In the Linux kernel, the following vulnerability has been resolved: netfilter: nfnetlink_queue: make hash table per queue Sharing a global hash table among all queues is tempting, but it can cause crash: BUG: KASAN: slab-use-after-free in nfqnl_recv_verdict+0x11ac/0x15e0 [nfnetlink_queue] [..] nfqnl_recv_verdict+0x11ac/0x15e0 [nfnetlink_queue] nfnetlink_rcv_msg+0x46a/0x930 kmem_cache_alloc_node_noprof+0x11e/0x450 struct nf_queue_entry is freed via kfree, but parallel cpu can still encounter such an nf_queue_entry when walking the list. Alternative fix is to free the nf_queue_entry via kfree_rcu() instead, but as we have to alloc/free for each skb this will cause more mem pressure.

An update of the linux package has been released.

The remote Oracle Linux 10 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-50372 advisory.

    - net/sched: fix pedit partial COW leading to page cache corruption (Rajat Gupta)   {CVE-2026-46331}
    - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Christian Brauner)  [Orabug: 39668743]     {CVE-2026-46242}
    - net: skbuff: fix missing zerocopy reference in pskb_carve helpers (Minh Nguyen)  [Orabug: 39656679]     {CVE-2026-52943}
    - arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Rutland)  [Orabug: 39548792]     {CVE-2025-10263}
    - openvswitch: vport: fix self-deadlock on release of tunnel ports (Ilya Maximets) {CVE-2026-46165}
    - iommu/amd: serialize sequence allocation under concurrent TLB invalidations (Ankit Soni)     {CVE-2026-43220}
    - usb: ulpi: fix memory leak on ulpi_register() error paths (Felix Gu) {CVE-2026-46109}
    - smb: client: reject userspace cifs.spnego descriptions (Asim Viladi Oglu Manizada)  [Orabug: 39463671]     {CVE-2026-46243}
    - net: skbuff: propagate shared-frag marker through frag-transfer helpers (Hyunwoo Kim) [Orabug:
    39368826,39441323] {CVE-2026-43503,CVE-2026-46300}
    - net: skbuff: preserve shared-frag marker during coalescing (William Bowling) [Orabug: 39368826]     {CVE-2026-46300}
    - netfilter: reject zero shift in nft_bitwise (Kai Ma) [Orabug: 39452464] {CVE-2026-46101}
    - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Andrea Mayer) [Orabug: 39452457]     {CVE-2026-46099}
    - ALSA: caiaq: fix usb_dev refcount leak on probe failure (Deepanshu Kartikey) [Orabug: 39452739]     {CVE-2026-46048}
    - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Greg Kroah-Hartman) [Orabug: 39426003]     {CVE-2026-43501}
    - ALSA: caiaq: Fix potentially leftover ep1_in_urb at error path (Takashi Iwai) [Orabug: 39452746]     {CVE-2026-45992}
    - net: bonding: fix use-after-free in bond_xmit_broadcast() (Xiang Mei) [Orabug: 39205989]     {CVE-2026-31419}
    - crypto: authencesn - reject short ahash digests during instance creation (Yucheng Lu) [Orabug: 39452231]     {CVE-2026-46033}
    - spi: fix resource leaks on device setup failure (Johan Hovold) [Orabug: 39452400] {CVE-2026-46083}
    - net: qrtr: ns: Limit the total number of nodes (Manivannan Sadhasivam) [Orabug: 39452123]     {CVE-2026-46003}
    - net: bridge: use a stable FDB dst snapshot in RCU readers (Zhengchuan Liang) [Orabug: 39452411]     {CVE-2026-46086}
    - net: qrtr: ns: Limit the maximum number of lookups (Manivannan Sadhasivam) [Orabug: 39452207]     {CVE-2026-46026}
    - net: qrtr: ns: Limit the maximum server registration per node (Manivannan Sadhasivam) [Orabug: 39410851]     {CVE-2026-43491}
    - RDMA/mana_ib: Disable RX steering on RSS QP destroy (Long Li) [Orabug: 39452406] {CVE-2026-46084}
    - media: rc: igorplugusb: heed coherency rules (Oliver Neukum) [Orabug: 39452432] {CVE-2026-46091}
    - wifi: mwifiex: fix use-after-free in mwifiex_adapter_cleanup() (Daniel Hodges) [Orabug: 39452343]     {CVE-2026-46069}
    - thermal: core: Fix thermal zone governor cleanup issues (Rafael J. Wysocki) [Orabug: 39452186]     {CVE-2026-46021}
    - smb: client: validate the whole DACL before rewriting it in cifsacl (Michael Bommarito) [Orabug:
    39300611] {CVE-2026-31709}
    - scsi: sd: fix missing put_disk() when device_add(&disk_dev) fails (Yang Xiuwei) [Orabug: 39452100]     {CVE-2026-45997}
    - rtmutex: Use waiter::task instead of current in remove_waiter() (Keenan Dong) [Orabug: 39425998]     {CVE-2026-43499}
    - ceph: only d_add() negative dentries when they are unhashed (Max Kellermann) [Orabug: 39452291]     {CVE-2026-46052}
    - dm mirror: fix integer overflow in create_dirty_log() (Junrui Luo) [Orabug: 39452196] {CVE-2026-46023}
    - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (Shuvam Pandey) [Orabug: 39452304]     {CVE-2026-46056}
    - tcp: call sk_data_ready() after listener migration (Zhenzhong Wu) [Orabug: 39452159] {CVE-2026-46015}
    - inotify: fix watch count leak when fsnotify_add_inode_mark_locked() fails (Chia-Ming Chang) [Orabug:
    39452250] {CVE-2026-46040}
    - md/raid5: validate payload size before accessing journal metadata (Junrui Luo) [Orabug: 39452349]     {CVE-2026-46070}
    - md/raid5: fix soft lockup in retry_aligned_read() (Chia-Ming Chang) [Orabug: 39452287] {CVE-2026-46051}
    - ext4: fix missing brelse() in ext4_xattr_inode_dec_ref_all() (Sohei Koyama) [Orabug: 39452269]     {CVE-2026-46046}
    - ext4: fix bounds check in check_xattrs() to prevent out-of-bounds access (Deepanshu Kartikey) [Orabug:
    39452442] {CVE-2026-46094}
    - io_uring/poll: fix multishot recv missing EOF on wakeup race (Jens Axboe) {CVE-2026-23473}
    - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Kevin Cheng) [Orabug: 39452372]     {CVE-2026-46076}
    - KVM: SVM: Inject #UD for INVLPGA if EFER.SVME=0 (Kevin Cheng) [Orabug: 39452394] {CVE-2026-46082}
    - KVM: nSVM: Sync interrupt shadow to cached vmcb12 after VMRUN of L2 (Yosry Ahmed) [Orabug: 39452061]     {CVE-2026-45987}
    - xfs: fix a resource leak in xfs_alloc_buftarg() (Haoxiang Li) [Orabug: 39452131] {CVE-2026-46005}
    - libceph: Prevent potential null-ptr-deref in ceph_handle_auth_reply() (Raphael Zimmer) [Orabug:
    39452201] {CVE-2026-46024}
    - ipv4: icmp: validate reply type before using icmp_pointers (Ruide Cao) [Orabug: 39452243]     {CVE-2026-46037}
    - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Hkbinbin) [Orabug: 39452259]     {CVE-2026-46043}
    - net: qrtr: ns: Free the node during ctrl_cmd_bye() (Manivannan Sadhasivam) [Orabug: 39452246]     {CVE-2026-46038}
    - rxrpc: Fix rxkad crypto unalignment handling (David Howells) [Orabug: 39452728] {CVE-2026-46085}
    - ALSA: caiaq: Handle probe errors properly (Takashi Iwai) [Orabug: 39452126] {CVE-2026-46004}
    - rbd: fix null-ptr-deref when device_add_disk() fails (Dawei Feng) [Orabug: 39452385] {CVE-2026-46079}
    - md/raid10: fix deadlock with check operation and nowait requests (Josh Hunt) [Orabug: 39452284]     {CVE-2026-46050}
    - jbd2: fix deadlock in jbd2_journal_cancel_revoke() (Zhang Yi) [Orabug: 39452318] {CVE-2026-46061}
    - erofs: fix the out-of-bounds nameoff handling for trailing dirents (Gao Xiang) [Orabug: 39452380]     {CVE-2026-46078}
    - ALSA: ctxfi: Add fallback to default RSR for S/PDIF (Harin Lee) [Orabug: 39452280] {CVE-2026-46049}
    - ext2: reject inodes with zero i_nlink and valid mode in ext2_iget() (Vasiliy Kovalev) [Orabug: 39452119]     {CVE-2026-46002}
    - net: qrtr: ns: Fix use-after-free in driver remove() (Manivannan Sadhasivam) [Orabug: 39452274]     {CVE-2026-46047}
    - net: strparser: fix skb_head leak in strp_abort_strp() (Luxiao Xu) [Orabug: 39452468] {CVE-2026-46102}
    - ALSA: control: Validate buf_len before strnlen() in snd_ctl_elem_init_enum_names() (Ziqing Chen)     [Orabug: 39452416] {CVE-2026-46088}
    - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Herbert Xu) [Orabug: 39410863] {CVE-2026-43493}
    - wifi: rtw88: check for PCI upstream bridge existence (Fedor Pchelkin) [Orabug: 39452437]     {CVE-2026-46092}
    - zram: do not forget to endio for partial discard requests (Sergey Senozhatsky) [Orabug: 39452420]     {CVE-2026-46089}
    - ocfs2: split transactions in dio completion to avoid credit exhaustion (Heming Zhao) [Orabug: 39452388]     {CVE-2026-46080}
    - drm/amdgpu: Limit BO list entry count to prevent resource exhaustion (Jesse Zhang) [Orabug: 39167551]     {CVE-2026-23468}
    - padata: Fix pd UAF once and for all (Herbert Xu) [Orabug: 38335055] {CVE-2025-38584}
    - drm/nouveau: fix u32 overflow in pushbuf reloc bounds check (Greg Kroah-Hartman) [Orabug: 39452133]     {CVE-2026-46006}
    - ALSA: usb-audio: stop parsing UAC2 rates at MAX_NR_RATES (Cassio Gabriel) [Orabug: 39452170]     {CVE-2026-46018}
    - Buffer overflow in drivers/xen/sys-hypervisor.c (Juergen Gross) [Orabug: 39305898] {CVE-2026-31786}
    - xen/privcmd: fix double free via VMA splitting (Juergen Gross) [Orabug: 39305908] {CVE-2026-31787}
    - rxrpc: Fix missing validation of ticket length in non-XDR key preparsing (Anderson Nascimento) [Orabug:
    39300563] {CVE-2026-31696}
    - crypto: ccp: Don't attempt to copy ID to userspace if PSP command failed (Sean Christopherson)     {CVE-2026-31697}
    - crypto: ccp: Don't attempt to copy PDH cert to userspace if PSP command failed (Sean Christopherson)     {CVE-2026-31698}
    - crypto: ccp: Don't attempt to copy CSR to userspace if PSP command failed (Sean Christopherson)     {CVE-2026-31699}
    - net/packet: fix TOCTOU race on mmap'd vnet_hdr in tpacket_snd() (Bingquan Chen) {CVE-2026-31700}
    - ALSA: caiaq: take a reference on the USB device in create_card() (Berk Cem Goksel) [Orabug: 39300586]     {CVE-2026-31701}
    - smb: client: fix OOB read in smb2_ioctl_query_info QUERY_INFO path (Michael Bommarito) [Orabug:
    39300607] {CVE-2026-31708}
    - smb: client: require a full NFS mode SID before reading mode bits (Michael Bommarito) [Orabug: 39343707]     {CVE-2026-43350}
    - fuse: reject oversized dirents in page cache (Samuel Page) [Orabug: 39300556] {CVE-2026-31694}
    - mm/pagewalk: fix race between concurrent split and refault (Max Boone) [Orabug: 39250782]     {CVE-2026-31456}
    - wifi: mac80211: always free skb on ieee80211_tx_prepare_skb() failure (Felix Fietkau) [Orabug: 39167472]     {CVE-2026-23444}
    - mm/userfaultfd: fix hugetlb fault mutex hash calculation (Jianhui Zhou) [Orabug: 39273453]     {CVE-2026-31575}
    - ipv6: add NULL checks for idev in SRv6 paths (Heminhong) [Orabug: 39167467] {CVE-2026-23442}
    - ocfs2: fix out-of-bounds write in ocfs2_write_end_inline (Joseph Qi) [Orabug: 39331090] {CVE-2026-43075}
    - ocfs2: validate inline data i_size during inode read (Deepanshu Kartikey) [Orabug: 39331097]     {CVE-2026-43076}
    - media: as102: fix to not free memory after the device is registered in as102_usb_probe() (Jeongjun Park)     [Orabug: 39273467] {CVE-2026-31578}
    - bcache: fix cached_dev.sb_bio use-after-free and crash (Mingzhe Zou) [Orabug: 39273481] {CVE-2026-31580}
    - ALSA: 6fire: fix use-after-free on disconnect (Berk Cem Goksel) [Orabug: 39273486] {CVE-2026-31581}
    - media: em28xx: fix use-after-free in em28xx_v4l2_open() (Abhishek Kumar) [Orabug: 39273493]     {CVE-2026-31583}
    - mm: blk-cgroup: fix use-after-free in cgwb_release_workfn() (Breno Leitao) [Orabug: 39273507]     {CVE-2026-31586}
    - KVM: x86: Use scratch field in MMIO fragment to hold small write values (Sean Christopherson) [Orabug:
    39273521] {CVE-2026-31588}
    - x86-64: rename misleadingly named '__copy_user_nocache()' function (Linus Torvalds) [Orabug: 39323162]     {CVE-2026-43073}
    - kernel: be more careful about dup_mmap() failures and uprobe registering (Liam R. Howlett)     {CVE-2025-21709}
    - gpiolib: fix race condition for gdev->srcu (Pawel Narewski) [Orabug: 38887677] {CVE-2026-22986}
    - KVM: SEV: Drop WARN on large size for KVM_MEMORY_ENCRYPT_REG_REGION (Sean Christopherson) [Orabug:
    39273529] {CVE-2026-31590}
    - KVM: SEV: Reject attempts to sync VMSA of an already-launched/encrypted vCPU (Sean Christopherson)     [Orabug: 39273553] {CVE-2026-31593}
    - ocfs2: handle invalid dinode in ocfs2_group_extend (Zhengyuan Huang) [Orabug: 39273569] {CVE-2026-31596}
    - ocfs2: fix use-after-free in ocfs2_fault() when VM_FAULT_RETRY (Tejas Bharambe) [Orabug: 39273578]     {CVE-2026-31597}
    - ocfs2: fix possible deadlock between unlink and dio_end_io_write (Joseph Qi) [Orabug: 39273586]     {CVE-2026-31598}
    - dcache: Limit the minimal number of bucket to two (Zhihao Cheng) [Orabug: 39323133] {CVE-2026-43071}
    - ALSA: ctxfi: Limit PTP to a single page (Harin Lee) [Orabug: 39273608] {CVE-2026-31602}
    - wifi: rtw88: fix device leak on probe failure (Johan Hovold) [Orabug: 39273620] {CVE-2026-31604}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 10 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-50293 advisory.

    - net: skbuff: propagate shared-frag marker through frag-transfer helpers (Hyunwoo Kim)  [Orabug:
    39442660]  {CVE-2026-46300}
    - ptrace: slightly saner 'get_dumpable()' logic (Linus Torvalds)  [Orabug: 39407652]  {CVE-2026-46333}
    - x86/CPU/AMD: Add a fix for AMD-SB-7052 (Prathyushi Nangia)  [Orabug: 39218893]  {CVE-2025-54518}
    - rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Hyunwoo Kim)  [Orabug: 39334587]     {CVE-2026-43500}
    - xfrm: esp: avoid in-place decrypt on shared skb frags (Kuan-Ting Chen)  [Orabug: 39334587]     {CVE-2026-43284}
    - nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Jeff Layton)  [Orabug: 39167615]  {CVE-2026-31402}
    - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal)  [Orabug: 39110670]     {CVE-2026-23278}
    - net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (Victor Nogueira)     [Orabug: 39103229]  {CVE-2026-23270}
    - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [Orabug: 39339273]     {CVE-2026-43084}
    - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [Orabug:
    39250685,39331108] {CVE-2026-43078}
    - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [Orabug:
    39250685,39300909] {CVE-2026-43033}
    - crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [Orabug:
    39250685,39283866,39291972,39292190] {CVE-2026-31431}
    - x86/CPU: Fix FPDSS on Zen1 (Borislav Petkov) [Orabug: 39241227,39273721] {CVE-2026-31628}
    - ipv6: use RCU in ip6_xmit() (Eric Dumazet) [Orabug: 38649060,39186444,39202432] {CVE-2025-40135}
    - dst: fix races in rt6_uncached_list_del() and rt_del_uncached_list() (Eric Dumazet) [Orabug:
    38887740,39181101,39202431] {CVE-2026-23004}
    - net: bridge: fix nd_tbl NULL dereference when IPv6 is disabled (Fernando Fernandez Mancera) [Orabug:
    39029337,39131054] {CVE-2026-23381}
    - io_uring/kbuf: check if target buffer list is still legacy on recycle (Jens Axboe) [Orabug:
    39144150,39343763] {CVE-2026-43366}
    - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Breno Leitao) [Orabug: 38970584,39166116]     {CVE-2026-23207}
    - tracing: Add NULL pointer check to trigger_data_free() (Guenter Roeck) [Orabug: 39227772]     {CVE-2026-23309}
    - bpf: Fix unsound scalar forking in maybe_fork_scalars() for BPF_OR (Daniel Wade) [Orabug: 39198231]     {CVE-2026-31413}
    - Bluetooth: L2CAP: Fix stack-out-of-bounds read in l2cap_ecred_conn_req (Minseo Park) [Orabug: 39251164]     {CVE-2026-31513}
    - erofs: set fileio bio failed in short read case (Sheng Yong) [Orabug: 39251169] {CVE-2026-31514}
    - ACPI: processor: Fix previous acpi_processor_errata_piix4() fix (Rafael J. Wysocki) [Orabug: 39198208]     {CVE-2026-23443}
    - wifi: wlcore: Return -ENOMEM instead of -EAGAIN if there is not enough headroom (Guenter Roeck) [Orabug:
    39262447] {CVE-2026-31552}
    - tracing: ring-buffer: Fix to check event length before using (Masami Hiramatsu) [Orabug: 39331678]     {CVE-2026-43210}
    - net/sched: act_skbedit: fix divide-by-zero in tcf_skbedit_hash() (Liu Ruitong) [Orabug: 39331784]     {CVE-2026-43238}
    - cifs: some missing initializations on replay (Shyam Prasad N) [Orabug: 39300554] {CVE-2026-31693}
    - fbdev: of: display_timing: fix refcount leak in of_get_display_timings() (Weigang He) [Orabug: 39331889]     {CVE-2026-43264}
    - fbcon: check return value of con2fb_acquire_newinfo() (Andrey Vatoropin) [Orabug: 39331303]     {CVE-2026-43123}
    - ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (Junxi Qian) [Orabug: 39331577]     {CVE-2026-43186}
    - procfs: fix possible double mmput() in do_procmap_query() (Andrii Nakryiko) [Orabug: 39339241]     {CVE-2026-43178}
    - drm/amdgpu: fix sync handling in amdgpu_dma_buf_move_notify (Pierre-Eric Pelloux-Prayer) [Orabug:
    39343623] {CVE-2026-43318}
    - ceph: supply snapshot context in ceph_zero_partial_object() (Ethanwu) [Orabug: 39331924]     {CVE-2026-43273}
    - cifs: Fix locking usage for tcon fields (Shyam Prasad N) [Orabug: 39331696] {CVE-2026-43215}
    - PCI: Fix pci_slot_trylock() error handling (Jinhui Guo) [Orabug: 39331680] {CVE-2026-43211}
    - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (Sunday Clement) [Orabug: 39331661]     {CVE-2026-43206}
    - usb: dwc3: gadget: Move vbus draw to workqueue context (Prashanth K) [Orabug: 39331512] {CVE-2026-43170}
    - scsi: ufs: core: Flush exception handling work when RPM level is zero (Thomas Yen) [Orabug: 39331937]     {CVE-2026-43275}
    - perf/arm-cmn: Reject unsupported hardware configurations (Robin Murphy) [Orabug: 39331435]     {CVE-2026-43150}
    - Revert 'PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV' (Niklas Schnelle)     [Orabug: 39331422] {CVE-2026-43147}
    - kexec: derive purgatory entry from symbol (Li Chen) [Orabug: 39343538] {CVE-2026-43289}
    - ocfs2: fix reflink preserve cleanup issue (Heming Zhao) [Orabug: 39331504] {CVE-2026-43168}
    - vhost: move vdpa group bound check to vhost_vdpa (Eugenio Perez) [Orabug: 39331827] {CVE-2026-43248}
    - mm/vmalloc: prevent RCU stalls in kasan_release_vmalloc_node (Deepanshu Kartikey) [Orabug: 39343546]     {CVE-2026-43292}
    - md/bitmap: fix GPF in write_page caused by resize race (Jack Wang) [Orabug: 39331482] {CVE-2026-43163}
    - xfs: check for deleted cursors when revalidating two btrees (Darrick J. Wong) [Orabug: 39103129]     {CVE-2026-23249}
    - xfs: check return value of xchk_scrub_create_subord (Darrick J. Wong) [Orabug: 39103131]     {CVE-2026-23250}
    - xfs: only call xf{array,blob}_destroy if we have a valid pointer (Darrick J. Wong) [Orabug: 39103133]     {CVE-2026-23251}
    - KVM: x86: Add SRCU protection for reading PDPTRs in __get_sregs2() (Vasiliy Kovalev) [Orabug: 39331693]     {CVE-2026-43214}
    - xfs: fix freemap adjustments when adding xattrs to leaf blocks (Darrick J. Wong) [Orabug: 39331458]     {CVE-2026-43158}
    - xfs: delete attr leaf freemap entries when empty (Darrick J. Wong) [Orabug: 39331580] {CVE-2026-43187}
    - mfd: core: Add locking around 'mfd_of_node_list' (Douglas Anderson) [Orabug: 39331409] {CVE-2026-43143}
    - iommu/vt-d: Flush dev-IOTLB only when PCIe device is accessible in scalable mode (Jinhui Guo) [Orabug:
    39331341] {CVE-2026-43130}
    - xfs: remove xfs_attr_leaf_hasname (Christoph Hellwig) [Orabug: 39331444] {CVE-2026-43153}
    - drm/buddy: Prevent BUG_ON by validating rounded allocation (Sanjay Yadav) [Orabug: 39331510]     {CVE-2026-43169}
    - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (Yosry Ahmed) [Orabug: 39331358]     {CVE-2026-43133}
    - dm: clear cloned request bio pointer when last clone bio completes (Michael Liang) [Orabug: 39331954]     {CVE-2026-43278}
    - media: ipu6: Fix RPM reference leak in probe error paths (Bingbu Cao) [Orabug: 39331545]     {CVE-2026-43177}
    - media: i2c/tw9906: Fix potential memory leak in tw9906_probe() (Abdun Nihaal) [Orabug: 39331821]     {CVE-2026-43246}
    - media: i2c/tw9903: Fix potential memory leak in tw9903_probe() (Abdun Nihaal) [Orabug: 39331705]     {CVE-2026-43218}
    - media: cx23885: Add missing unmap in snd_cx23885_hw_params() (Haoxiang Li) [Orabug: 39331366]     {CVE-2026-43135}
    - media: cx88: Add missing unmap in snd_cx88_hw_params() (Haoxiang Li) [Orabug: 39331866] {CVE-2026-43257}
    - media: radio-keene: fix memory leak in error path (Shaurya Rane) [Orabug: 39331752] {CVE-2026-43231}
    - HID: logitech-hidpp: Check maxfield in hidpp_get_report_length() (Gunther Noack) [Orabug: 39331370]     {CVE-2026-43136}
    - HID: prodikeys: Check presence of pm->input_ep82 (Gunther Noack) [Orabug: 39331846] {CVE-2026-43251}
    - HID: magicmouse: Do not crash on missing msc->input (Gunther Noack) [Orabug: 39331389] {CVE-2026-43140}
    - HID: hid-pl: handle probe errors (Oliver Neukum) [Orabug: 39331440] {CVE-2026-43152}
    - KVM: nSVM: Remove a user-triggerable WARN on nested_svm_load_cr3() succeeding (Sean Christopherson)     [Orabug: 39343613] {CVE-2026-43315}
    - dm-verity: correctly handle dm_bufio_client_create() failure (Eric Biggers) [Orabug: 39331353]     {CVE-2026-43132}
    - ASoC: SOF: ipc4-topology: Correct the allocation size for bytes controls (Peter Ujfalusi) [Orabug:
    39331023] {CVE-2025-71286}
    - rpmsg: core: fix race in driver_override_show() and use core helper (Gui-Dong Han) [Orabug: 39331012]     {CVE-2025-71274}
    - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (Vahagn Vardanian) [Orabug: 39331761]     {CVE-2026-43233}
    - net: consume xmit errors of GSO frames (Jakub Kicinski) [Orabug: 39331606] {CVE-2026-43194}
    - net/mlx5e: Fix 'scheduling while atomic' in IPsec MAC address query (Jianbo Liu) [Orabug: 39331628]     {CVE-2026-43199}
    - RDMA/umem: Fix double dma_buf_unpin in failure path (Jacob Moroni) [Orabug: 39331331] {CVE-2026-43128}
    - net: usb: pegasus: enable basic endpoint checking (Ziyi Guo) [Orabug: 39331449] {CVE-2026-43156}
    - tls: Fix race condition in tls_sw_cancel_work_tx() (Hyunwoo Kim) [Orabug: 39073883] {CVE-2026-23240}
    - Bluetooth: L2CAP: Fix missing key size check for L2CAP_LE_CONN_REQ (Luiz Augusto von Dentz) [Orabug:
    39331361] {CVE-2026-43134}
    - bnxt_en: Fix RSS context delete logic (Pavan Chebbi) [Orabug: 39331875] {CVE-2026-43260}
    - net: usb: kaweth: remove TX queue manipulation in kaweth_set_rx_mode (Ziyi Guo) [Orabug: 39331549]     {CVE-2026-43180}
    - xfrm: always flush state and policy upon NETDEV_UNREGISTER event (Tetsuo Handa) [Orabug: 39331496]     {CVE-2026-43167}
    - xfrm6: fix uninitialized saddr in xfrm6_get_saddr() (Jiayuan Chen) [Orabug: 39331383] {CVE-2026-43139}
    - ALSA: usb-audio: Add sanity check for OOB writes at silencing (Takashi Iwai) [Orabug: 39331959]     {CVE-2026-43279}
    - spi: spidev: fix lock inversion between spi_lock and buf_lock (Fabian Godehardt) [Orabug: 39343626]     {CVE-2026-43319}
    - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [Orabug: 39343577] {CVE-2026-43304}
    - netfilter: xt_tcpmss: check remaining length before reading optlen (Florian Westphal) [Orabug: 39331591]     {CVE-2026-43190}
    - ext4: move ext4_percpu_param_init() before ext4_mb_init() (Baokun Li) [Orabug: 39343531]     {CVE-2026-43288}
    - iommu/amd: move wait_on_sem() out of spinlock (Ankit Soni) [Orabug: 39331853] {CVE-2026-43253}
    - wifi: libertas: fix WARNING in usb_tx_block (Szymon Wilczek) [Orabug: 39331859] {CVE-2026-43255}
    - dm: remove fake timeout to avoid leak request (Ding Hui) [Orabug: 39343609] {CVE-2026-43314}
    - wifi: rtw88: Use devm_kmemdup() in rtw_set_supported_band() (Bitterblue Smith) [Orabug: 39331003]     {CVE-2025-71273}
    - wifi: rtw88: 8822b: Avoid WARNING in rtw8822b_config_trx_mode() (Bitterblue Smith) [Orabug: 39343515]     {CVE-2025-71297}
    - ALSA: mixer: oss: Add card disconnect checkpoints (Takashi Iwai) [Orabug: 39331318] {CVE-2026-43126}
    - ASoC: SOF: Intel: hda: Fix NULL pointer dereference (Ranjani Sridharan) [Orabug: 39331375]     {CVE-2026-43137}
    - drm: Account property blob allocations to memcg (Xiao Kan) [Orabug: 39343527] {CVE-2026-43287}
    - media: v4l2-async: Fix error handling on steps after finding a match (Sakari Ailus) [Orabug: 39331585]     {CVE-2026-43189}
    - media: solo6x10: Check for out of bounds chip_id (Kees Cook) [Orabug: 39343616] {CVE-2026-43316}
    - media: pvrusb2: fix URB leak in pvr2_send_request_ex (Szymon Wilczek) [Orabug: 39331719]     {CVE-2026-43223}
    - drm/amd/display: Add signal type check for dcn401 get_phyd32clk_src (Dmytro Laktyushkin) [Orabug:
    39331807] {CVE-2026-43243}
    - drm/amd/display: Fix dsc eDP issue (Charlene Liu) [Orabug: 39343628] {CVE-2026-43320}
    - drm/amdgpu: fix NULL pointer issue buffer funcs (Likun Gao) [Orabug: 39331070] {CVE-2025-71294}
    - pstore: ram_core: fix incorrect success return when vmap() fails (Ruipeng Qi) [Orabug: 39331308]     {CVE-2026-43124}
    - bpf: crypto: Use the correct destructor kfunc type (Sami Tolvanen) [Orabug: 39343581] {CVE-2026-43306}
    - md-cluster: fix NULL pointer dereference in process_metadata_update (Jiasheng Jiang) [Orabug: 39331918]     {CVE-2026-43271}
    - ACPI: processor: Fix NULL-pointer dereference in acpi_processor_errata_piix4() (Tuo Li) [Orabug:
    39343603] {CVE-2026-43313}
    - EFI/CPER: don't go past the ARM processor CPER record buffer (Mauro Carvalho Chehab) [Orabug: 39331896]     {CVE-2026-43266}
    - APEI/GHES: ARM processor Error: don't go past allocated memory (Mauro Carvalho Chehab) [Orabug:
    39331636] {CVE-2026-43201}
    - APEI/GHES: ensure that won't go past CPER allocated record (Mauro Carvalho Chehab) [Orabug: 39331947]     {CVE-2026-43277}
    - EFI/CPER: don't dump the entire memory region (Mauro Carvalho Chehab) [Orabug: 39331518]     {CVE-2026-43171}
    - arm64: Add support for TSV110 Spectre-BHB mitigation (Jinqian Yang) [Orabug: 39331877] {CVE-2026-43261}
    - smb: client: prevent races in ->query_interfaces() (Henrique Carvalho) [Orabug: 39331789]     {CVE-2026-43239}
    - gfs2: fiemap page fault fix (Andreas Gruenbacher) [Orabug: 39331882] {CVE-2026-43262}
    - dlm: validate length in dlm_search_rsb_tree (Ziming Zhang) [Orabug: 39331312] {CVE-2026-43125}
    - fs/buffer: add alert in try_to_free_buffers() for folios without buffers (Deepakkumar Karn) [Orabug:
    39331077] {CVE-2025-71295}
    - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Eric Dumazet) [Orabug:
    39110677] {CVE-2026-23273}
    - net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (Jiayuan Chen) [Orabug: 39188476]     {CVE-2026-31411}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1693 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    af_unix: Give up GC if MSG_PEEK intervened. (CVE-2026-23394)

    In the Linux kernel, the following vulnerability has been resolved:

    ipv6: add NULL checks for idev in SRv6 paths (CVE-2026-23442)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: conntrack: add missing netlink policy validations (CVE-2026-31407)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: ipset: drop logically empty buckets in mtype_del (CVE-2026-31418)

    In the Linux kernel, the following vulnerability has been resolved:

    net: skb: fix cross-cache free of KFENCE-allocated skb head (CVE-2026-31429)

    In the Linux kernel, the following vulnerability has been resolved:

    X.509: Fix out-of-bounds access when parsing extensions (CVE-2026-31430)

    In the Linux kernel, the following vulnerability has been resolved:

    ipv4: nexthop: allocate skb dynamically in rtm_get_nexthop() (CVE-2026-31531)

    In the Linux kernel, the following vulnerability has been resolved:

    can: raw: fix ro->uniq use-after-free in raw_rcv() (CVE-2026-31532)

    In the Linux kernel, the following vulnerability has been resolved:

    net/tls: fix use-after-free in -EBUSY error path of tls_do_encryption (CVE-2026-31533)

    In the Linux kernel, the following vulnerability has been resolved:

    mm/userfaultfd: fix hugetlb fault mutex hash calculation (CVE-2026-31575)

    In the Linux kernel, the following vulnerability has been resolved:

    wireguard: device: use exit_rtnl callback instead of manual rtnl_lock in pre_exit (CVE-2026-31579)

    In the Linux kernel, the following vulnerability has been resolved:

    bcache: fix cached_dev.sb_bio use-after-free and crash (CVE-2026-31580)

    In the Linux kernel, the following vulnerability has been resolved:

    mm: blk-cgroup: fix use-after-free in cgwb_release_workfn() (CVE-2026-31586)

    In the Linux kernel, the following vulnerability has been resolved:

    KVM: x86: Use scratch field in MMIO fragment to hold small write values (CVE-2026-31588)

    In the Linux kernel, the following vulnerability has been resolved:

    KVM: SEV: Lock all vCPUs when synchronzing VMSAs for SNP launch finish (CVE-2026-31591)

    In the Linux kernel, the following vulnerability has been resolved:

    KVM: SEV: Protect *all* of sev_mem_enc_register_region() with kvm->lock (CVE-2026-31592)

    In the Linux kernel, the following vulnerability has been resolved:

    KVM: SEV: Reject attempts to sync VMSA of an already-launched/encrypted vCPU (CVE-2026-31593)

    In the Linux kernel, the following vulnerability has been resolved:

    arm64: mm: Handle invalid large leaf mappings correctly (CVE-2026-31600)

    In the Linux kernel, the following vulnerability has been resolved:

    usbip: validate number_of_packets in usbip_pack_ret_submit() (CVE-2026-31607)

    In the Linux kernel, the following vulnerability has been resolved:

    smb: client: fix OOB reads parsing symlink error response (CVE-2026-31613)

    In the Linux kernel, the following vulnerability has been resolved:

    smb: client: fix off-by-8 bounds check in check_wsl_eas() (CVE-2026-31614)

    In the Linux kernel, the following vulnerability has been resolved:

    HID: core: clamp report_size in s32ton() to avoid undefined shift (CVE-2026-31624)

    In the Linux kernel, the following vulnerability has been resolved:

    HID: alps: fix NULL pointer dereference in alps_raw_event() (CVE-2026-31625)

    In the Linux kernel, the following vulnerability has been resolved:

    x86/CPU: Fix FPDSS on Zen1 (CVE-2026-31628)

    In the Linux kernel, the following vulnerability has been resolved:

    rxrpc: fix reference count leak in rxrpc_server_keyring() (CVE-2026-31634)

    In the Linux kernel, the following vulnerability has been resolved:

    rxrpc: reject undecryptable rxkad response tickets (CVE-2026-31637)

    In the Linux kernel, the following vulnerability has been resolved:

    mm: filemap: fix nr_pages calculation overflow in filemap_map_pages() (CVE-2026-31648)

    In the Linux kernel, the following vulnerability has been resolved:

    mm/damon/sysfs: dealloc repeat_call_control if damon_call() fails (CVE-2026-31653)

    In the Linux kernel, the following vulnerability has been resolved:

    drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CVE-2026-31656)

    In the Linux kernel, the following vulnerability has been resolved:

    tipc: fix bc_ackers underflow on duplicate GRP_ACK_MSG (CVE-2026-31662)

    In the Linux kernel, the following vulnerability has been resolved:

    xfrm: hold dev ref until after transport_finish NF_HOOK (CVE-2026-31663)

    In the Linux kernel, the following vulnerability has been resolved:

    xfrm: clear trailing padding in build_polexpire() (CVE-2026-31664)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: nft_ct: fix use-after-free in timeout object destroy (CVE-2026-31665)

    In the Linux kernel, the following vulnerability has been resolved:

    btrfs: fix incorrect return value after changing leaf in lookup_extent_data_ref() (CVE-2026-31666)

    In the Linux kernel, the following vulnerability has been resolved:

    Input: uinput - fix circular locking dependency with ff-core (CVE-2026-31667)

    In the Linux kernel, the following vulnerability has been resolved:

    seg6: separate dst_cache for input and output paths in seg6 lwtunnel (CVE-2026-31668)

    In the Linux kernel, the following vulnerability has been resolved:

    mptcp: fix slab-use-after-free in __inet_lookup_established (CVE-2026-31669)

    In the Linux kernel, the following vulnerability has been resolved:

    xfrm_user: fix info leak in build_report() (CVE-2026-31671)

    In the Linux kernel, the following vulnerability has been resolved:

    af_unix: read UNIX_DIAG_VFS data under unix_state_lock (CVE-2026-31673)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: xt_multiport: validate range encoding in checkentry (CVE-2026-31681)

    In the Linux kernel, the following vulnerability has been resolved:

    net: sched: act_csum: validate nested VLAN headers (CVE-2026-31684)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: ip6t_eui64: reject invalid MAC header for all packets (CVE-2026-31685)

    In the Linux kernel, the following vulnerability has been resolved:

    EDAC/mc: Fix error path ordering in edac_mc_alloc() (CVE-2026-31689)

    In the Linux kernel, the following vulnerability has been resolved:

    igb: remove napi_synchronize() in igb_down() (CVE-2026-31691)

    In the Linux kernel, the following vulnerability has been resolved:

    rtnetlink: add missing netlink_ns_capable() check for peer netns (CVE-2026-31692)

    In the Linux kernel, the following vulnerability has been resolved:

    fuse: reject oversized dirents in page cache (CVE-2026-31694)

    In the Linux kernel, the following vulnerability has been resolved:

    net/packet: fix TOCTOU race on mmap'd vnet_hdr in tpacket_snd() (CVE-2026-31700)

    In the Linux kernel, the following vulnerability has been resolved:

    writeback: Fix use after free in inode_switch_wbs_work_fn() (CVE-2026-31703)

    In the Linux kernel, the following vulnerability has been resolved:

    smb: client: fix OOB read in smb2_ioctl_query_info QUERY_INFO path (CVE-2026-31708)

    In the Linux kernel, the following vulnerability has been resolved:

    fuse: abort on fatal signal during sync init (CVE-2026-31713)

    In the Linux kernel, the following vulnerability has been resolved:

    fs/ntfs3: validate rec->used in journal-replay file record check (CVE-2026-31716)

    In the Linux kernel, the following vulnerability has been resolved:

    crypto: krb5enc - fix async decrypt skipping hash verification (CVE-2026-31719)

    In the Linux kernel, the following vulnerability has been resolved:

    dcache: Limit the minimal number of bucket to two (CVE-2026-43071)

    In the Linux kernel, the following vulnerability has been resolved:

    x86-64: rename misleadingly named '__copy_user_nocache()' function (CVE-2026-43073)

    In the Linux kernel, the following vulnerability has been resolved:

    eventpoll: defer struct eventpoll free to RCU grace period (CVE-2026-43074)

    In the Linux kernel, the following vulnerability has been resolved:

    perf/x86/intel/uncore: Skip discovery table for offline dies (CVE-2026-43079)

    In the Linux kernel, the following vulnerability has been resolved:

    net: ioam6: fix OOB and missing lock (CVE-2026-43083)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: nfnetlink_queue: make hash table per queue (CVE-2026-43084)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator (CVE-2026-43085)

    In the Linux kernel, the following vulnerability has been resolved:

    ipvs: fix NULL deref in ip_vs_add_service error path (CVE-2026-43086)

    In the Linux kernel, the following vulnerability has been resolved:

    xfrm_user: fix info leak in build_mapping() (CVE-2026-43089)

    In the Linux kernel, the following vulnerability has been resolved:

    xfrm: fix refcount leak in xfrm_migrate_policy_find (CVE-2026-43090)

    In the Linux kernel, the following vulnerability has been resolved:

    xfrm: Wait for RCU readers during policy netns exit (CVE-2026-43091)

    In the Linux kernel, the following vulnerability has been resolved:

    xsk: validate MTU against usable frame size on bind (CVE-2026-43092)

    In the Linux kernel, the following vulnerability has been resolved:

    xsk: tighten UMEM headroom validation to account for tailroom and min frame (CVE-2026-43093)

    In the Linux kernel, the following vulnerability has been resolved:

    ixgbevf: add missing negotiate_features op to Hyper-V ops table (CVE-2026-43094)

    In the Linux kernel, the following vulnerability has been resolved:

    ipv4: icmp: fix null-ptr-deref in icmp_build_probe() (CVE-2026-43099)

    In the Linux kernel, the following vulnerability has been resolved:

    bridge: guard local VLAN-0 FDB helpers against NULL vlan group (CVE-2026-43100)

    In the Linux kernel, the following vulnerability has been resolved:

    ipv6: ioam: fix potential NULL dereferences in __ioam6_fill_trace_data() (CVE-2026-43101)

    In the Linux kernel, the following vulnerability has been resolved:

    xfrm: account XFRMA_IF_ID in aevent size calculation (CVE-2026-43107)

    In the Linux kernel, the following vulnerability has been resolved:

    x86: shadow stacks: proper error handling for mmap lock (CVE-2026-43109)

    In the Linux kernel, the following vulnerability has been resolved:

    fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CVE-2026-43112)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CVE-2026-43114)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: ctnetlink: ensure safe access to master conntrack (CVE-2026-43116)

    In the Linux kernel, the following vulnerability has been resolved:

    btrfs: tracepoints: get correct superblock from dentry in event btrfs_sync_file() (CVE-2026-43117)

    In the Linux kernel, the following vulnerability has been resolved:

    btrfs: fix zero size inode with non-zero size after log replay (CVE-2026-43118)

    In the Linux kernel, the following vulnerability has been resolved:xfrm: esp: avoid in-place decrypt on     shared skb frags

    Dirty Frag and other issues in Amazon Linux kernels:https://aws.amazon.com/security/security-     bulletins/2026-027-aws/ (CVE-2026-43284)

    In the Linux kernel, the following vulnerability has been resolved:

    smb: client: require a full NFS mode SID before reading mode bits (CVE-2026-43350)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1695 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    btrfs: do not free data reservation in fallback from inline due to -ENOSPC (CVE-2025-71269)

    In the Linux kernel, the following vulnerability has been resolved:

    gpiolib: fix race condition for gdev->srcu (CVE-2026-22986)

    In the Linux kernel, the following vulnerability has been resolved:

    net: annotate data-races around sk->sk_{data_ready,write_space} (CVE-2026-23302)

    In the Linux kernel, the following vulnerability has been resolved:

    blktrace: fix __this_cpu_read/write in preemptible context (CVE-2026-23374)

    In the Linux kernel, the following vulnerability has been resolved:

    ice: Fix memory leak in ice_set_ringparam() (CVE-2026-23389)

    In the Linux kernel, the following vulnerability has been resolved:

    ipv6: add NULL checks for idev in SRv6 paths (CVE-2026-23442)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: conntrack: add missing netlink policy validations (CVE-2026-31407)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: nf_conntrack_expect: use expect->helper (CVE-2026-31414)

    In the Linux kernel, the following vulnerability has been resolved:

    ipv6: avoid overflows in ip6_datagram_send_ctl() (CVE-2026-31415)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: nfnetlink_log: account for netlink header size (CVE-2026-31416)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: ipset: drop logically empty buckets in mtype_del (CVE-2026-31418)

    In the Linux kernel, the following vulnerability has been resolved:

    net/sched: cls_fw: fix NULL pointer dereference on shared blocks (CVE-2026-31421)

    In the Linux kernel, the following vulnerability has been resolved:

    net/sched: cls_flow: fix NULL pointer dereference on shared blocks (CVE-2026-31422)

    In the Linux kernel, the following vulnerability has been resolved:

    net/sched: sch_hfsc: fix divide-by-zero in rtsc_min() (CVE-2026-31423)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP (CVE-2026-31424)

    In the Linux kernel, the following vulnerability has been resolved:

    net: skb: fix cross-cache free of KFENCE-allocated skb head (CVE-2026-31429)

    In the Linux kernel, the following vulnerability has been resolved:

    X.509: Fix out-of-bounds access when parsing extensions (CVE-2026-31430)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: publish jinode after initialization (CVE-2026-31450)

    In the Linux kernel, the following vulnerability has been resolved:

    mm/huge_memory: fix folio isn't locked in softleaf_to_folio() (CVE-2026-31466)

    In the Linux kernel, the following vulnerability has been resolved:

    ipv4: nexthop: allocate skb dynamically in rtm_get_nexthop() (CVE-2026-31531)

    In the Linux kernel, the following vulnerability has been resolved:

    can: raw: fix ro->uniq use-after-free in raw_rcv() (CVE-2026-31532)

    In the Linux kernel, the following vulnerability has been resolved:

    net/tls: fix use-after-free in -EBUSY error path of tls_do_encryption (CVE-2026-31533)

    In the Linux kernel, the following vulnerability has been resolved:

    bcache: fix cached_dev.sb_bio use-after-free and crash (CVE-2026-31580)

    In the Linux kernel, the following vulnerability has been resolved:

    mm: blk-cgroup: fix use-after-free in cgwb_release_workfn() (CVE-2026-31586)

    In the Linux kernel, the following vulnerability has been resolved:

    KVM: x86: Use scratch field in MMIO fragment to hold small write values (CVE-2026-31588)

    In the Linux kernel, the following vulnerability has been resolved:

    KVM: SEV: Reject attempts to sync VMSA of an already-launched/encrypted vCPU (CVE-2026-31593)

    In the Linux kernel, the following vulnerability has been resolved:

    usbip: validate number_of_packets in usbip_pack_ret_submit() (CVE-2026-31607)

    In the Linux kernel, the following vulnerability has been resolved:

    smb: client: fix off-by-8 bounds check in check_wsl_eas() (CVE-2026-31614)

    In the Linux kernel, the following vulnerability has been resolved:

    HID: core: clamp report_size in s32ton() to avoid undefined shift (CVE-2026-31624)

    In the Linux kernel, the following vulnerability has been resolved:

    HID: alps: fix NULL pointer dereference in alps_raw_event() (CVE-2026-31625)

    In the Linux kernel, the following vulnerability has been resolved:

    x86/CPU: Fix FPDSS on Zen1 (CVE-2026-31628)

    In the Linux kernel, the following vulnerability has been resolved:

    rxrpc: fix reference count leak in rxrpc_server_keyring() (CVE-2026-31634)

    In the Linux kernel, the following vulnerability has been resolved:

    rxrpc: reject undecryptable rxkad response tickets (CVE-2026-31637)

    In the Linux kernel, the following vulnerability has been resolved:

    mm: filemap: fix nr_pages calculation overflow in filemap_map_pages() (CVE-2026-31648)

    In the Linux kernel, the following vulnerability has been resolved:

    drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CVE-2026-31656)

    In the Linux kernel, the following vulnerability has been resolved:

    tipc: fix bc_ackers underflow on duplicate GRP_ACK_MSG (CVE-2026-31662)

    In the Linux kernel, the following vulnerability has been resolved:

    xfrm: clear trailing padding in build_polexpire() (CVE-2026-31664)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: nft_ct: fix use-after-free in timeout object destroy (CVE-2026-31665)

    In the Linux kernel, the following vulnerability has been resolved:

    btrfs: fix incorrect return value after changing leaf in lookup_extent_data_ref() (CVE-2026-31666)

    In the Linux kernel, the following vulnerability has been resolved:

    Input: uinput - fix circular locking dependency with ff-core (CVE-2026-31667)

    In the Linux kernel, the following vulnerability has been resolved:

    seg6: separate dst_cache for input and output paths in seg6 lwtunnel (CVE-2026-31668)

    In the Linux kernel, the following vulnerability has been resolved:

    mptcp: fix slab-use-after-free in __inet_lookup_established (CVE-2026-31669)

    In the Linux kernel, the following vulnerability has been resolved:

    xfrm_user: fix info leak in build_report() (CVE-2026-31671)

    In the Linux kernel, the following vulnerability has been resolved:

    af_unix: read UNIX_DIAG_VFS data under unix_state_lock (CVE-2026-31673)

    In the Linux kernel, the following vulnerability has been resolved:

    net/sched: sch_netem: fix out-of-bounds access in packet corruption (CVE-2026-31675)

    In the Linux kernel, the following vulnerability has been resolved:

    crypto: af_alg - limit RX SG extraction by receive buffer budget (CVE-2026-31677)

    In the Linux kernel, the following vulnerability has been resolved:

    net: ipv6: flowlabel: defer exclusive option free until RCU teardown (CVE-2026-31680)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: xt_multiport: validate range encoding in checkentry (CVE-2026-31681)

    In the Linux kernel, the following vulnerability has been resolved:

    bridge: br_nd_send: linearize skb before parsing ND options (CVE-2026-31682)

    In the Linux kernel, the following vulnerability has been resolved:

    net: sched: act_csum: validate nested VLAN headers (CVE-2026-31684)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: ip6t_eui64: reject invalid MAC header for all packets (CVE-2026-31685)

    In the Linux kernel, the following vulnerability has been resolved:

    EDAC/mc: Fix error path ordering in edac_mc_alloc() (CVE-2026-31689)

    In the Linux kernel, the following vulnerability has been resolved:

    thermal: core: Address thermal zone removal races with resume (CVE-2026-31731)

    In the Linux kernel, the following vulnerability has been resolved:

    sched_ext: Fix stale direct dispatch state in ddsp_dsq_id (CVE-2026-31733)

    In the Linux kernel, the following vulnerability has been resolved:

    vxlan: validate ND option lengths in vxlan_na_create (CVE-2026-31738)

    In the Linux kernel, the following vulnerability has been resolved:

    bridge: br_nd_send: validate ND option lengths (CVE-2026-31752)

    In the Linux kernel, the following vulnerability has been resolved:

    drm/i915/dsi: Don't do DSC horizontal timing adjustments in command mode (CVE-2026-31767)

    In the Linux kernel, the following vulnerability has been resolved:

    io_uring/net: fix slab-out-of-bounds read in io_bundle_nbufs() (CVE-2026-31774)

    In the Linux kernel, the following vulnerability has been resolved:

    drm/ioc32: stop speculation on the drm_compat_ioctl path (CVE-2026-31781)

    In the Linux kernel, the following vulnerability has been resolved:

    net/mlx5: Fix switchdev mode rollback in case of failure (CVE-2026-43012)

    In the Linux kernel, the following vulnerability has been resolved:

    net/mlx5: lag: Check for LAG device before creating debugfs (CVE-2026-43013)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf: sockmap: Fix use-after-free of sk->sk_socket in sk_psock_verdict_data_ready(). (CVE-2026-43016)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: nf_tables: reject immediate NF_QUEUE verdict (CVE-2026-43024)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: ctnetlink: ignore explicit helper on new expectations (CVE-2026-43025)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (CVE-2026-43026)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: nf_conntrack_helper: pass helper to expect cleanup (CVE-2026-43027)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: x_tables: ensure names are nul-terminated (CVE-2026-43028)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf: Fix regsafe() for pointers to packet (CVE-2026-43030)

    In the Linux kernel, the following vulnerability has been resolved:

    net: sched: cls_api: fix tc_chain_fill_node to initialize tcm_info to zero to prevent an info-leak     (CVE-2026-43035)

    In the Linux kernel, the following vulnerability has been resolved:

    net: use skb_header_pointer() for TCPv4 GSO frag_off check (CVE-2026-43036)

    In the Linux kernel, the following vulnerability has been resolved:

    ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (CVE-2026-43037)

    In the Linux kernel, the following vulnerability has been resolved:

    ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (CVE-2026-43038)

    In the Linux kernel, the following vulnerability has been resolved:

    net: ipv6: ndisc: fix ndisc_ra_useropt to initialize nduseropt_padX fields to zero to prevent an info-leak     (CVE-2026-43040)

    In the Linux kernel, the following vulnerability has been resolved:

    crypto: af-alg - fix NULL pointer dereference in scatterwalk (CVE-2026-43043)

    In the Linux kernel, the following vulnerability has been resolved:

    btrfs: reject root items with drop_progress and zero drop_level (CVE-2026-43046)

    In the Linux kernel, the following vulnerability has been resolved:

    HID: multitouch: Check to ensure report responses match the request (CVE-2026-43047)

    In the Linux kernel, the following vulnerability has been resolved:

    scsi: target: tcm_loop: Drain commands in target_reset handler (CVE-2026-43054)

    In the Linux kernel, the following vulnerability has been resolved:

    net: correctly handle tunneled traffic on IPV6_CSUM GSO fallback (CVE-2026-43057)

    In the Linux kernel, the following vulnerability has been resolved:

    dcache: Limit the minimal number of bucket to two (CVE-2026-43071)

    In the Linux kernel, the following vulnerability has been resolved:

    x86-64: rename misleadingly named '__copy_user_nocache()' function (CVE-2026-43073)

    In the Linux kernel, the following vulnerability has been resolved:

    eventpoll: defer struct eventpoll free to RCU grace period (CVE-2026-43074)

    In the Linux kernel, the following vulnerability has been resolved:

    perf/x86/intel/uncore: Skip discovery table for offline dies (CVE-2026-43079)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: nfnetlink_queue: make hash table per queue (CVE-2026-43084)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator (CVE-2026-43085)

    In the Linux kernel, the following vulnerability has been resolved:

    ipvs: fix NULL deref in ip_vs_add_service error path (CVE-2026-43086)

    In the Linux kernel, the following vulnerability has been resolved:

    xfrm_user: fix info leak in build_mapping() (CVE-2026-43089)

    In the Linux kernel, the following vulnerability has been resolved:

    xfrm: fix refcount leak in xfrm_migrate_policy_find (CVE-2026-43090)

    In the Linux kernel, the following vulnerability has been resolved:

    xfrm: Wait for RCU readers during policy netns exit (CVE-2026-43091)

    In the Linux kernel, the following vulnerability has been resolved:

    xsk: validate MTU against usable frame size on bind (CVE-2026-43092)

    In the Linux kernel, the following vulnerability has been resolved:

    xsk: tighten UMEM headroom validation to account for tailroom and min frame (CVE-2026-43093)

    In the Linux kernel, the following vulnerability has been resolved:

    ixgbevf: add missing negotiate_features op to Hyper-V ops table (CVE-2026-43094)

    In the Linux kernel, the following vulnerability has been resolved:

    ipv4: icmp: fix null-ptr-deref in icmp_build_probe() (CVE-2026-43099)

    In the Linux kernel, the following vulnerability has been resolved:

    xfrm: account XFRMA_IF_ID in aevent size calculation (CVE-2026-43107)

    In the Linux kernel, the following vulnerability has been resolved:

    fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CVE-2026-43112)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CVE-2026-43114)

    In the Linux kernel, the following vulnerability has been resolved:

    btrfs: tracepoints: get correct superblock from dentry in event btrfs_sync_file() (CVE-2026-43117)

    In the Linux kernel, the following vulnerability has been resolved:xfrm: esp: avoid in-place decrypt on     shared skb frags

    Dirty Frag and other issues in Amazon Linux kernels:https://aws.amazon.com/security/security-     bulletins/2026-027-aws/ (CVE-2026-43284)

    In the Linux kernel, the following vulnerability has been resolved:

    sched/fair: Fix zero_vruntime tracking fix (CVE-2026-43323)

    In the Linux kernel, the following vulnerability has been resolved:

    cpufreq: governor: fix double free in cpufreq_dbs_governor_init() error path (CVE-2026-43328)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: flowtable: strictly check for maximum number of actions (CVE-2026-43329)

    In the Linux kernel, the following vulnerability has been resolved:

    thermal: core: Fix thermal zone device registration error path (CVE-2026-43332)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf: reject direct access to nullable PTR_TO_BUF pointers (CVE-2026-43333)

    In the Linux kernel, the following vulnerability has been resolved:

    lib/crypto: chacha: Zeroize permuted_state before it leaves scope (CVE-2026-43336)

    In the Linux kernel, the following vulnerability has been resolved:

    btrfs: reserve enough transaction items for qgroup ioctls (CVE-2026-43338)

    In the Linux kernel, the following vulnerability has been resolved:

    ipv6: prevent possible UaF in addrconf_permanent_addr() (CVE-2026-43339)

    In the Linux kernel, the following vulnerability has been resolved:

    net/ipv6: ioam6: prevent schema length wraparound in trace fill (CVE-2026-43341)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - In the Linux kernel, the following vulnerability has been resolved: netfilter: nfnetlink_queue: make hash     table per queue Sharing a global hash table among all queues is tempting, but it can cause crash: BUG:
    KASAN: slab-use-after-free in nfqnl_recv_verdict+0x11ac/0x15e0 [nfnetlink_queue] [..]     nfqnl_recv_verdict+0x11ac/0x15e0 [nfnetlink_queue] nfnetlink_rcv_msg+0x46a/0x930     kmem_cache_alloc_node_noprof+0x11e/0x450 struct nf_queue_entry is freed via kfree, but parallel cpu can     still encounter such an nf_queue_entry when walking the list. Alternative fix is to free the     nf_queue_entry via kfree_rcu() instead, but as we have to alloc/free for each skb this will cause more mem     pressure. (CVE-2026-43084)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
340680	Ubuntu 24.04 LTS / Pro Realtime 24.04 LTS : Linux kernel (Raspberry Pi) vulnerabilities (USN-8665-1)	Nessus	Ubuntu Local Security Checks	Local	high
333798	Photon OS 5.0: Linux PHSA-2026-5.0-92-0849	Nessus	PhotonOS Local Security Checks	Local	high
325292	Oracle Linux 10 / 9 : Unbreakable Enterprise kernel (ELSA-2026-50372)	Nessus	Oracle Linux Local Security Checks	Local	high
318589	Oracle Linux 10 / 9 : Unbreakable Enterprise kernel (ELSA-2026-50293)	Nessus	Oracle Linux Local Security Checks	Local	high
313525	Amazon Linux 2023 : bpftool6.18, kernel6.18, kernel6.18-devel (ALAS2023-2026-1693)	Nessus	Amazon Linux Local Security Checks	Local	high
313517	Amazon Linux 2023 : bpftool6.12, kernel6.12, kernel6.12-devel (ALAS2023-2026-1695)	Nessus	Amazon Linux Local Security Checks	Local	high
312784	Linux Distros Unpatched Vulnerability : CVE-2026-43084	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2026-43084

high

Tenable Plugins

high

high

high

high

high

high

high