In the Linux kernel, the following vulnerability has been resolved: net: mana: Fix double destroy_workqueue on service rescan PCI path While testing corner cases in the driver, a use-after-free crash was found on the service rescan PCI path. When mana_serv_reset() calls mana_gd_suspend(), mana_gd_cleanup() destroys gc->service_wq. If the subsequent mana_gd_resume() fails with -ETIMEDOUT or -EPROTO, the code falls through to mana_serv_rescan() which triggers pci_stop_and_remove_bus_device(). This invokes the PCI .remove callback (mana_gd_remove), which calls mana_gd_cleanup() a second time, attempting to destroy the already- freed workqueue. Fix this by NULL-checking gc->service_wq in mana_gd_cleanup() and setting it to NULL after destruction. Call stack of issue for reference: [Sat Feb 21 18:53:48 2026] Call Trace: [Sat Feb 21 18:53:48 2026] <TASK> [Sat Feb 21 18:53:48 2026] mana_gd_cleanup+0x33/0x70 [mana] [Sat Feb 21 18:53:48 2026] mana_gd_remove+0x3a/0xc0 [mana] [Sat Feb 21 18:53:48 2026] pci_device_remove+0x41/0xb0 [Sat Feb 21 18:53:48 2026] device_remove+0x46/0x70 [Sat Feb 21 18:53:48 2026] device_release_driver_internal+0x1e3/0x250 [Sat Feb 21 18:53:48 2026] device_release_driver+0x12/0x20 [Sat Feb 21 18:53:48 2026] pci_stop_bus_device+0x6a/0x90 [Sat Feb 21 18:53:48 2026] pci_stop_and_remove_bus_device+0x13/0x30 [Sat Feb 21 18:53:48 2026] mana_do_service+0x180/0x290 [mana] [Sat Feb 21 18:53:48 2026] mana_serv_func+0x24/0x50 [mana] [Sat Feb 21 18:53:48 2026] process_one_work+0x190/0x3d0 [Sat Feb 21 18:53:48 2026] worker_thread+0x16e/0x2e0 [Sat Feb 21 18:53:48 2026] kthread+0xf7/0x130 [Sat Feb 21 18:53:48 2026] ? __pfx_worker_thread+0x10/0x10 [Sat Feb 21 18:53:48 2026] ? __pfx_kthread+0x10/0x10 [Sat Feb 21 18:53:48 2026] ret_from_fork+0x269/0x350 [Sat Feb 21 18:53:48 2026] ? __pfx_kthread+0x10/0x10 [Sat Feb 21 18:53:48 2026] ret_from_fork_asm+0x1a/0x30 [Sat Feb 21 18:53:48 2026] </TASK>

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:36018 advisory.

    * kernel: fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CVE-2026-43112)

    * kernel: net: mana: Fix double destroy_workqueue on service rescan PCI path (CVE-2026-43276)

    * kernel: Linux kernel: Use-After-Free in net/gro due to improper handling of zerocopy skbs     (CVE-2026-46323)

    * kernel: xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (CVE-2026-46116)

    * kernel: sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CVE-2026-46227)

    * kernel: drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs()     (CVE-2026-46209)

    * kernel: smb/client: fix out-of-bounds read in smb2_compound_op() (CVE-2026-46155)

    * kernel: netfilter: nft_inner: Fix IPv6 inner_thoff desync (CVE-2026-46244)

    * kernel: procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CVE-2026-46259)

    * kernel: Arm Processors: Privilege escalation or information disclosure via writes to higher exception     level resources (CVE-2025-10263)

    * kernel: KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry     (CVE-2026-46316)

    Bug Fix(es) and Enhancement(s):

    * WARNING at drivers/gpu/drm/nouveau/nvkm/subdev/gsp/r535.c:1585 r535_gsp_fini+0x2fb/0x310 [nouveau]     [rhel-9.8.z] (JIRA:Rocky Linux-160966)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:36541 advisory.

    * kernel: eventpoll: defer struct eventpoll free to RCU grace period (CVE-2026-43074)
      * kernel: net: mana: Fix double destroy_workqueue on service rescan PCI path (CVE-2026-43276)
      * kernel: net/ipv6: ioam6: prevent schema length wraparound in trace fill (CVE-2026-43341)
      * kernel: smb/client: fix out-of-bounds read in smb2_compound_op() (CVE-2026-46155)
      * kernel: eventpoll: fix ep_remove struct eventpoll / struct file UAF (CVE-2026-46242)
      * kernel: procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CVE-2026-46259)


    Bug Fix(es) and Enhancement(s):

      * CNB103: net: page_pool: avoid false positive warning if NAPI was never added [almalinux-10.2.z]     (JIRA:AlmaLinux-162140)
      * [AlmaLinux 10] Bonding reports unknown speed/duplex for tg3 interface [almalinux-10.2.z]     (JIRA:AlmaLinux-182770)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:36018 advisory.

    * kernel: fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CVE-2026-43112)
      * kernel: net: mana: Fix double destroy_workqueue on service rescan PCI path (CVE-2026-43276)
      * kernel: Linux kernel: Use-After-Free in net/gro due to improper handling of zerocopy skbs     (CVE-2026-46323)
      * kernel: xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (CVE-2026-46116)
      * kernel: sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CVE-2026-46227)
      * kernel: drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs()     (CVE-2026-46209)
      * kernel: smb/client: fix out-of-bounds read in smb2_compound_op() (CVE-2026-46155)
      * kernel: netfilter: nft_inner: Fix IPv6 inner_thoff desync (CVE-2026-46244)
      * kernel: procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CVE-2026-46259)
      * kernel: Arm Processors: Privilege escalation or information disclosure via writes to higher exception     level resources (CVE-2025-10263)
      * kernel: KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry     (CVE-2026-46316)


    Bug Fix(es) and Enhancement(s):

      * WARNING at drivers/gpu/drm/nouveau/nvkm/subdev/gsp/r535.c:1585 r535_gsp_fini+0x2fb/0x310 [nouveau]     [almalinux-9.8.z] (JIRA:AlmaLinux-160966)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-36018 advisory.

    - smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180041]     {CVE-2026-46155}
    - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180176]     {CVE-2026-46116}
    - net: gro: don't merge zcopy skbs (Sabrina Dubroca) [RHEL-177878] {CVE-2026-46323}
    - net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180271]     {CVE-2026-43276}
    - net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180271]     {CVE-2026-43276}
    - fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189503]     {CVE-2026-43112}
    - Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183625] {CVE-2025-10263}
    - arm64: cputype: Add NVIDIA Olympus definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
    - arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183625]     {CVE-2025-10263}
    - arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263}
    - arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183625] {CVE-2025-10263}
    - arm64: errata: Apply workarounds for Neoverse-V3AE (Mark Salter) [RHEL-183625] {CVE-2025-10263}
    - arm64: cputype: Add Neoverse-V3AE definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
    - arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
    - arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
    - arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
    - Clean up documentation mess left by previous backport (Mark Salter) [RHEL-183625] {CVE-2025-10263}
    - KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CKI Backport Bot)     [RHEL-183969] {CVE-2026-46316}
    - netfilter: nft_inner: Fix IPv6 inner_thoff desync (CKI Backport Bot) [RHEL-181929] {CVE-2026-46244}
    - procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot)     [RHEL-181907] {CVE-2026-46259}
    - drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot)     [RHEL-179909] {CVE-2026-46209}
    - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot)     [RHEL-179865] {CVE-2026-46227}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:36541 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: eventpoll: defer struct eventpoll free to RCU grace period (CVE-2026-43074)

    * kernel: net: mana: Fix double destroy_workqueue on service rescan PCI path (CVE-2026-43276)

    * kernel: net/ipv6: ioam6: prevent schema length wraparound in trace fill (CVE-2026-43341)

    * kernel: smb/client: fix out-of-bounds read in smb2_compound_op() (CVE-2026-46155)

    * kernel: eventpoll: fix ep_remove struct eventpoll / struct file UAF (CVE-2026-46242)

    * kernel: procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CVE-2026-46259)

    Bug Fix(es) and Enhancement(s):

    * CNB103: net: page_pool: avoid false positive warning if NAPI was never added [rhel-10.2.z]     (JIRA:RHEL-162140)

    * [RHEL 10] Bonding reports unknown speed/duplex for tg3 interface [rhel-10.2.z] (JIRA:RHEL-182770)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:36018 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CVE-2026-43112)

    * kernel: net: mana: Fix double destroy_workqueue on service rescan PCI path (CVE-2026-43276)

    * kernel: Linux kernel: Use-After-Free in net/gro due to improper handling of zerocopy skbs     (CVE-2026-46323)

    * kernel: xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (CVE-2026-46116)

    * kernel: sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CVE-2026-46227)

    * kernel: drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs()     (CVE-2026-46209)

    * kernel: smb/client: fix out-of-bounds read in smb2_compound_op() (CVE-2026-46155)

    * kernel: netfilter: nft_inner: Fix IPv6 inner_thoff desync (CVE-2026-46244)

    * kernel: procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CVE-2026-46259)

    * kernel: Arm Processors: Privilege escalation or information disclosure via writes to higher exception     level resources (CVE-2025-10263)

    * kernel: KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry     (CVE-2026-46316)

    Bug Fix(es) and Enhancement(s):

    * WARNING at drivers/gpu/drm/nouveau/nvkm/subdev/gsp/r535.c:1585 r535_gsp_fini+0x2fb/0x310 [nouveau]     [rhel-9.8.z] (JIRA:RHEL-160966)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 24.04 LTS / 25.10 host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-8310-1 advisory.

    It was discovered that the Linux kernel algif_aead module did not properly handle in-place cryptographic     operations. This flaw is known as Copy Fail. A local attacker could use this to escalate privileges, or     possibly escape a container. (CVE-2026-31431)

    Several security issues were discovered in the Linux kernel. An attacker could possibly use these to     compromise the system. This update corrects flaws in the following subsystems:

    - S390 architecture;

    - Cryptographic API;

    - GPU drivers;

    - Ethernet bonding driver;

    - Microsoft Azure Network Adapter (MANA) driver;

    - Network file system (NFS) server daemon;

    - Distributed Switch Architecture;

    - Netfilter;

    - Control group (cgroup);

    - Kernel kexec() syscall;

    - Memory management;

    - MAC80211 subsystem;

    - Multipath TCP;

    - Packet sockets;

    - TLS protocol;

    - Unix domain sockets; (CVE-2025-71088, CVE-2025-71090, CVE-2025-71127, CVE-2025-71134, CVE-2025-71139,     CVE-2025-71141, CVE-2025-71142, CVE-2025-71144, CVE-2025-71152, CVE-2025-71155, CVE-2026-23274,     CVE-2026-23351, CVE-2026-23394, CVE-2026-23454, CVE-2026-31419, CVE-2026-31504, CVE-2026-31533,     CVE-2026-43033, CVE-2026-43077, CVE-2026-43078, CVE-2026-43276)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - net: mana: Fix double destroy_workqueue on service rescan PCI path While testing corner cases in the     driver, a use-after-free crash was found on the service rescan PCI path. When mana_serv_reset() calls     mana_gd_suspend(), mana_gd_cleanup() destroys gc->service_wq. If the subsequent mana_gd_resume() fails     with -ETIMEDOUT or -EPROTO, the code falls through to mana_serv_rescan() which triggers     pci_stop_and_remove_bus_device(). This invokes the PCI .remove callback (mana_gd_remove), which calls     mana_gd_cleanup() a second time, attempting to destroy the already- freed workqueue. Fix this by NULL-     checking gc->service_wq in mana_gd_cleanup() and setting it to NULL after destruction. Call stack of issue     for reference: [Sat Feb 21 18:53:48 2026] Call Trace: [Sat Feb 21 18:53:48 2026] <TASK> [Sat Feb 21     18:53:48 2026] mana_gd_cleanup+0x33/0x70 [mana] [Sat Feb 21 18:53:48 2026] mana_gd_remove+0x3a/0xc0 [mana]     [Sat Feb 21 18:53:48 2026] pci_device_remove+0x41/0xb0 [Sat Feb 21 18:53:48 2026] device_remove+0x46/0x70     [Sat Feb 21 18:53:48 2026] device_release_driver_internal+0x1e3/0x250 [Sat Feb 21 18:53:48 2026]     device_release_driver+0x12/0x20 [Sat Feb 21 18:53:48 2026] pci_stop_bus_device+0x6a/0x90 [Sat Feb 21     18:53:48 2026] pci_stop_and_remove_bus_device+0x13/0x30 [Sat Feb 21 18:53:48 2026]     mana_do_service+0x180/0x290 [mana] [Sat Feb 21 18:53:48 2026] mana_serv_func+0x24/0x50 [mana] [Sat Feb 21     18:53:48 2026] process_one_work+0x190/0x3d0 [Sat Feb 21 18:53:48 2026] worker_thread+0x16e/0x2e0 [Sat Feb     21 18:53:48 2026] kthread+0xf7/0x130 [Sat Feb 21 18:53:48 2026] ? __pfx_worker_thread+0x10/0x10 [Sat Feb     21 18:53:48 2026] ? __pfx_kthread+0x10/0x10 [Sat Feb 21 18:53:48 2026] ret_from_fork+0x269/0x350 [Sat Feb     21 18:53:48 2026] ? __pfx_kthread+0x10/0x10 [Sat Feb 21 18:53:48 2026] ret_from_fork_asm+0x1a/0x30 [Sat     Feb 21 18:53:48 2026] </TASK> (CVE-2026-43276)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
326383	RockyLinux 9 : kernel (RLSA-2026:36018)	Nessus	Rocky Linux Local Security Checks	high
326058	AlmaLinux 10 : kernel (ALSA-2026:36541)	Nessus	Alma Linux Local Security Checks	high
326054	AlmaLinux 9 : kernel (ALSA-2026:36018)	Nessus	Alma Linux Local Security Checks	high
325873	Oracle Linux 9 : kernel (ELSA-2026-36018)	Nessus	Oracle Linux Local Security Checks	high
325663	RHEL 10 : kernel (RHSA-2026:36541)	Nessus	Red Hat Local Security Checks	high
325304	RHEL 9 : kernel (RHSA-2026:36018)	Nessus	Red Hat Local Security Checks	high
317095	Ubuntu 24.04 LTS / 25.10 : Linux kernel (Azure) vulnerabilities (USN-8310-1)	Nessus	Ubuntu Local Security Checks	high
312955	Linux Distros Unpatched Vulnerability : CVE-2026-43276	Nessus	Misc.	high

Detections

Analytics

CVE-2026-43276

high

Tenable Plugins

high

high

high

high

high

high

high

high