In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Clear Present bit before tearing down PASID entry The Intel VT-d Scalable Mode PASID table entry consists of 512 bits (64 bytes). When tearing down an entry, the current implementation zeros the entire 64-byte structure immediately using multiple 64-bit writes. Since the IOMMU hardware may fetch these 64 bytes using multiple internal transactions (e.g., four 128-bit bursts), updating or zeroing the entire entry while it is active (P=1) risks a "torn" read. If a hardware fetch occurs simultaneously with the CPU zeroing the entry, the hardware could observe an inconsistent state, leading to unpredictable behavior or spurious faults. Follow the "Guidance to Software for Invalidations" in the VT-d spec (Section 6.5.3.3) by implementing the recommended ownership handshake: 1. Clear only the 'Present' (P) bit of the PASID entry. 2. Use a dma_wmb() to ensure the cleared bit is visible to hardware before proceeding. 3. Execute the required invalidation sequence (PASID cache, IOTLB, and Device-TLB flush) to ensure the hardware has released all cached references. 4. Only after the flushes are complete, zero out the remaining fields of the PASID entry. Also, add a dma_wmb() in pasid_set_present() to ensure that all other fields of the PASID entry are visible to the hardware before the Present bit is set.

The remote Oracle Linux 10 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-50372 advisory.

    - net/sched: fix pedit partial COW leading to page cache corruption (Rajat Gupta)   {CVE-2026-46331}
    - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Christian Brauner)  [Orabug: 39668743]     {CVE-2026-46242}
    - net: skbuff: fix missing zerocopy reference in pskb_carve helpers (Minh Nguyen)  [Orabug: 39656679]     {CVE-2026-52943}
    - arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Rutland)  [Orabug: 39548792]     {CVE-2025-10263}
    - openvswitch: vport: fix self-deadlock on release of tunnel ports (Ilya Maximets) {CVE-2026-46165}
    - iommu/amd: serialize sequence allocation under concurrent TLB invalidations (Ankit Soni)     {CVE-2026-43220}
    - usb: ulpi: fix memory leak on ulpi_register() error paths (Felix Gu) {CVE-2026-46109}
    - smb: client: reject userspace cifs.spnego descriptions (Asim Viladi Oglu Manizada)  [Orabug: 39463671]     {CVE-2026-46243}
    - net: skbuff: propagate shared-frag marker through frag-transfer helpers (Hyunwoo Kim) [Orabug:
    39368826,39441323] {CVE-2026-43503,CVE-2026-46300}
    - net: skbuff: preserve shared-frag marker during coalescing (William Bowling) [Orabug: 39368826]     {CVE-2026-46300}
    - netfilter: reject zero shift in nft_bitwise (Kai Ma) [Orabug: 39452464] {CVE-2026-46101}
    - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Andrea Mayer) [Orabug: 39452457]     {CVE-2026-46099}
    - ALSA: caiaq: fix usb_dev refcount leak on probe failure (Deepanshu Kartikey) [Orabug: 39452739]     {CVE-2026-46048}
    - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Greg Kroah-Hartman) [Orabug: 39426003]     {CVE-2026-43501}
    - ALSA: caiaq: Fix potentially leftover ep1_in_urb at error path (Takashi Iwai) [Orabug: 39452746]     {CVE-2026-45992}
    - net: bonding: fix use-after-free in bond_xmit_broadcast() (Xiang Mei) [Orabug: 39205989]     {CVE-2026-31419}
    - crypto: authencesn - reject short ahash digests during instance creation (Yucheng Lu) [Orabug: 39452231]     {CVE-2026-46033}
    - spi: fix resource leaks on device setup failure (Johan Hovold) [Orabug: 39452400] {CVE-2026-46083}
    - net: qrtr: ns: Limit the total number of nodes (Manivannan Sadhasivam) [Orabug: 39452123]     {CVE-2026-46003}
    - net: bridge: use a stable FDB dst snapshot in RCU readers (Zhengchuan Liang) [Orabug: 39452411]     {CVE-2026-46086}
    - net: qrtr: ns: Limit the maximum number of lookups (Manivannan Sadhasivam) [Orabug: 39452207]     {CVE-2026-46026}
    - net: qrtr: ns: Limit the maximum server registration per node (Manivannan Sadhasivam) [Orabug: 39410851]     {CVE-2026-43491}
    - RDMA/mana_ib: Disable RX steering on RSS QP destroy (Long Li) [Orabug: 39452406] {CVE-2026-46084}
    - media: rc: igorplugusb: heed coherency rules (Oliver Neukum) [Orabug: 39452432] {CVE-2026-46091}
    - wifi: mwifiex: fix use-after-free in mwifiex_adapter_cleanup() (Daniel Hodges) [Orabug: 39452343]     {CVE-2026-46069}
    - thermal: core: Fix thermal zone governor cleanup issues (Rafael J. Wysocki) [Orabug: 39452186]     {CVE-2026-46021}
    - smb: client: validate the whole DACL before rewriting it in cifsacl (Michael Bommarito) [Orabug:
    39300611] {CVE-2026-31709}
    - scsi: sd: fix missing put_disk() when device_add(&disk_dev) fails (Yang Xiuwei) [Orabug: 39452100]     {CVE-2026-45997}
    - rtmutex: Use waiter::task instead of current in remove_waiter() (Keenan Dong) [Orabug: 39425998]     {CVE-2026-43499}
    - ceph: only d_add() negative dentries when they are unhashed (Max Kellermann) [Orabug: 39452291]     {CVE-2026-46052}
    - dm mirror: fix integer overflow in create_dirty_log() (Junrui Luo) [Orabug: 39452196] {CVE-2026-46023}
    - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (Shuvam Pandey) [Orabug: 39452304]     {CVE-2026-46056}
    - tcp: call sk_data_ready() after listener migration (Zhenzhong Wu) [Orabug: 39452159] {CVE-2026-46015}
    - inotify: fix watch count leak when fsnotify_add_inode_mark_locked() fails (Chia-Ming Chang) [Orabug:
    39452250] {CVE-2026-46040}
    - md/raid5: validate payload size before accessing journal metadata (Junrui Luo) [Orabug: 39452349]     {CVE-2026-46070}
    - md/raid5: fix soft lockup in retry_aligned_read() (Chia-Ming Chang) [Orabug: 39452287] {CVE-2026-46051}
    - ext4: fix missing brelse() in ext4_xattr_inode_dec_ref_all() (Sohei Koyama) [Orabug: 39452269]     {CVE-2026-46046}
    - ext4: fix bounds check in check_xattrs() to prevent out-of-bounds access (Deepanshu Kartikey) [Orabug:
    39452442] {CVE-2026-46094}
    - io_uring/poll: fix multishot recv missing EOF on wakeup race (Jens Axboe) {CVE-2026-23473}
    - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Kevin Cheng) [Orabug: 39452372]     {CVE-2026-46076}
    - KVM: SVM: Inject #UD for INVLPGA if EFER.SVME=0 (Kevin Cheng) [Orabug: 39452394] {CVE-2026-46082}
    - KVM: nSVM: Sync interrupt shadow to cached vmcb12 after VMRUN of L2 (Yosry Ahmed) [Orabug: 39452061]     {CVE-2026-45987}
    - xfs: fix a resource leak in xfs_alloc_buftarg() (Haoxiang Li) [Orabug: 39452131] {CVE-2026-46005}
    - libceph: Prevent potential null-ptr-deref in ceph_handle_auth_reply() (Raphael Zimmer) [Orabug:
    39452201] {CVE-2026-46024}
    - ipv4: icmp: validate reply type before using icmp_pointers (Ruide Cao) [Orabug: 39452243]     {CVE-2026-46037}
    - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Hkbinbin) [Orabug: 39452259]     {CVE-2026-46043}
    - net: qrtr: ns: Free the node during ctrl_cmd_bye() (Manivannan Sadhasivam) [Orabug: 39452246]     {CVE-2026-46038}
    - rxrpc: Fix rxkad crypto unalignment handling (David Howells) [Orabug: 39452728] {CVE-2026-46085}
    - ALSA: caiaq: Handle probe errors properly (Takashi Iwai) [Orabug: 39452126] {CVE-2026-46004}
    - rbd: fix null-ptr-deref when device_add_disk() fails (Dawei Feng) [Orabug: 39452385] {CVE-2026-46079}
    - md/raid10: fix deadlock with check operation and nowait requests (Josh Hunt) [Orabug: 39452284]     {CVE-2026-46050}
    - jbd2: fix deadlock in jbd2_journal_cancel_revoke() (Zhang Yi) [Orabug: 39452318] {CVE-2026-46061}
    - erofs: fix the out-of-bounds nameoff handling for trailing dirents (Gao Xiang) [Orabug: 39452380]     {CVE-2026-46078}
    - ALSA: ctxfi: Add fallback to default RSR for S/PDIF (Harin Lee) [Orabug: 39452280] {CVE-2026-46049}
    - ext2: reject inodes with zero i_nlink and valid mode in ext2_iget() (Vasiliy Kovalev) [Orabug: 39452119]     {CVE-2026-46002}
    - net: qrtr: ns: Fix use-after-free in driver remove() (Manivannan Sadhasivam) [Orabug: 39452274]     {CVE-2026-46047}
    - net: strparser: fix skb_head leak in strp_abort_strp() (Luxiao Xu) [Orabug: 39452468] {CVE-2026-46102}
    - ALSA: control: Validate buf_len before strnlen() in snd_ctl_elem_init_enum_names() (Ziqing Chen)     [Orabug: 39452416] {CVE-2026-46088}
    - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Herbert Xu) [Orabug: 39410863] {CVE-2026-43493}
    - wifi: rtw88: check for PCI upstream bridge existence (Fedor Pchelkin) [Orabug: 39452437]     {CVE-2026-46092}
    - zram: do not forget to endio for partial discard requests (Sergey Senozhatsky) [Orabug: 39452420]     {CVE-2026-46089}
    - ocfs2: split transactions in dio completion to avoid credit exhaustion (Heming Zhao) [Orabug: 39452388]     {CVE-2026-46080}
    - drm/amdgpu: Limit BO list entry count to prevent resource exhaustion (Jesse Zhang) [Orabug: 39167551]     {CVE-2026-23468}
    - padata: Fix pd UAF once and for all (Herbert Xu) [Orabug: 38335055] {CVE-2025-38584}
    - drm/nouveau: fix u32 overflow in pushbuf reloc bounds check (Greg Kroah-Hartman) [Orabug: 39452133]     {CVE-2026-46006}
    - ALSA: usb-audio: stop parsing UAC2 rates at MAX_NR_RATES (Cassio Gabriel) [Orabug: 39452170]     {CVE-2026-46018}
    - Buffer overflow in drivers/xen/sys-hypervisor.c (Juergen Gross) [Orabug: 39305898] {CVE-2026-31786}
    - xen/privcmd: fix double free via VMA splitting (Juergen Gross) [Orabug: 39305908] {CVE-2026-31787}
    - rxrpc: Fix missing validation of ticket length in non-XDR key preparsing (Anderson Nascimento) [Orabug:
    39300563] {CVE-2026-31696}
    - crypto: ccp: Don't attempt to copy ID to userspace if PSP command failed (Sean Christopherson)     {CVE-2026-31697}
    - crypto: ccp: Don't attempt to copy PDH cert to userspace if PSP command failed (Sean Christopherson)     {CVE-2026-31698}
    - crypto: ccp: Don't attempt to copy CSR to userspace if PSP command failed (Sean Christopherson)     {CVE-2026-31699}
    - net/packet: fix TOCTOU race on mmap'd vnet_hdr in tpacket_snd() (Bingquan Chen) {CVE-2026-31700}
    - ALSA: caiaq: take a reference on the USB device in create_card() (Berk Cem Goksel) [Orabug: 39300586]     {CVE-2026-31701}
    - smb: client: fix OOB read in smb2_ioctl_query_info QUERY_INFO path (Michael Bommarito) [Orabug:
    39300607] {CVE-2026-31708}
    - smb: client: require a full NFS mode SID before reading mode bits (Michael Bommarito) [Orabug: 39343707]     {CVE-2026-43350}
    - fuse: reject oversized dirents in page cache (Samuel Page) [Orabug: 39300556] {CVE-2026-31694}
    - mm/pagewalk: fix race between concurrent split and refault (Max Boone) [Orabug: 39250782]     {CVE-2026-31456}
    - wifi: mac80211: always free skb on ieee80211_tx_prepare_skb() failure (Felix Fietkau) [Orabug: 39167472]     {CVE-2026-23444}
    - mm/userfaultfd: fix hugetlb fault mutex hash calculation (Jianhui Zhou) [Orabug: 39273453]     {CVE-2026-31575}
    - ipv6: add NULL checks for idev in SRv6 paths (Heminhong) [Orabug: 39167467] {CVE-2026-23442}
    - ocfs2: fix out-of-bounds write in ocfs2_write_end_inline (Joseph Qi) [Orabug: 39331090] {CVE-2026-43075}
    - ocfs2: validate inline data i_size during inode read (Deepanshu Kartikey) [Orabug: 39331097]     {CVE-2026-43076}
    - media: as102: fix to not free memory after the device is registered in as102_usb_probe() (Jeongjun Park)     [Orabug: 39273467] {CVE-2026-31578}
    - bcache: fix cached_dev.sb_bio use-after-free and crash (Mingzhe Zou) [Orabug: 39273481] {CVE-2026-31580}
    - ALSA: 6fire: fix use-after-free on disconnect (Berk Cem Goksel) [Orabug: 39273486] {CVE-2026-31581}
    - media: em28xx: fix use-after-free in em28xx_v4l2_open() (Abhishek Kumar) [Orabug: 39273493]     {CVE-2026-31583}
    - mm: blk-cgroup: fix use-after-free in cgwb_release_workfn() (Breno Leitao) [Orabug: 39273507]     {CVE-2026-31586}
    - KVM: x86: Use scratch field in MMIO fragment to hold small write values (Sean Christopherson) [Orabug:
    39273521] {CVE-2026-31588}
    - x86-64: rename misleadingly named '__copy_user_nocache()' function (Linus Torvalds) [Orabug: 39323162]     {CVE-2026-43073}
    - kernel: be more careful about dup_mmap() failures and uprobe registering (Liam R. Howlett)     {CVE-2025-21709}
    - gpiolib: fix race condition for gdev->srcu (Pawel Narewski) [Orabug: 38887677] {CVE-2026-22986}
    - KVM: SEV: Drop WARN on large size for KVM_MEMORY_ENCRYPT_REG_REGION (Sean Christopherson) [Orabug:
    39273529] {CVE-2026-31590}
    - KVM: SEV: Reject attempts to sync VMSA of an already-launched/encrypted vCPU (Sean Christopherson)     [Orabug: 39273553] {CVE-2026-31593}
    - ocfs2: handle invalid dinode in ocfs2_group_extend (Zhengyuan Huang) [Orabug: 39273569] {CVE-2026-31596}
    - ocfs2: fix use-after-free in ocfs2_fault() when VM_FAULT_RETRY (Tejas Bharambe) [Orabug: 39273578]     {CVE-2026-31597}
    - ocfs2: fix possible deadlock between unlink and dio_end_io_write (Joseph Qi) [Orabug: 39273586]     {CVE-2026-31598}
    - dcache: Limit the minimal number of bucket to two (Zhihao Cheng) [Orabug: 39323133] {CVE-2026-43071}
    - ALSA: ctxfi: Limit PTP to a single page (Harin Lee) [Orabug: 39273608] {CVE-2026-31602}
    - wifi: rtw88: fix device leak on probe failure (Johan Hovold) [Orabug: 39273620] {CVE-2026-31604}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:2722-1 advisory.

    The SUSE Linux Enterprise 15 SP7 kernel was updated to receive various security bugfixes.


    The following security bugs were fixed:

    - CVE-2025-10263: arm64: errata: Mitigate TLBI errata on various Arm CPUs (bsc#1266290).
    - CVE-2025-68822: Input: alps - fix use-after-free bugs caused by dev3_register_work (bsc#1256668).
    - CVE-2026-23392: netfilter: nf_tables: release flowtable after rcu grace period on error (bsc#1260531).
    - CVE-2026-31414: netfilter: nf_conntrack_expect: use expect->helper (bsc#1262085).
    - CVE-2026-31429: net: skb: fix cross-cache free of KFENCE-allocated skb head (bsc#1262392).
    - CVE-2026-31452: ext4: convert inline data to extents when truncate exceeds inline size (bsc#1262620).
    - CVE-2026-31469: virtio_net: Fix UAF on dst_ops when IFF_XMIT_DST_RELEASE is cleared and napi_tx is false
    - CVE-2026-31492: RDMA/irdma: Initialize free_qp completion before using it (bsc#1262748).
    - CVE-2026-31495: netfilter: ctnetlink: use netlink policy range checks (bsc#1262798).
    - CVE-2026-31499: Bluetooth: L2CAP: Fix deadlock in l2cap_conn_del() (bsc#1262674).
    - CVE-2026-31500: Bluetooth: btintel: serialize btintel_hw_error() with hci_req_sync_lock (bsc#1262993).
    - CVE-2026-31555: futex: Clear stale exiting pointer in futex_lock_pi() retry path (bsc#1263178).
    - CVE-2026-31560: spi: spi-dw-dma: fix print error log when wait finish transaction (bsc#1263057).
    - CVE-2026-31592: KVM: SEV: Protect *all* of sev_mem_enc_register_region() with kvm->lock (bsc#1263123).
    - CVE-2026-31593: KVM: SEV: Reject attempts to sync VMSA of an already-launched/encrypted vCPU     (bsc#1263124).
    - CVE-2026-31664: string.h: Introduce memset_after() for wiping trailing members/padding (bsc#1263578).
    - CVE-2026-31665: kABI: netfilter: nft_ct: fix use-after-free in timeout object destroy (bsc#1263137).
    - CVE-2026-31674: netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (bsc#1263568).
    - CVE-2026-31680: net: ipv6: flowlabel: defer exclusive option free until RCU teardown (bsc#1263563).
    - CVE-2026-31693: cifs: some missing initializations on replay (bsc#1267744).
    - CVE-2026-31752: bridge: br_nd_send: validate ND option lengths (bsc#1264045).
    - CVE-2026-31759: usb: ulpi: fix double free in ulpi_register_interface() error path (bsc#1264076).
    - CVE-2026-43023: Bluetooth: SCO: fix race conditions in sco_sock_connect() (bsc#1264137).
    - CVE-2026-43024: netfilter: nf_tables: reject immediate NF_QUEUE verdict (bsc#1263930).
    - CVE-2026-43028: netfilter: x_tables: ensure names are nul-terminated (bsc#1263934).
    - CVE-2026-43035: net: sched: cls_api: fix tc_chain_fill_node to initialize tcm_info to zero to prevent an     info-leak (bsc#1263996).
    - CVE-2026-43036: net: use skb_header_pointer() for TCPv4 GSO frag_off check (bsc#1263993).
    - CVE-2026-43049: HID: logitech-hidpp: Prevent use-after-free on force feedback initialisation failure     (bsc#1264080).
    - CVE-2026-43077: crypto: algif_aead - Fix minimum RX size check for decryption (bsc#1264470).
    - CVE-2026-43083: net: ioam6: fix OOB and missing lock (bsc#1264266).
    - CVE-2026-43101: ipv6: ioam: fix potential NULL dereferences in __ioam6_fill_trace_data() (bsc#1264239).
    - CVE-2026-43112: fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (bsc#1264437).
    - CVE-2026-43119: Bluetooth: hci_sync: annotate data-races around hdev->req_status (bsc#1264561).
    - CVE-2026-43158: xfs: fix freemap adjustments when adding xattrs to leaf blocks (bsc#1264595).
    - CVE-2026-43171: EFI/CPER: do not dump the entire memory region (bsc#1264549).
    - CVE-2026-43187: xfs: delete attr leaf freemap entries when empty (bsc#1264603).
    - CVE-2026-43198: tcp: fix potential race in tcp_v6_syn_recv_sock() (bsc#1264610).
    - CVE-2026-43239: smb: client: prevent races in ->query_interfaces() (bsc#1264444).
    - CVE-2026-43339: ipv6: prevent possible UaF in addrconf_permanent_addr() (bsc#1264763).
    - CVE-2026-43345: net: ipa: fix event ring index not programmed for IPA v5.0+ (bsc#1265103).
    - CVE-2026-43405: libceph: Use u32 for non-negative values in ceph_monmap_decode() (bsc#1264741).
    - CVE-2026-43469: xprtrdma: Decrement re_receiving on the early exit paths (bsc#1265143).
    - CVE-2026-43491: net: qrtr: ns: Limit the maximum server registration per node (bsc#1265628).
    - CVE-2026-45840: openvswitch: cap upcall PID array size and pre-size vport replies (bsc#1266397).
    - CVE-2026-45841: netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO (bsc#1266390).
    - CVE-2026-45862: iommu/vt-d: Flush cache for PASID table before using it (bsc#1266705).
    - CVE-2026-45870: SUNRPC: auth_gss: fix memory leaks in XDR decoding error paths (bsc#1266704).
    - CVE-2026-45894: iommu/vt-d: Clear Present bit before tearing down PASID entry (bsc#1266895).
    - CVE-2026-45940: net: stmmac: fix oops when split header is enabled (bsc#1266916).
    - CVE-2026-45961: gfs2: fix memory leaks in gfs2_fill_super error path (bsc#1266933).
    - CVE-2026-45964: SUNRPC: fix gss_auth kref leak in gss_alloc_msg error path (bsc#1266698).
    - CVE-2026-45965: apparmor: fix invalid deref of rawdata when export_binary is unset (bsc#1267208).
    - CVE-2026-45974: btrfs: fix invalid leaf access in btrfs_quota_enable() if ref key not found     (bsc#1266922).
    - CVE-2026-46005: xfs: fix a resource leak in xfs_alloc_buftarg() (bsc#1267431).
    - CVE-2026-46037: ipv4: icmp: validate reply type before using icmp_pointers (bsc#1267361).
    - CVE-2026-46101: netfilter: reject zero shift in nft_bitwise (bsc#1266878).
    - CVE-2026-46119: libceph: Fix slab-out-of-bounds access in auth message processing (bsc#1267628).
    - CVE-2026-46123: Bluetooth: virtio_bt: clamp rx length before skb_put (bsc#1267621).
    - CVE-2026-46150: fanotify: fix false positive on permission events (bsc#1267387).
    - CVE-2026-46160: btrfs: fix missing last_unlink_trans update when removing a directory (bsc#1267624).
    - CVE-2026-46162: ice: fix double free in ice_sf_eth_activate() error path (bsc#1266840).
    - CVE-2026-46172: ipv6: xfrm6: release dst on error in xfrm6_rcv_encap() (bsc#1266903).
    - CVE-2026-46244: netfilter: nft_inner: Fix IPv6 inner_thoff desync (bsc#1267654).
    - CVE-2026-46259: procfs: fix missing RCU protection when reading real_parent in do_task_stat()     (bsc#1267685).
    - CVE-2026-46273: ibmveth: Disable GSO for packets with small MSS (bsc#1267651).


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - iommu/vt-d: Clear Present bit before tearing down PASID entry The Intel VT-d Scalable Mode PASID table     entry consists of 512 bits (64 bytes). When tearing down an entry, the current implementation zeros the     entire 64-byte structure immediately using multiple 64-bit writes. Since the IOMMU hardware may fetch     these 64 bytes using multiple internal transactions (e.g., four 128-bit bursts), updating or zeroing the     entire entry while it is active (P=1) risks a torn read. If a hardware fetch occurs simultaneously with     the CPU zeroing the entry, the hardware could observe an inconsistent state, leading to unpredictable     behavior or spurious faults. Follow the Guidance to Software for Invalidations in the VT-d spec (Section     6.5.3.3) by implementing the recommended ownership handshake: 1. Clear only the 'Present' (P) bit of the     PASID entry. 2. Use a dma_wmb() to ensure the cleared bit is visible to hardware before proceeding. 3.
    Execute the required invalidation sequence (PASID cache, IOTLB, and Device-TLB flush) to ensure the     hardware has released all cached references. 4. Only after the flushes are complete, zero out the     remaining fields of the PASID entry. Also, add a dma_wmb() in pasid_set_present() to ensure that all other     fields of the PASID entry are visible to the hardware before the Present bit is set. (CVE-2026-45894)

Note that Nessus relies on the presence of the package as reported by the vendor.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1514 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    btrfs: fix reservation leak in some error paths when inserting inline extent (CVE-2025-71268)

    In the Linux kernel, the following vulnerability has been resolved:

    btrfs: do not free data reservation in fallback from inline due to -ENOSPC (CVE-2025-71269)

    In the Linux kernel, the following vulnerability has been resolved:

    smack: /smack/doi: accept previously used values (CVE-2025-71304)

    In the Linux kernel, the following vulnerability has been resolved:

    fs/ntfs3: Initialize new folios before use (CVE-2025-71311)

    In the Linux kernel, the following vulnerability has been resolved:

    RDMA/umad: Reject negative data_len in ib_umad_write (CVE-2026-23243)

    In the Linux kernel, the following vulnerability has been resolved:

    net: gro: fix outer network offset (CVE-2026-23254)

    In the Linux kernel, the following vulnerability has been resolved:

    net: add proper RCU protection to /proc/net/ptype (CVE-2026-23255)

    In the Linux kernel, the following vulnerability has been resolved:

    io_uring/rw: free potentially allocated iovec on cache put failure (CVE-2026-23259)

    In the Linux kernel, the following vulnerability has been resolved:

    regmap: maple: free entry on mas_store_gfp() failure (CVE-2026-23260)

    In the Linux kernel, the following vulnerability has been resolved:

    io_uring/zcrx: fix page array leak (CVE-2026-23263)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: nft_set_rbtree: validate open interval overlap (CVE-2026-23333)

    In the Linux kernel, the following vulnerability has been resolved:

    tracing/dma: Cap dma_map_sg tracepoint arrays to prevent buffer overflow (CVE-2026-23390)

    In the Linux kernel, the following vulnerability has been resolved:

    smb: client: make use of smbdirect_socket.recv_io.credits.available (CVE-2026-31535)

    In the Linux kernel, the following vulnerability has been resolved:

    smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (CVE-2026-31539)

    In the Linux kernel, the following vulnerability has been resolved:

    driver core: enforce device_lock for driver_match_device() (CVE-2026-31688)

    In the Linux kernel, the following vulnerability has been resolved:

    ACPI: processor: Update cpuidle driver check in __acpi_processor_start() (CVE-2026-43122)

    In the Linux kernel, the following vulnerability has been resolved:

    cpufreq: intel_pstate: Fix NULL pointer dereference in update_cpu_qos_request() (CVE-2026-43401)

    In the Linux kernel, the following vulnerability has been resolved:

    net: remove WARN_ON_ONCE when accessing forward path array (CVE-2026-45847)

    In the Linux kernel, the following vulnerability has been resolved:

    efi: Fix reservation of unaccepted memory table (CVE-2026-45851)

    In the Linux kernel, the following vulnerability has been resolved:

    ata: libata-scsi: avoid Non-NCQ command starvation (CVE-2026-45855)

    In the Linux kernel, the following vulnerability has been resolved:

    RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CVE-2026-45856)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: don't zero the entire extent if EXT4_EXT_DATA_PARTIAL_VALID1 (CVE-2026-45858)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: nfnetlink_queue: do shared-unconfirmed check before segmentation (CVE-2026-45859)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: nf_conncount: increase the connection clean up limit to 64 (CVE-2026-45860)

    In the Linux kernel, the following vulnerability has been resolved:

    iommu/vt-d: Flush cache for PASID table before using it (CVE-2026-45862)

    In the Linux kernel, the following vulnerability has been resolved:

    fs/ntfs3: prevent infinite loops caused by the next valid being the same (CVE-2026-45864)

    In the Linux kernel, the following vulnerability has been resolved:

    SUNRPC: auth_gss: fix memory leaks in XDR decoding error paths (CVE-2026-45870)

    In the Linux kernel, the following vulnerability has been resolved:

    scsi: smartpqi: Fix memory leak in pqi_report_phys_luns() (CVE-2026-45872)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: nft_set_rbtree: check for partial overlaps in anonymous sets (CVE-2026-45873)

    In the Linux kernel, the following vulnerability has been resolved:

    arm64/gcs: Fix error handling in arch_set_shadow_stack_status() (CVE-2026-45876)

    In the Linux kernel, the following vulnerability has been resolved:

    PCI/P2PDMA: Release per-CPU pgmap ref when vm_insert_page() fails (CVE-2026-45880)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf: Fix bpf_xdp_store_bytes proto for read-only arg (CVE-2026-45886)

    In the Linux kernel, the following vulnerability has been resolved:

    af_unix: Fix memleak of newsk in unix_stream_connect(). (CVE-2026-45887)

    In the Linux kernel, the following vulnerability has been resolved:

    md/raid1: fix memory leak in raid1_run() (CVE-2026-45888)

    In the Linux kernel, the following vulnerability has been resolved:

    mptcp: do not account for OoO in mptcp_rcvbuf_grow() (CVE-2026-45889)

    In the Linux kernel, the following vulnerability has been resolved:

    xen-netback: reject zero-queue configuration from guest (CVE-2026-45890)

    In the Linux kernel, the following vulnerability has been resolved:

    iommu/vt-d: Clear Present bit before tearing down PASID entry (CVE-2026-45894)

    In the Linux kernel, the following vulnerability has been resolved:

    quota: fix livelock between quotactl and freeze_super (CVE-2026-45895)

    In the Linux kernel, the following vulnerability has been resolved:

    RDMA/iwcm: Fix workqueue list corruption by removing work_list (CVE-2026-45898)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: drop extent cache when splitting extent fails (CVE-2026-45899)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf: Fix memory access flags in helper prototypes (CVE-2026-45903)

    In the Linux kernel, the following vulnerability has been resolved:

    xfrm: fix ip_rt_bug race in icmp_route_lookup reverse path (CVE-2026-45905)

    In the Linux kernel, the following vulnerability has been resolved:

    net/mlx5e: Fix deadlocks between devlink and netdev instance locks (CVE-2026-45907)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: don't cache extent during splitting extent (CVE-2026-45912)

    In the Linux kernel, the following vulnerability has been resolved:

    net: bridge: mcast: always update mdb_n_entries for vlan contexts (CVE-2026-45913)

    In the Linux kernel, the following vulnerability has been resolved:

    fat: avoid parent link count underflow in rmdir (CVE-2026-45915)

    In the Linux kernel, the following vulnerability has been resolved:

    ipvs: do not keep dest_dst if dev is going down (CVE-2026-45917)

    In the Linux kernel, the following vulnerability has been resolved:

    ovpn: tcp - don't deref NULL sk_socket member after tcp_close() (CVE-2026-45918)

    In the Linux kernel, the following vulnerability has been resolved:

    sched/rt: Skip currently executing CPU in rto_next_cpu() (CVE-2026-45919)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: fix dirtyclusters double decrement on fs shutdown (CVE-2026-45920)

    In the Linux kernel, the following vulnerability has been resolved:

    RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (CVE-2026-45922)

    In the Linux kernel, the following vulnerability has been resolved:

    thermal/of: Fix reference leak in thermal_of_cm_lookup() (CVE-2026-45925)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf: Require frozen map for calculating map hash (CVE-2026-45927)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf: Fix tcx/netkit detach permissions when prog fd isn't given (CVE-2026-45932)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf: Preserve id of register in sync_linked_regs() (CVE-2026-45933)

    In the Linux kernel, the following vulnerability has been resolved:

    btrfs: fix EEXIST abort due to non-consecutive gaps in chunk allocation (CVE-2026-45934)

    In the Linux kernel, the following vulnerability has been resolved:

    fs/ntfs3: Fix slab-out-of-bounds read in DeleteIndexEntryRoot (CVE-2026-45935)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: fix e4b bitmap inconsistency reports (CVE-2026-45942)

    In the Linux kernel, the following vulnerability has been resolved:

    erofs: fix inline data read failure for ztailpacking pclusters (CVE-2026-45943)

    In the Linux kernel, the following vulnerability has been resolved:

    iommu/vt-d: Clear Present bit before tearing down context entry (CVE-2026-45944)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: fix memory leak in ext4_ext_shift_extents() (CVE-2026-45948)

    In the Linux kernel, the following vulnerability has been resolved:

    hwrng: core - use RCU and work_struct to fix race condition (CVE-2026-45949)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf: Fix a potential use-after-free of BTF object (CVE-2026-45951)

    In the Linux kernel, the following vulnerability has been resolved:

    md/raid5: fix IO hang with degraded array with llbitmap (CVE-2026-45953)

    In the Linux kernel, the following vulnerability has been resolved:

    md/md-llbitmap: fix percpu_ref not resurrected on suspend timeout (CVE-2026-45955)

    In the Linux kernel, the following vulnerability has been resolved:

    rcu: Fix rcu_read_unlock() deadloop due to softirq (CVE-2026-45957)

    In the Linux kernel, the following vulnerability has been resolved:

    SUNRPC: fix gss_auth kref leak in gss_alloc_msg error path (CVE-2026-45964)

    In the Linux kernel, the following vulnerability has been resolved:

    cpuidle: Skip governor when only one idle state is available (CVE-2026-45968)

    In the Linux kernel, the following vulnerability has been resolved:

    bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CVE-2026-45970)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf: Limit bpf program signature size (CVE-2026-45971)

    In the Linux kernel, the following vulnerability has been resolved:

    RDMA/mlx5: Fix UMR hang in LAG error state unload (CVE-2026-45973)

    In the Linux kernel, the following vulnerability has been resolved:

    btrfs: fix invalid leaf access in btrfs_quota_enable() if ref key not found (CVE-2026-45974)

    In the Linux kernel, the following vulnerability has been resolved:

    ACPICA: Fix NULL pointer dereference in acpi_ev_address_space_dispatch() (CVE-2026-45982)

    In the Linux kernel, the following vulnerability has been resolved:

    nfsd: never defer requests during idmap lookup (CVE-2026-45983)

    In the Linux kernel, the following vulnerability has been resolved:

    btrfs: fix block_group_tree dirty_list corruption (CVE-2026-46251)

    In the Linux kernel, the following vulnerability has been resolved:

    pstore/ram: fix buffer overflow in persistent_ram_save_old() (CVE-2026-46253)

    In the Linux kernel, the following vulnerability has been resolved:

    NFS/localio: prevent direct reclaim recursion into NFS via nfs_writepages (CVE-2026-46256)

    In the Linux kernel, the following vulnerability has been resolved:

    procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CVE-2026-46259)

    In the Linux kernel, the following vulnerability has been resolved:

    inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (CVE-2026-46266)

    In the Linux kernel, the following vulnerability has been resolved:

    dm: fix unlocked test for dm_suspended_md (CVE-2026-46327)

    In the Linux kernel, the following vulnerability has been resolved:

    apparmor: fix rlimit for posix cpu timers (CVE-2026-46328)

    In the Linux kernel, the following vulnerability has been resolved:

    erofs: handle end of filesystem properly for file-backed mounts (CVE-2026-46329)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
325292	Oracle Linux 10 / 9 : Unbreakable Enterprise kernel (ELSA-2026-50372)	Nessus	Oracle Linux Local Security Checks	high
324872	SUSE SLED15: cluster-md-kmp-default / dlm-kmp-default / gfs2-kmp-default / etc (SUSE-SU-2026:2722-1)	Nessus	SuSE Local Security Checks	high
317157	Linux Distros Unpatched Vulnerability : CVE-2026-45894	Nessus	Misc.	high
305231	Amazon Linux 2023 : bpftool6.12, kernel6.12, kernel6.12-devel (ALAS2023-2026-1543)	Nessus	Amazon Linux Local Security Checks	high
304298	Amazon Linux 2023 : bpftool6.18, kernel6.18, kernel6.18-devel (ALAS2023-2026-1514)	Nessus	Amazon Linux Local Security Checks	high

Detections

Analytics

CVE-2026-45894

high

Tenable Plugins

high

high

high

high

high