In the Linux kernel, the following vulnerability has been resolved: netfilter: nfnetlink_queue: make hash table per queue Sharing a global hash table among all queues is tempting, but it can cause crash: BUG: KASAN: slab-use-after-free in nfqnl_recv_verdict+0x11ac/0x15e0 [nfnetlink_queue] [..] nfqnl_recv_verdict+0x11ac/0x15e0 [nfnetlink_queue] nfnetlink_rcv_msg+0x46a/0x930 kmem_cache_alloc_node_noprof+0x11e/0x450 struct nf_queue_entry is freed via kfree, but parallel cpu can still encounter such an nf_queue_entry when walking the list. Alternative fix is to free the nf_queue_entry via kfree_rcu() instead, but as we have to alloc/free for each skb this will cause more mem pressure.

The remote Oracle Linux 10 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-50293 advisory.

    - net: skbuff: propagate shared-frag marker through frag-transfer helpers (Hyunwoo Kim)  [Orabug:
    39442660]  {CVE-2026-46300}
    - ptrace: slightly saner 'get_dumpable()' logic (Linus Torvalds)  [Orabug: 39407652]  {CVE-2026-46333}
    - x86/CPU/AMD: Add a fix for AMD-SB-7052 (Prathyushi Nangia)  [Orabug: 39218893]  {CVE-2025-54518}
    - rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Hyunwoo Kim)  [Orabug: 39334587]     {CVE-2026-43500}
    - xfrm: esp: avoid in-place decrypt on shared skb frags (Kuan-Ting Chen)  [Orabug: 39334587]     {CVE-2026-43284}
    - nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Jeff Layton)  [Orabug: 39167615]  {CVE-2026-31402}
    - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal)  [Orabug: 39110670]     {CVE-2026-23278}
    - net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (Victor Nogueira)     [Orabug: 39103229]  {CVE-2026-23270}
    - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [Orabug: 39339273]     {CVE-2026-43084}
    - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [Orabug:
    39250685,39331108] {CVE-2026-43078}
    - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [Orabug:
    39250685,39300909] {CVE-2026-43033}
    - crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [Orabug:
    39250685,39283866,39291972,39292190] {CVE-2026-31431}
    - x86/CPU: Fix FPDSS on Zen1 (Borislav Petkov) [Orabug: 39241227,39273721] {CVE-2026-31628}
    - ipv6: use RCU in ip6_xmit() (Eric Dumazet) [Orabug: 38649060,39186444,39202432] {CVE-2025-40135}
    - dst: fix races in rt6_uncached_list_del() and rt_del_uncached_list() (Eric Dumazet) [Orabug:
    38887740,39181101,39202431] {CVE-2026-23004}
    - net: bridge: fix nd_tbl NULL dereference when IPv6 is disabled (Fernando Fernandez Mancera) [Orabug:
    39029337,39131054] {CVE-2026-23381}
    - io_uring/kbuf: check if target buffer list is still legacy on recycle (Jens Axboe) [Orabug:
    39144150,39343763] {CVE-2026-43366}
    - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Breno Leitao) [Orabug: 38970584,39166116]     {CVE-2026-23207}
    - tracing: Add NULL pointer check to trigger_data_free() (Guenter Roeck) [Orabug: 39227772]     {CVE-2026-23309}
    - bpf: Fix unsound scalar forking in maybe_fork_scalars() for BPF_OR (Daniel Wade) [Orabug: 39198231]     {CVE-2026-31413}
    - Bluetooth: L2CAP: Fix stack-out-of-bounds read in l2cap_ecred_conn_req (Minseo Park) [Orabug: 39251164]     {CVE-2026-31513}
    - erofs: set fileio bio failed in short read case (Sheng Yong) [Orabug: 39251169] {CVE-2026-31514}
    - ACPI: processor: Fix previous acpi_processor_errata_piix4() fix (Rafael J. Wysocki) [Orabug: 39198208]     {CVE-2026-23443}
    - wifi: wlcore: Return -ENOMEM instead of -EAGAIN if there is not enough headroom (Guenter Roeck) [Orabug:
    39262447] {CVE-2026-31552}
    - tracing: ring-buffer: Fix to check event length before using (Masami Hiramatsu) [Orabug: 39331678]     {CVE-2026-43210}
    - net/sched: act_skbedit: fix divide-by-zero in tcf_skbedit_hash() (Liu Ruitong) [Orabug: 39331784]     {CVE-2026-43238}
    - cifs: some missing initializations on replay (Shyam Prasad N) [Orabug: 39300554] {CVE-2026-31693}
    - fbdev: of: display_timing: fix refcount leak in of_get_display_timings() (Weigang He) [Orabug: 39331889]     {CVE-2026-43264}
    - fbcon: check return value of con2fb_acquire_newinfo() (Andrey Vatoropin) [Orabug: 39331303]     {CVE-2026-43123}
    - ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (Junxi Qian) [Orabug: 39331577]     {CVE-2026-43186}
    - procfs: fix possible double mmput() in do_procmap_query() (Andrii Nakryiko) [Orabug: 39339241]     {CVE-2026-43178}
    - drm/amdgpu: fix sync handling in amdgpu_dma_buf_move_notify (Pierre-Eric Pelloux-Prayer) [Orabug:
    39343623] {CVE-2026-43318}
    - ceph: supply snapshot context in ceph_zero_partial_object() (Ethanwu) [Orabug: 39331924]     {CVE-2026-43273}
    - cifs: Fix locking usage for tcon fields (Shyam Prasad N) [Orabug: 39331696] {CVE-2026-43215}
    - PCI: Fix pci_slot_trylock() error handling (Jinhui Guo) [Orabug: 39331680] {CVE-2026-43211}
    - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (Sunday Clement) [Orabug: 39331661]     {CVE-2026-43206}
    - usb: dwc3: gadget: Move vbus draw to workqueue context (Prashanth K) [Orabug: 39331512] {CVE-2026-43170}
    - scsi: ufs: core: Flush exception handling work when RPM level is zero (Thomas Yen) [Orabug: 39331937]     {CVE-2026-43275}
    - perf/arm-cmn: Reject unsupported hardware configurations (Robin Murphy) [Orabug: 39331435]     {CVE-2026-43150}
    - Revert 'PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV' (Niklas Schnelle)     [Orabug: 39331422] {CVE-2026-43147}
    - kexec: derive purgatory entry from symbol (Li Chen) [Orabug: 39343538] {CVE-2026-43289}
    - ocfs2: fix reflink preserve cleanup issue (Heming Zhao) [Orabug: 39331504] {CVE-2026-43168}
    - vhost: move vdpa group bound check to vhost_vdpa (Eugenio Perez) [Orabug: 39331827] {CVE-2026-43248}
    - mm/vmalloc: prevent RCU stalls in kasan_release_vmalloc_node (Deepanshu Kartikey) [Orabug: 39343546]     {CVE-2026-43292}
    - md/bitmap: fix GPF in write_page caused by resize race (Jack Wang) [Orabug: 39331482] {CVE-2026-43163}
    - xfs: check for deleted cursors when revalidating two btrees (Darrick J. Wong) [Orabug: 39103129]     {CVE-2026-23249}
    - xfs: check return value of xchk_scrub_create_subord (Darrick J. Wong) [Orabug: 39103131]     {CVE-2026-23250}
    - xfs: only call xf{array,blob}_destroy if we have a valid pointer (Darrick J. Wong) [Orabug: 39103133]     {CVE-2026-23251}
    - KVM: x86: Add SRCU protection for reading PDPTRs in __get_sregs2() (Vasiliy Kovalev) [Orabug: 39331693]     {CVE-2026-43214}
    - xfs: fix freemap adjustments when adding xattrs to leaf blocks (Darrick J. Wong) [Orabug: 39331458]     {CVE-2026-43158}
    - xfs: delete attr leaf freemap entries when empty (Darrick J. Wong) [Orabug: 39331580] {CVE-2026-43187}
    - mfd: core: Add locking around 'mfd_of_node_list' (Douglas Anderson) [Orabug: 39331409] {CVE-2026-43143}
    - iommu/vt-d: Flush dev-IOTLB only when PCIe device is accessible in scalable mode (Jinhui Guo) [Orabug:
    39331341] {CVE-2026-43130}
    - xfs: remove xfs_attr_leaf_hasname (Christoph Hellwig) [Orabug: 39331444] {CVE-2026-43153}
    - drm/buddy: Prevent BUG_ON by validating rounded allocation (Sanjay Yadav) [Orabug: 39331510]     {CVE-2026-43169}
    - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (Yosry Ahmed) [Orabug: 39331358]     {CVE-2026-43133}
    - dm: clear cloned request bio pointer when last clone bio completes (Michael Liang) [Orabug: 39331954]     {CVE-2026-43278}
    - media: ipu6: Fix RPM reference leak in probe error paths (Bingbu Cao) [Orabug: 39331545]     {CVE-2026-43177}
    - media: i2c/tw9906: Fix potential memory leak in tw9906_probe() (Abdun Nihaal) [Orabug: 39331821]     {CVE-2026-43246}
    - media: i2c/tw9903: Fix potential memory leak in tw9903_probe() (Abdun Nihaal) [Orabug: 39331705]     {CVE-2026-43218}
    - media: cx23885: Add missing unmap in snd_cx23885_hw_params() (Haoxiang Li) [Orabug: 39331366]     {CVE-2026-43135}
    - media: cx88: Add missing unmap in snd_cx88_hw_params() (Haoxiang Li) [Orabug: 39331866] {CVE-2026-43257}
    - media: radio-keene: fix memory leak in error path (Shaurya Rane) [Orabug: 39331752] {CVE-2026-43231}
    - HID: logitech-hidpp: Check maxfield in hidpp_get_report_length() (Gunther Noack) [Orabug: 39331370]     {CVE-2026-43136}
    - HID: prodikeys: Check presence of pm->input_ep82 (Gunther Noack) [Orabug: 39331846] {CVE-2026-43251}
    - HID: magicmouse: Do not crash on missing msc->input (Gunther Noack) [Orabug: 39331389] {CVE-2026-43140}
    - HID: hid-pl: handle probe errors (Oliver Neukum) [Orabug: 39331440] {CVE-2026-43152}
    - KVM: nSVM: Remove a user-triggerable WARN on nested_svm_load_cr3() succeeding (Sean Christopherson)     [Orabug: 39343613] {CVE-2026-43315}
    - dm-verity: correctly handle dm_bufio_client_create() failure (Eric Biggers) [Orabug: 39331353]     {CVE-2026-43132}
    - ASoC: SOF: ipc4-topology: Correct the allocation size for bytes controls (Peter Ujfalusi) [Orabug:
    39331023] {CVE-2025-71286}
    - rpmsg: core: fix race in driver_override_show() and use core helper (Gui-Dong Han) [Orabug: 39331012]     {CVE-2025-71274}
    - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (Vahagn Vardanian) [Orabug: 39331761]     {CVE-2026-43233}
    - net: consume xmit errors of GSO frames (Jakub Kicinski) [Orabug: 39331606] {CVE-2026-43194}
    - net/mlx5e: Fix 'scheduling while atomic' in IPsec MAC address query (Jianbo Liu) [Orabug: 39331628]     {CVE-2026-43199}
    - RDMA/umem: Fix double dma_buf_unpin in failure path (Jacob Moroni) [Orabug: 39331331] {CVE-2026-43128}
    - net: usb: pegasus: enable basic endpoint checking (Ziyi Guo) [Orabug: 39331449] {CVE-2026-43156}
    - tls: Fix race condition in tls_sw_cancel_work_tx() (Hyunwoo Kim) [Orabug: 39073883] {CVE-2026-23240}
    - Bluetooth: L2CAP: Fix missing key size check for L2CAP_LE_CONN_REQ (Luiz Augusto von Dentz) [Orabug:
    39331361] {CVE-2026-43134}
    - bnxt_en: Fix RSS context delete logic (Pavan Chebbi) [Orabug: 39331875] {CVE-2026-43260}
    - net: usb: kaweth: remove TX queue manipulation in kaweth_set_rx_mode (Ziyi Guo) [Orabug: 39331549]     {CVE-2026-43180}
    - xfrm: always flush state and policy upon NETDEV_UNREGISTER event (Tetsuo Handa) [Orabug: 39331496]     {CVE-2026-43167}
    - xfrm6: fix uninitialized saddr in xfrm6_get_saddr() (Jiayuan Chen) [Orabug: 39331383] {CVE-2026-43139}
    - ALSA: usb-audio: Add sanity check for OOB writes at silencing (Takashi Iwai) [Orabug: 39331959]     {CVE-2026-43279}
    - spi: spidev: fix lock inversion between spi_lock and buf_lock (Fabian Godehardt) [Orabug: 39343626]     {CVE-2026-43319}
    - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [Orabug: 39343577] {CVE-2026-43304}
    - netfilter: xt_tcpmss: check remaining length before reading optlen (Florian Westphal) [Orabug: 39331591]     {CVE-2026-43190}
    - ext4: move ext4_percpu_param_init() before ext4_mb_init() (Baokun Li) [Orabug: 39343531]     {CVE-2026-43288}
    - iommu/amd: move wait_on_sem() out of spinlock (Ankit Soni) [Orabug: 39331853] {CVE-2026-43253}
    - wifi: libertas: fix WARNING in usb_tx_block (Szymon Wilczek) [Orabug: 39331859] {CVE-2026-43255}
    - dm: remove fake timeout to avoid leak request (Ding Hui) [Orabug: 39343609] {CVE-2026-43314}
    - wifi: rtw88: Use devm_kmemdup() in rtw_set_supported_band() (Bitterblue Smith) [Orabug: 39331003]     {CVE-2025-71273}
    - wifi: rtw88: 8822b: Avoid WARNING in rtw8822b_config_trx_mode() (Bitterblue Smith) [Orabug: 39343515]     {CVE-2025-71297}
    - ALSA: mixer: oss: Add card disconnect checkpoints (Takashi Iwai) [Orabug: 39331318] {CVE-2026-43126}
    - ASoC: SOF: Intel: hda: Fix NULL pointer dereference (Ranjani Sridharan) [Orabug: 39331375]     {CVE-2026-43137}
    - drm: Account property blob allocations to memcg (Xiao Kan) [Orabug: 39343527] {CVE-2026-43287}
    - media: v4l2-async: Fix error handling on steps after finding a match (Sakari Ailus) [Orabug: 39331585]     {CVE-2026-43189}
    - media: solo6x10: Check for out of bounds chip_id (Kees Cook) [Orabug: 39343616] {CVE-2026-43316}
    - media: pvrusb2: fix URB leak in pvr2_send_request_ex (Szymon Wilczek) [Orabug: 39331719]     {CVE-2026-43223}
    - drm/amd/display: Add signal type check for dcn401 get_phyd32clk_src (Dmytro Laktyushkin) [Orabug:
    39331807] {CVE-2026-43243}
    - drm/amd/display: Fix dsc eDP issue (Charlene Liu) [Orabug: 39343628] {CVE-2026-43320}
    - drm/amdgpu: fix NULL pointer issue buffer funcs (Likun Gao) [Orabug: 39331070] {CVE-2025-71294}
    - pstore: ram_core: fix incorrect success return when vmap() fails (Ruipeng Qi) [Orabug: 39331308]     {CVE-2026-43124}
    - bpf: crypto: Use the correct destructor kfunc type (Sami Tolvanen) [Orabug: 39343581] {CVE-2026-43306}
    - md-cluster: fix NULL pointer dereference in process_metadata_update (Jiasheng Jiang) [Orabug: 39331918]     {CVE-2026-43271}
    - ACPI: processor: Fix NULL-pointer dereference in acpi_processor_errata_piix4() (Tuo Li) [Orabug:
    39343603] {CVE-2026-43313}
    - EFI/CPER: don't go past the ARM processor CPER record buffer (Mauro Carvalho Chehab) [Orabug: 39331896]     {CVE-2026-43266}
    - APEI/GHES: ARM processor Error: don't go past allocated memory (Mauro Carvalho Chehab) [Orabug:
    39331636] {CVE-2026-43201}
    - APEI/GHES: ensure that won't go past CPER allocated record (Mauro Carvalho Chehab) [Orabug: 39331947]     {CVE-2026-43277}
    - EFI/CPER: don't dump the entire memory region (Mauro Carvalho Chehab) [Orabug: 39331518]     {CVE-2026-43171}
    - arm64: Add support for TSV110 Spectre-BHB mitigation (Jinqian Yang) [Orabug: 39331877] {CVE-2026-43261}
    - smb: client: prevent races in ->query_interfaces() (Henrique Carvalho) [Orabug: 39331789]     {CVE-2026-43239}
    - gfs2: fiemap page fault fix (Andreas Gruenbacher) [Orabug: 39331882] {CVE-2026-43262}
    - dlm: validate length in dlm_search_rsb_tree (Ziming Zhang) [Orabug: 39331312] {CVE-2026-43125}
    - fs/buffer: add alert in try_to_free_buffers() for folios without buffers (Deepakkumar Karn) [Orabug:
    39331077] {CVE-2025-71295}
    - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Eric Dumazet) [Orabug:
    39110677] {CVE-2026-23273}
    - net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (Jiayuan Chen) [Orabug: 39188476]     {CVE-2026-31411}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1693 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    af_unix: Give up GC if MSG_PEEK intervened. (CVE-2026-23394)

    In the Linux kernel, the following vulnerability has been resolved:

    ipv6: add NULL checks for idev in SRv6 paths (CVE-2026-23442)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: conntrack: add missing netlink policy validations (CVE-2026-31407)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: ipset: drop logically empty buckets in mtype_del (CVE-2026-31418)

    In the Linux kernel, the following vulnerability has been resolved:

    net: skb: fix cross-cache free of KFENCE-allocated skb head (CVE-2026-31429)

    In the Linux kernel, the following vulnerability has been resolved:

    X.509: Fix out-of-bounds access when parsing extensions (CVE-2026-31430)

    In the Linux kernel, the following vulnerability has been resolved:

    ipv4: nexthop: allocate skb dynamically in rtm_get_nexthop() (CVE-2026-31531)

    In the Linux kernel, the following vulnerability has been resolved:

    can: raw: fix ro->uniq use-after-free in raw_rcv() (CVE-2026-31532)

    In the Linux kernel, the following vulnerability has been resolved:

    net/tls: fix use-after-free in -EBUSY error path of tls_do_encryption (CVE-2026-31533)

    In the Linux kernel, the following vulnerability has been resolved:

    mm/userfaultfd: fix hugetlb fault mutex hash calculation (CVE-2026-31575)

    In the Linux kernel, the following vulnerability has been resolved:

    wireguard: device: use exit_rtnl callback instead of manual rtnl_lock in pre_exit (CVE-2026-31579)

    In the Linux kernel, the following vulnerability has been resolved:

    bcache: fix cached_dev.sb_bio use-after-free and crash (CVE-2026-31580)

    In the Linux kernel, the following vulnerability has been resolved:

    mm: blk-cgroup: fix use-after-free in cgwb_release_workfn() (CVE-2026-31586)

    In the Linux kernel, the following vulnerability has been resolved:

    KVM: x86: Use scratch field in MMIO fragment to hold small write values (CVE-2026-31588)

    In the Linux kernel, the following vulnerability has been resolved:

    KVM: SEV: Lock all vCPUs when synchronzing VMSAs for SNP launch finish (CVE-2026-31591)

    In the Linux kernel, the following vulnerability has been resolved:

    KVM: SEV: Protect *all* of sev_mem_enc_register_region() with kvm->lock (CVE-2026-31592)

    In the Linux kernel, the following vulnerability has been resolved:

    KVM: SEV: Reject attempts to sync VMSA of an already-launched/encrypted vCPU (CVE-2026-31593)

    In the Linux kernel, the following vulnerability has been resolved:

    arm64: mm: Handle invalid large leaf mappings correctly (CVE-2026-31600)

    In the Linux kernel, the following vulnerability has been resolved:

    usbip: validate number_of_packets in usbip_pack_ret_submit() (CVE-2026-31607)

    In the Linux kernel, the following vulnerability has been resolved:

    smb: client: fix OOB reads parsing symlink error response (CVE-2026-31613)

    In the Linux kernel, the following vulnerability has been resolved:

    smb: client: fix off-by-8 bounds check in check_wsl_eas() (CVE-2026-31614)

    In the Linux kernel, the following vulnerability has been resolved:

    HID: core: clamp report_size in s32ton() to avoid undefined shift (CVE-2026-31624)

    In the Linux kernel, the following vulnerability has been resolved:

    HID: alps: fix NULL pointer dereference in alps_raw_event() (CVE-2026-31625)

    In the Linux kernel, the following vulnerability has been resolved:

    x86/CPU: Fix FPDSS on Zen1 (CVE-2026-31628)

    In the Linux kernel, the following vulnerability has been resolved:

    rxrpc: fix reference count leak in rxrpc_server_keyring() (CVE-2026-31634)

    In the Linux kernel, the following vulnerability has been resolved:

    rxrpc: reject undecryptable rxkad response tickets (CVE-2026-31637)

    In the Linux kernel, the following vulnerability has been resolved:

    mm: filemap: fix nr_pages calculation overflow in filemap_map_pages() (CVE-2026-31648)

    In the Linux kernel, the following vulnerability has been resolved:

    mm/damon/sysfs: dealloc repeat_call_control if damon_call() fails (CVE-2026-31653)

    In the Linux kernel, the following vulnerability has been resolved:

    drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CVE-2026-31656)

    In the Linux kernel, the following vulnerability has been resolved:

    tipc: fix bc_ackers underflow on duplicate GRP_ACK_MSG (CVE-2026-31662)

    In the Linux kernel, the following vulnerability has been resolved:

    xfrm: hold dev ref until after transport_finish NF_HOOK (CVE-2026-31663)

    In the Linux kernel, the following vulnerability has been resolved:

    xfrm: clear trailing padding in build_polexpire() (CVE-2026-31664)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: nft_ct: fix use-after-free in timeout object destroy (CVE-2026-31665)

    In the Linux kernel, the following vulnerability has been resolved:

    btrfs: fix incorrect return value after changing leaf in lookup_extent_data_ref() (CVE-2026-31666)

    In the Linux kernel, the following vulnerability has been resolved:

    Input: uinput - fix circular locking dependency with ff-core (CVE-2026-31667)

    In the Linux kernel, the following vulnerability has been resolved:

    seg6: separate dst_cache for input and output paths in seg6 lwtunnel (CVE-2026-31668)

    In the Linux kernel, the following vulnerability has been resolved:

    mptcp: fix slab-use-after-free in __inet_lookup_established (CVE-2026-31669)

    In the Linux kernel, the following vulnerability has been resolved:

    xfrm_user: fix info leak in build_report() (CVE-2026-31671)

    In the Linux kernel, the following vulnerability has been resolved:

    af_unix: read UNIX_DIAG_VFS data under unix_state_lock (CVE-2026-31673)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: xt_multiport: validate range encoding in checkentry (CVE-2026-31681)

    In the Linux kernel, the following vulnerability has been resolved:

    net: sched: act_csum: validate nested VLAN headers (CVE-2026-31684)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: ip6t_eui64: reject invalid MAC header for all packets (CVE-2026-31685)

    In the Linux kernel, the following vulnerability has been resolved:

    EDAC/mc: Fix error path ordering in edac_mc_alloc() (CVE-2026-31689)

    In the Linux kernel, the following vulnerability has been resolved:

    igb: remove napi_synchronize() in igb_down() (CVE-2026-31691)

    In the Linux kernel, the following vulnerability has been resolved:

    rtnetlink: add missing netlink_ns_capable() check for peer netns (CVE-2026-31692)

    In the Linux kernel, the following vulnerability has been resolved:

    fuse: reject oversized dirents in page cache (CVE-2026-31694)

    In the Linux kernel, the following vulnerability has been resolved:

    net/packet: fix TOCTOU race on mmap'd vnet_hdr in tpacket_snd() (CVE-2026-31700)

    In the Linux kernel, the following vulnerability has been resolved:

    writeback: Fix use after free in inode_switch_wbs_work_fn() (CVE-2026-31703)

    In the Linux kernel, the following vulnerability has been resolved:

    smb: client: fix OOB read in smb2_ioctl_query_info QUERY_INFO path (CVE-2026-31708)

    In the Linux kernel, the following vulnerability has been resolved:

    fuse: abort on fatal signal during sync init (CVE-2026-31713)

    In the Linux kernel, the following vulnerability has been resolved:

    fs/ntfs3: validate rec->used in journal-replay file record check (CVE-2026-31716)

    In the Linux kernel, the following vulnerability has been resolved:

    crypto: krb5enc - fix async decrypt skipping hash verification (CVE-2026-31719)

    In the Linux kernel, the following vulnerability has been resolved:

    dcache: Limit the minimal number of bucket to two (CVE-2026-43071)

    In the Linux kernel, the following vulnerability has been resolved:

    x86-64: rename misleadingly named '__copy_user_nocache()' function (CVE-2026-43073)

    In the Linux kernel, the following vulnerability has been resolved:

    eventpoll: defer struct eventpoll free to RCU grace period (CVE-2026-43074)

    In the Linux kernel, the following vulnerability has been resolved:

    perf/x86/intel/uncore: Skip discovery table for offline dies (CVE-2026-43079)

    In the Linux kernel, the following vulnerability has been resolved:

    net: ioam6: fix OOB and missing lock (CVE-2026-43083)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: nfnetlink_queue: make hash table per queue (CVE-2026-43084)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator (CVE-2026-43085)

    In the Linux kernel, the following vulnerability has been resolved:

    ipvs: fix NULL deref in ip_vs_add_service error path (CVE-2026-43086)

    In the Linux kernel, the following vulnerability has been resolved:

    xfrm_user: fix info leak in build_mapping() (CVE-2026-43089)

    In the Linux kernel, the following vulnerability has been resolved:

    xfrm: fix refcount leak in xfrm_migrate_policy_find (CVE-2026-43090)

    In the Linux kernel, the following vulnerability has been resolved:

    xfrm: Wait for RCU readers during policy netns exit (CVE-2026-43091)

    In the Linux kernel, the following vulnerability has been resolved:

    xsk: validate MTU against usable frame size on bind (CVE-2026-43092)

    In the Linux kernel, the following vulnerability has been resolved:

    xsk: tighten UMEM headroom validation to account for tailroom and min frame (CVE-2026-43093)

    In the Linux kernel, the following vulnerability has been resolved:

    ixgbevf: add missing negotiate_features op to Hyper-V ops table (CVE-2026-43094)

    In the Linux kernel, the following vulnerability has been resolved:

    ipv4: icmp: fix null-ptr-deref in icmp_build_probe() (CVE-2026-43099)

    In the Linux kernel, the following vulnerability has been resolved:

    bridge: guard local VLAN-0 FDB helpers against NULL vlan group (CVE-2026-43100)

    In the Linux kernel, the following vulnerability has been resolved:

    ipv6: ioam: fix potential NULL dereferences in __ioam6_fill_trace_data() (CVE-2026-43101)

    In the Linux kernel, the following vulnerability has been resolved:

    xfrm: account XFRMA_IF_ID in aevent size calculation (CVE-2026-43107)

    In the Linux kernel, the following vulnerability has been resolved:

    x86: shadow stacks: proper error handling for mmap lock (CVE-2026-43109)

    In the Linux kernel, the following vulnerability has been resolved:

    fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CVE-2026-43112)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CVE-2026-43114)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: ctnetlink: ensure safe access to master conntrack (CVE-2026-43116)

    In the Linux kernel, the following vulnerability has been resolved:

    btrfs: tracepoints: get correct superblock from dentry in event btrfs_sync_file() (CVE-2026-43117)

    In the Linux kernel, the following vulnerability has been resolved:

    btrfs: fix zero size inode with non-zero size after log replay (CVE-2026-43118)

    In the Linux kernel, the following vulnerability has been resolved:xfrm: esp: avoid in-place decrypt on     shared skb frags

    Dirty Frag and other issues in Amazon Linux kernels:https://aws.amazon.com/security/security-     bulletins/2026-027-aws/ (CVE-2026-43284)

    In the Linux kernel, the following vulnerability has been resolved:

    smb: client: require a full NFS mode SID before reading mode bits (CVE-2026-43350)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1695 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    btrfs: do not free data reservation in fallback from inline due to -ENOSPC (CVE-2025-71269)

    In the Linux kernel, the following vulnerability has been resolved:

    gpiolib: fix race condition for gdev->srcu (CVE-2026-22986)

    In the Linux kernel, the following vulnerability has been resolved:

    net: annotate data-races around sk->sk_{data_ready,write_space} (CVE-2026-23302)

    In the Linux kernel, the following vulnerability has been resolved:

    blktrace: fix __this_cpu_read/write in preemptible context (CVE-2026-23374)

    In the Linux kernel, the following vulnerability has been resolved:

    ice: Fix memory leak in ice_set_ringparam() (CVE-2026-23389)

    In the Linux kernel, the following vulnerability has been resolved:

    ipv6: add NULL checks for idev in SRv6 paths (CVE-2026-23442)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: conntrack: add missing netlink policy validations (CVE-2026-31407)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: nf_conntrack_expect: use expect->helper (CVE-2026-31414)

    In the Linux kernel, the following vulnerability has been resolved:

    ipv6: avoid overflows in ip6_datagram_send_ctl() (CVE-2026-31415)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: nfnetlink_log: account for netlink header size (CVE-2026-31416)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: ipset: drop logically empty buckets in mtype_del (CVE-2026-31418)

    In the Linux kernel, the following vulnerability has been resolved:

    net/sched: cls_fw: fix NULL pointer dereference on shared blocks (CVE-2026-31421)

    In the Linux kernel, the following vulnerability has been resolved:

    net/sched: cls_flow: fix NULL pointer dereference on shared blocks (CVE-2026-31422)

    In the Linux kernel, the following vulnerability has been resolved:

    net/sched: sch_hfsc: fix divide-by-zero in rtsc_min() (CVE-2026-31423)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP (CVE-2026-31424)

    In the Linux kernel, the following vulnerability has been resolved:

    net: skb: fix cross-cache free of KFENCE-allocated skb head (CVE-2026-31429)

    In the Linux kernel, the following vulnerability has been resolved:

    X.509: Fix out-of-bounds access when parsing extensions (CVE-2026-31430)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: publish jinode after initialization (CVE-2026-31450)

    In the Linux kernel, the following vulnerability has been resolved:

    mm/huge_memory: fix folio isn't locked in softleaf_to_folio() (CVE-2026-31466)

    In the Linux kernel, the following vulnerability has been resolved:

    ipv4: nexthop: allocate skb dynamically in rtm_get_nexthop() (CVE-2026-31531)

    In the Linux kernel, the following vulnerability has been resolved:

    can: raw: fix ro->uniq use-after-free in raw_rcv() (CVE-2026-31532)

    In the Linux kernel, the following vulnerability has been resolved:

    net/tls: fix use-after-free in -EBUSY error path of tls_do_encryption (CVE-2026-31533)

    In the Linux kernel, the following vulnerability has been resolved:

    bcache: fix cached_dev.sb_bio use-after-free and crash (CVE-2026-31580)

    In the Linux kernel, the following vulnerability has been resolved:

    mm: blk-cgroup: fix use-after-free in cgwb_release_workfn() (CVE-2026-31586)

    In the Linux kernel, the following vulnerability has been resolved:

    KVM: x86: Use scratch field in MMIO fragment to hold small write values (CVE-2026-31588)

    In the Linux kernel, the following vulnerability has been resolved:

    KVM: SEV: Reject attempts to sync VMSA of an already-launched/encrypted vCPU (CVE-2026-31593)

    In the Linux kernel, the following vulnerability has been resolved:

    usbip: validate number_of_packets in usbip_pack_ret_submit() (CVE-2026-31607)

    In the Linux kernel, the following vulnerability has been resolved:

    smb: client: fix off-by-8 bounds check in check_wsl_eas() (CVE-2026-31614)

    In the Linux kernel, the following vulnerability has been resolved:

    HID: core: clamp report_size in s32ton() to avoid undefined shift (CVE-2026-31624)

    In the Linux kernel, the following vulnerability has been resolved:

    HID: alps: fix NULL pointer dereference in alps_raw_event() (CVE-2026-31625)

    In the Linux kernel, the following vulnerability has been resolved:

    x86/CPU: Fix FPDSS on Zen1 (CVE-2026-31628)

    In the Linux kernel, the following vulnerability has been resolved:

    rxrpc: fix reference count leak in rxrpc_server_keyring() (CVE-2026-31634)

    In the Linux kernel, the following vulnerability has been resolved:

    rxrpc: reject undecryptable rxkad response tickets (CVE-2026-31637)

    In the Linux kernel, the following vulnerability has been resolved:

    mm: filemap: fix nr_pages calculation overflow in filemap_map_pages() (CVE-2026-31648)

    In the Linux kernel, the following vulnerability has been resolved:

    drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CVE-2026-31656)

    In the Linux kernel, the following vulnerability has been resolved:

    tipc: fix bc_ackers underflow on duplicate GRP_ACK_MSG (CVE-2026-31662)

    In the Linux kernel, the following vulnerability has been resolved:

    xfrm: clear trailing padding in build_polexpire() (CVE-2026-31664)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: nft_ct: fix use-after-free in timeout object destroy (CVE-2026-31665)

    In the Linux kernel, the following vulnerability has been resolved:

    btrfs: fix incorrect return value after changing leaf in lookup_extent_data_ref() (CVE-2026-31666)

    In the Linux kernel, the following vulnerability has been resolved:

    Input: uinput - fix circular locking dependency with ff-core (CVE-2026-31667)

    In the Linux kernel, the following vulnerability has been resolved:

    seg6: separate dst_cache for input and output paths in seg6 lwtunnel (CVE-2026-31668)

    In the Linux kernel, the following vulnerability has been resolved:

    mptcp: fix slab-use-after-free in __inet_lookup_established (CVE-2026-31669)

    In the Linux kernel, the following vulnerability has been resolved:

    xfrm_user: fix info leak in build_report() (CVE-2026-31671)

    In the Linux kernel, the following vulnerability has been resolved:

    af_unix: read UNIX_DIAG_VFS data under unix_state_lock (CVE-2026-31673)

    In the Linux kernel, the following vulnerability has been resolved:

    net/sched: sch_netem: fix out-of-bounds access in packet corruption (CVE-2026-31675)

    In the Linux kernel, the following vulnerability has been resolved:

    crypto: af_alg - limit RX SG extraction by receive buffer budget (CVE-2026-31677)

    In the Linux kernel, the following vulnerability has been resolved:

    net: ipv6: flowlabel: defer exclusive option free until RCU teardown (CVE-2026-31680)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: xt_multiport: validate range encoding in checkentry (CVE-2026-31681)

    In the Linux kernel, the following vulnerability has been resolved:

    bridge: br_nd_send: linearize skb before parsing ND options (CVE-2026-31682)

    In the Linux kernel, the following vulnerability has been resolved:

    net: sched: act_csum: validate nested VLAN headers (CVE-2026-31684)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: ip6t_eui64: reject invalid MAC header for all packets (CVE-2026-31685)

    In the Linux kernel, the following vulnerability has been resolved:

    EDAC/mc: Fix error path ordering in edac_mc_alloc() (CVE-2026-31689)

    In the Linux kernel, the following vulnerability has been resolved:

    thermal: core: Address thermal zone removal races with resume (CVE-2026-31731)

    In the Linux kernel, the following vulnerability has been resolved:

    sched_ext: Fix stale direct dispatch state in ddsp_dsq_id (CVE-2026-31733)

    In the Linux kernel, the following vulnerability has been resolved:

    vxlan: validate ND option lengths in vxlan_na_create (CVE-2026-31738)

    In the Linux kernel, the following vulnerability has been resolved:

    bridge: br_nd_send: validate ND option lengths (CVE-2026-31752)

    In the Linux kernel, the following vulnerability has been resolved:

    drm/i915/dsi: Don't do DSC horizontal timing adjustments in command mode (CVE-2026-31767)

    In the Linux kernel, the following vulnerability has been resolved:

    io_uring/net: fix slab-out-of-bounds read in io_bundle_nbufs() (CVE-2026-31774)

    In the Linux kernel, the following vulnerability has been resolved:

    drm/ioc32: stop speculation on the drm_compat_ioctl path (CVE-2026-31781)

    In the Linux kernel, the following vulnerability has been resolved:

    net/mlx5: Fix switchdev mode rollback in case of failure (CVE-2026-43012)

    In the Linux kernel, the following vulnerability has been resolved:

    net/mlx5: lag: Check for LAG device before creating debugfs (CVE-2026-43013)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf: sockmap: Fix use-after-free of sk->sk_socket in sk_psock_verdict_data_ready(). (CVE-2026-43016)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: nf_tables: reject immediate NF_QUEUE verdict (CVE-2026-43024)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: ctnetlink: ignore explicit helper on new expectations (CVE-2026-43025)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (CVE-2026-43026)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: nf_conntrack_helper: pass helper to expect cleanup (CVE-2026-43027)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: x_tables: ensure names are nul-terminated (CVE-2026-43028)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf: Fix regsafe() for pointers to packet (CVE-2026-43030)

    In the Linux kernel, the following vulnerability has been resolved:

    net: sched: cls_api: fix tc_chain_fill_node to initialize tcm_info to zero to prevent an info-leak     (CVE-2026-43035)

    In the Linux kernel, the following vulnerability has been resolved:

    net: use skb_header_pointer() for TCPv4 GSO frag_off check (CVE-2026-43036)

    In the Linux kernel, the following vulnerability has been resolved:

    ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (CVE-2026-43037)

    In the Linux kernel, the following vulnerability has been resolved:

    ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (CVE-2026-43038)

    In the Linux kernel, the following vulnerability has been resolved:

    net: ipv6: ndisc: fix ndisc_ra_useropt to initialize nduseropt_padX fields to zero to prevent an info-leak     (CVE-2026-43040)

    In the Linux kernel, the following vulnerability has been resolved:

    crypto: af-alg - fix NULL pointer dereference in scatterwalk (CVE-2026-43043)

    In the Linux kernel, the following vulnerability has been resolved:

    btrfs: reject root items with drop_progress and zero drop_level (CVE-2026-43046)

    In the Linux kernel, the following vulnerability has been resolved:

    HID: multitouch: Check to ensure report responses match the request (CVE-2026-43047)

    In the Linux kernel, the following vulnerability has been resolved:

    scsi: target: tcm_loop: Drain commands in target_reset handler (CVE-2026-43054)

    In the Linux kernel, the following vulnerability has been resolved:

    net: correctly handle tunneled traffic on IPV6_CSUM GSO fallback (CVE-2026-43057)

    In the Linux kernel, the following vulnerability has been resolved:

    dcache: Limit the minimal number of bucket to two (CVE-2026-43071)

    In the Linux kernel, the following vulnerability has been resolved:

    x86-64: rename misleadingly named '__copy_user_nocache()' function (CVE-2026-43073)

    In the Linux kernel, the following vulnerability has been resolved:

    eventpoll: defer struct eventpoll free to RCU grace period (CVE-2026-43074)

    In the Linux kernel, the following vulnerability has been resolved:

    perf/x86/intel/uncore: Skip discovery table for offline dies (CVE-2026-43079)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: nfnetlink_queue: make hash table per queue (CVE-2026-43084)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator (CVE-2026-43085)

    In the Linux kernel, the following vulnerability has been resolved:

    ipvs: fix NULL deref in ip_vs_add_service error path (CVE-2026-43086)

    In the Linux kernel, the following vulnerability has been resolved:

    xfrm_user: fix info leak in build_mapping() (CVE-2026-43089)

    In the Linux kernel, the following vulnerability has been resolved:

    xfrm: fix refcount leak in xfrm_migrate_policy_find (CVE-2026-43090)

    In the Linux kernel, the following vulnerability has been resolved:

    xfrm: Wait for RCU readers during policy netns exit (CVE-2026-43091)

    In the Linux kernel, the following vulnerability has been resolved:

    xsk: validate MTU against usable frame size on bind (CVE-2026-43092)

    In the Linux kernel, the following vulnerability has been resolved:

    xsk: tighten UMEM headroom validation to account for tailroom and min frame (CVE-2026-43093)

    In the Linux kernel, the following vulnerability has been resolved:

    ixgbevf: add missing negotiate_features op to Hyper-V ops table (CVE-2026-43094)

    In the Linux kernel, the following vulnerability has been resolved:

    ipv4: icmp: fix null-ptr-deref in icmp_build_probe() (CVE-2026-43099)

    In the Linux kernel, the following vulnerability has been resolved:

    xfrm: account XFRMA_IF_ID in aevent size calculation (CVE-2026-43107)

    In the Linux kernel, the following vulnerability has been resolved:

    fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CVE-2026-43112)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CVE-2026-43114)

    In the Linux kernel, the following vulnerability has been resolved:

    btrfs: tracepoints: get correct superblock from dentry in event btrfs_sync_file() (CVE-2026-43117)

    In the Linux kernel, the following vulnerability has been resolved:xfrm: esp: avoid in-place decrypt on     shared skb frags

    Dirty Frag and other issues in Amazon Linux kernels:https://aws.amazon.com/security/security-     bulletins/2026-027-aws/ (CVE-2026-43284)

    In the Linux kernel, the following vulnerability has been resolved:

    sched/fair: Fix zero_vruntime tracking fix (CVE-2026-43323)

    In the Linux kernel, the following vulnerability has been resolved:

    cpufreq: governor: fix double free in cpufreq_dbs_governor_init() error path (CVE-2026-43328)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: flowtable: strictly check for maximum number of actions (CVE-2026-43329)

    In the Linux kernel, the following vulnerability has been resolved:

    thermal: core: Fix thermal zone device registration error path (CVE-2026-43332)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf: reject direct access to nullable PTR_TO_BUF pointers (CVE-2026-43333)

    In the Linux kernel, the following vulnerability has been resolved:

    lib/crypto: chacha: Zeroize permuted_state before it leaves scope (CVE-2026-43336)

    In the Linux kernel, the following vulnerability has been resolved:

    btrfs: reserve enough transaction items for qgroup ioctls (CVE-2026-43338)

    In the Linux kernel, the following vulnerability has been resolved:

    ipv6: prevent possible UaF in addrconf_permanent_addr() (CVE-2026-43339)

    In the Linux kernel, the following vulnerability has been resolved:

    net/ipv6: ioam6: prevent schema length wraparound in trace fill (CVE-2026-43341)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - netfilter: nfnetlink_queue: make hash table per queue Sharing a global hash table among all queues is     tempting, but it can cause crash: BUG: KASAN: slab-use-after-free in nfqnl_recv_verdict+0x11ac/0x15e0     [nfnetlink_queue] [..] nfqnl_recv_verdict+0x11ac/0x15e0 [nfnetlink_queue] nfnetlink_rcv_msg+0x46a/0x930     kmem_cache_alloc_node_noprof+0x11e/0x450 struct nf_queue_entry is freed via kfree, but parallel cpu can     still encounter such an nf_queue_entry when walking the list. Alternative fix is to free the     nf_queue_entry via kfree_rcu() instead, but as we have to alloc/free for each skb this will cause more mem     pressure. (CVE-2026-43084)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
318589	Oracle Linux 10 / 9 : Unbreakable Enterprise kernel (ELSA-2026-50293)	Nessus	Oracle Linux Local Security Checks	high
313525	Amazon Linux 2023 : bpftool6.18, kernel6.18, kernel6.18-devel (ALAS2023-2026-1693)	Nessus	Amazon Linux Local Security Checks	high
313517	Amazon Linux 2023 : bpftool6.12, kernel6.12, kernel6.12-devel (ALAS2023-2026-1695)	Nessus	Amazon Linux Local Security Checks	high
312784	Linux Distros Unpatched Vulnerability : CVE-2026-43084	Nessus	Misc.	high

Detections

Analytics

CVE-2026-43084

high

Tenable Plugins

high

high

high

high