In the Linux kernel, the following vulnerability has been resolved: tcp: fix potential race in tcp_v6_syn_recv_sock() Code in tcp_v6_syn_recv_sock() after the call to tcp_v4_syn_recv_sock() is done too late. After tcp_v4_syn_recv_sock(), the child socket is already visible from TCP ehash table and other cpus might use it. Since newinet->pinet6 is still pointing to the listener ipv6_pinfo bad things can happen as syzbot found. Move the problematic code in tcp_v6_mapped_child_init() and call this new helper from tcp_v4_syn_recv_sock() before the ehash insertion. This allows the removal of one tcp_sync_mss(), since tcp_v4_syn_recv_sock() will call it with the correct context.

suse_linux SUSE-SU-2026:2722-1: SUSE SLED15 / SLES15 : Security update for the Linux Kernel (Important) (SUSE-SU-2026:2722-1)

redhat RHSA-2026:34443: RHSA-2026:34443: kernel security update (Important)

alma_linux ALSA-2026:33285: ALSA-2026:33285: kernel security, bug fix, and enhancement update (High)

redhat RHSA-2026:34094: RHSA-2026:34094: kernel security, bug fix, and enhancement update (Important)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:33285 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (CVE-2026-31411)

    * kernel: tcp: fix potential race in tcp_v6_syn_recv_sock() (CVE-2026-43198)

    Bug Fix(es) and Enhancement(s):

    * [RHEL 9.8 Bug] qla2xxx flash image validation failure [rhel-9.8.z] (JIRA:RHEL-181886)

    * crypto: testmgr - allow authenc(hmac(sha{256,384}),cts(cbc(aes))) in FIPS mode [rhel-9.8.z]     (JIRA:RHEL-182540)

    * tegra-se fixes and updates [rhel-9.8.z] (JIRA:RHEL-182760)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:33215 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: mptcp: fix slab-use-after-free in __inet_lookup_established (CVE-2026-31669)

    * kernel: RDMA/umem: Fix double dma_buf_unpin in failure path (CVE-2026-43128)

    * kernel: xfs: fix freemap adjustments when adding xattrs to leaf blocks (CVE-2026-43158)

    * kernel: tcp: fix potential race in tcp_v6_syn_recv_sock() (CVE-2026-43198)

    * kernel: mm/page_alloc: clear page->private in free_pages_prepare() (CVE-2026-43303)

    * kernel: net/ipv6: ioam6: prevent schema length wraparound in trace fill (CVE-2026-43341)

    * kernel: netfilter: flowtable: strictly check for maximum number of actions (CVE-2026-43329)

    * kernel: ALSA: aloop: Fix peer runtime UAF during format-change stop (CVE-2026-46090)

    * kernel: RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CVE-2026-46176)

    * kernel: wifi: mac80211: use safe list iteration in radar detect work (CVE-2026-46166)

    * kernel: netfilter: nft_inner: Fix IPv6 inner_thoff desync (CVE-2026-46244)

    Bug Fix(es) and Enhancement(s):

    * Backport KVM: arm64: Hide ID_AA64MMFR2_EL1.NV from guest and userspace [rhel-10.0.z]     (JIRA:RHEL-134762)

    * Kernel panic while shutting down ice driver due to use-after-free [rhel-10.0.z] (JIRA:RHEL-177516)

    * crypto: testmgr - allow authenc(hmac(sha{256,384}),cts(cbc(aes))) in FIPS mode [rhel-10.0.z]     (JIRA:RHEL-182536)

    * RHEL10.0 - s390/mm: Add missing secure storage access fixups [rhel-10.0.z] (JIRA:RHEL-183318)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:30129 advisory.

    * kernel: rxrpc: fix RESPONSE authenticator parser OOB read (CVE-2026-31636)
      * kernel: ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (CVE-2026-43038)
      * kernel: tcp: fix potential race in tcp_v6_syn_recv_sock() (CVE-2026-43198)
      * kernel: scsi: qla2xxx: Completely fix fcport double free (CVE-2026-43414)
      * kernel: RDMA/iwcm: Fix workqueue list corruption by removing work_list (CVE-2026-45898)
      * kernel: RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CVE-2026-46117)
      * kernel: RDMA/mana: Validate rx_hash_key_len (CVE-2026-46145)
      * kernel: nvmet-tcp: fix race between ICReq handling and queue teardown (CVE-2026-46135)
      * kernel: KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry     (CVE-2026-46316)


    Bug Fix(es) and Enhancement(s):

      * Unexpected execmem SELinux denials after CVE-2026-46054 fix [rhel-10.2.z] (JIRA:RHEL-185117)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:2658-1 advisory.

    The SUSE Linux Enterprise 15 SP5 kernel was updated to fix various security issues

    The following security issues were fixed:

    - CVE-2025-10263: arm64: errata: Mitigate TLBI errata on various Arm CPUs (bsc#1266290).
    - CVE-2025-68324: scsi: imm: Fix use-after-free bug caused by unfinished delayed work (bsc#1255416).
    - CVE-2026-23392: netfilter: nf_tables: release flowtable after rcu grace period on error (bsc#1260531).
    - CVE-2026-31405: media: dvb-net: fix OOB access in ULE extension header tables (bsc#1261700).
    - CVE-2026-31473: media: mc, v4l2: serialize REINIT and REQBUFS with req_queue_mutex (bsc#1262663).
    - CVE-2026-31500: Bluetooth: btintel: serialize btintel_hw_error() with hci_req_sync_lock (bsc#1262993).
    - CVE-2026-31613: smb: client: fix OOB reads parsing symlink error response (bsc#1263769).
    - CVE-2026-31697: crypto: ccp: Don't attempt to copy ID to userspace if PSP command failed (bsc#1264116).
    - CVE-2026-31698: crypto: ccp: Don't attempt to copy PDH cert to userspace if PSP command failed     (bsc#1263880).
    - CVE-2026-31699: crypto: ccp: Don't attempt to copy CSR to userspace if PSP command failed (bsc#1263879).
    - CVE-2026-31758: usb: usbtmc: Flush anchored URBs in usbtmc_release (bsc#1264093).
    - CVE-2026-31759: usb: ulpi: fix double free in ulpi_register_interface() error path (bsc#1264076).
    - CVE-2026-43077: crypto: algif_aead - Fix minimum RX size check for decryption (bsc#1264470).
    - CVE-2026-43198: tcp: fix potential race in tcp_v6_syn_recv_sock() (bsc#1264610).
    - CVE-2026-43366: io_uring/kbuf: check if target buffer list is still legacy on recycle (bsc#1265116).
    - CVE-2026-45886: bpf: Fix bpf_xdp_store_bytes proto for read-only arg (bsc#1266810).
    - CVE-2026-45970: bonding: alb: fix UAF in rlb_arp_recv during bond up/down (bsc#1267205).
    - CVE-2026-45984: gfs2: Move the inode glock locking to gfs2_file_buffered_write (bsc#1267214).
    - CVE-2026-46021: thermal: core: Fix thermal zone governor cleanup issues (bsc#1267220).
    - CVE-2026-46037: ipv4: icmp: validate reply type before using icmp_pointers (bsc#1267361).
    - CVE-2026-46113: KVM: x86/mmu: Add helper to convert SPTE value to its shadow page (bsc#1266969).
    - CVE-2026-46116: xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (bsc#1267369).
    - CVE-2026-46120: ip6_gre: Use cached t->net in ip6erspan_changelink() (bsc#1267640).
    - CVE-2026-46123: Bluetooth: virtio_bt: clamp rx length before skb_put (bsc#1267621).
    - CVE-2026-46150: fanotify: fix false positive on permission events (bsc#1267387).
    - CVE-2026-46159: btrfs: fix btrfs_ioctl_space_info() slot_count TOCTOU which can lead to info-leak     (bsc#1267652).
    - CVE-2026-46227: sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (bsc#1267697).
    - CVE-2026-46273: ibmveth: Disable GSO for packets with small MSS (bsc#1265211 bsc#1267651).

    The following non security issues were fixed:

    - arm64: tlb: Allow XZR argument to TLBI ops (git-fixes).
    - arm64: tlb: Optimize ARM64_WORKAROUND_REPEAT_TLBI (git-fixes).
    - KVM: x86: Constrain guest-supported xfeatures only at KVM_GET_XSAVE{2} (bsc#1247954).
    - KVM: x86: Remove 'return void' expression for 'void function' (bsc#1247954).
    - smb: client: correctly handle ErrorContextData as a flexible array (git-fixes).
    - x86/fpu: Allow caller to constrain xfeatures when copying to uabi buffer (bsc#1247954).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:30129 advisory.

    * kernel: rxrpc: fix RESPONSE authenticator parser OOB read (CVE-2026-31636)

    * kernel: ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (CVE-2026-43038)

    * kernel: tcp: fix potential race in tcp_v6_syn_recv_sock() (CVE-2026-43198)

    * kernel: scsi: qla2xxx: Completely fix fcport double free (CVE-2026-43414)

    * kernel: RDMA/iwcm: Fix workqueue list corruption by removing work_list (CVE-2026-45898)

    * kernel: RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CVE-2026-46117)

    * kernel: RDMA/mana: Validate rx_hash_key_len (CVE-2026-46145)

    * kernel: nvmet-tcp: fix race between ICReq handling and queue teardown (CVE-2026-46135)

    Bug Fix(es) and Enhancement(s):

    * Unexpected execmem SELinux denials after CVE-2026-46054 fix [rhel-10.2.z] (JIRA:Rocky Linux-185117)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:2632-1 advisory.

    The SUSE Linux Enterprise 15 SP6 kernel was updated to fix various security issues

    The following security issues were fixed:

    - CVE-2025-10263: arm64: errata: Mitigate TLBI errata on various Arm CPUs (bsc#1266290).
    - CVE-2025-68324: scsi: imm: Fix use-after-free bug caused by unfinished delayed work (bsc#1255416).
    - CVE-2026-23392: netfilter: nf_tables: release flowtable after rcu grace period on error (bsc#1260531).
    - CVE-2026-31500: Bluetooth: btintel: serialize btintel_hw_error() with hci_req_sync_lock (bsc#1262993).
    - CVE-2026-31697: crypto: ccp: Don't attempt to copy ID to userspace if PSP command failed (bsc#1264116).
    - CVE-2026-31698: crypto: ccp: Don't attempt to copy PDH cert to userspace if PSP command failed     (bsc#1263880).
    - CVE-2026-31699: crypto: ccp: Don't attempt to copy CSR to userspace if PSP command failed (bsc#1263879).
    - CVE-2026-31759: usb: ulpi: fix double free in ulpi_register_interface() error path (bsc#1264076).
    - CVE-2026-31771: Bluetooth: hci_event: move wake reason storage into validated event handlers     (bsc#1264145).
    - CVE-2026-43023: Bluetooth: SCO: fix race conditions in sco_sock_connect() (bsc#1264137).
    - CVE-2026-43074: eventpoll: defer struct eventpoll free to RCU grace period (bsc#1264263).
    - CVE-2026-43077: crypto: algif_aead - Fix minimum RX size check for decryption (bsc#1264470).
    - CVE-2026-43198: tcp: fix potential race in tcp_v6_syn_recv_sock() (bsc#1264610).
    - CVE-2026-45878: drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (bsc#1266767).
    - CVE-2026-45886: bpf: Fix bpf_xdp_store_bytes proto for read-only arg (bsc#1266810).
    - CVE-2026-45932: bpf: Fix tcx/netkit detach permissions when prog fd isn't given (bsc#1266827).
    - CVE-2026-45984: gfs2: Move the inode glock locking to gfs2_file_buffered_write (bsc#1267214).
    - CVE-2026-46037: ipv4: icmp: validate reply type before using icmp_pointers (bsc#1267361).
    - CVE-2026-46090: ALSA: aloop: Use guard() for spin locks (bsc#1267531).
    - CVE-2026-46120: ip6_gre: Use cached t->net in ip6erspan_changelink() (bsc#1267640).
    - CVE-2026-46123: Bluetooth: virtio_bt: clamp rx length before skb_put (bsc#1267621).
    - CVE-2026-46150: fanotify: fix false positive on permission events (bsc#1267387).
    - CVE-2026-46159: btrfs: fix btrfs_ioctl_space_info() slot_count TOCTOU which can lead to info-leak     (bsc#1267652).
    - CVE-2026-46197: drm/amdkfd: validate SVM ioctl nattr against buffer size (bsc#1267381).
    - CVE-2026-46209: drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs()     (bsc#1267663).
    - CVE-2026-46227: sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (bsc#1267697).
    - CVE-2026-46273: ibmveth: Disable GSO for packets with small MSS (bsc#1265211 bsc#1267651).

    The following non security issues were fixed:

    - bnxt_en: Fix NULL pointer dereference (bsc#1268307).
    - Drivers: hv: vmbus: Improve the logic of reserving fb_mmio on Gen2 VMs (git-fixes).
    - ethtool: provide customized dim profile management (bsc#1261256).
    - hv: utils: handle and propagate errors in kvp_register (git-fixes).
    - hyperv: Clean up and fix the guest ID comment in hvgdk.h (git-fixes).
    - linux/dim: move useful macros to .h file (bsc#1261256).
    - net: ethtool: add ethtool COALESCE_RX_CQE_FRAMES/NSECS (bsc#1261256).
    - net: mana: Add ethtool counters for RX CQEs in coalesced type (bsc#1261256).
    - net: mana: Add support for RX CQE Coalescing (bsc#1261256).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:2638-1 advisory.

    The SUSE Linux Enterprise 15 SP4 kernel was updated to fix various security issues

    The following security issues were fixed:

    - CVE-2025-10263: arm64: errata: Mitigate TLBI errata on various Arm CPUs (bsc#1266290).
    - CVE-2025-68324: scsi: imm: Fix use-after-free bug caused by unfinished delayed work (bsc#1255416).
    - CVE-2026-23392: netfilter: nf_tables: release flowtable after rcu grace period on error (bsc#1260531).
    - CVE-2026-31473: media: mc, v4l2: serialize REINIT and REQBUFS with req_queue_mutex (bsc#1262663).
    - CVE-2026-31500: Bluetooth: btintel: serialize btintel_hw_error() with hci_req_sync_lock (bsc#1262993).
    - CVE-2026-31613: smb: client: fix OOB reads parsing symlink error response (bsc#1263769).
    - CVE-2026-31697: crypto: ccp: Don't attempt to copy ID to userspace if PSP command failed (bsc#1264116).
    - CVE-2026-31698: crypto: ccp: Don't attempt to copy PDH cert to userspace if PSP command failed     (bsc#1263880).
    - CVE-2026-31699: crypto: ccp: Don't attempt to copy CSR to userspace if PSP command failed (bsc#1263879).
    - CVE-2026-31759: usb: ulpi: fix double free in ulpi_register_interface() error path (bsc#1264076).
    - CVE-2026-43077: crypto: algif_aead - Fix minimum RX size check for decryption (bsc#1264470).
    - CVE-2026-43198: tcp: fix potential race in tcp_v6_syn_recv_sock() (bsc#1264610).
    - CVE-2026-45984: gfs2: Move the inode glock locking to gfs2_file_buffered_write (bsc#1267214).
    - CVE-2026-46037: ipv4: icmp: validate reply type before using icmp_pointers (bsc#1267361).
    - CVE-2026-46116: xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (bsc#1267369).
    - CVE-2026-46120: ip6_gre: Use cached t->net in ip6erspan_changelink() (bsc#1267640).
    - CVE-2026-46123: Bluetooth: virtio_bt: clamp rx length before skb_put (bsc#1267621).
    - CVE-2026-46150: fanotify: fix false positive on permission events (bsc#1267387).
    - CVE-2026-46159: btrfs: fix btrfs_ioctl_space_info() slot_count TOCTOU which can lead to info-leak     (bsc#1267652).
    - CVE-2026-46197: drm/amdkfd: validate SVM ioctl nattr against buffer size (bsc#1267381).
    - CVE-2026-46227: sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (bsc#1267697).

    The following non security issues were fixed:

    - smb: client: correctly handle ErrorContextData as a flexible array (git-fixes).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:30129 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: rxrpc: fix RESPONSE authenticator parser OOB read (CVE-2026-31636)

    * kernel: ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (CVE-2026-43038)

    * kernel: tcp: fix potential race in tcp_v6_syn_recv_sock() (CVE-2026-43198)

    * kernel: scsi: qla2xxx: Completely fix fcport double free (CVE-2026-43414)

    * kernel: RDMA/iwcm: Fix workqueue list corruption by removing work_list (CVE-2026-45898)

    * kernel: RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CVE-2026-46117)

    * kernel: RDMA/mana: Validate rx_hash_key_len (CVE-2026-46145)

    * kernel: nvmet-tcp: fix race between ICReq handling and queue teardown (CVE-2026-46135)

    Bug Fix(es) and Enhancement(s):

    * Unexpected execmem SELinux denials after CVE-2026-46054 fix [rhel-10.2.z] (JIRA:RHEL-185117)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:2450-1 advisory.

    The SUSE Linux Enterprise 12 SP5 kernel was updated to fix various security issues

    The following security issues were fixed:

    - CVE-2025-10263: arm64: Add workaround for Cortex-A76 erratum 1286807 (bsc#1266290).
    - CVE-2025-40253: s390/ctcm: Fix double-kfree (bsc#1255084).
    - CVE-2025-68822: Input: alps - fix use-after-free bugs caused by dev3_register_work (bsc#1256668).
    - CVE-2026-3150: bcache: fix cached_dev.sb_bio use-after-free and crash (bsc#1263169).
    - CVE-2026-23271: perf: Fix __perf_event_overflow() vs perf_remove_from_context() race (bsc#1260018).
    - CVE-2026-23279: wifi: mac80211: fix NULL pointer dereference in mesh_rx_csa_frame() (bsc#1260468).
    - CVE-2026-23303: smb: client: Don't log plaintext credentials in cifs_set_cifscreds (bsc#1260502).
    - CVE-2026-23367: wifi: radiotap: reject radiotap with unknown bits (bsc#1260731).
    - CVE-2026-23396: wifi: mac80211: fix NULL deref in mesh_matches_local() (bsc#1260729).
    - CVE-2026-23444: wifi: mac80211: always free skb on ieee80211_tx_prepare_skb() failure (bsc#1266307).
    - CVE-2026-23448: net: usb: cdc_ncm: add ndpoffset to NDP16 nframes bounds check (bsc#1261750).
    - CVE-2026-31405: media: dvb-net: fix OOB access in ULE extension header tables (bsc#1261700).
    - CVE-2026-31415: ipv6: avoid overflows in ip6_datagram_send_ctl() (bsc#1262099).
    - CVE-2026-31421: net/sched: cls_fw: fix NULL pointer dereference on shared blocks (bsc#1262061).
    - CVE-2026-31447: ext4: reject mount if bigalloc with s_first_data_block != 0 (bsc#1262614).
    - CVE-2026-31452: ext4: convert inline data to extents when truncate exceeds inline size (bsc#1262620).
    - CVE-2026-31464: scsi: ibmvfc: Fix OOB access in ibmvfc_discover_targets_done() (bsc#1262656).
    - CVE-2026-31469: virtio_net: Fix UAF on dst_ops when IFF_XMIT_DST_RELEASE is cleared and napi_tx is false       (bsc#1267816).
    - CVE-2026-31498: Bluetooth: L2CAP: Fix ERTM re-init and zero pdu_len infinite loop (bsc#1262751).
    - CVE-2026-31500: Bluetooth: btintel: serialize btintel_hw_error() with hci_req_sync_lock (bsc#1262993).
    - CVE-2026-31515: af_key: validate families in pfkey_send_migrate() (bsc#1262752).
    - CVE-2026-31516: xfrm: prevent policy_hthresh.work from racing with netns teardown (bsc#1262755).
    - CVE-2026-31532: can: af_can: export can_sock_destruct() (bsc#1262757).
    - CVE-2026-31540: drm/i915/gt: Check set_default_submission() before deferencing (bsc#1263011).
    - CVE-2026-31546: net: bonding: fix NULL deref in bond_debug_rlb_hash_show (bsc#1263006).
    - CVE-2026-31588: KVM: x86: Use scratch field in MMIO fragment to hold small write values (bsc#1263165).
    - CVE-2026-31590: KVM: SEV: Drop WARN on large size for KVM_MEMORY_ENCRYPT_REG_REGION (bsc#1263152).
    - CVE-2026-31596: ocfs2: handle invalid dinode in ocfs2_group_extend (bsc#1263319).
    - CVE-2026-31629: nfc: llcp: add missing return after LLCP_CLOSED checks (bsc#1263790).
    - CVE-2026-31664: string.h: Introduce memset_after() for wiping trailing members/padding (bsc#1263578).
    - CVE-2026-31668: seg6: separate dst_cache for input and output paths in seg6 lwtunnel (bsc#1263140).
    - CVE-2026-31671: xfrm_user: fix info leak in build_report() (bsc#1263115).
    - CVE-2026-31673: af_unix: read UNIX_DIAG_VFS data under unix_state_lock (bsc#1263143).
    - CVE-2026-31674: netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (bsc#1263568).
    - CVE-2026-31678: openvswitch: defer tunnel netdev_put to RCU release (bsc#1263562).
    - CVE-2026-31759: usb: ulpi: fix double free in ulpi_register_interface() error path (bsc#1264076).
    - CVE-2026-31778: ALSA: caiaq: fix stack out-of-bounds read in init_card (bsc#1263923).
    - CVE-2026-43020: Bluetooth: MGMT: validate LTK enc_size on load (bsc#1264006).
    - CVE-2026-43024: netfilter: nf_tables: reject immediate NF_QUEUE verdict (bsc#1263930).
    - CVE-2026-43026: netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (bsc#1263932).
    - CVE-2026-43028: netfilter: x_tables: ensure names are nul-terminated (bsc#1263934).
    - CVE-2026-43037: ip6_tunnel: clear skb2->cb in ip4ip6_err() (bsc#1263995).
    - CVE-2026-43038: ipv6: icmp: clear skb2->cb in ip6_err_gen_icmpv6_unreach() (bsc#1264097).
    - CVE-2026-43040: net: ipv6: ndisc: fix ndisc_ra_useropt to initialize nduseropt_padX fields to zero to     prevent an info-       leak (bsc#1264091).
    - CVE-2026-43052: wifi: mac80211: check tdls flag in ieee80211_tdls_oper (bsc#1263945).
    - CVE-2026-43077: crypto: algif_aead - Fix minimum RX size check for decryption (bsc#1264470).
    - CVE-2026-43140: HID: magicmouse: Do not crash on missing msc->input (bsc#1264630).
    - CVE-2026-43158: xfs: fix freemap adjustments when adding xattrs to leaf blocks (bsc#1264595).
    - CVE-2026-43187: xfs: delete attr leaf freemap entries when empty (bsc#1264603).
    - CVE-2026-43198: tcp: fix potential race in tcp_v6_syn_recv_sock() (bsc#1264610).
    - CVE-2026-43206: drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (bsc#1264551).
    - CVE-2026-43234: team: avoid NETDEV_CHANGEMTU event when unregistering slave (bsc#1264409).
    - CVE-2026-43338: btrfs: reserve enough transaction items for qgroup ioctls (bsc#1264716).
    - CVE-2026-43339: ipv6: prevent possible UaF in addrconf_permanent_addr() (bsc#1264763).
    - CVE-2026-43359: btrfs: fix transaction abort on set received ioctl due to item overflow (bsc#1264719).
    - CVE-2026-43361: btrfs: fix transaction abort when snapshotting received subvolumes (bsc#1264722).
    - CVE-2026-43407: libceph: Fix potential out-of-bounds access in ceph_handle_auth_reply() (bsc#1265020).
    - CVE-2026-43413: scsi: hisi_sas: Fix NULL pointer exception during user_scan() (bsc#1264671).
    - CVE-2026-43414: scsi: qla2xxx: Completely fix fcport double free (bsc#1264669).
    - CVE-2026-43499: rtmutex: Use waiter::task instead of current in remove_waiter() (bsc#1266001).
    - CVE-2026-43503: net: skbuff: propagate shared-frag marker through frag-transfer helpers (bsc#1265960).
    - CVE-2026-45835: Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (bsc#1266411).
    - CVE-2026-45841: netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO (bsc#1266390).
    - CVE-2026-45842: slip: reject VJ receive packets on instances with no rstate array (bsc#1266400).
    - CVE-2026-45843: slip: bound decode() reads against the compressed packet length (bsc#1266395).
    - CVE-2026-45852: RDMA/rxe: Fix double free in rxe_srq_from_init (bsc#1266711).
    - CVE-2026-45870: SUNRPC: auth_gss: fix memory leaks in XDR decoding error paths (bsc#1266704).
    - CVE-2026-45970: bonding: alb: fix UAF in rlb_arp_recv during bond up/down (bsc#1267205).
    - CVE-2026-45983: nfsd: never defer requests during idmap lookup (bsc#1266697).
    - CVE-2026-46021: thermal: core: Fix thermal zone governor cleanup issues (bsc#1267220).
    - CVE-2026-46024: libceph: Prevent potential null-ptr-deref in ceph_handle_auth_reply() (bsc#1267218).
    - CVE-2026-46043: RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (bsc#1266901).
    - CVE-2026-46090: ALSA: aloop: Fix peer runtime UAF during format-change stop (bsc#1267531).
    - CVE-2026-46113: KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (bsc#1266969).
    - CVE-2026-46116: xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (bsc#1267369).
    - CVE-2026-46150: fanotify: fix false positive on permission events (bsc#1267387).
    - CVE-2026-46157: ALSA: pcm: oss: Fix data race at accessing runtime.oss.trigger (bsc#1267726).
    - CVE-2026-46159: btrfs: fix btrfs_ioctl_space_info() slot_count TOCTOU which can lead to info-leak     (bsc#1267652).
    - CVE-2026-46160: btrfs: fix missing last_unlink_trans update when removing a directory (bsc#1267624).
    - CVE-2026-46169: hfsplus: fix uninit-value by validating catalog record size (bsc#1267713).
    - CVE-2026-46181: RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (bsc#1266826).
    - CVE-2026-46243: smb: client: reject userspace cifs.spnego descriptions (bsc#1266238).
    - CVE-2026-46259: procfs: fix missing RCU protection when reading real_parent in do_task_stat()     (bsc#1267685).
    - CVE-2026-46273: ibmveth: Disable GSO for packets with small MSS (bsc#1267651).

    The following non security issues were fixed:

    - arm64: tlb: Allow XZR argument to TLBI ops (git-fixes).
    - arm64: tlb: Optimize ARM64_WORKAROUND_REPEAT_TLBI (git-fixes).
    - bcache: fix uninitialized closure object (git-fixes).
    - check-for-config-changes: Exclude CC_MS_EXTENSIONS.
    - check-for-config-changes: Exclude HAVE_CFI_ICALL_NORMALIZE_INTEGERS{,_RUSTC}.
    - kvm/svm: PKU not currently supported (bsc#1263887).
    - KVM: x86: Handle PKU CPUID adjustment in VMX code (bsc#1263887).
    - mkspec: Add signature to source list only when it exists.
    - net/sched: cls_fw: fix NULL dereference of 'old' filters before change() (git-fixes).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the linux package has been released.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1702 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    audit: add fchmodat2() to change attributes class (CVE-2025-71239)

    In the Linux kernel, the following vulnerability has been resolved:

    fs: ntfs3: fix infinite loop in attr_load_runs_range on inconsistent metadata (CVE-2025-71265)

    In the Linux kernel, the following vulnerability has been resolved:

    fs: ntfs3: check return value of indx_find to avoid infinite loop (CVE-2025-71266)

    In the Linux kernel, the following vulnerability has been resolved:

    fs: ntfs3: fix infinite loop triggered by zero-sized ATTR_LIST (CVE-2025-71267)

    In the Linux kernel, the following vulnerability has been resolved:

    fs/buffer: add alert in try_to_free_buffers() for folios without buffers (CVE-2025-71295)

    In the Linux kernel, the following vulnerability has been resolved:

    drm/tests: shmem: Hold reservation lock around purge (CVE-2025-71296)

    In the Linux kernel, the following vulnerability has been resolved:

    drm/tests: shmem: Hold reservation lock around madvise (CVE-2025-71298)

    In the Linux kernel, the following vulnerability has been resolved:

    drm/tests: shmem: Hold reservation lock around vmap/vunmap (CVE-2025-71301)

    In the Linux kernel, the following vulnerability has been resolved:

    drm/display/dp_mst: Add protection against 0 vcpi (CVE-2025-71305)

    In the Linux kernel, the following vulnerability has been resolved:

    espintcp: Fix race condition in espintcp_close() (CVE-2026-23239)

    In the Linux kernel, the following vulnerability has been resolved:

    tls: Fix race condition in tls_sw_cancel_work_tx() (CVE-2026-23240)

    In the Linux kernel, the following vulnerability has been resolved:

    audit: add missing syscalls to read class (CVE-2026-23241)

    In the Linux kernel, the following vulnerability has been resolved:

    xfs: check for deleted cursors when revalidating two btrees (CVE-2026-23249)

    In the Linux kernel, the following vulnerability has been resolved:

    cifs: some missing initializations on replay (CVE-2026-31693)

    In the Linux kernel, the following vulnerability has been resolved:

    io_uring/zcrx: fix user_ref race between scrub and refill paths (CVE-2026-43121)

    In the Linux kernel, the following vulnerability has been resolved:

    fbcon: check return value of con2fb_acquire_newinfo() (CVE-2026-43123)

    In the Linux kernel, the following vulnerability has been resolved:

    pstore: ram_core: fix incorrect success return when vmap() fails (CVE-2026-43124)

    In the Linux kernel, the following vulnerability has been resolved:

    ntfs3: fix circular locking dependency in run_unpack_ex (CVE-2026-43127)

    In the Linux kernel, the following vulnerability has been resolved:

    RDMA/umem: Fix double dma_buf_unpin in failure path (CVE-2026-43128)

    In the Linux kernel, the following vulnerability has been resolved:

    ima: verify the previous kernel's IMA buffer lies in addressable RAM (CVE-2026-43129)

    In the Linux kernel, the following vulnerability has been resolved:

    iommu/vt-d: Flush dev-IOTLB only when PCIe device is accessible in scalable mode (CVE-2026-43130)

    In the Linux kernel, the following vulnerability has been resolved:

    dm-verity: correctly handle dm_bufio_client_create() failure (CVE-2026-43132)

    In the Linux kernel, the following vulnerability has been resolved:

    KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CVE-2026-43133)

    In the Linux kernel, the following vulnerability has been resolved:

    xfrm6: fix uninitialized saddr in xfrm6_get_saddr() (CVE-2026-43139)

    In the Linux kernel, the following vulnerability has been resolved:

    mfd: core: Add locking around 'mfd_of_node_list' (CVE-2026-43143)

    In the Linux kernel, the following vulnerability has been resolved:

    Revert PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV (CVE-2026-43147)

    In the Linux kernel, the following vulnerability has been resolved:

    perf/arm-cmn: Reject unsupported hardware configurations (CVE-2026-43150)

    In the Linux kernel, the following vulnerability has been resolved:

    HID: hid-pl: handle probe errors (CVE-2026-43152)

    In the Linux kernel, the following vulnerability has been resolved:

    xfs: remove xfs_attr_leaf_hasname (CVE-2026-43153)

    In the Linux kernel, the following vulnerability has been resolved:

    erofs: fix incorrect early exits in volume label handling (CVE-2026-43154)

    In the Linux kernel, the following vulnerability has been resolved:

    xfs: fix freemap adjustments when adding xattrs to leaf blocks (CVE-2026-43158)

    In the Linux kernel, the following vulnerability has been resolved:

    md/bitmap: fix GPF in write_page caused by resize race (CVE-2026-43163)

    In the Linux kernel, the following vulnerability has been resolved:

    udplite: Fix null-ptr-deref in __udp_enqueue_schedule_skb(). (CVE-2026-43164)

    In the Linux kernel, the following vulnerability has been resolved:

    erofs: fix interlaced plain identification for encoded extents (CVE-2026-43166)

    In the Linux kernel, the following vulnerability has been resolved:

    xfrm: always flush state and policy upon NETDEV_UNREGISTER event (CVE-2026-43167)

    In the Linux kernel, the following vulnerability has been resolved:

    drm/buddy: Prevent BUG_ON by validating rounded allocation (CVE-2026-43169)

    In the Linux kernel, the following vulnerability has been resolved:

    EFI/CPER: don't dump the entire memory region (CVE-2026-43171)

    In the Linux kernel, the following vulnerability has been resolved:

    erofs: fix incorrect early exits for invalid metabox-enabled images (CVE-2026-43179)

    In the Linux kernel, the following vulnerability has been resolved:

    ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (CVE-2026-43186)

    In the Linux kernel, the following vulnerability has been resolved:

    xfs: delete attr leaf freemap entries when empty (CVE-2026-43187)

    In the Linux kernel, the following vulnerability has been resolved:

    ceph: do not propagate page array emplacement errors as batch errors (CVE-2026-43188)

    In the Linux kernel, the following vulnerability has been resolved:

    media: v4l2-async: Fix error handling on steps after finding a match (CVE-2026-43189)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: xt_tcpmss: check remaining length before reading optlen (CVE-2026-43190)

    In the Linux kernel, the following vulnerability has been resolved:

    net: consume xmit errors of GSO frames (CVE-2026-43194)

    In the Linux kernel, the following vulnerability has been resolved:

    tcp: fix potential race in tcp_v6_syn_recv_sock() (CVE-2026-43198)

    In the Linux kernel, the following vulnerability has been resolved:

    net/mlx5e: Fix scheduling while atomic in IPsec MAC address query (CVE-2026-43199)

    In the Linux kernel, the following vulnerability has been resolved:

    APEI/GHES: ARM processor Error: don't go past allocated memory (CVE-2026-43201)

    In the Linux kernel, the following vulnerability has been resolved:

    net: do not pass flow_id to set_rps_cpu() (CVE-2026-43208)

    In the Linux kernel, the following vulnerability has been resolved:

    tracing: ring-buffer: Fix to check event length before using (CVE-2026-43210)

    In the Linux kernel, the following vulnerability has been resolved:

    PCI: Fix pci_slot_trylock() error handling (CVE-2026-43211)

    In the Linux kernel, the following vulnerability has been resolved:

    KVM: x86: Add SRCU protection for reading PDPTRs in __get_sregs2() (CVE-2026-43214)

    In the Linux kernel, the following vulnerability has been resolved:

    cifs: Fix locking usage for tcon fields (CVE-2026-43215)

    In the Linux kernel, the following vulnerability has been resolved:

    net: Drop the lock in skb_may_tx_timestamp() (CVE-2026-43216)

    In the Linux kernel, the following vulnerability has been resolved:

    io_uring/zcrx: fix sgtable leak on mapping failures (CVE-2026-43224)

    In the Linux kernel, the following vulnerability has been resolved:

    net/rds: No shortcut out of RDS_CONN_ERROR (CVE-2026-43226)

    In the Linux kernel, the following vulnerability has been resolved:

    net/rds: Clear reconnect pending bit (CVE-2026-43230)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CVE-2026-43233)

    In the Linux kernel, the following vulnerability has been resolved:

    team: avoid NETDEV_CHANGEMTU event when unregistering slave (CVE-2026-43234)

    In the Linux kernel, the following vulnerability has been resolved:

    net/sched: act_skbedit: fix divide-by-zero in tcf_skbedit_hash() (CVE-2026-43238)

    In the Linux kernel, the following vulnerability has been resolved:

    smb: client: prevent races in ->query_interfaces() (CVE-2026-43239)

    In the Linux kernel, the following vulnerability has been resolved:

    x86/kexec: add a sanity check on previous kernel's ima kexec buffer (CVE-2026-43240)

    In the Linux kernel, the following vulnerability has been resolved:

    kcm: fix zero-frag skb in frag_list on partial sendmsg error (CVE-2026-43244)

    In the Linux kernel, the following vulnerability has been resolved:

    ntfs: ->d_compare() must not block (CVE-2026-43245)

    In the Linux kernel, the following vulnerability has been resolved:

    mptcp: pm: in-kernel: always set ID as avail when rm endp (CVE-2026-43252)

    In the Linux kernel, the following vulnerability has been resolved:

    iommu/amd: move wait_on_sem() out of spinlock (CVE-2026-43253)

    In the Linux kernel, the following vulnerability has been resolved:

    ovpn: tcp - fix packet extraction from stream (CVE-2026-43254)

    In the Linux kernel, the following vulnerability has been resolved:

    alpha: fix user-space corruption during memory compaction (CVE-2026-43258)

    In the Linux kernel, the following vulnerability has been resolved:

    arm64: Add support for TSV110 Spectre-BHB mitigation (CVE-2026-43261)

    In the Linux kernel, the following vulnerability has been resolved:

    EFI/CPER: don't go past the ARM processor CPER record buffer (CVE-2026-43266)

    In the Linux kernel, the following vulnerability has been resolved:

    ring-buffer: Fix possible dereference of uninitialized pointer (CVE-2026-43272)

    In the Linux kernel, the following vulnerability has been resolved:

    ceph: supply snapshot context in ceph_zero_partial_object() (CVE-2026-43273)

    In the Linux kernel, the following vulnerability has been resolved:

    APEI/GHES: ensure that won't go past CPER allocated record (CVE-2026-43277)

    In the Linux kernel, the following vulnerability has been resolved:

    dm: clear cloned request bio pointer when last clone bio completes (CVE-2026-43278)

    In the Linux kernel, the following vulnerability has been resolved:

    mailbox: Prevent out-of-bounds access in fw_mbox_index_xlate() (CVE-2026-43281)

    In the Linux kernel, the following vulnerability has been resolved:

    mm/slab: do not access current->mems_allowed_seq if !allow_spin (CVE-2026-43285)

    In the Linux kernel, the following vulnerability has been resolved:

    mm/hugetlb: restore failed global reservations to subpool (CVE-2026-43286)

    In the Linux kernel, the following vulnerability has been resolved:

    drm: Account property blob allocations to memcg (CVE-2026-43287)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: move ext4_percpu_param_init() before ext4_mb_init() (CVE-2026-43288)

    In the Linux kernel, the following vulnerability has been resolved:

    kexec: derive purgatory entry from symbol (CVE-2026-43289)

    In the Linux kernel, the following vulnerability has been resolved:

    mm/vmalloc: prevent RCU stalls in kasan_release_vmalloc_node (CVE-2026-43292)

    In the Linux kernel, the following vulnerability has been resolved:

    mm/page_alloc: clear page->private in free_pages_prepare() (CVE-2026-43303)

    In the Linux kernel, the following vulnerability has been resolved:

    libceph: define and enforce CEPH_MAX_KEY_LEN (CVE-2026-43304)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf: crypto: Use the correct destructor kfunc type (CVE-2026-43306)

    In the Linux kernel, the following vulnerability has been resolved:

    md raid: fix hang when stopping arrays with metadata through dm-raid (CVE-2026-43309)

    In the Linux kernel, the following vulnerability has been resolved:

    ACPI: processor: Fix NULL-pointer dereference in acpi_processor_errata_piix4() (CVE-2026-43313)

    In the Linux kernel, the following vulnerability has been resolved:

    dm: remove fake timeout to avoid leak request (CVE-2026-43314)

    In the Linux kernel, the following vulnerability has been resolved:

    KVM: nSVM: Remove a user-triggerable WARN on nested_svm_load_cr3() succeeding (CVE-2026-43315)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf: Properly mark live registers for indirect jumps (CVE-2026-43321)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - tcp: fix potential race in tcp_v6_syn_recv_sock() Code in tcp_v6_syn_recv_sock() after the call to     tcp_v4_syn_recv_sock() is done too late. After tcp_v4_syn_recv_sock(), the child socket is already visible     from TCP ehash table and other cpus might use it. Since newinet->pinet6 is still pointing to the listener     ipv6_pinfo bad things can happen as syzbot found. Move the problematic code in tcp_v6_mapped_child_init()     and call this new helper from tcp_v4_syn_recv_sock() before the ehash insertion. This allows the removal     of one tcp_sync_mss(), since tcp_v4_syn_recv_sock() will call it with the correct context.
    (CVE-2026-43198)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
323877	RHEL 9 : kernel (RHSA-2026:33285)	Nessus	Red Hat Local Security Checks	medium
323876	RHEL 10 : kernel (RHSA-2026:33215)	Nessus	Red Hat Local Security Checks	high
323260	AlmaLinux 10 : kernel (ALSA-2026:30129)	Nessus	Alma Linux Local Security Checks	critical
323249	SUSE SLES15: cluster-md-kmp-default / dlm-kmp-default / gfs2-kmp-default / etc (SUSE-SU-2026:2658-1)	Nessus	SuSE Local Security Checks	high
323232	RockyLinux 10 : kernel (RLSA-2026:30129)	Nessus	Rocky Linux Local Security Checks	critical
323031	SUSE SLES15: cluster-md-kmp-default / dlm-kmp-default / gfs2-kmp-default / etc (SUSE-SU-2026:2632-1)	Nessus	SuSE Local Security Checks	high
323029	SUSE SLES15: cluster-md-kmp-default / dlm-kmp-default / gfs2-kmp-default / etc (SUSE-SU-2026:2638-1)	Nessus	SuSE Local Security Checks	high
322976	RHEL 10 : kernel (RHSA-2026:30129)	Nessus	Red Hat Local Security Checks	critical
321690	SUSE SLES12 Security Update : kernel (SUSE-SU-2026:2450-1)	Nessus	SuSE Local Security Checks	medium
318594	Photon OS 4.0: Linux PHSA-2026-4.0-1027	Nessus	PhotonOS Local Security Checks	critical
315658	Amazon Linux 2023 : bpftool6.18, kernel6.18, kernel6.18-devel (ALAS2023-2026-1702)	Nessus	Amazon Linux Local Security Checks	high
312692	Linux Distros Unpatched Vulnerability : CVE-2026-43198	Nessus	Misc.	critical

Detections

Analytics

CVE-2026-43198

high

Tenable Plugins

Coming Soon

medium

high

critical

high

critical

high

high

critical

medium

critical

high

critical