026-31763                      CVE-2026-31768 CVE-2026-31770 CVE-2026-31773 CVE-2026-31776                      CVE-2026-31778 CVE-2026-31779 CVE-2026-31780 CVE-2026-31781                      CVE-2026-31786 CVE-2026-31787 CVE-2026-31788 CVE-2026-43011                      CVE-2026-43013 CVE-2026-43014 CVE-2026-43015 CVE-2026-43017                      CVE-2026-43018 CVE-2026-43020 CVE-2026-43023 CVE-2026-43024                      CVE-2026-43025 CVE-2026-43026 CVE-2026-43027 CVE-2026-43028                      CVE-2026-43030 CVE-2026-43032 CVE-2026-43033 CVE-2026-43035                      CVE-2026-43037 CVE-2026-43038 CVE-2026-43040 CVE-2026-43041                      CVE-2026-43043 CVE-2026-43046 CVE-2026-43047 CVE-2026-43050                      CVE-2026-43051 CVE-2026-43054 CVE-2026-43057

    Several vulnerabilities have been discovered in the Linux kernel that     may lead to a privilege escalation, denial of service or information     leaks.

    For the oldstable distribution (bookworm), these problems have been fixed     in version 6.1.170-1.

    We recommend that you upgrade your linux packages.

    For the detailed security status of linux please refer to its security     tracker page at:
    https://security-tracker.debian.org/tracker/linux

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the linux package has been released.

ID	Name	Product	Family	Severity
319631	AlmaLinux 9 : kernel (ALSA-2026:21556)	Nessus	Alma Linux Local Security Checks	high
318641	RockyLinux 10 : kernel (RLSA-2026:21557)	Nessus	Rocky Linux Local Security Checks	high
318366	MiracleLinux 8 : kernel-4.18.0-553.126.1.el8_10 (AXSA:2026-751:40)	Nessus	Miracle Linux Local Security Checks	high
318320	Oracle Linux 8 : kernel (ELSA-2026-21706)	Nessus	Oracle Linux Local Security Checks	high
318288	Debian dla-4606 : ata-modules-5.10.0-43-armmp-di - security update	Nessus	Debian Local Security Checks	critical
318054	RockyLinux 8 : kernel (RLSA-2026:21706)	Nessus	Rocky Linux Local Security Checks	high
318052	RockyLinux 8 : kernel-rt (RLSA-2026:21745)	Nessus	Rocky Linux Local Security Checks	high
318033	RockyLinux 9 : kernel (RLSA-2026:21556)	Nessus	Rocky Linux Local Security Checks	high
317530	AlmaLinux 8 : kernel-rt (ALSA-2026:21745)	Nessus	Alma Linux Local Security Checks	high
317512	RHEL 8 : kernel (RHSA-2026:21706)	Nessus	Red Hat Local Security Checks	high
317504	RHEL 8 : kernel-rt (RHSA-2026:21745)	Nessus	Red Hat Local Security Checks	high
317462	RHEL 9 : kernel (RHSA-2026:21556)	Nessus	Red Hat Local Security Checks	high
317455	AlmaLinux 8 : kernel (ALSA-2026:21706)	Nessus	Alma Linux Local Security Checks	high
317380	RHEL 10 : kernel (RHSA-2026:21557)	Nessus	Red Hat Local Security Checks	high
314431	CentOS 9 : kernel-5.14.0-704.el9	Nessus	CentOS Local Security Checks	high
313610	Amazon Linux 2 : kernel, --advisory ALAS2KERNEL-5.10-2026-118 (ALASKERNEL-5.10-2026-118)	Nessus	Amazon Linux Local Security Checks	high
311783	Debian dla-4561 : linux-config-6.1 - security update	Nessus	Debian Local Security Checks	high
311568	Linux Distros Unpatched Vulnerability : CVE-2026-43051	Nessus	Misc.	high
311547	Debian dsa-6243 : affs-modules-6.1.0-44-4kc-malta-di - security update	Nessus	Debian Local Security Checks	high
310100	Photon OS 5.0: Linux PHSA-2026-5.0-0830	Nessus	PhotonOS Local Security Checks	high
310098	Photon OS 4.0: Linux PHSA-2026-4.0-1002	Nessus	PhotonOS Local Security Checks	high

Detections

Analytics

CVE-2026-43051

high

Tenable Plugins

high

high

high

high

critical

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high