In the Linux kernel, the following vulnerability has been resolved: crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree Annotating a local pointer variable, which will be assigned with the kmalloc-family functions, with the `__cleanup(kfree)` attribute will make the address of the local variable, rather than the address returned by kmalloc, passed to kfree directly and lead to a crash due to invalid deallocation of stack address. According to other places in the repo, the correct usage should be `__free(kfree)`. The code coincidentally compiled because the parameter type `void *` of kfree is compatible with the desired type `struct { ... } **`.

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-70498 advisory.

    - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-242509] {CVE-2026-68121}
    - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263403]     {CVE-2026-89481}
    - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229262] {CVE-2026-53005}
    - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255860] {CVE-2026-80714}
    - drm/amdgpu/vce: fix integer overflow in image size (Mika Penttila) [RHEL-257136] {CVE-2026-68108}
    - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (Mika Penttila) [RHEL-237844]     {CVE-2026-68257}
    - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236300] {CVE-2026-68266}
    - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229327]     {CVE-2026-64098}
    - drm/amdgpu/userq: fix access to stale wptr mapping (Mika Penttila) [RHEL-225409] {CVE-2026-46311}
    - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (Mika Penttila) [RHEL-225409]     {CVE-2026-46311}
    - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236714] {CVE-2026-68273}
    - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237962]     {CVE-2026-68267}
    - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237962]     {CVE-2026-68267}
    - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267}
    - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229371]     {CVE-2026-53290}
    - drm/amdgpu/vcn3: Avoid overflow on msg bound check (Mika Penttila) [RHEL-225316] {CVE-2026-46230}
    - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (Mika Penttila) [RHEL-225316] {CVE-2026-46230}
    - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226047] {CVE-2026-46204}
    - fbcon: Set fb_display[i]->mode to NULL when the mode is released (Mika Penttila) [RHEL-250108]     {CVE-2025-40323}
    - drm/amdgpu/vcn4: Avoid overflow on msg bound check (Mika Penttila) [RHEL-225444] {CVE-2026-46199}
    - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (Mika Penttila) [RHEL-225444] {CVE-2026-46199}
    - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230647]     {CVE-2026-53203}
    - libceph: fix potential use-after-free in have_mon_and_osd_map() (CKI Backport Bot) [RHEL-169081]     {CVE-2025-68285}
    - libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169079] {CVE-2026-23136}
    - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169072]     {CVE-2026-22990}
    - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169068]     {CVE-2026-22984}
    - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169064]     {CVE-2025-71116}
    - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264371] {CVE-2026-81000}
    - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264303] {CVE-2026-80844}
    - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262556]     {CVE-2026-89846}
    - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot)     [RHEL-260585] {CVE-2026-74569}
    - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258024]     {CVE-2026-72243}
    - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253205] {CVE-2026-64383}
    - RHEL: revert 'block: only zero non-PI metadata tuples in bio_integrity_prep' (Jeff Moyer) [RHEL-189638]     {CVE-2026-23007}
    - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232375] {CVE-2026-64053}
    - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230292] {CVE-2026-63802}
    - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236084]     {CVE-2026-68201}
    - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234288]     {CVE-2026-64564}
    - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231034]     {CVE-2026-63831}
    - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-190036] {CVE-2026-53266}
    - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264234]     {CVE-2025-39964}
    - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264234]     {CVE-2025-39964}
    - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot)     [RHEL-260452] {CVE-2026-64534}
    - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254491]     {CVE-2026-74518}
    - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237164]     {CVE-2026-68159}
    - libceph: Amend checking to fix make W=1 build breakage (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159}
    - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-241107] {CVE-2026-68188}
    - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-240892] {CVE-2026-68155}
    - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228471]     {CVE-2026-45945}
    - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228471]     {CVE-2026-45944}
    - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228471]     {CVE-2026-45894}
    - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236849]     {CVE-2026-68391}
    - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236786]     {CVE-2026-68293}
    - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231825]     {CVE-2026-53062}
    - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231825]     {CVE-2026-53062}
    - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230408]     {CVE-2026-45959}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:70498 advisory.

    * kernel: crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CVE-2025-39964)
      * kernel: iommu/vt-d: Clear Present bit before tearing down PASID entry (CVE-2026-45894)
      * kernel: crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CVE-2026-45959)
      * kernel: dm cache policy smq: fix missing locks in invalidating cache blocks (CVE-2026-53062)
      * kernel: keys: Pin request_key_auth payload in instantiate paths (CVE-2026-63823)
      * kernel: nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CVE-2026-64534)
      * kernel: net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CVE-2026-68293)
      * kernel: Linux kernel: libceph stack out-of-bounds write via crafted OSDMap (CVE-2026-68159)
      * kernel: Linux kernel Bluetooth RFCOMM: Denial of Service via use-after-free in set_termios     (CVE-2026-68188)
      * kernel: Linux kernel (libceph): Denial of Service due to malformed monitor maps (CVE-2026-68155)
      * kernel: Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CVE-2026-68391)
      * kernel: mm/hugetlb: fix list corruption in allocate_file_region_entries() (CVE-2026-74518)


    Bug Fix(es) and Enhancement(s):

      * Update kernel to use new certificate paths [almalinux-10.2.z] (JIRA:AlmaLinux-169478)
      * RHIVOS - [backport] S32G Driver Enablement - PWM (JIRA:AlmaLinux-255517)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Rocky Linux 10.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-2026_70498 advisory.

    * kernel: crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CVE-2025-39964)

    * kernel: iommu/vt-d: Clear Present bit before tearing down PASID entry (CVE-2026-45894)

    * kernel: crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CVE-2026-45959)

    * kernel: dm cache policy smq: fix missing locks in invalidating cache blocks (CVE-2026-53062)

    * kernel: keys: Pin request_key_auth payload in instantiate paths (CVE-2026-63823)

    * kernel: nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CVE-2026-64534)

    * kernel: net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CVE-2026-68293)

    * kernel: Linux kernel: libceph stack out-of-bounds write via crafted OSDMap (CVE-2026-68159)

    * kernel: Linux kernel Bluetooth RFCOMM: Denial of Service via use-after-free in set_termios     (CVE-2026-68188)

    * kernel: Linux kernel (libceph): Denial of Service due to malformed monitor maps (CVE-2026-68155)

    * kernel: Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CVE-2026-68391)

    * kernel: mm/hugetlb: fix list corruption in allocate_file_region_entries() (CVE-2026-74518)

    Bug Fix(es) and Enhancement(s):

    * Update kernel to use new certificate paths [rhel-10.2.z] (JIRA:Rocky Linux-169478)

    * RHIVOS - [backport] S32G Driver Enablement - PWM (JIRA:Rocky Linux-255517)

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-2026_70459 advisory.

    * kernel: crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CVE-2025-39964)

    * kernel: iommu/vt-d: Clear Present bit before tearing down PASID entry (CVE-2026-45894)

    * kernel: crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CVE-2026-45959)

    * kernel: dm cache policy smq: fix missing locks in invalidating cache blocks (CVE-2026-53062)

    * kernel: keys: Pin request_key_auth payload in instantiate paths (CVE-2026-63823)

    * kernel: net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CVE-2026-68293)

    * kernel: Linux kernel: libceph null pointer dereference leads to denial of service (CVE-2026-68157)

    * kernel: Linux kernel Bluetooth RFCOMM: Denial of Service via use-after-free in set_termios     (CVE-2026-68188)

    * kernel: libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CVE-2026-68156)

    * kernel: Linux kernel (libceph): Denial of Service due to malformed monitor maps (CVE-2026-68155)

    * kernel: Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CVE-2026-68391)

    * kernel: net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (CVE-2026-72072)

    * kernel: mm/hugetlb: fix list corruption in allocate_file_region_entries() (CVE-2026-74518)

    Bug Fix(es) and Enhancement(s):

    * [Intel 9.8 FEAT] ice: Driver Update [rhel-9.8.z] (JIRA:Rocky Linux-213003)

    * Rocky Linux 9.8: Multiuser Kerberized DFS shares fail to mount with UID mount option [rhel-9.8.z]     (JIRA:Rocky Linux-254108)

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the kernel-5.14.0-754.el9 build changelog.

  - In the Linux kernel, the following vulnerability has been resolved: crypto: af_alg - Cap AEAD AD length to     0x80000000 In order to prevent arithmetic overflows when checking the TX buffer size, cap the associated     data length to 0x80000000. (CVE-2026-52972)

  - In the Linux kernel, the following vulnerability has been resolved: crypto: ccp - Fix a crash due to     incorrect cleanup usage of kfree Annotating a local pointer variable, which will be assigned with the     kmalloc-family functions, with the `__cleanup(kfree)` attribute will make the address of the local     variable, rather than the address returned by kmalloc, passed to kfree directly and lead to a crash due to     invalid deallocation of stack address. According to other places in the repo, the correct usage should be     `__free(kfree)`. The code coincidentally compiled because the parameter type `void *` of kfree is     compatible with the desired type `struct { ... } **`. (CVE-2026-45959)

  - In the Linux kernel, the following vulnerability has been resolved: fhandle: fix UAF due to unlocked
    ->mnt_ns read in may_decode_fh() may_decode_fh() accesses mount::mnt_ns without holding any locks; that     means the mount can concurrently be unmounted, and the mnt_namespace can concurrently be freed after an     RCU grace period. This race can happens as follows, assuming that the mount point was created by     open_tree(..., OPEN_TREE_CLONE): thread 1 thread 2 RCU __do_sys_open_by_handle_at do_handle_open     handle_to_path may_decode_fh is_mounted [mount::mnt_ns access] [mount::mnt_ns access] __do_sys_close     fput_close_sync __fput dissolve_on_fput umount_tree class_namespace_excl_destructor namespace_unlock     free_mnt_ns mnt_ns_tree_remove call_rcu(mnt_ns_release_rcu) mnt_ns_release_rcu mnt_ns_release kfree     [mnt_namespace::user_ns access] **UAF** Fix it by taking rcu_read_lock() around the mount::mnt_ns access,     like in __prepend_path(). Additionally, document the semantics of mount::mnt_ns, and use WRITE_ONCE() for     writers that can race with lockless readers. This bug is unreachable unless one of the following is set: -     CONFIG_PREEMPTION - CONFIG_RCU_STRICT_GRACE_PERIOD because it requires an RCU grace period to happen     during a syscall without an explicit preemption. This doesn't seem to have interesting security impact;
    worst-case, it could leak the result of an integer comparison to userspace (from the level check in     cap_capable()), cause an endless loop, or crash the kernel by dereferencing an invalid address.
    (CVE-2026-53341)

  - In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: check INIT_FAILED before     nvmet_req_uninit in digest error path In nvmet_tcp_try_recv_ddgst(), when a data digest mismatch is     detected, nvmet_req_uninit() is called unconditionally. However, if the command arrived via the     nvmet_tcp_handle_req_failure() path, nvmet_req_init() had returned false and percpu_ref_tryget_live() was     never executed. The unconditional percpu_ref_put() inside nvmet_req_uninit() then causes a refcount     underflow, leading to a WARNING in percpu_ref_switch_to_atomic_rcu, a use-after-free diagnostic, and     eventually a permanent workqueue deadlock. Check cmd->flags & NVMET_TCP_F_INIT_FAILED before calling     nvmet_req_uninit(), matching the existing pattern in nvmet_tcp_execute_request(). (CVE-2026-64534)

  - In the Linux kernel, the following vulnerability has been resolved: perf/core: Detach event groups during     remove_on_exec perf_event_remove_on_exec() removes events by calling perf_event_exit_event(). For top-     level events, this removes the event from the context with DETACH_EXIT only. This can leave inconsistent     group state when a removed event is a group leader and the group contains siblings without remove_on_exec.
    If the group was active, the surviving siblings can remain active and attached to the removed leader's     sibling list, but are no longer represented by a valid group leader on the PMU context active lists. A     later close of the removed leader uses DETACH_GROUP and can promote the still-active siblings from this     stale group state. The next schedule-in can then add an already-linked active_list entry again, corrupting     the PMU context active list. With DEBUG_LIST enabled, this is caught as a list_add double-add in     merge_sched_in(). Fix this by detaching group relationships when remove_on_exec removes an event. This     preserves the existing task-exit and revoke behavior, while ensuring surviving siblings are ungrouped     before the removed event leaves the context. (CVE-2026-64556)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-70459 advisory.

    - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235]     {CVE-2025-39964}
    - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235]     {CVE-2025-39964}
    - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487]     {CVE-2026-74518}
    - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927]     {CVE-2026-72072}
    - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484]     {CVE-2026-45945}
    - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484]     {CVE-2026-45944}
    - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484]     {CVE-2026-45894}
    - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155}
    - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157}
    - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486]     {CVE-2026-68156}
    - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188}
    - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850]     {CVE-2026-68391}
    - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791]     {CVE-2026-68293}
    - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819]     {CVE-2026-53062}
    - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819]     {CVE-2026-53062}
    - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406]     {CVE-2026-45959}
    - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501]     {CVE-2026-63823}
    - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski)     [RHEL-213003] {CVE-2026-53007}
    - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008}
    - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389}
    - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009}
    - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003]     {CVE-2026-46162}
    - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003]     {CVE-2026-43346}
    - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003]     {CVE-2026-63977}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:70459 advisory.

    * kernel: crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CVE-2025-39964)

    * kernel: iommu/vt-d: Clear Present bit before tearing down PASID entry (CVE-2026-45894)

    * kernel: crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CVE-2026-45959)

    * kernel: dm cache policy smq: fix missing locks in invalidating cache blocks (CVE-2026-53062)

    * kernel: keys: Pin request_key_auth payload in instantiate paths (CVE-2026-63823)

    * kernel: net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CVE-2026-68293)

    * kernel: Linux kernel: libceph null pointer dereference leads to denial of service (CVE-2026-68157)

    * kernel: Linux kernel Bluetooth RFCOMM: Denial of Service via use-after-free in set_termios     (CVE-2026-68188)

    * kernel: libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CVE-2026-68156)

    * kernel: Linux kernel (libceph): Denial of Service due to malformed monitor maps (CVE-2026-68155)

    * kernel: Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CVE-2026-68391)

    * kernel: net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (CVE-2026-72072)

    * kernel: mm/hugetlb: fix list corruption in allocate_file_region_entries() (CVE-2026-74518)

    Bug Fix(es) and Enhancement(s):

    * [Intel 9.8 FEAT] ice: Driver Update [rhel-9.8.z] (JIRA:Rocky Linux-213003)

    * Rocky Linux 9.8: Multiuser Kerberized DFS shares fail to mount with UID mount option [rhel-9.8.z]     (JIRA:Rocky Linux-254108)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:70498 advisory.

    * kernel: crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CVE-2025-39964)

    * kernel: iommu/vt-d: Clear Present bit before tearing down PASID entry (CVE-2026-45894)

    * kernel: crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CVE-2026-45959)

    * kernel: dm cache policy smq: fix missing locks in invalidating cache blocks (CVE-2026-53062)

    * kernel: keys: Pin request_key_auth payload in instantiate paths (CVE-2026-63823)

    * kernel: nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CVE-2026-64534)

    * kernel: net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CVE-2026-68293)

    * kernel: Linux kernel: libceph stack out-of-bounds write via crafted OSDMap (CVE-2026-68159)

    * kernel: Linux kernel Bluetooth RFCOMM: Denial of Service via use-after-free in set_termios     (CVE-2026-68188)

    * kernel: Linux kernel (libceph): Denial of Service due to malformed monitor maps (CVE-2026-68155)

    * kernel: Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CVE-2026-68391)

    * kernel: mm/hugetlb: fix list corruption in allocate_file_region_entries() (CVE-2026-74518)

    Bug Fix(es) and Enhancement(s):

    * Update kernel to use new certificate paths [rhel-10.2.z] (JIRA:Rocky Linux-169478)

    * RHIVOS - [backport] S32G Driver Enablement - PWM (JIRA:Rocky Linux-255517)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:70459 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CVE-2025-39964)

    * kernel: iommu/vt-d: Clear Present bit before tearing down PASID entry (CVE-2026-45894)

    * kernel: crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CVE-2026-45959)

    * kernel: dm cache policy smq: fix missing locks in invalidating cache blocks (CVE-2026-53062)

    * kernel: keys: Pin request_key_auth payload in instantiate paths (CVE-2026-63823)

    * kernel: net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CVE-2026-68293)

    * kernel: Linux kernel: libceph null pointer dereference leads to denial of service (CVE-2026-68157)

    * kernel: Linux kernel Bluetooth RFCOMM: Denial of Service via use-after-free in set_termios     (CVE-2026-68188)

    * kernel: libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CVE-2026-68156)

    * kernel: Linux kernel (libceph): Denial of Service due to malformed monitor maps (CVE-2026-68155)

    * kernel: Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CVE-2026-68391)

    * kernel: net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (CVE-2026-72072)

    * kernel: mm/hugetlb: fix list corruption in allocate_file_region_entries() (CVE-2026-74518)

    Bug Fix(es) and Enhancement(s):

    * [Intel 9.8 FEAT] ice: Driver Update [rhel-9.8.z] (JIRA:RHEL-213003)

    * RHEL 9.8: Multiuser Kerberized DFS shares fail to mount with UID mount option [rhel-9.8.z]     (JIRA:RHEL-254108)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:70498 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CVE-2025-39964)

    * kernel: iommu/vt-d: Clear Present bit before tearing down PASID entry (CVE-2026-45894)

    * kernel: crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CVE-2026-45959)

    * kernel: dm cache policy smq: fix missing locks in invalidating cache blocks (CVE-2026-53062)

    * kernel: keys: Pin request_key_auth payload in instantiate paths (CVE-2026-63823)

    * kernel: nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CVE-2026-64534)

    * kernel: net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CVE-2026-68293)

    * kernel: Linux kernel: libceph stack out-of-bounds write via crafted OSDMap (CVE-2026-68159)

    * kernel: Linux kernel Bluetooth RFCOMM: Denial of Service via use-after-free in set_termios     (CVE-2026-68188)

    * kernel: Linux kernel (libceph): Denial of Service due to malformed monitor maps (CVE-2026-68155)

    * kernel: Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CVE-2026-68391)

    * kernel: mm/hugetlb: fix list corruption in allocate_file_region_entries() (CVE-2026-74518)

    Bug Fix(es) and Enhancement(s):

    * Update kernel to use new certificate paths [rhel-10.2.z] (JIRA:RHEL-169478)

    * RHIVOS - [backport] S32G Driver Enablement - PWM (JIRA:RHEL-255517)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree Annotating a local pointer variable,     which will be assigned with the kmalloc-family functions, with the `__cleanup(kfree)` attribute will make     the address of the local variable, rather than the address returned by kmalloc, passed to kfree directly     and lead to a crash due to invalid deallocation of stack address. According to other places in the repo,     the correct usage should be `__free(kfree)`. The code coincidentally compiled because the parameter type     `void *` of kfree is compatible with the desired type `struct { ... } **`. (CVE-2026-45959)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
364200	Oracle Linux 10 : kernel (ELSA-2026-70498)	Nessus	Oracle Linux Local Security Checks	Local	medium
362948	AlmaLinux 10 : kernel (ALSA-2026:70498)	Nessus	Alma Linux Local Security Checks	Local	medium
356967	Rocky Linux 10.2 [CIQ] Security Update: kernel / kernel-64k / kernel-64k-core / kernel-64k-debug / etc Multiple Vulnerabilities (crlsa-2026_70498)	Nessus	Rocky Linux Local Security Checks	Local	medium
353610	Rocky Linux 9 [CIQ] Security Update: kernel / kernel-64k / kernel-64k-core / kernel-64k-debug / etc Multiple Vulnerabilities (crlsa-2026_70459)	Nessus	Rocky Linux Local Security Checks	Local	medium
352255	CentOS 9 : kernel-5.14.0-754.el9	Nessus	CentOS Local Security Checks	Local	medium
350194	Oracle Linux 9 : kernel (ELSA-2026-70459)	Nessus	Oracle Linux Local Security Checks	Local	medium
349900	RockyLinux 9 : kernel (RLSA-2026:70459)	Nessus	Rocky Linux Local Security Checks	Local	medium
349731	RockyLinux 10 : kernel (RLSA-2026:70498)	Nessus	Rocky Linux Local Security Checks	Local	medium
349629	RHEL 9 : kernel (RHSA-2026:70459)	Nessus	Red Hat Local Security Checks	Local	medium
349274	RHEL 10 : kernel (RHSA-2026:70498)	Nessus	Red Hat Local Security Checks	Local	medium
317293	Linux Distros Unpatched Vulnerability : CVE-2026-45959	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2026-45959

high

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

high