In the Linux kernel, the following vulnerability has been resolved: ceph: fix memory leaks in ceph_mdsc_build_path() Add __putname() calls to error code paths that did not free the "path" pointer obtained by __getname(). If ownership of this pointer is not passed to the caller via path_info.path, the function must free it before returning.

The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1786824415 advisory.

  - In the Linux kernel, the following vulnerability has been resolved: CDC-NCM: avoid overflow in sanity     checking A broken device may give an extreme offset like 0xFFF0 and a reasonable length for a fragment. In     the sanity check as formulated now, this will create an integer overflow, defeating the sanity check. Both     offset and offset + len need to be checked in such a manner that no overflow can occur. And those     quantities should be unsigned. (CVE-2022-48938)

  - In the Linux kernel, the following vulnerability has been resolved: pinctrl: devicetree: fix null pointer     dereferencing in pinctrl_dt_to_map Here is the BUG report by KASAN about null pointer dereference: BUG:
    KASAN: null-ptr-deref in strcmp+0x2e/0x50 Read of size 1 at addr 0000000000000000 by task python3/2640     Call Trace: strcmp __of_find_property of_find_property pinctrl_dt_to_map kasprintf() would return NULL     pointer when kmalloc() fail to allocate. So directly return ENOMEM, if kasprintf() return NULL pointer.
    (CVE-2022-49832)

  - In the Linux kernel, the following vulnerability has been resolved: hugetlbfs: fix null-ptr-deref in     hugetlbfs_parse_param() Syzkaller reports a null-ptr-deref bug as follows:
    ====================================================== KASAN: null-ptr-deref in range     [0x0000000000000000-0x0000000000000007] RIP: 0010:hugetlbfs_parse_param+0x1dd/0x8e0     fs/hugetlbfs/inode.c:1380 [...] Call Trace: <TASK> vfs_parse_fs_param fs/fs_context.c:148 [inline]     vfs_parse_fs_param+0x1f9/0x3c0 fs/fs_context.c:129 vfs_parse_fs_string+0xdb/0x170 fs/fs_context.c:191     generic_parse_monolithic+0x16f/0x1f0 fs/fs_context.c:231 do_new_mount fs/namespace.c:3036 [inline]     path_mount+0x12de/0x1e20 fs/namespace.c:3370 do_mount fs/namespace.c:3383 [inline] __do_sys_mount     fs/namespace.c:3591 [inline] __se_sys_mount fs/namespace.c:3568 [inline] __x64_sys_mount+0x27f/0x300     fs/namespace.c:3568 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x35/0xb0     arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd [...] </TASK>     ====================================================== According to commit vfs: parse: deal with zero     length string value, kernel will set the param->string to null pointer in vfs_parse_fs_string() if fs     string has zero length. Yet the problem is that, hugetlbfs_parse_param() will dereference the     param->string, without checking whether it is a null pointer. To be more specific, if     hugetlbfs_parse_param() parses an illegal mount parameter, such as size=,, kernel will constructs struct     fs_parameter with null pointer in vfs_parse_fs_string(), then passes this struct fs_parameter to     hugetlbfs_parse_param(), which triggers the above null-ptr-deref bug. This patch solves it by adding     sanity check on param->string in hugetlbfs_parse_param(). (CVE-2022-50334)

  - In the Linux kernel, the following vulnerability has been resolved: Input: cyapa - add missing input core     locking to suspend/resume functions Grab input->mutex during suspend/resume functions like it is done in     other input drivers. This fixes the following warning during system suspend/resume cycle on Samsung     Exynos5250-based Snow Chromebook: ------------[ cut here ]------------ WARNING: CPU: 1 PID: 1680 at     drivers/input/input.c:2291 input_device_enabled+0x68/0x6c Modules linked in: ... CPU: 1 PID: 1680 Comm:
    kworker/u4:12 Tainted: G W 6.6.0-rc5-next-20231009 #14109 Hardware name: Samsung Exynos (Flattened Device     Tree) Workqueue: events_unbound async_run_entry_fn unwind_backtrace from show_stack+0x10/0x14 show_stack     from dump_stack_lvl+0x58/0x70 dump_stack_lvl from __warn+0x1a8/0x1cc __warn from     warn_slowpath_fmt+0x18c/0x1b4 warn_slowpath_fmt from input_device_enabled+0x68/0x6c input_device_enabled     from cyapa_gen3_set_power_mode+0x13c/0x1dc cyapa_gen3_set_power_mode from cyapa_reinitialize+0x10c/0x15c     cyapa_reinitialize from cyapa_resume+0x48/0x98 cyapa_resume from dpm_run_callback+0x90/0x298     dpm_run_callback from device_resume+0xb4/0x258 device_resume from async_resume+0x20/0x64 async_resume from     async_run_entry_fn+0x40/0x15c async_run_entry_fn from process_scheduled_works+0xbc/0x6a8     process_scheduled_works from worker_thread+0x188/0x454 worker_thread from kthread+0x108/0x140 kthread from     ret_from_fork+0x14/0x28 Exception stack(0xf1625fb0 to 0xf1625ff8) ... ---[ end trace 0000000000000000 ]---     ... ------------[ cut here ]------------ WARNING: CPU: 1 PID: 1680 at drivers/input/input.c:2291     input_device_enabled+0x68/0x6c Modules linked in: ... CPU: 1 PID: 1680 Comm: kworker/u4:12 Tainted: G W     6.6.0-rc5-next-20231009 #14109 Hardware name: Samsung Exynos (Flattened Device Tree) Workqueue:
    events_unbound async_run_entry_fn unwind_backtrace from show_stack+0x10/0x14 show_stack from     dump_stack_lvl+0x58/0x70 dump_stack_lvl from __warn+0x1a8/0x1cc __warn from warn_slowpath_fmt+0x18c/0x1b4     warn_slowpath_fmt from input_device_enabled+0x68/0x6c input_device_enabled from     cyapa_gen3_set_power_mode+0x13c/0x1dc cyapa_gen3_set_power_mode from cyapa_reinitialize+0x10c/0x15c     cyapa_reinitialize from cyapa_resume+0x48/0x98 cyapa_resume from dpm_run_callback+0x90/0x298     dpm_run_callback from device_resume+0xb4/0x258 device_resume from async_resume+0x20/0x64 async_resume from     async_run_entry_fn+0x40/0x15c async_run_entry_fn from process_scheduled_works+0xbc/0x6a8     process_scheduled_works from worker_thread+0x188/0x454 worker_thread from kthread+0x108/0x140 kthread from     ret_from_fork+0x14/0x28 Exception stack(0xf1625fb0 to 0xf1625ff8) ... ---[ end trace 0000000000000000 ]---     (CVE-2023-52884)

  - In the Linux kernel, the following vulnerability has been resolved: tracing: Do not let histogram values     have some modifiers Histogram values can not be strings, stacktraces, graphs, symbols, syscalls, or     grouped in buckets or log. Give an error if a value is set to do so. Note, the histogram code was not     prepared to handle these modifiers for histograms and caused a bug. Mark Rutland reported: # echo     'p:copy_to_user __arch_copy_to_user n=$arg2' >> /sys/kernel/tracing/kprobe_events # echo     'hist:keys=n:vals=hitcount.buckets=8:sort=hitcount' >     /sys/kernel/tracing/events/kprobes/copy_to_user/trigger # cat     /sys/kernel/tracing/events/kprobes/copy_to_user/hist [ 143.694628] Unable to handle kernel NULL pointer     dereference at virtual address 0000000000000000 [ 143.695190] Mem abort info: [ 143.695362] ESR =     0x0000000096000004 [ 143.695604] EC = 0x25: DABT (current EL), IL = 32 bits [ 143.695889] SET = 0, FnV = 0     [ 143.696077] EA = 0, S1PTW = 0 [ 143.696302] FSC = 0x04: level 0 translation fault [ 143.702381] Data     abort info: [ 143.702614] ISV = 0, ISS = 0x00000004 [ 143.702832] CM = 0, WnR = 0 [ 143.703087] user     pgtable: 4k pages, 48-bit VAs, pgdp=00000000448f9000 [ 143.703407] [0000000000000000]     pgd=0000000000000000, p4d=0000000000000000 [ 143.704137] Internal error: Oops: 0000000096000004 [#1]     PREEMPT SMP [ 143.704714] Modules linked in: [ 143.705273] CPU: 0 PID: 133 Comm: cat Not tainted     6.2.0-00003-g6fc512c10a7c #3 [ 143.706138] Hardware name: linux,dummy-virt (DT) [ 143.706723] pstate:
    80000005 (Nzcv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 143.707120] pc :
    hist_field_name.part.0+0x14/0x140 [ 143.707504] lr : hist_field_name.part.0+0x104/0x140 [ 143.707774] sp :
    ffff800008333a30 [ 143.707952] x29: ffff800008333a30 x28: 0000000000000001 x27: 0000000000400cc0 [     143.708429] x26: ffffd7a653b20260 x25: 0000000000000000 x24: ffff10d303ee5800 [ 143.708776] x23:
    ffffd7a6539b27b0 x22: ffff10d303fb8c00 x21: 0000000000000001 [ 143.709127] x20: ffff10d303ec2000 x19:
    0000000000000000 x18: 0000000000000000 [ 143.709478] x17: 0000000000000000 x16: 0000000000000000 x15:
    0000000000000000 [ 143.709824] x14: 0000000000000000 x13: 203a6f666e692072 x12: 6567676972742023 [     143.710179] x11: 0a230a6d6172676f x10: 000000000000002c x9 : ffffd7a6521e018c [ 143.710584] x8 :
    000000000000002c x7 : 7f7f7f7f7f7f7f7f x6 : 000000000000002c [ 143.710915] x5 : ffff10d303b0103e x4 :
    ffffd7a653b20261 x3 : 000000000000003d [ 143.711239] x2 : 0000000000020001 x1 : 0000000000000001 x0 :
    0000000000000000 [ 143.711746] Call trace: [ 143.712115] hist_field_name.part.0+0x14/0x140 [ 143.712642]     hist_field_name.part.0+0x104/0x140 [ 143.712925] hist_field_print+0x28/0x140 [ 143.713125]     event_hist_trigger_print+0x174/0x4d0 [ 143.713348] hist_show+0xf8/0x980 [ 143.713521]     seq_read_iter+0x1bc/0x4b0 [ 143.713711] seq_read+0x8c/0xc4 [ 143.713876] vfs_read+0xc8/0x2a4 [ 143.714043]     ksys_read+0x70/0xfc [ 143.714218] __arm64_sys_read+0x24/0x30 [ 143.714400] invoke_syscall+0x50/0x120 [     143.714587] el0_svc_common.constprop.0+0x4c/0x100 [ 143.714807] do_el0_svc+0x44/0xd0 [ 143.714970]     el0_svc+0x2c/0x84 [ 143.715134] el0t_64_sync_handler+0xbc/0x140 [ 143.715334] el0t_64_sync+0x190/0x194 [     143.715742] Code: a9bd7bfd 910003fd a90153f3 aa0003f3 (f9400000) [ 143.716510] ---[ end trace     0000000000000000 ]--- Segmentation fault (CVE-2023-53093)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The AlmaLinux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1786824415 advisory.

  - In the Linux kernel, the following vulnerability has been resolved: CDC-NCM: avoid overflow in sanity     checking A broken device may give an extreme offset like 0xFFF0 and a reasonable length for a fragment. In     the sanity check as formulated now, this will create an integer overflow, defeating the sanity check. Both     offset and offset + len need to be checked in such a manner that no overflow can occur. And those     quantities should be unsigned. (CVE-2022-48938)

  - In the Linux kernel, the following vulnerability has been resolved: pinctrl: devicetree: fix null pointer     dereferencing in pinctrl_dt_to_map Here is the BUG report by KASAN about null pointer dereference: BUG:
    KASAN: null-ptr-deref in strcmp+0x2e/0x50 Read of size 1 at addr 0000000000000000 by task python3/2640     Call Trace: strcmp __of_find_property of_find_property pinctrl_dt_to_map kasprintf() would return NULL     pointer when kmalloc() fail to allocate. So directly return ENOMEM, if kasprintf() return NULL pointer.
    (CVE-2022-49832)

  - In the Linux kernel, the following vulnerability has been resolved: hugetlbfs: fix null-ptr-deref in     hugetlbfs_parse_param() Syzkaller reports a null-ptr-deref bug as follows:
    ====================================================== KASAN: null-ptr-deref in range     [0x0000000000000000-0x0000000000000007] RIP: 0010:hugetlbfs_parse_param+0x1dd/0x8e0     fs/hugetlbfs/inode.c:1380 [...] Call Trace: <TASK> vfs_parse_fs_param fs/fs_context.c:148 [inline]     vfs_parse_fs_param+0x1f9/0x3c0 fs/fs_context.c:129 vfs_parse_fs_string+0xdb/0x170 fs/fs_context.c:191     generic_parse_monolithic+0x16f/0x1f0 fs/fs_context.c:231 do_new_mount fs/namespace.c:3036 [inline]     path_mount+0x12de/0x1e20 fs/namespace.c:3370 do_mount fs/namespace.c:3383 [inline] __do_sys_mount     fs/namespace.c:3591 [inline] __se_sys_mount fs/namespace.c:3568 [inline] __x64_sys_mount+0x27f/0x300     fs/namespace.c:3568 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x35/0xb0     arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd [...] </TASK>     ====================================================== According to commit vfs: parse: deal with zero     length string value, kernel will set the param->string to null pointer in vfs_parse_fs_string() if fs     string has zero length. Yet the problem is that, hugetlbfs_parse_param() will dereference the     param->string, without checking whether it is a null pointer. To be more specific, if     hugetlbfs_parse_param() parses an illegal mount parameter, such as size=,, kernel will constructs struct     fs_parameter with null pointer in vfs_parse_fs_string(), then passes this struct fs_parameter to     hugetlbfs_parse_param(), which triggers the above null-ptr-deref bug. This patch solves it by adding     sanity check on param->string in hugetlbfs_parse_param(). (CVE-2022-50334)

  - In the Linux kernel, the following vulnerability has been resolved: Input: cyapa - add missing input core     locking to suspend/resume functions Grab input->mutex during suspend/resume functions like it is done in     other input drivers. This fixes the following warning during system suspend/resume cycle on Samsung     Exynos5250-based Snow Chromebook: ------------[ cut here ]------------ WARNING: CPU: 1 PID: 1680 at     drivers/input/input.c:2291 input_device_enabled+0x68/0x6c Modules linked in: ... CPU: 1 PID: 1680 Comm:
    kworker/u4:12 Tainted: G W 6.6.0-rc5-next-20231009 #14109 Hardware name: Samsung Exynos (Flattened Device     Tree) Workqueue: events_unbound async_run_entry_fn unwind_backtrace from show_stack+0x10/0x14 show_stack     from dump_stack_lvl+0x58/0x70 dump_stack_lvl from __warn+0x1a8/0x1cc __warn from     warn_slowpath_fmt+0x18c/0x1b4 warn_slowpath_fmt from input_device_enabled+0x68/0x6c input_device_enabled     from cyapa_gen3_set_power_mode+0x13c/0x1dc cyapa_gen3_set_power_mode from cyapa_reinitialize+0x10c/0x15c     cyapa_reinitialize from cyapa_resume+0x48/0x98 cyapa_resume from dpm_run_callback+0x90/0x298     dpm_run_callback from device_resume+0xb4/0x258 device_resume from async_resume+0x20/0x64 async_resume from     async_run_entry_fn+0x40/0x15c async_run_entry_fn from process_scheduled_works+0xbc/0x6a8     process_scheduled_works from worker_thread+0x188/0x454 worker_thread from kthread+0x108/0x140 kthread from     ret_from_fork+0x14/0x28 Exception stack(0xf1625fb0 to 0xf1625ff8) ... ---[ end trace 0000000000000000 ]---     ... ------------[ cut here ]------------ WARNING: CPU: 1 PID: 1680 at drivers/input/input.c:2291     input_device_enabled+0x68/0x6c Modules linked in: ... CPU: 1 PID: 1680 Comm: kworker/u4:12 Tainted: G W     6.6.0-rc5-next-20231009 #14109 Hardware name: Samsung Exynos (Flattened Device Tree) Workqueue:
    events_unbound async_run_entry_fn unwind_backtrace from show_stack+0x10/0x14 show_stack from     dump_stack_lvl+0x58/0x70 dump_stack_lvl from __warn+0x1a8/0x1cc __warn from warn_slowpath_fmt+0x18c/0x1b4     warn_slowpath_fmt from input_device_enabled+0x68/0x6c input_device_enabled from     cyapa_gen3_set_power_mode+0x13c/0x1dc cyapa_gen3_set_power_mode from cyapa_reinitialize+0x10c/0x15c     cyapa_reinitialize from cyapa_resume+0x48/0x98 cyapa_resume from dpm_run_callback+0x90/0x298     dpm_run_callback from device_resume+0xb4/0x258 device_resume from async_resume+0x20/0x64 async_resume from     async_run_entry_fn+0x40/0x15c async_run_entry_fn from process_scheduled_works+0xbc/0x6a8     process_scheduled_works from worker_thread+0x188/0x454 worker_thread from kthread+0x108/0x140 kthread from     ret_from_fork+0x14/0x28 Exception stack(0xf1625fb0 to 0xf1625ff8) ... ---[ end trace 0000000000000000 ]---     (CVE-2023-52884)

  - In the Linux kernel, the following vulnerability has been resolved: tracing: Do not let histogram values     have some modifiers Histogram values can not be strings, stacktraces, graphs, symbols, syscalls, or     grouped in buckets or log. Give an error if a value is set to do so. Note, the histogram code was not     prepared to handle these modifiers for histograms and caused a bug. Mark Rutland reported: # echo     'p:copy_to_user __arch_copy_to_user n=$arg2' >> /sys/kernel/tracing/kprobe_events # echo     'hist:keys=n:vals=hitcount.buckets=8:sort=hitcount' >     /sys/kernel/tracing/events/kprobes/copy_to_user/trigger # cat     /sys/kernel/tracing/events/kprobes/copy_to_user/hist [ 143.694628] Unable to handle kernel NULL pointer     dereference at virtual address 0000000000000000 [ 143.695190] Mem abort info: [ 143.695362] ESR =     0x0000000096000004 [ 143.695604] EC = 0x25: DABT (current EL), IL = 32 bits [ 143.695889] SET = 0, FnV = 0     [ 143.696077] EA = 0, S1PTW = 0 [ 143.696302] FSC = 0x04: level 0 translation fault [ 143.702381] Data     abort info: [ 143.702614] ISV = 0, ISS = 0x00000004 [ 143.702832] CM = 0, WnR = 0 [ 143.703087] user     pgtable: 4k pages, 48-bit VAs, pgdp=00000000448f9000 [ 143.703407] [0000000000000000]     pgd=0000000000000000, p4d=0000000000000000 [ 143.704137] Internal error: Oops: 0000000096000004 [#1]     PREEMPT SMP [ 143.704714] Modules linked in: [ 143.705273] CPU: 0 PID: 133 Comm: cat Not tainted     6.2.0-00003-g6fc512c10a7c #3 [ 143.706138] Hardware name: linux,dummy-virt (DT) [ 143.706723] pstate:
    80000005 (Nzcv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 143.707120] pc :
    hist_field_name.part.0+0x14/0x140 [ 143.707504] lr : hist_field_name.part.0+0x104/0x140 [ 143.707774] sp :
    ffff800008333a30 [ 143.707952] x29: ffff800008333a30 x28: 0000000000000001 x27: 0000000000400cc0 [     143.708429] x26: ffffd7a653b20260 x25: 0000000000000000 x24: ffff10d303ee5800 [ 143.708776] x23:
    ffffd7a6539b27b0 x22: ffff10d303fb8c00 x21: 0000000000000001 [ 143.709127] x20: ffff10d303ec2000 x19:
    0000000000000000 x18: 0000000000000000 [ 143.709478] x17: 0000000000000000 x16: 0000000000000000 x15:
    0000000000000000 [ 143.709824] x14: 0000000000000000 x13: 203a6f666e692072 x12: 6567676972742023 [     143.710179] x11: 0a230a6d6172676f x10: 000000000000002c x9 : ffffd7a6521e018c [ 143.710584] x8 :
    000000000000002c x7 : 7f7f7f7f7f7f7f7f x6 : 000000000000002c [ 143.710915] x5 : ffff10d303b0103e x4 :
    ffffd7a653b20261 x3 : 000000000000003d [ 143.711239] x2 : 0000000000020001 x1 : 0000000000000001 x0 :
    0000000000000000 [ 143.711746] Call trace: [ 143.712115] hist_field_name.part.0+0x14/0x140 [ 143.712642]     hist_field_name.part.0+0x104/0x140 [ 143.712925] hist_field_print+0x28/0x140 [ 143.713125]     event_hist_trigger_print+0x174/0x4d0 [ 143.713348] hist_show+0xf8/0x980 [ 143.713521]     seq_read_iter+0x1bc/0x4b0 [ 143.713711] seq_read+0x8c/0xc4 [ 143.713876] vfs_read+0xc8/0x2a4 [ 143.714043]     ksys_read+0x70/0xfc [ 143.714218] __arm64_sys_read+0x24/0x30 [ 143.714400] invoke_syscall+0x50/0x120 [     143.714587] el0_svc_common.constprop.0+0x4c/0x100 [ 143.714807] do_el0_svc+0x44/0xd0 [ 143.714970]     el0_svc+0x2c/0x84 [ 143.715134] el0t_64_sync_handler+0xbc/0x140 [ 143.715334] el0t_64_sync+0x190/0x194 [     143.715742] Code: a9bd7bfd 910003fd a90153f3 aa0003f3 (f9400000) [ 143.716510] ---[ end trace     0000000000000000 ]--- Segmentation fault (CVE-2023-53093)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 10 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-50372 advisory.

    - net/sched: fix pedit partial COW leading to page cache corruption (Rajat Gupta)   {CVE-2026-46331}
    - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Christian Brauner)  [Orabug: 39668743]     {CVE-2026-46242}
    - net: skbuff: fix missing zerocopy reference in pskb_carve helpers (Minh Nguyen)  [Orabug: 39656679]     {CVE-2026-52943}
    - arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Rutland)  [Orabug: 39548792]     {CVE-2025-10263}
    - openvswitch: vport: fix self-deadlock on release of tunnel ports (Ilya Maximets) {CVE-2026-46165}
    - iommu/amd: serialize sequence allocation under concurrent TLB invalidations (Ankit Soni)     {CVE-2026-43220}
    - usb: ulpi: fix memory leak on ulpi_register() error paths (Felix Gu) {CVE-2026-46109}
    - smb: client: reject userspace cifs.spnego descriptions (Asim Viladi Oglu Manizada)  [Orabug: 39463671]     {CVE-2026-46243}
    - net: skbuff: propagate shared-frag marker through frag-transfer helpers (Hyunwoo Kim) [Orabug:
    39368826,39441323] {CVE-2026-43503,CVE-2026-46300}
    - net: skbuff: preserve shared-frag marker during coalescing (William Bowling) [Orabug: 39368826]     {CVE-2026-46300}
    - netfilter: reject zero shift in nft_bitwise (Kai Ma) [Orabug: 39452464] {CVE-2026-46101}
    - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Andrea Mayer) [Orabug: 39452457]     {CVE-2026-46099}
    - ALSA: caiaq: fix usb_dev refcount leak on probe failure (Deepanshu Kartikey) [Orabug: 39452739]     {CVE-2026-46048}
    - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Greg Kroah-Hartman) [Orabug: 39426003]     {CVE-2026-43501}
    - ALSA: caiaq: Fix potentially leftover ep1_in_urb at error path (Takashi Iwai) [Orabug: 39452746]     {CVE-2026-45992}
    - net: bonding: fix use-after-free in bond_xmit_broadcast() (Xiang Mei) [Orabug: 39205989]     {CVE-2026-31419}
    - crypto: authencesn - reject short ahash digests during instance creation (Yucheng Lu) [Orabug: 39452231]     {CVE-2026-46033}
    - spi: fix resource leaks on device setup failure (Johan Hovold) [Orabug: 39452400] {CVE-2026-46083}
    - net: qrtr: ns: Limit the total number of nodes (Manivannan Sadhasivam) [Orabug: 39452123]     {CVE-2026-46003}
    - net: bridge: use a stable FDB dst snapshot in RCU readers (Zhengchuan Liang) [Orabug: 39452411]     {CVE-2026-46086}
    - net: qrtr: ns: Limit the maximum number of lookups (Manivannan Sadhasivam) [Orabug: 39452207]     {CVE-2026-46026}
    - net: qrtr: ns: Limit the maximum server registration per node (Manivannan Sadhasivam) [Orabug: 39410851]     {CVE-2026-43491}
    - RDMA/mana_ib: Disable RX steering on RSS QP destroy (Long Li) [Orabug: 39452406] {CVE-2026-46084}
    - media: rc: igorplugusb: heed coherency rules (Oliver Neukum) [Orabug: 39452432] {CVE-2026-46091}
    - wifi: mwifiex: fix use-after-free in mwifiex_adapter_cleanup() (Daniel Hodges) [Orabug: 39452343]     {CVE-2026-46069}
    - thermal: core: Fix thermal zone governor cleanup issues (Rafael J. Wysocki) [Orabug: 39452186]     {CVE-2026-46021}
    - smb: client: validate the whole DACL before rewriting it in cifsacl (Michael Bommarito) [Orabug:
    39300611] {CVE-2026-31709}
    - scsi: sd: fix missing put_disk() when device_add(&disk_dev) fails (Yang Xiuwei) [Orabug: 39452100]     {CVE-2026-45997}
    - rtmutex: Use waiter::task instead of current in remove_waiter() (Keenan Dong) [Orabug: 39425998]     {CVE-2026-43499}
    - ceph: only d_add() negative dentries when they are unhashed (Max Kellermann) [Orabug: 39452291]     {CVE-2026-46052}
    - dm mirror: fix integer overflow in create_dirty_log() (Junrui Luo) [Orabug: 39452196] {CVE-2026-46023}
    - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (Shuvam Pandey) [Orabug: 39452304]     {CVE-2026-46056}
    - tcp: call sk_data_ready() after listener migration (Zhenzhong Wu) [Orabug: 39452159] {CVE-2026-46015}
    - inotify: fix watch count leak when fsnotify_add_inode_mark_locked() fails (Chia-Ming Chang) [Orabug:
    39452250] {CVE-2026-46040}
    - md/raid5: validate payload size before accessing journal metadata (Junrui Luo) [Orabug: 39452349]     {CVE-2026-46070}
    - md/raid5: fix soft lockup in retry_aligned_read() (Chia-Ming Chang) [Orabug: 39452287] {CVE-2026-46051}
    - ext4: fix missing brelse() in ext4_xattr_inode_dec_ref_all() (Sohei Koyama) [Orabug: 39452269]     {CVE-2026-46046}
    - ext4: fix bounds check in check_xattrs() to prevent out-of-bounds access (Deepanshu Kartikey) [Orabug:
    39452442] {CVE-2026-46094}
    - io_uring/poll: fix multishot recv missing EOF on wakeup race (Jens Axboe) {CVE-2026-23473}
    - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Kevin Cheng) [Orabug: 39452372]     {CVE-2026-46076}
    - KVM: SVM: Inject #UD for INVLPGA if EFER.SVME=0 (Kevin Cheng) [Orabug: 39452394] {CVE-2026-46082}
    - KVM: nSVM: Sync interrupt shadow to cached vmcb12 after VMRUN of L2 (Yosry Ahmed) [Orabug: 39452061]     {CVE-2026-45987}
    - xfs: fix a resource leak in xfs_alloc_buftarg() (Haoxiang Li) [Orabug: 39452131] {CVE-2026-46005}
    - libceph: Prevent potential null-ptr-deref in ceph_handle_auth_reply() (Raphael Zimmer) [Orabug:
    39452201] {CVE-2026-46024}
    - ipv4: icmp: validate reply type before using icmp_pointers (Ruide Cao) [Orabug: 39452243]     {CVE-2026-46037}
    - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Hkbinbin) [Orabug: 39452259]     {CVE-2026-46043}
    - net: qrtr: ns: Free the node during ctrl_cmd_bye() (Manivannan Sadhasivam) [Orabug: 39452246]     {CVE-2026-46038}
    - rxrpc: Fix rxkad crypto unalignment handling (David Howells) [Orabug: 39452728] {CVE-2026-46085}
    - ALSA: caiaq: Handle probe errors properly (Takashi Iwai) [Orabug: 39452126] {CVE-2026-46004}
    - rbd: fix null-ptr-deref when device_add_disk() fails (Dawei Feng) [Orabug: 39452385] {CVE-2026-46079}
    - md/raid10: fix deadlock with check operation and nowait requests (Josh Hunt) [Orabug: 39452284]     {CVE-2026-46050}
    - jbd2: fix deadlock in jbd2_journal_cancel_revoke() (Zhang Yi) [Orabug: 39452318] {CVE-2026-46061}
    - erofs: fix the out-of-bounds nameoff handling for trailing dirents (Gao Xiang) [Orabug: 39452380]     {CVE-2026-46078}
    - ALSA: ctxfi: Add fallback to default RSR for S/PDIF (Harin Lee) [Orabug: 39452280] {CVE-2026-46049}
    - ext2: reject inodes with zero i_nlink and valid mode in ext2_iget() (Vasiliy Kovalev) [Orabug: 39452119]     {CVE-2026-46002}
    - net: qrtr: ns: Fix use-after-free in driver remove() (Manivannan Sadhasivam) [Orabug: 39452274]     {CVE-2026-46047}
    - net: strparser: fix skb_head leak in strp_abort_strp() (Luxiao Xu) [Orabug: 39452468] {CVE-2026-46102}
    - ALSA: control: Validate buf_len before strnlen() in snd_ctl_elem_init_enum_names() (Ziqing Chen)     [Orabug: 39452416] {CVE-2026-46088}
    - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Herbert Xu) [Orabug: 39410863] {CVE-2026-43493}
    - wifi: rtw88: check for PCI upstream bridge existence (Fedor Pchelkin) [Orabug: 39452437]     {CVE-2026-46092}
    - zram: do not forget to endio for partial discard requests (Sergey Senozhatsky) [Orabug: 39452420]     {CVE-2026-46089}
    - ocfs2: split transactions in dio completion to avoid credit exhaustion (Heming Zhao) [Orabug: 39452388]     {CVE-2026-46080}
    - drm/amdgpu: Limit BO list entry count to prevent resource exhaustion (Jesse Zhang) [Orabug: 39167551]     {CVE-2026-23468}
    - padata: Fix pd UAF once and for all (Herbert Xu) [Orabug: 38335055] {CVE-2025-38584}
    - drm/nouveau: fix u32 overflow in pushbuf reloc bounds check (Greg Kroah-Hartman) [Orabug: 39452133]     {CVE-2026-46006}
    - ALSA: usb-audio: stop parsing UAC2 rates at MAX_NR_RATES (Cassio Gabriel) [Orabug: 39452170]     {CVE-2026-46018}
    - Buffer overflow in drivers/xen/sys-hypervisor.c (Juergen Gross) [Orabug: 39305898] {CVE-2026-31786}
    - xen/privcmd: fix double free via VMA splitting (Juergen Gross) [Orabug: 39305908] {CVE-2026-31787}
    - rxrpc: Fix missing validation of ticket length in non-XDR key preparsing (Anderson Nascimento) [Orabug:
    39300563] {CVE-2026-31696}
    - crypto: ccp: Don't attempt to copy ID to userspace if PSP command failed (Sean Christopherson)     {CVE-2026-31697}
    - crypto: ccp: Don't attempt to copy PDH cert to userspace if PSP command failed (Sean Christopherson)     {CVE-2026-31698}
    - crypto: ccp: Don't attempt to copy CSR to userspace if PSP command failed (Sean Christopherson)     {CVE-2026-31699}
    - net/packet: fix TOCTOU race on mmap'd vnet_hdr in tpacket_snd() (Bingquan Chen) {CVE-2026-31700}
    - ALSA: caiaq: take a reference on the USB device in create_card() (Berk Cem Goksel) [Orabug: 39300586]     {CVE-2026-31701}
    - smb: client: fix OOB read in smb2_ioctl_query_info QUERY_INFO path (Michael Bommarito) [Orabug:
    39300607] {CVE-2026-31708}
    - smb: client: require a full NFS mode SID before reading mode bits (Michael Bommarito) [Orabug: 39343707]     {CVE-2026-43350}
    - fuse: reject oversized dirents in page cache (Samuel Page) [Orabug: 39300556] {CVE-2026-31694}
    - mm/pagewalk: fix race between concurrent split and refault (Max Boone) [Orabug: 39250782]     {CVE-2026-31456}
    - wifi: mac80211: always free skb on ieee80211_tx_prepare_skb() failure (Felix Fietkau) [Orabug: 39167472]     {CVE-2026-23444}
    - mm/userfaultfd: fix hugetlb fault mutex hash calculation (Jianhui Zhou) [Orabug: 39273453]     {CVE-2026-31575}
    - ipv6: add NULL checks for idev in SRv6 paths (Heminhong) [Orabug: 39167467] {CVE-2026-23442}
    - ocfs2: fix out-of-bounds write in ocfs2_write_end_inline (Joseph Qi) [Orabug: 39331090] {CVE-2026-43075}
    - ocfs2: validate inline data i_size during inode read (Deepanshu Kartikey) [Orabug: 39331097]     {CVE-2026-43076}
    - media: as102: fix to not free memory after the device is registered in as102_usb_probe() (Jeongjun Park)     [Orabug: 39273467] {CVE-2026-31578}
    - bcache: fix cached_dev.sb_bio use-after-free and crash (Mingzhe Zou) [Orabug: 39273481] {CVE-2026-31580}
    - ALSA: 6fire: fix use-after-free on disconnect (Berk Cem Goksel) [Orabug: 39273486] {CVE-2026-31581}
    - media: em28xx: fix use-after-free in em28xx_v4l2_open() (Abhishek Kumar) [Orabug: 39273493]     {CVE-2026-31583}
    - mm: blk-cgroup: fix use-after-free in cgwb_release_workfn() (Breno Leitao) [Orabug: 39273507]     {CVE-2026-31586}
    - KVM: x86: Use scratch field in MMIO fragment to hold small write values (Sean Christopherson) [Orabug:
    39273521] {CVE-2026-31588}
    - x86-64: rename misleadingly named '__copy_user_nocache()' function (Linus Torvalds) [Orabug: 39323162]     {CVE-2026-43073}
    - kernel: be more careful about dup_mmap() failures and uprobe registering (Liam R. Howlett)     {CVE-2025-21709}
    - gpiolib: fix race condition for gdev->srcu (Pawel Narewski) [Orabug: 38887677] {CVE-2026-22986}
    - KVM: SEV: Drop WARN on large size for KVM_MEMORY_ENCRYPT_REG_REGION (Sean Christopherson) [Orabug:
    39273529] {CVE-2026-31590}
    - KVM: SEV: Reject attempts to sync VMSA of an already-launched/encrypted vCPU (Sean Christopherson)     [Orabug: 39273553] {CVE-2026-31593}
    - ocfs2: handle invalid dinode in ocfs2_group_extend (Zhengyuan Huang) [Orabug: 39273569] {CVE-2026-31596}
    - ocfs2: fix use-after-free in ocfs2_fault() when VM_FAULT_RETRY (Tejas Bharambe) [Orabug: 39273578]     {CVE-2026-31597}
    - ocfs2: fix possible deadlock between unlink and dio_end_io_write (Joseph Qi) [Orabug: 39273586]     {CVE-2026-31598}
    - dcache: Limit the minimal number of bucket to two (Zhihao Cheng) [Orabug: 39323133] {CVE-2026-43071}
    - ALSA: ctxfi: Limit PTP to a single page (Harin Lee) [Orabug: 39273608] {CVE-2026-31602}
    - wifi: rtw88: fix device leak on probe failure (Johan Hovold) [Orabug: 39273620] {CVE-2026-31604}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - ceph: fix memory leaks in ceph_mdsc_build_path() Add __putname() calls to error code paths that did not     free the path pointer obtained by __getname(). If ownership of this pointer is not passed to the caller     via path_info.path, the function must free it before returning. (CVE-2026-43419)

Note that Nessus relies on the presence of the package as reported by the vendor.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1594 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: ctnetlink: remove refcounting in expectation dumpers (CVE-2025-39764)

    In the Linux kernel, the following vulnerability has been resolved:

    ipv6: use RCU in ip6_xmit() (CVE-2025-40135)

    In the Linux kernel, the following vulnerability has been resolved:

    blk-throttle: fix access race during throttle policy activation (CVE-2025-40147)

    In the Linux kernel, the following vulnerability has been resolved:

    binfmt_misc: restore write access before closing files opened by open_exec() (CVE-2025-68239)

    In the Linux kernel, the following vulnerability has been resolved:

    dm-verity: disable recursive forward error correction (CVE-2025-71161)

    In the Linux kernel, the following vulnerability has been resolved:

    dst: fix races in rt6_uncached_list_del() and rt_del_uncached_list() (CVE-2026-23004)

    In the Linux kernel, the following vulnerability has been resolved:

    tracing: Add recursion protection in kernel stack trace recording (CVE-2026-23138)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: xt_IDLETIMER: reject rev0 reuse of ALARM timer labels (CVE-2026-23274)

    In the Linux kernel, the following vulnerability has been resolved:

    net: add xmit recursion limit to tunnel xmit functions (CVE-2026-23276)

    In the Linux kernel, the following vulnerability has been resolved:

    net/sched: teql: fix NULL pointer dereference in iptunnel_xmit on TEQL slave xmit (CVE-2026-23277)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: nf_tables: always walk all pending catchall elements (CVE-2026-23278)

    In the Linux kernel, the following vulnerability has been resolved:

    mptcp: pm: in-kernel: always mark signal+subflow endp as used (CVE-2026-23321)

    In the Linux kernel, the following vulnerability has been resolved:

    net: phy: register phy led_triggers during probe to avoid AB-BA deadlock (CVE-2026-23368)

    In the Linux kernel, the following vulnerability has been resolved:

    mm: thp: deny THP for files on anonymous inodes (CVE-2026-23375)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: xt_CT: drop pending enqueued packets on template removal (CVE-2026-23391)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: nf_tables: release flowtable after rcu grace period on error (CVE-2026-23392)

    In the Linux kernel, the following vulnerability has been resolved:

    nfnetlink_osf: validate individual option lengths in fingerprints (CVE-2026-23397)

    In the Linux kernel, the following vulnerability has been resolved:

    icmp: fix NULL pointer dereference in icmp_tag_validation() (CVE-2026-23398)

    In the Linux kernel, the following vulnerability has been resolved:

    nf_tables: nft_dynset: fix possible stateful expression memleak in error path (CVE-2026-23399)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: bpf: defer hook memory release until rcu readers are done (CVE-2026-23412)

    In the Linux kernel, the following vulnerability has been resolved:

    clsact: Fix use-after-free in init/destroy rollback asymmetry (CVE-2026-23413)

    In the Linux kernel, the following vulnerability has been resolved:

    udp_tunnel: fix NULL deref caused by udp_sock_create6 when CONFIG_IPV6=n (CVE-2026-23439)

    In the Linux kernel, the following vulnerability has been resolved:

    net/mlx5e: Fix race condition during IPSec ESN update (CVE-2026-23440)

    In the Linux kernel, the following vulnerability has been resolved:

    net/mlx5e: Prevent concurrent access to IPSec ASO context (CVE-2026-23441)

    In the Linux kernel, the following vulnerability has been resolved:

    ACPI: processor: Fix previous acpi_processor_errata_piix4() fix (CVE-2026-23443)

    In the Linux kernel, the following vulnerability has been resolved:

    igc: fix page fault in XDP TX timestamps handling (CVE-2026-23445)

    In the Linux kernel, the following vulnerability has been resolved:

    net/sched: teql: Fix double-free in teql_master_xmit (CVE-2026-23449)

    In the Linux kernel, the following vulnerability has been resolved:

    PM: runtime: Fix a race condition related to device removal (CVE-2026-23452)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CVE-2026-23455)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (CVE-2026-23456)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (CVE-2026-23457)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (CVE-2026-23458)

    In the Linux kernel, the following vulnerability has been resolved:

    btrfs: log new dentries when logging parent dir of a conflicting inode (CVE-2026-23465)

    In the Linux kernel, the following vulnerability has been resolved:

    spi: fix statistics allocation (CVE-2026-23475)

    In the Linux kernel, the following vulnerability has been resolved:

    spi: fix use-after-free on controller registration failure (CVE-2026-31389)

    In the Linux kernel, the following vulnerability has been resolved:

    smb: client: fix krb5 mount with username option (CVE-2026-31392)

    In the Linux kernel, the following vulnerability has been resolved:

    nvdimm/bus: Fix potential use after free in asynchronous initialization (CVE-2026-31399)

    In the Linux kernel, the following vulnerability has been resolved:

    sunrpc: fix cache_request leak in cache_release (CVE-2026-31400)

    In the Linux kernel, the following vulnerability has been resolved:

    HID: bpf: prevent buffer overflow in hid_hw_request (CVE-2026-31401)

    In the Linux kernel, the following vulnerability has been resolved:

    nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (CVE-2026-31402)

    In the Linux kernel, the following vulnerability has been resolved:

    NFSD: Hold net reference for the lifetime of /proc/fs/nfs/exports fd (CVE-2026-31403)

    In the Linux kernel, the following vulnerability has been resolved:

    drm/i915/gt: Check set_default_submission() before deferencing (CVE-2026-31540)

    In the Linux kernel, the following vulnerability has been resolved:

    net: bonding: fix NULL deref in bond_debug_rlb_hash_show (CVE-2026-31546)

    In the Linux kernel, the following vulnerability has been resolved:

    xen/privcmd: restrict usage in unprivileged domU (CVE-2026-31788)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: nft_ct: drop pending enqueued packets on removal (CVE-2026-43060)

    In the Linux kernel, the following vulnerability has been resolved:

    serial: 8250: Fix TX deadlock when using DMA (CVE-2026-43061)

    In the Linux kernel, the following vulnerability has been resolved:

    mptcp: pm: in-kernel: always set ID as avail when rm endp (CVE-2026-43252)

    In the Linux kernel, the following vulnerability has been resolved:

    btrfs: fix transaction abort on set received ioctl due to item overflow (CVE-2026-43359)

    In the Linux kernel, the following vulnerability has been resolved:

    btrfs: fix transaction abort on file creation due to name hash collision (CVE-2026-43360)

    In the Linux kernel, the following vulnerability has been resolved:

    btrfs: fix transaction abort when snapshotting received subvolumes (CVE-2026-43361)

    In the Linux kernel, the following vulnerability has been resolved:

    smb: client: fix in-place encryption corruption in SMB2_write() (CVE-2026-43362)

    In the Linux kernel, the following vulnerability has been resolved:

    x86/apic: Disable x2apic on resume if the kernel expects so (CVE-2026-43363)

    In the Linux kernel, the following vulnerability has been resolved:

    xfs: fix undersized l_iclog_roundoff values (CVE-2026-43365)

    In the Linux kernel, the following vulnerability has been resolved:

    io_uring/kbuf: check if target buffer list is still legacy on recycle (CVE-2026-43366)

    In the Linux kernel, the following vulnerability has been resolved:

    drm/i915: Fix potential overflow of shmem scatterlist length (CVE-2026-43368)

    In the Linux kernel, the following vulnerability has been resolved:

    net: nexthop: fix percpu use-after-free in remove_nh_grp_entry (CVE-2026-43374)

    In the Linux kernel, the following vulnerability has been resolved:

    net/tcp-md5: Fix MAC comparison to be constant-time (CVE-2026-43383)

    In the Linux kernel, the following vulnerability has been resolved:

    net/tcp-ao: Fix MAC comparison to be constant-time (CVE-2026-43384)

    In the Linux kernel, the following vulnerability has been resolved:

    sched_ext: Fix starvation of scx_enable() under fair-class saturation (CVE-2026-43392)

    In the Linux kernel, the following vulnerability has been resolved:

    btrfs: fix chunk map leak in btrfs_map_block() after btrfs_chunk_map_num_copies() (CVE-2026-43393)

    In the Linux kernel, the following vulnerability has been resolved:

    nfsd: Fix cred ref leak in nfsd_nl_listener_set_doit(). (CVE-2026-43394)

    In the Linux kernel, the following vulnerability has been resolved:

    nsfs: tighten permission checks for ns iteration ioctls (CVE-2026-43403)

    In the Linux kernel, the following vulnerability has been resolved:

    libceph: Use u32 for non-negative values in ceph_monmap_decode() (CVE-2026-43405)

    In the Linux kernel, the following vulnerability has been resolved:

    libceph: prevent potential out-of-bounds reads in process_message_header() (CVE-2026-43406)

    In the Linux kernel, the following vulnerability has been resolved:

    libceph: Fix potential out-of-bounds access in ceph_handle_auth_reply() (CVE-2026-43407)

    In the Linux kernel, the following vulnerability has been resolved:

    ceph: add a bunch of missing ceph_path_info initializers (CVE-2026-43408)

    In the Linux kernel, the following vulnerability has been resolved:

    kprobes: avoid crash when rmmod/insmod after ftrace killed (CVE-2026-43409)

    In the Linux kernel, the following vulnerability has been resolved:

    tipc: fix divide-by-zero in tipc_sk_filter_connect() (CVE-2026-43411)

    In the Linux kernel, the following vulnerability has been resolved:

    ceph: fix memory leaks in ceph_mdsc_build_path() (CVE-2026-43419)

    In the Linux kernel, the following vulnerability has been resolved:

    ceph: fix i_nlink underrun during async unlink (CVE-2026-43420)

    In the Linux kernel, the following vulnerability has been resolved:

    usb: class: cdc-wdm: fix reordering issue in read code path (CVE-2026-43427)

    In the Linux kernel, the following vulnerability has been resolved:

    USB: core: Limit the length of unkillable synchronous timeouts (CVE-2026-43428)

    In the Linux kernel, the following vulnerability has been resolved:

    usb: xhci: Fix memory leak in xhci_disable_slot() (CVE-2026-43432)

    In the Linux kernel, the following vulnerability has been resolved:

    sched_ext: Remove redundant css_put() in scx_cgroup_init() (CVE-2026-43438)

    In the Linux kernel, the following vulnerability has been resolved:

    cgroup: fix race between task migration and iteration (CVE-2026-43439)

    In the Linux kernel, the following vulnerability has been resolved:

    net: bonding: Fix nd_tbl NULL dereference when IPv6 is disabled (CVE-2026-43441)

    In the Linux kernel, the following vulnerability has been resolved:

    e1000/e1000e: Fix leak in DMA error cleanup (CVE-2026-43445)

    In the Linux kernel, the following vulnerability has been resolved:

    nvme-pci: Fix race bug in nvme_poll_irqdisable() (CVE-2026-43448)

    In the Linux kernel, the following vulnerability has been resolved:

    nvme-pci: Fix slab-out-of-bounds in nvme_dbbuf_set (CVE-2026-43449)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CVE-2026-43450)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (CVE-2026-43451)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: x_tables: guard option walkers against 1-byte tail reads (CVE-2026-43452)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop() (CVE-2026-43453)

    In the Linux kernel, the following vulnerability has been resolved:

    bonding: fix type confusion in bond_setup_by_slave() (CVE-2026-43456)

    In the Linux kernel, the following vulnerability has been resolved:

    net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (CVE-2026-43466)

    In the Linux kernel, the following vulnerability has been resolved:

    net/mlx5: Fix crash when moving to switchdev mode (CVE-2026-43467)

    In the Linux kernel, the following vulnerability has been resolved:

    net/mlx5: Fix deadlock between devlink lock and esw->wq (CVE-2026-43468)

    In the Linux kernel, the following vulnerability has been resolved:

    nfs: return EISDIR on nfs3_proc_create if d_alias is a dir (CVE-2026-43470)

    In the Linux kernel, the following vulnerability has been resolved:

    unshare: fix unshare_fs() handling (CVE-2026-43472)

    In the Linux kernel, the following vulnerability has been resolved:

    scsi: mpi3mr: Add NULL checks when resetting request and reply queues (CVE-2026-43473)

    In the Linux kernel, the following vulnerability has been resolved:

    scsi: storvsc: Fix scheduling while atomic on PREEMPT_RT (CVE-2026-43475)

    In the Linux kernel, the following vulnerability has been resolved:

    sched_ext: Disable preemption between scx_claim_exit() and kicking helper work (CVE-2026-43482)

    In the Linux kernel, the following vulnerability has been resolved:

    KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (CVE-2026-43483)

    In the Linux kernel, the following vulnerability has been resolved:

    arm64: contpte: fix set_access_flags() no-op check for SMMU/ATS faults (CVE-2026-43486)

    In the Linux kernel, the following vulnerability has been resolved:

    ata: libata-core: Disable LPM on ST1000DM010-2EP102 (CVE-2026-43487)

    In the Linux kernel, the following vulnerability has been resolved:

    usb: xhci: Prevent interrupt storm on host controller error (HCE) (CVE-2026-43488)

    In the Linux kernel, the following vulnerability has been resolved:

    erofs: fix inline data read failure for ztailpacking pclusters (CVE-2026-45943)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
359751	Rocky Linux 9.6 [TuxCare] Security Update: kernel / kernel-64k / kernel-64k-core / kernel-64k-debug / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1786824415)	Nessus	Rocky Linux Local Security Checks	Local	critical
359602	AlmaLinux 9.6 [TuxCare] Security Update: kernel / kernel-64k / kernel-64k-core / kernel-64k-debug / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1786824415)	Nessus	Alma Linux Local Security Checks	Local	critical
340680	Ubuntu 24.04 LTS / Pro Realtime 24.04 LTS : Linux kernel (Raspberry Pi) vulnerabilities (USN-8665-1)	Nessus	Ubuntu Local Security Checks	Local	high
325292	Oracle Linux 10 / 9 : Unbreakable Enterprise kernel (ELSA-2026-50372)	Nessus	Oracle Linux Local Security Checks	Local	high
324048	SUSE SLED15 / SLES15 : Security update for the Linux Kernel (SUSE-SU-2026:2238-1)	Nessus	SuSE Local Security Checks	Local	high
313362	Linux Distros Unpatched Vulnerability : CVE-2026-43419	Nessus	Misc.	Local	medium
311340	Amazon Linux 2023 : bpftool6.18, kernel6.18, kernel6.18-devel (ALAS2023-2026-1596)	Nessus	Amazon Linux Local Security Checks	Local	high
311335	Amazon Linux 2023 : bpftool6.12, kernel6.12, kernel6.12-devel (ALAS2023-2026-1594)	Nessus	Amazon Linux Local Security Checks	Local	high

Detections

Analytics

CVE-2026-43419

medium

Tenable Plugins

critical

critical

high

high

high

medium

high

high