In the Linux kernel, the following vulnerability has been resolved: bonding: fix type confusion in bond_setup_by_slave() kernel BUG at net/core/skbuff.c:2306! Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI RIP: 0010:pskb_expand_head+0xa08/0xfe0 net/core/skbuff.c:2306 RSP: 0018:ffffc90004aff760 EFLAGS: 00010293 RAX: 0000000000000000 RBX: ffff88807e3c8780 RCX: ffffffff89593e0e RDX: ffff88807b7c4900 RSI: ffffffff89594747 RDI: ffff88807b7c4900 RBP: 0000000000000820 R08: 0000000000000005 R09: 0000000000000000 R10: 00000000961a63e0 R11: 0000000000000000 R12: ffff88807e3c8780 R13: 00000000961a6560 R14: dffffc0000000000 R15: 00000000961a63e0 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fe1a0ed8df0 CR3: 000000002d816000 CR4: 00000000003526f0 Call Trace: <TASK> ipgre_header+0xdd/0x540 net/ipv4/ip_gre.c:900 dev_hard_header include/linux/netdevice.h:3439 [inline] packet_snd net/packet/af_packet.c:3028 [inline] packet_sendmsg+0x3ae5/0x53c0 net/packet/af_packet.c:3108 sock_sendmsg_nosec net/socket.c:727 [inline] __sock_sendmsg net/socket.c:742 [inline] ____sys_sendmsg+0xa54/0xc30 net/socket.c:2592 ___sys_sendmsg+0x190/0x1e0 net/socket.c:2646 __sys_sendmsg+0x170/0x220 net/socket.c:2678 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0x106/0xf80 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fe1a0e6c1a9 When a non-Ethernet device (e.g. GRE tunnel) is enslaved to a bond, bond_setup_by_slave() directly copies the slave's header_ops to the bond device: bond_dev->header_ops = slave_dev->header_ops; This causes a type confusion when dev_hard_header() is later called on the bond device. Functions like ipgre_header(), ip6gre_header(),all use netdev_priv(dev) to access their device-specific private data. When called with the bond device, netdev_priv() returns the bond's private data (struct bonding) instead of the expected type (e.g. struct ip_tunnel), leading to garbage values being read and kernel crashes. Fix this by introducing bond_header_ops with wrapper functions that delegate to the active slave's header_ops using the slave's own device. This ensures netdev_priv() in the slave's header functions always receives the correct device. The fix is placed in the bonding driver rather than individual device drivers, as the root cause is bond blindly inheriting header_ops from the slave without considering that these callbacks expect a specific netdev_priv() layout. The type confusion can be observed by adding a printk in ipgre_header() and running the following commands: ip link add dummy0 type dummy ip addr add 10.0.0.1/24 dev dummy0 ip link set dummy0 up ip link add gre1 type gre local 10.0.0.1 ip link add bond1 type bond mode active-backup ip link set gre1 master bond1 ip link set gre1 up ip link set bond1 up ip addr add fe80::1/64 dev bond1

The remote SUSE Linux SLES12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:2914-1 advisory.

    The SUSE Linux Enterprise 12 SP5 kernel was updated to fix various security issues

    The following security issues were fixed:

    - CVE-2023-53995: net: ipv4: fix one memleak in __inet_del_ifa() (bsc#1255616).
    - CVE-2026-23255: net: add proper RCU protection to /proc/net/ptype (bsc#1259891).
    - CVE-2026-23451: bonding: prevent potential infinite loop in bond_header_parse() (bsc#1261604).
    - CVE-2026-31462: drm/amdgpu: prevent immediate PASID reuse case (bsc#1262655).
    - CVE-2026-31499: Bluetooth: L2CAP: Fix deadlock in l2cap_conn_del() (bsc#1262674).
    - CVE-2026-31502: team: fix header_ops type confusion with non-Ethernet ports (bsc#1263072).
    - CVE-2026-31592: KVM: SEV: Protect *all* of sev_mem_enc_register_region() with kvm->lock (bsc#1263123).
    - CVE-2026-31670: net: rfkill: prevent unlimited numbers of rfkill events from being created     (bsc#1263573).
    - CVE-2026-31677: crypto: af_alg - limit RX SG extraction by receive buffer budget (bsc#1263560).
    - CVE-2026-31680: net: ipv6: flowlabel: defer exclusive option free until RCU teardown (bsc#1263563).
    - CVE-2026-31773: Bluetooth: SMP: derive legacy responder STK authentication from MITM state     (bsc#1264039).
    - CVE-2026-31781: drm/ioc32: stop speculation on the drm_compat_ioctl path (bsc#1264033).
    - CVE-2026-43035: net: sched: cls_api: fix tc_chain_fill_node to initialize tcm_info to zero to prevent an     info-leak       (bsc#1263996).
    - CVE-2026-43036: net: use skb_header_pointer() for TCPv4 GSO frag_off check (bsc#1263993).
    - CVE-2026-43043: crypto: af-alg - fix NULL pointer dereference in scatterwalk (bsc#1264088).
    - CVE-2026-43047: HID: multitouch: Check to ensure report responses match the request (bsc#1264073).
    - CVE-2026-43051: HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (bsc#1264065).
    - CVE-2026-43080: l2tp: Drop large packets with UDP encap (bsc#1264236).
    - CVE-2026-43089: xfrm_user: fix info leak in build_mapping() (bsc#1264261).
    - CVE-2026-43093: xsk: tighten UMEM headroom validation to account for tailroom and min frame     (bsc#1264254).
    - CVE-2026-43112: fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (bsc#1264437).
    - CVE-2026-43117: btrfs: tracepoints: get correct superblock from dentry in event btrfs_sync_file()     (bsc#1264414).
    - CVE-2026-43139: xfrm6: fix uninitialized saddr in xfrm6_get_saddr() (bsc#1264294).
    - CVE-2026-43233: netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (bsc#1264337).
    - CVE-2026-43279: ALSA: usb-audio: Add sanity check for OOB writes at silencing (bsc#1264618).
    - CVE-2026-43336: lib/crypto: chacha: Zeroize permuted_state before it leaves scope (bsc#1265113).
    - CVE-2026-43456: bonding: fix type confusion in bond_setup_by_slave() (bsc#1264734).
    - CVE-2026-43472: unshare: fix unshare_fs() handling (bsc#1264748).
    - CVE-2026-43492: lib/crypto: mpi: Fix integer underflow in mpi_read_raw_from_sgl() (bsc#1265629).
    - CVE-2026-45840: openvswitch: cap upcall PID array size and pre-size vport replies (bsc#1266397).
    - CVE-2026-45912: ext4: don't cache extent during splitting extent (bsc#1266899).
    - CVE-2026-45948: ext4: fix memory leak in ext4_ext_shift_extents() (bsc#1266929).
    - CVE-2026-45960: hfsplus: return error when node already exists in hfs_bnode_create (bsc#1266971).
    - CVE-2026-46028: crypto: algif_aead - snapshot IV for async AEAD requests (bsc#1267430).
    - CVE-2026-46065: fbdev: defio: Disconnect deferred I/O from the lifetime of struct (bsc#1267458).
    - CVE-2026-46069: wifi: mwifiex: fix use-after-free in mwifiex_adapter_cleanup() (bsc#1267437).
    - CVE-2026-46082: KVM: SVM: Inject #UD for INVLPGA if EFER.SVME=0 (bsc#1267473).
    - CVE-2026-46124: isofs: validate block number from NFS file handle in isofs_export_iget (bsc#1266847).
    - CVE-2026-46133: RDMA/rxe: Reject unknown opcodes before ICRC processing (bsc#1266928).
    - CVE-2026-46253: pstore/ram: fix buffer overflow in persistent_ram_save_old() (bsc#1267635).
    - CVE-2026-46254: AppArmor: Allow apparmor to handle unaligned dfa tables (bsc#1267637).
    - CVE-2026-46266: inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (bsc#1267684).
    - CVE-2026-46275: Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (bsc#1267968).
    - CVE-2026-46299: hfsplus: fix held lock freed on hfsplus_fill_super() (bsc#1267920).
    - CVE-2026-46320: tap: free page on error paths in tap_get_user_xdp() (bsc#1267993).
    - CVE-2026-46328: apparmor: fix rlimit for posix cpu timers (bsc#1268037).
    - CVE-2026-46331: net/sched: fix pedit partial COW leading to page cache (bsc#1265421).
    - CVE-2026-52918: Bluetooth: serialize accept_q access (bsc#1269100).
    - CVE-2026-52923: ipc: limit next_id allocation to the valid ID range (bsc#1269033).
    - CVE-2026-52954: libceph: handle rbtree insertion error in decode_choose_args() (bsc#1269137).
    - CVE-2026-52955: libceph: Fix potential out-of-bounds access in crush_decode() (bsc#1269159).
    - CVE-2026-52957: libceph: Fix potential null-ptr-deref in decode_choose_args() (bsc#1269103).
    - CVE-2026-52962: ceph: fix a buffer leak in __ceph_setxattr() (bsc#1269135).
    - CVE-2026-52972: crypto: af_alg - Cap AEAD AD length to 0x80000000 (bsc#1269195).
    - CVE-2026-53040: ocfs2: validate bg_bits during freefrag scan (bsc#1269397).
    - CVE-2026-53041: ocfs2: fix listxattr handling when the buffer is full (bsc#1269398).
    - CVE-2026-53075: ppp: require CAP_NET_ADMIN in target netns for unattached ioctls (bsc#1269690).
    - CVE-2026-53148: thunderbolt: Clamp XDomain response data copy to allocation size (bsc#1269786).
    - CVE-2026-53150: thunderbolt: Reject zero-length property entries in validator (bsc#1269386).
    - CVE-2026-53194: USB: serial: kl5kusb105: fix bulk-out buffer overflow (bsc#1269904).
    - CVE-2026-53253: Bluetooth: bnep: fix incorrect length parsing in bnep_rx_frame() extension handling     (bsc#1269574).
    - CVE-2026-53287: audit: fix incorrect inheritable capability in CAPSET records (bsc#1269506).
    - CVE-2026-53359: KVM: x86: Fix shadow paging use-after-free due to unexpected role (bsc#1270059).

    The following non security issues were fixed:

    - btrfs: tracepoints: fix sleep while in atomic context in btrfs_sync_file() (git-fixes).
    - libceph: add non-asserting rbtree insertion helper (bsc#1269137).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 10 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-50372 advisory.

    - net/sched: fix pedit partial COW leading to page cache corruption (Rajat Gupta)   {CVE-2026-46331}
    - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Christian Brauner)  [Orabug: 39668743]     {CVE-2026-46242}
    - net: skbuff: fix missing zerocopy reference in pskb_carve helpers (Minh Nguyen)  [Orabug: 39656679]     {CVE-2026-52943}
    - arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Rutland)  [Orabug: 39548792]     {CVE-2025-10263}
    - openvswitch: vport: fix self-deadlock on release of tunnel ports (Ilya Maximets) {CVE-2026-46165}
    - iommu/amd: serialize sequence allocation under concurrent TLB invalidations (Ankit Soni)     {CVE-2026-43220}
    - usb: ulpi: fix memory leak on ulpi_register() error paths (Felix Gu) {CVE-2026-46109}
    - smb: client: reject userspace cifs.spnego descriptions (Asim Viladi Oglu Manizada)  [Orabug: 39463671]     {CVE-2026-46243}
    - net: skbuff: propagate shared-frag marker through frag-transfer helpers (Hyunwoo Kim) [Orabug:
    39368826,39441323] {CVE-2026-43503,CVE-2026-46300}
    - net: skbuff: preserve shared-frag marker during coalescing (William Bowling) [Orabug: 39368826]     {CVE-2026-46300}
    - netfilter: reject zero shift in nft_bitwise (Kai Ma) [Orabug: 39452464] {CVE-2026-46101}
    - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Andrea Mayer) [Orabug: 39452457]     {CVE-2026-46099}
    - ALSA: caiaq: fix usb_dev refcount leak on probe failure (Deepanshu Kartikey) [Orabug: 39452739]     {CVE-2026-46048}
    - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Greg Kroah-Hartman) [Orabug: 39426003]     {CVE-2026-43501}
    - ALSA: caiaq: Fix potentially leftover ep1_in_urb at error path (Takashi Iwai) [Orabug: 39452746]     {CVE-2026-45992}
    - net: bonding: fix use-after-free in bond_xmit_broadcast() (Xiang Mei) [Orabug: 39205989]     {CVE-2026-31419}
    - crypto: authencesn - reject short ahash digests during instance creation (Yucheng Lu) [Orabug: 39452231]     {CVE-2026-46033}
    - spi: fix resource leaks on device setup failure (Johan Hovold) [Orabug: 39452400] {CVE-2026-46083}
    - net: qrtr: ns: Limit the total number of nodes (Manivannan Sadhasivam) [Orabug: 39452123]     {CVE-2026-46003}
    - net: bridge: use a stable FDB dst snapshot in RCU readers (Zhengchuan Liang) [Orabug: 39452411]     {CVE-2026-46086}
    - net: qrtr: ns: Limit the maximum number of lookups (Manivannan Sadhasivam) [Orabug: 39452207]     {CVE-2026-46026}
    - net: qrtr: ns: Limit the maximum server registration per node (Manivannan Sadhasivam) [Orabug: 39410851]     {CVE-2026-43491}
    - RDMA/mana_ib: Disable RX steering on RSS QP destroy (Long Li) [Orabug: 39452406] {CVE-2026-46084}
    - media: rc: igorplugusb: heed coherency rules (Oliver Neukum) [Orabug: 39452432] {CVE-2026-46091}
    - wifi: mwifiex: fix use-after-free in mwifiex_adapter_cleanup() (Daniel Hodges) [Orabug: 39452343]     {CVE-2026-46069}
    - thermal: core: Fix thermal zone governor cleanup issues (Rafael J. Wysocki) [Orabug: 39452186]     {CVE-2026-46021}
    - smb: client: validate the whole DACL before rewriting it in cifsacl (Michael Bommarito) [Orabug:
    39300611] {CVE-2026-31709}
    - scsi: sd: fix missing put_disk() when device_add(&disk_dev) fails (Yang Xiuwei) [Orabug: 39452100]     {CVE-2026-45997}
    - rtmutex: Use waiter::task instead of current in remove_waiter() (Keenan Dong) [Orabug: 39425998]     {CVE-2026-43499}
    - ceph: only d_add() negative dentries when they are unhashed (Max Kellermann) [Orabug: 39452291]     {CVE-2026-46052}
    - dm mirror: fix integer overflow in create_dirty_log() (Junrui Luo) [Orabug: 39452196] {CVE-2026-46023}
    - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (Shuvam Pandey) [Orabug: 39452304]     {CVE-2026-46056}
    - tcp: call sk_data_ready() after listener migration (Zhenzhong Wu) [Orabug: 39452159] {CVE-2026-46015}
    - inotify: fix watch count leak when fsnotify_add_inode_mark_locked() fails (Chia-Ming Chang) [Orabug:
    39452250] {CVE-2026-46040}
    - md/raid5: validate payload size before accessing journal metadata (Junrui Luo) [Orabug: 39452349]     {CVE-2026-46070}
    - md/raid5: fix soft lockup in retry_aligned_read() (Chia-Ming Chang) [Orabug: 39452287] {CVE-2026-46051}
    - ext4: fix missing brelse() in ext4_xattr_inode_dec_ref_all() (Sohei Koyama) [Orabug: 39452269]     {CVE-2026-46046}
    - ext4: fix bounds check in check_xattrs() to prevent out-of-bounds access (Deepanshu Kartikey) [Orabug:
    39452442] {CVE-2026-46094}
    - io_uring/poll: fix multishot recv missing EOF on wakeup race (Jens Axboe) {CVE-2026-23473}
    - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Kevin Cheng) [Orabug: 39452372]     {CVE-2026-46076}
    - KVM: SVM: Inject #UD for INVLPGA if EFER.SVME=0 (Kevin Cheng) [Orabug: 39452394] {CVE-2026-46082}
    - KVM: nSVM: Sync interrupt shadow to cached vmcb12 after VMRUN of L2 (Yosry Ahmed) [Orabug: 39452061]     {CVE-2026-45987}
    - xfs: fix a resource leak in xfs_alloc_buftarg() (Haoxiang Li) [Orabug: 39452131] {CVE-2026-46005}
    - libceph: Prevent potential null-ptr-deref in ceph_handle_auth_reply() (Raphael Zimmer) [Orabug:
    39452201] {CVE-2026-46024}
    - ipv4: icmp: validate reply type before using icmp_pointers (Ruide Cao) [Orabug: 39452243]     {CVE-2026-46037}
    - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Hkbinbin) [Orabug: 39452259]     {CVE-2026-46043}
    - net: qrtr: ns: Free the node during ctrl_cmd_bye() (Manivannan Sadhasivam) [Orabug: 39452246]     {CVE-2026-46038}
    - rxrpc: Fix rxkad crypto unalignment handling (David Howells) [Orabug: 39452728] {CVE-2026-46085}
    - ALSA: caiaq: Handle probe errors properly (Takashi Iwai) [Orabug: 39452126] {CVE-2026-46004}
    - rbd: fix null-ptr-deref when device_add_disk() fails (Dawei Feng) [Orabug: 39452385] {CVE-2026-46079}
    - md/raid10: fix deadlock with check operation and nowait requests (Josh Hunt) [Orabug: 39452284]     {CVE-2026-46050}
    - jbd2: fix deadlock in jbd2_journal_cancel_revoke() (Zhang Yi) [Orabug: 39452318] {CVE-2026-46061}
    - erofs: fix the out-of-bounds nameoff handling for trailing dirents (Gao Xiang) [Orabug: 39452380]     {CVE-2026-46078}
    - ALSA: ctxfi: Add fallback to default RSR for S/PDIF (Harin Lee) [Orabug: 39452280] {CVE-2026-46049}
    - ext2: reject inodes with zero i_nlink and valid mode in ext2_iget() (Vasiliy Kovalev) [Orabug: 39452119]     {CVE-2026-46002}
    - net: qrtr: ns: Fix use-after-free in driver remove() (Manivannan Sadhasivam) [Orabug: 39452274]     {CVE-2026-46047}
    - net: strparser: fix skb_head leak in strp_abort_strp() (Luxiao Xu) [Orabug: 39452468] {CVE-2026-46102}
    - ALSA: control: Validate buf_len before strnlen() in snd_ctl_elem_init_enum_names() (Ziqing Chen)     [Orabug: 39452416] {CVE-2026-46088}
    - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Herbert Xu) [Orabug: 39410863] {CVE-2026-43493}
    - wifi: rtw88: check for PCI upstream bridge existence (Fedor Pchelkin) [Orabug: 39452437]     {CVE-2026-46092}
    - zram: do not forget to endio for partial discard requests (Sergey Senozhatsky) [Orabug: 39452420]     {CVE-2026-46089}
    - ocfs2: split transactions in dio completion to avoid credit exhaustion (Heming Zhao) [Orabug: 39452388]     {CVE-2026-46080}
    - drm/amdgpu: Limit BO list entry count to prevent resource exhaustion (Jesse Zhang) [Orabug: 39167551]     {CVE-2026-23468}
    - padata: Fix pd UAF once and for all (Herbert Xu) [Orabug: 38335055] {CVE-2025-38584}
    - drm/nouveau: fix u32 overflow in pushbuf reloc bounds check (Greg Kroah-Hartman) [Orabug: 39452133]     {CVE-2026-46006}
    - ALSA: usb-audio: stop parsing UAC2 rates at MAX_NR_RATES (Cassio Gabriel) [Orabug: 39452170]     {CVE-2026-46018}
    - Buffer overflow in drivers/xen/sys-hypervisor.c (Juergen Gross) [Orabug: 39305898] {CVE-2026-31786}
    - xen/privcmd: fix double free via VMA splitting (Juergen Gross) [Orabug: 39305908] {CVE-2026-31787}
    - rxrpc: Fix missing validation of ticket length in non-XDR key preparsing (Anderson Nascimento) [Orabug:
    39300563] {CVE-2026-31696}
    - crypto: ccp: Don't attempt to copy ID to userspace if PSP command failed (Sean Christopherson)     {CVE-2026-31697}
    - crypto: ccp: Don't attempt to copy PDH cert to userspace if PSP command failed (Sean Christopherson)     {CVE-2026-31698}
    - crypto: ccp: Don't attempt to copy CSR to userspace if PSP command failed (Sean Christopherson)     {CVE-2026-31699}
    - net/packet: fix TOCTOU race on mmap'd vnet_hdr in tpacket_snd() (Bingquan Chen) {CVE-2026-31700}
    - ALSA: caiaq: take a reference on the USB device in create_card() (Berk Cem Goksel) [Orabug: 39300586]     {CVE-2026-31701}
    - smb: client: fix OOB read in smb2_ioctl_query_info QUERY_INFO path (Michael Bommarito) [Orabug:
    39300607] {CVE-2026-31708}
    - smb: client: require a full NFS mode SID before reading mode bits (Michael Bommarito) [Orabug: 39343707]     {CVE-2026-43350}
    - fuse: reject oversized dirents in page cache (Samuel Page) [Orabug: 39300556] {CVE-2026-31694}
    - mm/pagewalk: fix race between concurrent split and refault (Max Boone) [Orabug: 39250782]     {CVE-2026-31456}
    - wifi: mac80211: always free skb on ieee80211_tx_prepare_skb() failure (Felix Fietkau) [Orabug: 39167472]     {CVE-2026-23444}
    - mm/userfaultfd: fix hugetlb fault mutex hash calculation (Jianhui Zhou) [Orabug: 39273453]     {CVE-2026-31575}
    - ipv6: add NULL checks for idev in SRv6 paths (Heminhong) [Orabug: 39167467] {CVE-2026-23442}
    - ocfs2: fix out-of-bounds write in ocfs2_write_end_inline (Joseph Qi) [Orabug: 39331090] {CVE-2026-43075}
    - ocfs2: validate inline data i_size during inode read (Deepanshu Kartikey) [Orabug: 39331097]     {CVE-2026-43076}
    - media: as102: fix to not free memory after the device is registered in as102_usb_probe() (Jeongjun Park)     [Orabug: 39273467] {CVE-2026-31578}
    - bcache: fix cached_dev.sb_bio use-after-free and crash (Mingzhe Zou) [Orabug: 39273481] {CVE-2026-31580}
    - ALSA: 6fire: fix use-after-free on disconnect (Berk Cem Goksel) [Orabug: 39273486] {CVE-2026-31581}
    - media: em28xx: fix use-after-free in em28xx_v4l2_open() (Abhishek Kumar) [Orabug: 39273493]     {CVE-2026-31583}
    - mm: blk-cgroup: fix use-after-free in cgwb_release_workfn() (Breno Leitao) [Orabug: 39273507]     {CVE-2026-31586}
    - KVM: x86: Use scratch field in MMIO fragment to hold small write values (Sean Christopherson) [Orabug:
    39273521] {CVE-2026-31588}
    - x86-64: rename misleadingly named '__copy_user_nocache()' function (Linus Torvalds) [Orabug: 39323162]     {CVE-2026-43073}
    - kernel: be more careful about dup_mmap() failures and uprobe registering (Liam R. Howlett)     {CVE-2025-21709}
    - gpiolib: fix race condition for gdev->srcu (Pawel Narewski) [Orabug: 38887677] {CVE-2026-22986}
    - KVM: SEV: Drop WARN on large size for KVM_MEMORY_ENCRYPT_REG_REGION (Sean Christopherson) [Orabug:
    39273529] {CVE-2026-31590}
    - KVM: SEV: Reject attempts to sync VMSA of an already-launched/encrypted vCPU (Sean Christopherson)     [Orabug: 39273553] {CVE-2026-31593}
    - ocfs2: handle invalid dinode in ocfs2_group_extend (Zhengyuan Huang) [Orabug: 39273569] {CVE-2026-31596}
    - ocfs2: fix use-after-free in ocfs2_fault() when VM_FAULT_RETRY (Tejas Bharambe) [Orabug: 39273578]     {CVE-2026-31597}
    - ocfs2: fix possible deadlock between unlink and dio_end_io_write (Joseph Qi) [Orabug: 39273586]     {CVE-2026-31598}
    - dcache: Limit the minimal number of bucket to two (Zhihao Cheng) [Orabug: 39323133] {CVE-2026-43071}
    - ALSA: ctxfi: Limit PTP to a single page (Harin Lee) [Orabug: 39273608] {CVE-2026-31602}
    - wifi: rtw88: fix device leak on probe failure (Johan Hovold) [Orabug: 39273620] {CVE-2026-31604}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the linux package has been released.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - bonding: fix type confusion in bond_setup_by_slave() kernel BUG at net/core/skbuff.c:2306! Oops: invalid     opcode: 0000 [#1] SMP KASAN NOPTI RIP: 0010:pskb_expand_head+0xa08/0xfe0 net/core/skbuff.c:2306 RSP:
    0018:ffffc90004aff760 EFLAGS: 00010293 RAX: 0000000000000000 RBX: ffff88807e3c8780 RCX: ffffffff89593e0e     RDX: ffff88807b7c4900 RSI: ffffffff89594747 RDI: ffff88807b7c4900 RBP: 0000000000000820 R08:
    0000000000000005 R09: 0000000000000000 R10: 00000000961a63e0 R11: 0000000000000000 R12: ffff88807e3c8780     R13: 00000000961a6560 R14: dffffc0000000000 R15: 00000000961a63e0 CS: 0010 DS: 0000 ES: 0000 CR0:
    0000000080050033 CR2: 00007fe1a0ed8df0 CR3: 000000002d816000 CR4: 00000000003526f0 Call Trace: <TASK>     ipgre_header+0xdd/0x540 net/ipv4/ip_gre.c:900 dev_hard_header include/linux/netdevice.h:3439 [inline]     packet_snd net/packet/af_packet.c:3028 [inline] packet_sendmsg+0x3ae5/0x53c0 net/packet/af_packet.c:3108     sock_sendmsg_nosec net/socket.c:727 [inline] __sock_sendmsg net/socket.c:742 [inline]
    ____sys_sendmsg+0xa54/0xc30 net/socket.c:2592 ___sys_sendmsg+0x190/0x1e0 net/socket.c:2646
    __sys_sendmsg+0x170/0x220 net/socket.c:2678 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]     do_syscall_64+0x106/0xf80 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP:
    0033:0x7fe1a0e6c1a9 When a non-Ethernet device (e.g. GRE tunnel) is enslaved to a bond,     bond_setup_by_slave() directly copies the slave's header_ops to the bond device: bond_dev->header_ops =     slave_dev->header_ops; This causes a type confusion when dev_hard_header() is later called on the bond     device. Functions like ipgre_header(), ip6gre_header(),all use netdev_priv(dev) to access their device-     specific private data. When called with the bond device, netdev_priv() returns the bond's private data     (struct bonding) instead of the expected type (e.g. struct ip_tunnel), leading to garbage values being     read and kernel crashes. Fix this by introducing bond_header_ops with wrapper functions that delegate to     the active slave's header_ops using the slave's own device. This ensures netdev_priv() in the slave's     header functions always receives the correct device. The fix is placed in the bonding driver rather than     individual device drivers, as the root cause is bond blindly inheriting header_ops from the slave without     considering that these callbacks expect a specific netdev_priv() layout. The type confusion can be     observed by adding a printk in ipgre_header() and running the following commands: ip link add dummy0 type     dummy ip addr add 10.0.0.1/24 dev dummy0 ip link set dummy0 up ip link add gre1 type gre local 10.0.0.1 ip     link add bond1 type bond mode active-backup ip link set gre1 master bond1 ip link set gre1 up ip link set     bond1 up ip addr add fe80::1/64 dev bond1 (CVE-2026-43456)

Note that Nessus relies on the presence of the package as reported by the vendor.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1594 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: ctnetlink: remove refcounting in expectation dumpers (CVE-2025-39764)

    In the Linux kernel, the following vulnerability has been resolved:

    ipv6: use RCU in ip6_xmit() (CVE-2025-40135)

    In the Linux kernel, the following vulnerability has been resolved:

    blk-throttle: fix access race during throttle policy activation (CVE-2025-40147)

    In the Linux kernel, the following vulnerability has been resolved:

    binfmt_misc: restore write access before closing files opened by open_exec() (CVE-2025-68239)

    In the Linux kernel, the following vulnerability has been resolved:

    dm-verity: disable recursive forward error correction (CVE-2025-71161)

    In the Linux kernel, the following vulnerability has been resolved:

    dst: fix races in rt6_uncached_list_del() and rt_del_uncached_list() (CVE-2026-23004)

    In the Linux kernel, the following vulnerability has been resolved:

    tracing: Add recursion protection in kernel stack trace recording (CVE-2026-23138)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: xt_IDLETIMER: reject rev0 reuse of ALARM timer labels (CVE-2026-23274)

    In the Linux kernel, the following vulnerability has been resolved:

    net: add xmit recursion limit to tunnel xmit functions (CVE-2026-23276)

    In the Linux kernel, the following vulnerability has been resolved:

    net/sched: teql: fix NULL pointer dereference in iptunnel_xmit on TEQL slave xmit (CVE-2026-23277)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: nf_tables: always walk all pending catchall elements (CVE-2026-23278)

    In the Linux kernel, the following vulnerability has been resolved:

    mptcp: pm: in-kernel: always mark signal+subflow endp as used (CVE-2026-23321)

    In the Linux kernel, the following vulnerability has been resolved:

    net: phy: register phy led_triggers during probe to avoid AB-BA deadlock (CVE-2026-23368)

    In the Linux kernel, the following vulnerability has been resolved:

    mm: thp: deny THP for files on anonymous inodes (CVE-2026-23375)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: xt_CT: drop pending enqueued packets on template removal (CVE-2026-23391)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: nf_tables: release flowtable after rcu grace period on error (CVE-2026-23392)

    In the Linux kernel, the following vulnerability has been resolved:

    nfnetlink_osf: validate individual option lengths in fingerprints (CVE-2026-23397)

    In the Linux kernel, the following vulnerability has been resolved:

    icmp: fix NULL pointer dereference in icmp_tag_validation() (CVE-2026-23398)

    In the Linux kernel, the following vulnerability has been resolved:

    nf_tables: nft_dynset: fix possible stateful expression memleak in error path (CVE-2026-23399)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: bpf: defer hook memory release until rcu readers are done (CVE-2026-23412)

    In the Linux kernel, the following vulnerability has been resolved:

    clsact: Fix use-after-free in init/destroy rollback asymmetry (CVE-2026-23413)

    In the Linux kernel, the following vulnerability has been resolved:

    udp_tunnel: fix NULL deref caused by udp_sock_create6 when CONFIG_IPV6=n (CVE-2026-23439)

    In the Linux kernel, the following vulnerability has been resolved:

    net/mlx5e: Fix race condition during IPSec ESN update (CVE-2026-23440)

    In the Linux kernel, the following vulnerability has been resolved:

    net/mlx5e: Prevent concurrent access to IPSec ASO context (CVE-2026-23441)

    In the Linux kernel, the following vulnerability has been resolved:

    ACPI: processor: Fix previous acpi_processor_errata_piix4() fix (CVE-2026-23443)

    In the Linux kernel, the following vulnerability has been resolved:

    igc: fix page fault in XDP TX timestamps handling (CVE-2026-23445)

    In the Linux kernel, the following vulnerability has been resolved:

    net/sched: teql: Fix double-free in teql_master_xmit (CVE-2026-23449)

    In the Linux kernel, the following vulnerability has been resolved:

    PM: runtime: Fix a race condition related to device removal (CVE-2026-23452)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CVE-2026-23455)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (CVE-2026-23456)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (CVE-2026-23457)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (CVE-2026-23458)

    In the Linux kernel, the following vulnerability has been resolved:

    btrfs: log new dentries when logging parent dir of a conflicting inode (CVE-2026-23465)

    In the Linux kernel, the following vulnerability has been resolved:

    spi: fix statistics allocation (CVE-2026-23475)

    In the Linux kernel, the following vulnerability has been resolved:

    spi: fix use-after-free on controller registration failure (CVE-2026-31389)

    In the Linux kernel, the following vulnerability has been resolved:

    smb: client: fix krb5 mount with username option (CVE-2026-31392)

    In the Linux kernel, the following vulnerability has been resolved:

    nvdimm/bus: Fix potential use after free in asynchronous initialization (CVE-2026-31399)

    In the Linux kernel, the following vulnerability has been resolved:

    sunrpc: fix cache_request leak in cache_release (CVE-2026-31400)

    In the Linux kernel, the following vulnerability has been resolved:

    HID: bpf: prevent buffer overflow in hid_hw_request (CVE-2026-31401)

    In the Linux kernel, the following vulnerability has been resolved:

    nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (CVE-2026-31402)

    In the Linux kernel, the following vulnerability has been resolved:

    NFSD: Hold net reference for the lifetime of /proc/fs/nfs/exports fd (CVE-2026-31403)

    In the Linux kernel, the following vulnerability has been resolved:

    drm/i915/gt: Check set_default_submission() before deferencing (CVE-2026-31540)

    In the Linux kernel, the following vulnerability has been resolved:

    net: bonding: fix NULL deref in bond_debug_rlb_hash_show (CVE-2026-31546)

    In the Linux kernel, the following vulnerability has been resolved:

    xen/privcmd: restrict usage in unprivileged domU (CVE-2026-31788)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: nft_ct: drop pending enqueued packets on removal (CVE-2026-43060)

    In the Linux kernel, the following vulnerability has been resolved:

    serial: 8250: Fix TX deadlock when using DMA (CVE-2026-43061)

    In the Linux kernel, the following vulnerability has been resolved:

    mptcp: pm: in-kernel: always set ID as avail when rm endp (CVE-2026-43252)

    In the Linux kernel, the following vulnerability has been resolved:

    btrfs: fix transaction abort on set received ioctl due to item overflow (CVE-2026-43359)

    In the Linux kernel, the following vulnerability has been resolved:

    btrfs: fix transaction abort on file creation due to name hash collision (CVE-2026-43360)

    In the Linux kernel, the following vulnerability has been resolved:

    btrfs: fix transaction abort when snapshotting received subvolumes (CVE-2026-43361)

    In the Linux kernel, the following vulnerability has been resolved:

    smb: client: fix in-place encryption corruption in SMB2_write() (CVE-2026-43362)

    In the Linux kernel, the following vulnerability has been resolved:

    x86/apic: Disable x2apic on resume if the kernel expects so (CVE-2026-43363)

    In the Linux kernel, the following vulnerability has been resolved:

    xfs: fix undersized l_iclog_roundoff values (CVE-2026-43365)

    In the Linux kernel, the following vulnerability has been resolved:

    io_uring/kbuf: check if target buffer list is still legacy on recycle (CVE-2026-43366)

    In the Linux kernel, the following vulnerability has been resolved:

    drm/i915: Fix potential overflow of shmem scatterlist length (CVE-2026-43368)

    In the Linux kernel, the following vulnerability has been resolved:

    net: nexthop: fix percpu use-after-free in remove_nh_grp_entry (CVE-2026-43374)

    In the Linux kernel, the following vulnerability has been resolved:

    net/tcp-md5: Fix MAC comparison to be constant-time (CVE-2026-43383)

    In the Linux kernel, the following vulnerability has been resolved:

    net/tcp-ao: Fix MAC comparison to be constant-time (CVE-2026-43384)

    In the Linux kernel, the following vulnerability has been resolved:

    sched_ext: Fix starvation of scx_enable() under fair-class saturation (CVE-2026-43392)

    In the Linux kernel, the following vulnerability has been resolved:

    btrfs: fix chunk map leak in btrfs_map_block() after btrfs_chunk_map_num_copies() (CVE-2026-43393)

    In the Linux kernel, the following vulnerability has been resolved:

    nfsd: Fix cred ref leak in nfsd_nl_listener_set_doit(). (CVE-2026-43394)

    In the Linux kernel, the following vulnerability has been resolved:

    nsfs: tighten permission checks for ns iteration ioctls (CVE-2026-43403)

    In the Linux kernel, the following vulnerability has been resolved:

    libceph: Use u32 for non-negative values in ceph_monmap_decode() (CVE-2026-43405)

    In the Linux kernel, the following vulnerability has been resolved:

    libceph: prevent potential out-of-bounds reads in process_message_header() (CVE-2026-43406)

    In the Linux kernel, the following vulnerability has been resolved:

    libceph: Fix potential out-of-bounds access in ceph_handle_auth_reply() (CVE-2026-43407)

    In the Linux kernel, the following vulnerability has been resolved:

    ceph: add a bunch of missing ceph_path_info initializers (CVE-2026-43408)

    In the Linux kernel, the following vulnerability has been resolved:

    kprobes: avoid crash when rmmod/insmod after ftrace killed (CVE-2026-43409)

    In the Linux kernel, the following vulnerability has been resolved:

    tipc: fix divide-by-zero in tipc_sk_filter_connect() (CVE-2026-43411)

    In the Linux kernel, the following vulnerability has been resolved:

    ceph: fix memory leaks in ceph_mdsc_build_path() (CVE-2026-43419)

    In the Linux kernel, the following vulnerability has been resolved:

    ceph: fix i_nlink underrun during async unlink (CVE-2026-43420)

    In the Linux kernel, the following vulnerability has been resolved:

    usb: class: cdc-wdm: fix reordering issue in read code path (CVE-2026-43427)

    In the Linux kernel, the following vulnerability has been resolved:

    USB: core: Limit the length of unkillable synchronous timeouts (CVE-2026-43428)

    In the Linux kernel, the following vulnerability has been resolved:

    usb: xhci: Fix memory leak in xhci_disable_slot() (CVE-2026-43432)

    In the Linux kernel, the following vulnerability has been resolved:

    sched_ext: Remove redundant css_put() in scx_cgroup_init() (CVE-2026-43438)

    In the Linux kernel, the following vulnerability has been resolved:

    cgroup: fix race between task migration and iteration (CVE-2026-43439)

    In the Linux kernel, the following vulnerability has been resolved:

    net: bonding: Fix nd_tbl NULL dereference when IPv6 is disabled (CVE-2026-43441)

    In the Linux kernel, the following vulnerability has been resolved:

    e1000/e1000e: Fix leak in DMA error cleanup (CVE-2026-43445)

    In the Linux kernel, the following vulnerability has been resolved:

    nvme-pci: Fix race bug in nvme_poll_irqdisable() (CVE-2026-43448)

    In the Linux kernel, the following vulnerability has been resolved:

    nvme-pci: Fix slab-out-of-bounds in nvme_dbbuf_set (CVE-2026-43449)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CVE-2026-43450)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (CVE-2026-43451)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: x_tables: guard option walkers against 1-byte tail reads (CVE-2026-43452)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop() (CVE-2026-43453)

    In the Linux kernel, the following vulnerability has been resolved:

    bonding: fix type confusion in bond_setup_by_slave() (CVE-2026-43456)

    In the Linux kernel, the following vulnerability has been resolved:

    net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (CVE-2026-43466)

    In the Linux kernel, the following vulnerability has been resolved:

    net/mlx5: Fix crash when moving to switchdev mode (CVE-2026-43467)

    In the Linux kernel, the following vulnerability has been resolved:

    net/mlx5: Fix deadlock between devlink lock and esw->wq (CVE-2026-43468)

    In the Linux kernel, the following vulnerability has been resolved:

    nfs: return EISDIR on nfs3_proc_create if d_alias is a dir (CVE-2026-43470)

    In the Linux kernel, the following vulnerability has been resolved:

    unshare: fix unshare_fs() handling (CVE-2026-43472)

    In the Linux kernel, the following vulnerability has been resolved:

    scsi: mpi3mr: Add NULL checks when resetting request and reply queues (CVE-2026-43473)

    In the Linux kernel, the following vulnerability has been resolved:

    scsi: storvsc: Fix scheduling while atomic on PREEMPT_RT (CVE-2026-43475)

    In the Linux kernel, the following vulnerability has been resolved:

    sched_ext: Disable preemption between scx_claim_exit() and kicking helper work (CVE-2026-43482)

    In the Linux kernel, the following vulnerability has been resolved:

    KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (CVE-2026-43483)

    In the Linux kernel, the following vulnerability has been resolved:

    arm64: contpte: fix set_access_flags() no-op check for SMMU/ATS faults (CVE-2026-43486)

    In the Linux kernel, the following vulnerability has been resolved:

    ata: libata-core: Disable LPM on ST1000DM010-2EP102 (CVE-2026-43487)

    In the Linux kernel, the following vulnerability has been resolved:

    usb: xhci: Prevent interrupt storm on host controller error (HCE) (CVE-2026-43488)

    In the Linux kernel, the following vulnerability has been resolved:

    erofs: fix inline data read failure for ztailpacking pclusters (CVE-2026-45943)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
326705	SUSE SLES12: cluster-md-kmp-default / dlm-kmp-default / gfs2-kmp-default / etc (SUSE-SU-2026:2914-1)	Nessus	SuSE Local Security Checks	high
326000	SUSE SLED15: cluster-md-kmp-default / dlm-kmp-default / gfs2-kmp-default / etc (SUSE-SU-2026:2800-1)	Nessus	SuSE Local Security Checks	high
325292	Oracle Linux 10 / 9 : Unbreakable Enterprise kernel (ELSA-2026-50372)	Nessus	Oracle Linux Local Security Checks	high
322162	Photon OS 5.0: Linux PHSA-2026-5.0-0890	Nessus	PhotonOS Local Security Checks	medium
318009	Photon OS 4.0: Linux PHSA-2026-4.0-1025	Nessus	PhotonOS Local Security Checks	high
313325	Linux Distros Unpatched Vulnerability : CVE-2026-43456	Nessus	Misc.	high
311340	Amazon Linux 2023 : bpftool6.18, kernel6.18, kernel6.18-devel (ALAS2023-2026-1596)	Nessus	Amazon Linux Local Security Checks	high
311335	Amazon Linux 2023 : bpftool6.12, kernel6.12, kernel6.12-devel (ALAS2023-2026-1594)	Nessus	Amazon Linux Local Security Checks	high

Detections

Analytics

CVE-2026-43456

high

Tenable Plugins

high

high

high

medium

high

high

high

high