In the Linux kernel, the following vulnerability has been resolved: ext4: always drain queued discard work in ext4_mb_release() While reviewing recent ext4 patch[1], Sashiko raised the following concern[2]: > If the filesystem is initially mounted with the discard option, > deleting files will populate sbi->s_discard_list and queue > s_discard_work. If it is then remounted with nodiscard, the > EXT4_MOUNT_DISCARD flag is cleared, but the pending s_discard_work is > neither cancelled nor flushed. [1] https://lore.kernel.org/r/20260319094545.19291-1-qiang.zhang@linux.dev/ [2] https://sashiko.dev/#/patchset/20260319094545.19291-1-qiang.zhang%40linux.dev The concern was valid, but it had nothing to do with the patch[1]. One of the problems with Sashiko in its current (early) form is that it will detect pre-existing issues and report it as a problem with the patch that it is reviewing. In practice, it would be hard to hit deliberately (unless you are a malicious syzkaller fuzzer), since it would involve mounting the file system with -o discard, and then deleting a large number of files, remounting the file system with -o nodiscard, and then immediately unmounting the file system before the queued discard work has a change to drain on its own. Fix it because it's a real bug, and to avoid Sashiko from raising this concern when analyzing future patches to mballoc.c.

The remote SUSE Linux SLES16 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:22099-1 advisory.

    The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues

    The following security issues were fixed:

    - CVE-2026-23254: net: gro: fix outer network offset (bsc#1259884).
    - CVE-2026-23303: smb: client: Don't log plaintext credentials in cifs_set_cifscreds (bsc#1260502).
    - CVE-2026-23327: cxl/mbox: validate payload size before accessing       contents in cxl_payload_from_user_allowed() (bsc#1260548).
    - CVE-2026-23438: net: mvpp2: guard flow control update with global_tx_fc in buffer switching     (bsc#1261619).
    - CVE-2026-31396: net: macb: fix use-after-free access to PTP clock (bsc#1261791).
    - CVE-2026-31401: HID: bpf: prevent buffer overflow in hid_hw_request (bsc#1261603).
    - CVE-2026-31446: ext4: fix use-after-free in update_super_work when racing with umount (bsc#1262619).
    - CVE-2026-31448: ext4: avoid infinite loops caused by residual data (bsc#1262622).
    - CVE-2026-31454: xfs: save ailp before dropping the AIL lock in push callbacks (bsc#1262624).
    - CVE-2026-31455: xfs: stop reclaim before pushing AIL during unmount (bsc#1262615).
    - CVE-2026-31518: esp: fix skb leak with espintcp and async crypto (bsc#1262606).
    - CVE-2026-31546: net: bonding: fix NULL deref in bond_debug_rlb_hash_show (bsc#1263006).
    - CVE-2026-31556: xfs: scrub: unlock dquot before early return in quota scrub (bsc#1263062).
    - CVE-2026-31562: drm/mediatek: dsi: Store driver data before invoking mipi_dsi_host_register     (bsc#1263058).
    - CVE-2026-31584: media: mediatek: vcodec: fix use-after-free in encoder release path (bsc#1263180).
    - CVE-2026-31645: net: lan966x: fix page pool leak in error paths (bsc#1263794).
    - CVE-2026-31648: mm: filemap: fix nr_pages calculation overflow in filemap_map_pages() (bsc#1263579).
    - CVE-2026-31655: pmdomain: imx8mp-blk-ctrl: Keep the NOC_HDCP clock enabled (bsc#1263724).
    - CVE-2026-31671: xfrm_user: fix info leak in build_report() (bsc#1263115).
    - CVE-2026-31683: batman-adv: avoid OGM aggregation when skb tailroom is insufficient (bsc#1263594).
    - CVE-2026-31703: writeback: Fix use after free in inode_switch_wbs_work_fn() (bsc#1263883).
    - CVE-2026-31774: io_uring/net: fix slab-out-of-bounds read in io_bundle_nbufs() (bsc#1264040).
    - CVE-2026-43026: netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (bsc#1263932).
    - CVE-2026-43030: bpf: Fix regsafe() for pointers to packet (bsc#1264000).
    - CVE-2026-43040: net: ipv6: ndisc: fix ndisc_ra_useropt to initialize       nduseropt_padX fields to zero to prevent an info-leak (bsc#1264091).
    - CVE-2026-43063: xfs: don't irele after failing to iget in xfs_attri_recover_work (bsc#1264196).
    - CVE-2026-43065: ext4: always drain queued discard work in ext4_mb_release() (bsc#1264243).
    - CVE-2026-43066: ext4: fix iloc.bh leak in ext4_fc_replay_inode() error paths (bsc#1264245).
    - CVE-2026-43068: ext4: avoid allocate block from corrupted group in ext4_mb_find_by_goal() (bsc#1264255).
    - CVE-2026-43109: x86: shadow stacks: proper error handling for mmap lock (bsc#1264484).
    - CVE-2026-43150: perf/arm-cmn: Reject unsupported hardware configurations (bsc#1264415).
    - CVE-2026-43184: rnbd-srv: Zero the rsp buffer before using it (bsc#1264622).
    - CVE-2026-43197: netconsole: avoid OOB reads, msg is not nul-terminated (bsc#1264609).
    - CVE-2026-43332: thermal: core: Fix thermal zone device registration error path (bsc#1265114).
    - CVE-2026-43393: btrfs: fix chunk map leak in btrfs_map_block() after btrfs_chunk_map_num_copies()     (bsc#1264723).
    - CVE-2026-43394: nfsd: Fix cred ref leak in nfsd_nl_listener_set_doit() (bsc#1265081).
    - CVE-2026-43411: tipc: fix divide-by-zero in tipc_sk_filter_connect() (bsc#1264672).
    - CVE-2026-43455: net: mctp: Ensure keys maintain only one ref to corresponding dev (bsc#1264765).
    - CVE-2026-45842: slip: reject VJ receive packets on instances with no rstate array (bsc#1266400).
    - CVE-2026-45846: bareudp: fix NULL pointer dereference in bareudp_fill_metadata_dst() (bsc#1266394).
    - CVE-2026-45852: RDMA/rxe: Fix double free in rxe_srq_from_init (bsc#1266711).
    - CVE-2026-45856: RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (bsc#1266720).
    - CVE-2026-45886: bpf: Fix bpf_xdp_store_bytes proto for read-only arg (bsc#1266810).
    - CVE-2026-45898: RDMA/iwcm: Fix workqueue list corruption by removing work_list (bsc#1266888).
    - CVE-2026-45910: RDMA/rxe: Fix race condition in QP timer handlers (bsc#1266889).
    - CVE-2026-45932: bpf: Fix tcx/netkit detach permissions when prog fd isn't given (bsc#1266827).
    - CVE-2026-45942: ext4: fix e4b bitmap inconsistency reports (bsc#1266914).
    - CVE-2026-45970: bonding: alb: fix UAF in rlb_arp_recv during bond up/down (bsc#1267205).
    - CVE-2026-45984: gfs2: Fix use-after-free in iomap inline data write path (bsc#1267214).
    - CVE-2026-46021: thermal: core: Fix thermal zone governor cleanup issues (bsc#1267220).
    - CVE-2026-46043: RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (bsc#1266901).
    - CVE-2026-46083: spi: fix resource leaks on device setup failure (bsc#1266696).
    - CVE-2026-46090: ALSA: aloop: Use guard() for spin locks (bsc#1267531).
    - CVE-2026-46094: ext4: fix bounds check in check_xattrs() to prevent out-of-bounds access (bsc#1266927).
    - CVE-2026-46114: RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (bsc#1266972).
    - CVE-2026-46159: btrfs: fix btrfs_ioctl_space_info() slot_count TOCTOU which can lead to info-leak     (bsc#1267652).
    - CVE-2026-46176: RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (bsc#1266816).
    - CVE-2026-46181: RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (bsc#1266826).

    The following non security issues were fixed:

    - accel/ivpu: Add bounds checks for firmware log indices (git-fixes).
    - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (git-fixes).
    - ALSA: PCM: Fix wait queue list corruption in snd_pcm_drain() on linked streams (git-fixes).
    - ALSA: seq: dummy: fix UMP event stack overread (git-fixes).
    - arm64: tlb: Allow XZR argument to TLBI ops (git-fixes).
    - arm64: tlb: Optimize ARM64_WORKAROUND_REPEAT_TLBI (git-fixes).
    - Bluetooth: bnep: reject short frames before parsing (git-fixes).
    - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (git-fixes).
    - Bluetooth: ISO: Fix not releasing hdev reference on iso_conn_big_sync (git-fixes).
    - Bluetooth: MGMT: Fix backward compatibility with userspace (git-fixes).
    - Bluetooth: MGMT: validate advertising TLV before type checks (git-fixes).
    - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (git-fixes).
    - Bluetooth: RFCOMM: validate skb length in MCC handlers (git-fixes).
    - config: remove DEBUG_FS_DISALLOW_MOUNT
    - debugfs: Remove broken no-mount mode (bsc#1265186).
    - debugfs: Fix default access mode config check (bsc#1265186).
    - debugfs: Remove broken no-mount mode (bsc#1265186).
    - debugfs: Remove redundant access mode checks (bsc#1265186).
    - drm/amd/display: Bound VBIOS record-chain walk loops (git-fixes).
    - drm/amd/display: Clamp HDMI HDCP2 rx_id_list read to buffer size (git-fixes).
    - drm/amd/display: Fix NULL deref and buffer over-read in SDP debugfs (git-fixes).
    - drm/amd/display: Reject gpio_bitshift >= 32 in bios_parser_get_gpio_pin_info() (git-fixes).
    - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (git-fixes).
    - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (git-fixes).
    - drm/amdkfd: fix NULL dereference in get_queue_ids() (git-fixes).
    - drm/imx: Fix three kernel-doc warnings in dcss-scaler.c (git-fixes).
    - drm/v3d: Fix vaddr leak when indirect CSD has zeroed workgroups (git-fixes).
    - drm/xe: Clear pending_disable before signaling suspend fence (git-fixes).
    - ima: return error early if file xattr cannot be changed (bsc#1261041).
    - Input: atkbd - skip deactivate for HONOR BCC-N's internal keyboard (git-fixes).
    - KVM: arm64: Reassign nested_mmus array behind mmu_lock (git-fixes).
    - KVM: arm64: Take the SRCU lock for page table walks in fault injection and AT emulation (git-fixes).
    - KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (git-fixes).
    - KVM: SEV: Check PSC request indices against the actual size of the buffer (git-fixes).
    - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (git-fixes).
    - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (git-fixes).
    - KVM: SEV: Ignore MMIO requests of length '0' (git-fixes).
    - KVM: SEV: Ignore Port I/O requests of length '0' (git-fixes).
    - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (git-fixes).
    - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (git-fixes).
    - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (git-fixes).
    - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (git-fixes).
    - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (git-fixes).
    - KVM: SVM: Convert plain error code numbers to defines (git-fixes).
    - KVM: SVM: Flush the current TLB when transitioning from xAVIC => x2AVIC (git-fixes).
    - KVM: SVM: Provide helpers to set the error code (git-fixes).
    - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (git-fixes).
    - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (git-fixes).
    - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (git-fixes).
    - KVM: x86: Move MMIO write tracing into vcpu_mmio_write() (git-fixes).
    - KVM: x86: Open code handling of completed MMIO reads in emulator_read_write() (git-fixes).
    - KVM: x86: Open code read vs. write userspace MMIO exits in emulator_read_write() (git-fixes).
    - KVM: x86: Trace unsatisfied MMIO reads on a per-page basis (git-fixes).
    - KVM: x86: Use local MMIO fragment variable to clean up emulator_read_write() (git-fixes).
    - mmc: core: Fix host controller programming for fixed driver type (git-fixes).
    - mmc: dw_mmc-rockchip: Add missing private data for very old controllers (git-fixes).
    - mmc: litex_mmc: Set mandatory idle clocks before CMD0 (git-fixes).
    - mmc: litex_mmc: Use DIV_ROUND_UP for more accurate clock calculation (git-fixes).
    - mmc: renesas_sdhi: Add OF entry for RZ/G2H SoC (git-fixes).
    - mmc: sdhci: add signal voltage switch in sdhci_resume_host (git-fixes).
    - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (git-fixes).
    - wifi: nl80211: reject oversized EMA RNR lists (git-fixes).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES16 / SLES_SAP16 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:22127-1 advisory.

    The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues

    The following security issues were fixed:

    - CVE-2026-23254: net: gro: fix outer network offset (bsc#1259884).
    - CVE-2026-23303: smb: client: Don't log plaintext credentials in cifs_set_cifscreds (bsc#1260502).
    - CVE-2026-23327: cxl/mbox: validate payload size before accessing       contents in cxl_payload_from_user_allowed() (bsc#1260548).
    - CVE-2026-23438: net: mvpp2: guard flow control update with global_tx_fc in buffer switching     (bsc#1261619).
    - CVE-2026-31396: net: macb: fix use-after-free access to PTP clock (bsc#1261791).
    - CVE-2026-31401: HID: bpf: prevent buffer overflow in hid_hw_request (bsc#1261603).
    - CVE-2026-31446: ext4: fix use-after-free in update_super_work when racing with umount (bsc#1262619).
    - CVE-2026-31448: ext4: avoid infinite loops caused by residual data (bsc#1262622).
    - CVE-2026-31454: xfs: save ailp before dropping the AIL lock in push callbacks (bsc#1262624).
    - CVE-2026-31455: xfs: stop reclaim before pushing AIL during unmount (bsc#1262615).
    - CVE-2026-31518: esp: fix skb leak with espintcp and async crypto (bsc#1262606).
    - CVE-2026-31546: net: bonding: fix NULL deref in bond_debug_rlb_hash_show (bsc#1263006).
    - CVE-2026-31556: xfs: scrub: unlock dquot before early return in quota scrub (bsc#1263062).
    - CVE-2026-31562: drm/mediatek: dsi: Store driver data before invoking mipi_dsi_host_register     (bsc#1263058).
    - CVE-2026-31584: media: mediatek: vcodec: fix use-after-free in encoder release path (bsc#1263180).
    - CVE-2026-31645: net: lan966x: fix page pool leak in error paths (bsc#1263794).
    - CVE-2026-31648: mm: filemap: fix nr_pages calculation overflow in filemap_map_pages() (bsc#1263579).
    - CVE-2026-31655: pmdomain: imx8mp-blk-ctrl: Keep the NOC_HDCP clock enabled (bsc#1263724).
    - CVE-2026-31671: xfrm_user: fix info leak in build_report() (bsc#1263115).
    - CVE-2026-31683: batman-adv: avoid OGM aggregation when skb tailroom is insufficient (bsc#1263594).
    - CVE-2026-31703: writeback: Fix use after free in inode_switch_wbs_work_fn() (bsc#1263883).
    - CVE-2026-31774: io_uring/net: fix slab-out-of-bounds read in io_bundle_nbufs() (bsc#1264040).
    - CVE-2026-43026: netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (bsc#1263932).
    - CVE-2026-43030: bpf: Fix regsafe() for pointers to packet (bsc#1264000).
    - CVE-2026-43040: net: ipv6: ndisc: fix ndisc_ra_useropt to initialize       nduseropt_padX fields to zero to prevent an info-leak (bsc#1264091).
    - CVE-2026-43063: xfs: don't irele after failing to iget in xfs_attri_recover_work (bsc#1264196).
    - CVE-2026-43065: ext4: always drain queued discard work in ext4_mb_release() (bsc#1264243).
    - CVE-2026-43066: ext4: fix iloc.bh leak in ext4_fc_replay_inode() error paths (bsc#1264245).
    - CVE-2026-43068: ext4: avoid allocate block from corrupted group in ext4_mb_find_by_goal() (bsc#1264255).
    - CVE-2026-43109: x86: shadow stacks: proper error handling for mmap lock (bsc#1264484).
    - CVE-2026-43150: perf/arm-cmn: Reject unsupported hardware configurations (bsc#1264415).
    - CVE-2026-43184: rnbd-srv: Zero the rsp buffer before using it (bsc#1264622).
    - CVE-2026-43197: netconsole: avoid OOB reads, msg is not nul-terminated (bsc#1264609).
    - CVE-2026-43332: thermal: core: Fix thermal zone device registration error path (bsc#1265114).
    - CVE-2026-43393: btrfs: fix chunk map leak in btrfs_map_block() after btrfs_chunk_map_num_copies()     (bsc#1264723).
    - CVE-2026-43394: nfsd: Fix cred ref leak in nfsd_nl_listener_set_doit() (bsc#1265081).
    - CVE-2026-43411: tipc: fix divide-by-zero in tipc_sk_filter_connect() (bsc#1264672).
    - CVE-2026-43455: net: mctp: Ensure keys maintain only one ref to corresponding dev (bsc#1264765).
    - CVE-2026-45842: slip: reject VJ receive packets on instances with no rstate array (bsc#1266400).
    - CVE-2026-45846: bareudp: fix NULL pointer dereference in bareudp_fill_metadata_dst() (bsc#1266394).
    - CVE-2026-45852: RDMA/rxe: Fix double free in rxe_srq_from_init (bsc#1266711).
    - CVE-2026-45856: RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (bsc#1266720).
    - CVE-2026-45886: bpf: Fix bpf_xdp_store_bytes proto for read-only arg (bsc#1266810).
    - CVE-2026-45898: RDMA/iwcm: Fix workqueue list corruption by removing work_list (bsc#1266888).
    - CVE-2026-45910: RDMA/rxe: Fix race condition in QP timer handlers (bsc#1266889).
    - CVE-2026-45932: bpf: Fix tcx/netkit detach permissions when prog fd isn't given (bsc#1266827).
    - CVE-2026-45942: ext4: fix e4b bitmap inconsistency reports (bsc#1266914).
    - CVE-2026-45970: bonding: alb: fix UAF in rlb_arp_recv during bond up/down (bsc#1267205).
    - CVE-2026-45984: gfs2: Fix use-after-free in iomap inline data write path (bsc#1267214).
    - CVE-2026-46021: thermal: core: Fix thermal zone governor cleanup issues (bsc#1267220).
    - CVE-2026-46043: RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (bsc#1266901).
    - CVE-2026-46083: spi: fix resource leaks on device setup failure (bsc#1266696).
    - CVE-2026-46090: ALSA: aloop: Use guard() for spin locks (bsc#1267531).
    - CVE-2026-46094: ext4: fix bounds check in check_xattrs() to prevent out-of-bounds access (bsc#1266927).
    - CVE-2026-46114: RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (bsc#1266972).
    - CVE-2026-46159: btrfs: fix btrfs_ioctl_space_info() slot_count TOCTOU which can lead to info-leak     (bsc#1267652).
    - CVE-2026-46176: RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (bsc#1266816).
    - CVE-2026-46181: RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (bsc#1266826).

    The following non security issues were fixed:

    - accel/ivpu: Add bounds checks for firmware log indices (git-fixes).
    - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (git-fixes).
    - ALSA: PCM: Fix wait queue list corruption in snd_pcm_drain() on linked streams (git-fixes).
    - ALSA: seq: dummy: fix UMP event stack overread (git-fixes).
    - arm64: tlb: Allow XZR argument to TLBI ops (git-fixes).
    - arm64: tlb: Optimize ARM64_WORKAROUND_REPEAT_TLBI (git-fixes).
    - Bluetooth: bnep: reject short frames before parsing (git-fixes).
    - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (git-fixes).
    - Bluetooth: ISO: Fix not releasing hdev reference on iso_conn_big_sync (git-fixes).
    - Bluetooth: MGMT: Fix backward compatibility with userspace (git-fixes).
    - Bluetooth: MGMT: validate advertising TLV before type checks (git-fixes).
    - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (git-fixes).
    - Bluetooth: RFCOMM: validate skb length in MCC handlers (git-fixes).
    - config: remove DEBUG_FS_DISALLOW_MOUNT
    - debugfs: Remove broken no-mount mode (bsc#1265186).
    - debugfs: Fix default access mode config check (bsc#1265186).
    - debugfs: Remove broken no-mount mode (bsc#1265186).
    - debugfs: Remove redundant access mode checks (bsc#1265186).
    - drm/amd/display: Bound VBIOS record-chain walk loops (git-fixes).
    - drm/amd/display: Clamp HDMI HDCP2 rx_id_list read to buffer size (git-fixes).
    - drm/amd/display: Fix NULL deref and buffer over-read in SDP debugfs (git-fixes).
    - drm/amd/display: Reject gpio_bitshift >= 32 in bios_parser_get_gpio_pin_info() (git-fixes).
    - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (git-fixes).
    - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (git-fixes).
    - drm/amdkfd: fix NULL dereference in get_queue_ids() (git-fixes).
    - drm/imx: Fix three kernel-doc warnings in dcss-scaler.c (git-fixes).
    - drm/v3d: Fix vaddr leak when indirect CSD has zeroed workgroups (git-fixes).
    - drm/xe: Clear pending_disable before signaling suspend fence (git-fixes).
    - ima: return error early if file xattr cannot be changed (bsc#1261041).
    - Input: atkbd - skip deactivate for HONOR BCC-N's internal keyboard (git-fixes).
    - KVM: arm64: Reassign nested_mmus array behind mmu_lock (git-fixes).
    - KVM: arm64: Take the SRCU lock for page table walks in fault injection and AT emulation (git-fixes).
    - KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (git-fixes).
    - KVM: SEV: Check PSC request indices against the actual size of the buffer (git-fixes).
    - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (git-fixes).
    - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (git-fixes).
    - KVM: SEV: Ignore MMIO requests of length '0' (git-fixes).
    - KVM: SEV: Ignore Port I/O requests of length '0' (git-fixes).
    - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (git-fixes).
    - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (git-fixes).
    - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (git-fixes).
    - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (git-fixes).
    - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (git-fixes).
    - KVM: SVM: Convert plain error code numbers to defines (git-fixes).
    - KVM: SVM: Flush the current TLB when transitioning from xAVIC => x2AVIC (git-fixes).
    - KVM: SVM: Provide helpers to set the error code (git-fixes).
    - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (git-fixes).
    - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (git-fixes).
    - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (git-fixes).
    - KVM: x86: Move MMIO write tracing into vcpu_mmio_write() (git-fixes).
    - KVM: x86: Open code handling of completed MMIO reads in emulator_read_write() (git-fixes).
    - KVM: x86: Open code read vs. write userspace MMIO exits in emulator_read_write() (git-fixes).
    - KVM: x86: Trace unsatisfied MMIO reads on a per-page basis (git-fixes).
    - KVM: x86: Use local MMIO fragment variable to clean up emulator_read_write() (git-fixes).
    - mmc: core: Fix host controller programming for fixed driver type (git-fixes).
    - mmc: dw_mmc-rockchip: Add missing private data for very old controllers (git-fixes).
    - mmc: litex_mmc: Set mandatory idle clocks before CMD0 (git-fixes).
    - mmc: litex_mmc: Use DIV_ROUND_UP for more accurate clock calculation (git-fixes).
    - mmc: renesas_sdhi: Add OF entry for RZ/G2H SoC (git-fixes).
    - mmc: sdhci: add signal voltage switch in sdhci_resume_host (git-fixes).
    - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (git-fixes).
    - wifi: nl80211: reject oversized EMA RNR lists (git-fixes).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of kernel installed on the remote host is prior to 5.15.204-143.230. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.15-2026-102 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    fbcon: Set fb_display[i]->mode to NULL when the mode is released (CVE-2025-40323)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: nft_ct: add seqadj extension for natted connections (CVE-2025-68206)

    In the Linux kernel, the following vulnerability has been resolved:

    io_uring/io-wq: check IO_WQ_BIT_EXIT inside work run loop (CVE-2026-23113)

    In the Linux kernel, the following vulnerability has been resolved:

    net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (CVE-2026-23270)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: xt_IDLETIMER: reject rev0 reuse of ALARM timer labels (CVE-2026-23274)

    In the Linux kernel, the following vulnerability has been resolved:

    net/sched: teql: fix NULL pointer dereference in iptunnel_xmit on TEQL slave xmit (CVE-2026-23277)

    In the Linux kernel, the following vulnerability has been resolved:

    net: vxlan: fix nd_tbl NULL dereference when IPv6 is disabled (CVE-2026-23293)

    In the Linux kernel, the following vulnerability has been resolved:

    scsi: core: Fix refcount leak for tagset_refcnt (CVE-2026-23296)

    In the Linux kernel, the following vulnerability has been resolved:

    net: ipv6: fix panic when IPv4 route references loopback IPv6 nexthop (CVE-2026-23300)

    In the Linux kernel, the following vulnerability has been resolved:

    smb: client: Don't log plaintext credentials in cifs_set_cifscreds (CVE-2026-23303)

    In the Linux kernel, the following vulnerability has been resolved:

    ipv6: fix NULL pointer deref in ip6_rt_get_dev_rcu() (CVE-2026-23304)

    In the Linux kernel, the following vulnerability has been resolved:

    net: sched: avoid qdisc_reset_all_tx_gt() vs dequeue race for lockless qdiscs (CVE-2026-23340)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (CVE-2026-23351)

    In the Linux kernel, the following vulnerability has been resolved:

    x86/efi: defer freeing of boot services memory (CVE-2026-23352)

    In the Linux kernel, the following vulnerability has been resolved:

    drbd: fix LOGIC BUG in drbd_al_begin_io_nonblock() (CVE-2026-23356)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf: Fix stack-out-of-bounds write in devmap (CVE-2026-23359)

    In the Linux kernel, the following vulnerability has been resolved:

    can: bcm: fix locking for bcm_op runtime updates (CVE-2026-23362)

    In the Linux kernel, the following vulnerability has been resolved:

    net: phy: register phy led_triggers during probe to avoid AB-BA deadlock (CVE-2026-23368)

    In the Linux kernel, the following vulnerability has been resolved:

    net: bridge: fix nd_tbl NULL dereference when IPv6 is disabled (CVE-2026-23381)

    In the Linux kernel, the following vulnerability has been resolved:

    Squashfs: check metadata block offset is within range (CVE-2026-23388)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: xt_CT: drop pending enqueued packets on template removal (CVE-2026-23391)

    In the Linux kernel, the following vulnerability has been resolved:

    nfnetlink_osf: validate individual option lengths in fingerprints (CVE-2026-23397)

    In the Linux kernel, the following vulnerability has been resolved:

    icmp: fix NULL pointer dereference in icmp_tag_validation() (CVE-2026-23398)

    In the Linux kernel, the following vulnerability has been resolved:

    KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (CVE-2026-23401)

    In the Linux kernel, the following vulnerability has been resolved:

    udp_tunnel: fix NULL deref caused by udp_sock_create6 when CONFIG_IPV6=n (CVE-2026-23439)

    In the Linux kernel, the following vulnerability has been resolved:

    ACPI: processor: Fix previous acpi_processor_errata_piix4() fix (CVE-2026-23443)

    In the Linux kernel, the following vulnerability has been resolved:

    PM: runtime: Fix a race condition related to device removal (CVE-2026-23452)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CVE-2026-23455)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (CVE-2026-23456)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (CVE-2026-23457)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (CVE-2026-23458)

    In the Linux kernel, the following vulnerability has been resolved:

    sunrpc: fix cache_request leak in cache_release (CVE-2026-31400)

    In the Linux kernel, the following vulnerability has been resolved:

    ipv6: avoid overflows in ip6_datagram_send_ctl() (CVE-2026-31415)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: nfnetlink_log: account for netlink header size (CVE-2026-31416)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: ipset: drop logically empty buckets in mtype_del (CVE-2026-31418)

    In the Linux kernel, the following vulnerability has been resolved:

    net/sched: cls_fw: fix NULL pointer dereference on shared blocks (CVE-2026-31421)

    In the Linux kernel, the following vulnerability has been resolved:

    net/sched: cls_flow: fix NULL pointer dereference on shared blocks (CVE-2026-31422)

    In the Linux kernel, the following vulnerability has been resolved:

    net/sched: sch_hfsc: fix divide-by-zero in rtsc_min() (CVE-2026-31423)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP (CVE-2026-31424)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: nf_conntrack_sip: fix use of uninitialized rtp_addr in process_sdp (CVE-2026-31427)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD (CVE-2026-31428)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: fix use-after-free in update_super_work when racing with umount (CVE-2026-31446)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: reject mount if bigalloc with s_first_data_block != 0 (CVE-2026-31447)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: publish jinode after initialization (CVE-2026-31450)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: convert inline data to extents when truncate exceeds inline size (CVE-2026-31452)

    In the Linux kernel, the following vulnerability has been resolved:

    xfs: save ailp before dropping the AIL lock in push callbacks (CVE-2026-31454)

    In the Linux kernel, the following vulnerability has been resolved:

    xfs: stop reclaim before pushing AIL during unmount (CVE-2026-31455)

    In the Linux kernel, the following vulnerability has been resolved:

    mm/huge_memory: fix folio isn't locked in softleaf_to_folio() (CVE-2026-31466)

    In the Linux kernel, the following vulnerability has been resolved:

    virtio_net: Fix UAF on dst_ops when IFF_XMIT_DST_RELEASE is cleared and napi_tx is false (CVE-2026-31469)

    In the Linux kernel, the following vulnerability has been resolved:

    tracing: Fix potential deadlock in cpu hotplug with osnoise (CVE-2026-31480)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: ctnetlink: use netlink policy range checks (CVE-2026-31495)

    In the Linux kernel, the following vulnerability has been resolved:

    net: fix fanout UAF in packet_release() via NETDEV_UP race (CVE-2026-31504)

    In the Linux kernel, the following vulnerability has been resolved:

    net: openvswitch: Avoid releasing netdev before teardown completes (CVE-2026-31508)

    In the Linux kernel, the following vulnerability has been resolved:

    af_key: validate families in pfkey_send_migrate() (CVE-2026-31515)

    In the Linux kernel, the following vulnerability has been resolved:

    esp: fix skb leak with espintcp and async crypto (CVE-2026-31518)

    In the Linux kernel, the following vulnerability has been resolved:

    module: Fix kernel panic when a symbol st_shndx is out of bounds (CVE-2026-31521)

    In the Linux kernel, the following vulnerability has been resolved:

    nvme-pci: ensure we're polling a polled queue (CVE-2026-31523)

    In the Linux kernel, the following vulnerability has been resolved:

    HID: asus: avoid memory leak in asus_report_fixup() (CVE-2026-31524)

    In the Linux kernel, the following vulnerability has been resolved:

    net/tls: fix use-after-free in -EBUSY error path of tls_do_encryption (CVE-2026-31533)

    In the Linux kernel, the following vulnerability has been resolved:

    drm/i915/gt: Check set_default_submission() before deferencing (CVE-2026-31540)

    In the Linux kernel, the following vulnerability has been resolved:

    net: bonding: fix NULL deref in bond_debug_rlb_hash_show (CVE-2026-31546)

    In the Linux kernel, the following vulnerability has been resolved:

    futex: Clear stale exiting pointer in futex_lock_pi() retry path (CVE-2026-31555)

    In the Linux kernel, the following vulnerability has been resolved:

    can: gw: fix OOB heap access in cgw_csum_crc8_rel() (CVE-2026-31570)

    In the Linux kernel, the following vulnerability has been resolved:

    x86/CPU: Fix FPDSS on Zen1 (CVE-2026-31628)

    In the Linux kernel, the following vulnerability has been resolved:

    rxrpc: fix reference count leak in rxrpc_server_keyring() (CVE-2026-31634)

    In the Linux kernel, the following vulnerability has been resolved:

    drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CVE-2026-31656)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: nft_ct: fix use-after-free in timeout object destroy (CVE-2026-31665)

    In the Linux kernel, the following vulnerability has been resolved:

    Input: uinput - fix circular locking dependency with ff-core (CVE-2026-31667)

    In the Linux kernel, the following vulnerability has been resolved:

    seg6: separate dst_cache for input and output paths in seg6 lwtunnel (CVE-2026-31668)

    In the Linux kernel, the following vulnerability has been resolved:

    mptcp: fix slab-use-after-free in __inet_lookup_established (CVE-2026-31669)

    In the Linux kernel, the following vulnerability has been resolved:

    xfrm_user: fix info leak in build_report() (CVE-2026-31671)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (CVE-2026-31674)

    In the Linux kernel, the following vulnerability has been resolved:

    openvswitch: validate MPLS set/set_masked payload length (CVE-2026-31679)

    In the Linux kernel, the following vulnerability has been resolved:

    net: ipv6: flowlabel: defer exclusive option free until RCU teardown (CVE-2026-31680)

    In the Linux kernel, the following vulnerability has been resolved:

    bridge: br_nd_send: linearize skb before parsing ND options (CVE-2026-31682)

    In the Linux kernel, the following vulnerability has been resolved:

    vxlan: validate ND option lengths in vxlan_na_create (CVE-2026-31738)

    In the Linux kernel, the following vulnerability has been resolved:

    bridge: br_nd_send: validate ND option lengths (CVE-2026-31752)

    In the Linux kernel, the following vulnerability has been resolved:

    drm/ioc32: stop speculation on the drm_compat_ioctl path (CVE-2026-31781)

    In the Linux kernel, the following vulnerability has been resolved:

    Buffer overflow in drivers/xen/sys-hypervisor.c (CVE-2026-31786)

    In the Linux kernel, the following vulnerability has been resolved:

    xen/privcmd: fix double free via VMA splitting (CVE-2026-31787)

    In the Linux kernel, the following vulnerability has been resolved:

    xen/privcmd: restrict usage in unprivileged domU (CVE-2026-31788)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: nf_tables: reject immediate NF_QUEUE verdict (CVE-2026-43024)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (CVE-2026-43026)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: nf_conntrack_helper: pass helper to expect cleanup (CVE-2026-43027)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: x_tables: ensure names are nul-terminated (CVE-2026-43028)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf: Fix regsafe() for pointers to packet (CVE-2026-43030)

    In the Linux kernel, the following vulnerability has been resolved:

    net: sched: cls_api: fix tc_chain_fill_node to initialize tcm_info to zero to prevent an info-leak     (CVE-2026-43035)

    In the Linux kernel, the following vulnerability has been resolved:

    ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (CVE-2026-43037)

    In the Linux kernel, the following vulnerability has been resolved:

    ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (CVE-2026-43038)

    In the Linux kernel, the following vulnerability has been resolved:

    net: ipv6: ndisc: fix ndisc_ra_useropt to initialize nduseropt_padX fields to zero to prevent an info-leak     (CVE-2026-43040)

    In the Linux kernel, the following vulnerability has been resolved:

    crypto: af-alg - fix NULL pointer dereference in scatterwalk (CVE-2026-43043)

    In the Linux kernel, the following vulnerability has been resolved:

    btrfs: reject root items with drop_progress and zero drop_level (CVE-2026-43046)

    In the Linux kernel, the following vulnerability has been resolved:

    HID: multitouch: Check to ensure report responses match the request (CVE-2026-43047)

    In the Linux kernel, the following vulnerability has been resolved:

    scsi: target: tcm_loop: Drain commands in target_reset handler (CVE-2026-43054)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: nft_ct: drop pending enqueued packets on removal (CVE-2026-43060)

    In the Linux kernel, the following vulnerability has been resolved:

    serial: 8250: Fix TX deadlock when using DMA (CVE-2026-43061)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: always drain queued discard work in ext4_mb_release() (CVE-2026-43065)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: fix iloc.bh leak in ext4_fc_replay_inode() error paths (CVE-2026-43066)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: avoid allocate block from corrupted group in ext4_mb_find_by_goal() (CVE-2026-43068)

    In the Linux kernel, the following vulnerability has been resolved:

    fbcon: check return value of con2fb_acquire_newinfo() (CVE-2026-43123)

    In the Linux kernel, the following vulnerability has been resolved:xfrm: esp: avoid in-place decrypt on     shared skb frags

    Dirty Frag and other issues in Amazon Linux kernels:https://aws.amazon.com/security/security-     bulletins/2026-027-aws/ (CVE-2026-43284)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: flowtable: strictly check for maximum number of actions (CVE-2026-43329)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf: reject direct access to nullable PTR_TO_BUF pointers (CVE-2026-43333)

    In the Linux kernel, the following vulnerability has been resolved:

    lib/crypto: chacha: Zeroize permuted_state before it leaves scope (CVE-2026-43336)

    In the Linux kernel, the following vulnerability has been resolved:

    ipv6: prevent possible UaF in addrconf_permanent_addr() (CVE-2026-43339)

    In the Linux kernel, the following vulnerability has been resolved:

    x86/apic: Disable x2apic on resume if the kernel expects so (CVE-2026-43363)

    In the Linux kernel, the following vulnerability has been resolved:

    xfs: fix undersized l_iclog_roundoff values (CVE-2026-43365)

    In the Linux kernel, the following vulnerability has been resolved:

    libceph: Use u32 for non-negative values in ceph_monmap_decode() (CVE-2026-43405)

    In the Linux kernel, the following vulnerability has been resolved:

    libceph: prevent potential out-of-bounds reads in process_message_header() (CVE-2026-43406)

    In the Linux kernel, the following vulnerability has been resolved:

    libceph: Fix potential out-of-bounds access in ceph_handle_auth_reply() (CVE-2026-43407)

    In the Linux kernel, the following vulnerability has been resolved:

    ceph: fix i_nlink underrun during async unlink (CVE-2026-43420)

    In the Linux kernel, the following vulnerability has been resolved:

    usb: class: cdc-wdm: fix reordering issue in read code path (CVE-2026-43427)

    In the Linux kernel, the following vulnerability has been resolved:

    USB: core: Limit the length of unkillable synchronous timeouts (CVE-2026-43428)

    In the Linux kernel, the following vulnerability has been resolved:

    usb: xhci: Fix memory leak in xhci_disable_slot() (CVE-2026-43432)

    In the Linux kernel, the following vulnerability has been resolved:

    cgroup: fix race between task migration and iteration (CVE-2026-43439)

    In the Linux kernel, the following vulnerability has been resolved:

    e1000/e1000e: Fix leak in DMA error cleanup (CVE-2026-43445)

    In the Linux kernel, the following vulnerability has been resolved:

    nvme-pci: Fix slab-out-of-bounds in nvme_dbbuf_set (CVE-2026-43449)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CVE-2026-43450)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (CVE-2026-43451)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: x_tables: guard option walkers against 1-byte tail reads (CVE-2026-43452)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop() (CVE-2026-43453)

    In the Linux kernel, the following vulnerability has been resolved:

    net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (CVE-2026-43466)

    In the Linux kernel, the following vulnerability has been resolved:

    unshare: fix unshare_fs() handling (CVE-2026-43472)

    In the Linux kernel, the following vulnerability has been resolved:

    scsi: storvsc: Fix scheduling while atomic on PREEMPT_RT (CVE-2026-43475)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - ext4: always drain queued discard work in ext4_mb_release() While reviewing recent ext4 patch[1], Sashiko     raised the following concern[2]: > If the filesystem is initially mounted with the discard option, >     deleting files will populate sbi->s_discard_list and queue > s_discard_work. If it is then remounted with     nodiscard, the > EXT4_MOUNT_DISCARD flag is cleared, but the pending s_discard_work is > neither cancelled     nor flushed. [1] https://lore.kernel.org/r/20260319094545.19291-1-qiang.zhang@linux.dev/ [2]     https://sashiko.dev/#/patchset/20260319094545.19291-1-qiang.zhang%40linux.dev The concern was valid, but     it had nothing to do with the patch[1]. One of the problems with Sashiko in its current (early) form is     that it will detect pre-existing issues and report it as a problem with the patch that it is reviewing. In     practice, it would be hard to hit deliberately (unless you are a malicious syzkaller fuzzer), since it     would involve mounting the file system with -o discard, and then deleting a large number of files,     remounting the file system with -o nodiscard, and then immediately unmounting the file system before the     queued discard work has a change to drain on its own. Fix it because it's a real bug, and to avoid Sashiko     from raising this concern when analyzing future patches to mballoc.c. (CVE-2026-43065)

Note that Nessus relies on the presence of the package as reported by the vendor.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1646 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    landlock: Fix handling of disconnected directories (CVE-2025-68736)

    In the Linux kernel, the following vulnerability has been resolved:

    arm64/fpsimd: signal: Fix restoration of SVE context (CVE-2026-23102)

    In the Linux kernel, the following vulnerability has been resolved:

    spi: tegra210-quad: Protect curr_xfer check in IRQ handler (CVE-2026-23207)

    In the Linux kernel, the following vulnerability has been resolved:

    net: add proper RCU protection to /proc/net/ptype (CVE-2026-23255)

    In the Linux kernel, the following vulnerability has been resolved:

    KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (CVE-2026-23401)

    In the Linux kernel, the following vulnerability has been resolved:

    tls: Purge async_hold in tls_decrypt_async_wait() (CVE-2026-23414)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf: Fix constant blinding for PROBE_MEM32 stores (CVE-2026-23417)

    In the Linux kernel, the following vulnerability has been resolved:

    xfrm: Fix work re-schedule after cancel in xfrm_nat_keepalive_net_fini() (CVE-2026-31406)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf: Fix unsound scalar forking in maybe_fork_scalars() for BPF_OR (CVE-2026-31413)

    In the Linux kernel, the following vulnerability has been resolved:

    ACPI: EC: clean up handlers on probe failure in acpi_ec_setup() (CVE-2026-31426)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: nf_conntrack_sip: fix use of uninitialized rtp_addr in process_sdp (CVE-2026-31427)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD (CVE-2026-31428)

    In the Linux kernel, the following vulnerability has been resolved:

    btrfs: fix leak of kobject name for sub-group space_info (CVE-2026-31434)

    In the Linux kernel, the following vulnerability has been resolved:

    netfs: Fix kernel BUG in netfs_limit_iter() for ITER_KVEC iterators (CVE-2026-31438)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: fix use-after-free in update_super_work when racing with umount (CVE-2026-31446)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: reject mount if bigalloc with s_first_data_block != 0 (CVE-2026-31447)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: avoid infinite loops caused by residual data (CVE-2026-31448)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: validate p_idx bounds in ext4_ext_correct_indexes (CVE-2026-31449)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: replace BUG_ON with proper error handling in ext4_read_inline_folio (CVE-2026-31451)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: convert inline data to extents when truncate exceeds inline size (CVE-2026-31452)

    In the Linux kernel, the following vulnerability has been resolved:

    xfs: avoid dereferencing log items after push callbacks (CVE-2026-31453)

    In the Linux kernel, the following vulnerability has been resolved:

    xfs: save ailp before dropping the AIL lock in push callbacks (CVE-2026-31454)

    In the Linux kernel, the following vulnerability has been resolved:

    xfs: stop reclaim before pushing AIL during unmount (CVE-2026-31455)

    In the Linux kernel, the following vulnerability has been resolved:

    mm/damon/sysfs: check contexts->nr before accessing contexts_arr[0] (CVE-2026-31458)

    In the Linux kernel, the following vulnerability has been resolved:

    erofs: add GFP_NOIO in the bio completion if needed (CVE-2026-31467)

    In the Linux kernel, the following vulnerability has been resolved:

    virtio_net: Fix UAF on dst_ops when IFF_XMIT_DST_RELEASE is cleared and napi_tx is false (CVE-2026-31469)

    In the Linux kernel, the following vulnerability has been resolved:

    virt: tdx-guest: Fix handling of host controlled 'quote' buffer length (CVE-2026-31470)

    In the Linux kernel, the following vulnerability has been resolved:

    media: mc, v4l2: serialize REINIT and REQBUFS with req_queue_mutex (CVE-2026-31473)

    In the Linux kernel, the following vulnerability has been resolved:

    tracing: Fix potential deadlock in cpu hotplug with osnoise (CVE-2026-31480)

    In the Linux kernel, the following vulnerability has been resolved:

    spi: use generic driver_override infrastructure (CVE-2026-31487)

    In the Linux kernel, the following vulnerability has been resolved:

    RDMA/irdma: Initialize free_qp completion before using it (CVE-2026-31492)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: ctnetlink: use netlink policy range checks (CVE-2026-31495)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: nf_conntrack_expect: skip expectations in other netns via proc (CVE-2026-31496)

    In the Linux kernel, the following vulnerability has been resolved:

    team: fix header_ops type confusion with non-Ethernet ports (CVE-2026-31502)

    In the Linux kernel, the following vulnerability has been resolved:

    udp: Fix wildcard bind conflict check when using hash2 (CVE-2026-31503)

    In the Linux kernel, the following vulnerability has been resolved:

    net: fix fanout UAF in packet_release() via NETDEV_UP race (CVE-2026-31504)

    In the Linux kernel, the following vulnerability has been resolved:

    net: openvswitch: Avoid releasing netdev before teardown completes (CVE-2026-31508)

    In the Linux kernel, the following vulnerability has been resolved:

    erofs: set fileio bio failed in short read case (CVE-2026-31514)

    In the Linux kernel, the following vulnerability has been resolved:

    af_key: validate families in pfkey_send_migrate() (CVE-2026-31515)

    In the Linux kernel, the following vulnerability has been resolved:

    xfrm: prevent policy_hthresh.work from racing with netns teardown (CVE-2026-31516)

    In the Linux kernel, the following vulnerability has been resolved:

    esp: fix skb leak with espintcp and async crypto (CVE-2026-31518)

    In the Linux kernel, the following vulnerability has been resolved:

    btrfs: set BTRFS_ROOT_ORPHAN_CLEANUP during subvol create (CVE-2026-31519)

    In the Linux kernel, the following vulnerability has been resolved:

    module: Fix kernel panic when a symbol st_shndx is out of bounds (CVE-2026-31521)

    In the Linux kernel, the following vulnerability has been resolved:

    nvme-pci: ensure we're polling a polled queue (CVE-2026-31523)

    In the Linux kernel, the following vulnerability has been resolved:

    HID: asus: avoid memory leak in asus_report_fixup() (CVE-2026-31524)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf: Fix undefined behavior in interpreter sdiv/smod for INT_MIN (CVE-2026-31525)

    In the Linux kernel, the following vulnerability has been resolved:

    driver core: platform: use generic driver_override infrastructure (CVE-2026-31527)

    In the Linux kernel, the following vulnerability has been resolved:

    perf: Make sure to use pmu_ctx->pmu for groups (CVE-2026-31528)

    In the Linux kernel, the following vulnerability has been resolved:

    futex: Require sys_futex_requeue() to have identical flags (CVE-2026-31554)

    In the Linux kernel, the following vulnerability has been resolved:

    futex: Clear stale exiting pointer in futex_lock_pi() retry path (CVE-2026-31555)

    In the Linux kernel, the following vulnerability has been resolved:

    x86/cpu: Remove X86_CR4_FRED from the CR4 pinned bits mask (CVE-2026-31561)

    In the Linux kernel, the following vulnerability has been resolved:

    can: gw: fix OOB heap access in cgw_csum_crc8_rel() (CVE-2026-31570)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (CVE-2026-31674)

    In the Linux kernel, the following vulnerability has been resolved:

    openvswitch: defer tunnel netdev_put to RCU release (CVE-2026-31678)

    In the Linux kernel, the following vulnerability has been resolved:

    openvswitch: validate MPLS set/set_masked payload length (CVE-2026-31679)

    In the Linux kernel, the following vulnerability has been resolved:

    xfs: don't irele after failing to iget in xfs_attri_recover_work (CVE-2026-43063)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: always drain queued discard work in ext4_mb_release() (CVE-2026-43065)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: fix iloc.bh leak in ext4_fc_replay_inode() error paths (CVE-2026-43066)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: handle wraparound when searching for blocks for indirect mapped blocks (CVE-2026-43067)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: avoid allocate block from corrupted group in ext4_mb_find_by_goal() (CVE-2026-43068)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the linux package has been released.

ID	Name	Product	Family	Severity
321697	SUSE SLES16 Security Update : kernel (SUSE-SU-2026:22099-1)	Nessus	SuSE Local Security Checks	high
321588	SUSE SLES16 Security Update : kernel (SUSE-SU-2026:22127-1)	Nessus	SuSE Local Security Checks	high
316948	Amazon Linux 2023 : bpftool6.18, kernel6.18, kernel6.18-devel (ALAS2023-2026-1746)	Nessus	Amazon Linux Local Security Checks	high
313609	Amazon Linux 2 : kernel, --advisory ALAS2KERNEL-5.15-2026-102 (ALASKERNEL-5.15-2026-102)	Nessus	Amazon Linux Local Security Checks	high
313522	Amazon Linux 2023 : bpftool, kernel, kernel-devel (ALAS2023-2026-1681)	Nessus	Amazon Linux Local Security Checks	high
312596	Linux Distros Unpatched Vulnerability : CVE-2026-43065	Nessus	Misc.	medium
312152	Amazon Linux 2023 : bpftool6.12, kernel6.12, kernel6.12-devel (ALAS2023-2026-1646)	Nessus	Amazon Linux Local Security Checks	high
310100	Photon OS 5.0: Linux PHSA-2026-5.0-0830	Nessus	PhotonOS Local Security Checks	high

Detections

Analytics

CVE-2026-43065

medium

Tenable Plugins

high

high

high

high

high

medium

high

high