In the Linux kernel, the following vulnerability has been resolved: selinux: fix overlayfs mmap() and mprotect() access checks The existing SELinux security model for overlayfs is to allow access if the current task is able to access the top level file (the "user" file) and the mounter's credentials are sufficient to access the lower level file (the "backing" file). Unfortunately, the current code does not properly enforce these access controls for both mmap() and mprotect() operations on overlayfs filesystems. This patch makes use of the newly created security_mmap_backing_file() LSM hook to provide the missing backing file enforcement for mmap() operations, and leverages the backing file API and new LSM blob to provide the necessary information to properly enforce the mprotect() access controls.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:27811 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: selinux: fix overlayfs mmap() and mprotect() access checks (CVE-2026-46054)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:27812 advisory.

    The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with     extremely high determinism requirements.

    Security Fix(es):

    * kernel: selinux: fix overlayfs mmap() and mprotect() access checks (CVE-2026-46054)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:25191 advisory.

    * kernel: Linux kernel: Use-after-free in bonding driver leads to denial of service (CVE-2026-31419)

    * kernel: Linux kernel: Denial of Service in erofs filesystem (CVE-2026-31467)

    * kernel: can: raw: fix ro->uniq use-after-free in raw_rcv() (CVE-2026-31532)

    * kernel: ALSA: 6fire: fix use-after-free on disconnect (CVE-2026-31581)

    * kernel: ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (CVE-2026-43037)

    * kernel: ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (CVE-2026-43501)

    * kernel: selinux: fix overlayfs mmap() and mprotect() access checks (CVE-2026-46054)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:25191 advisory.

    * kernel: Linux kernel: Use-after-free in bonding driver leads to denial of service (CVE-2026-31419)
      * kernel: Linux kernel: Denial of Service in erofs filesystem (CVE-2026-31467)
      * kernel: can: raw: fix ro->uniq use-after-free in raw_rcv() (CVE-2026-31532)
      * kernel: ALSA: 6fire: fix use-after-free on disconnect (CVE-2026-31581)
      * kernel: ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (CVE-2026-43037)
      * kernel: ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (CVE-2026-43501)
      * kernel: selinux: fix overlayfs mmap() and mprotect() access checks (CVE-2026-46054)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:25191 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: Linux kernel: Use-after-free in bonding driver leads to denial of service (CVE-2026-31419)

    * kernel: Linux kernel: Denial of Service in erofs filesystem (CVE-2026-31467)

    * kernel: can: raw: fix ro->uniq use-after-free in raw_rcv() (CVE-2026-31532)

    * kernel: ALSA: 6fire: fix use-after-free on disconnect (CVE-2026-31581)

    * kernel: ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (CVE-2026-43037)

    * kernel: ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (CVE-2026-43501)

    * kernel: selinux: fix overlayfs mmap() and mprotect() access checks (CVE-2026-46054)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - selinux: fix overlayfs mmap() and mprotect() access checks The existing SELinux security model for     overlayfs is to allow access if the current task is able to access the top level file (the user file)     and the mounter's credentials are sufficient to access the lower level file (the backing file).
    Unfortunately, the current code does not properly enforce these access controls for both mmap() and     mprotect() operations on overlayfs filesystems. This patch makes use of the newly created     security_mmap_backing_file() LSM hook to provide the missing backing file enforcement for mmap()     operations, and leverages the backing file API and new LSM blob to provide the necessary information to     properly enforce the mprotect() access controls. (CVE-2026-46054)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
321967	RHEL 8 : kernel (RHSA-2026:27811)	Nessus	Red Hat Local Security Checks	high
321961	RHEL 8 : kernel-rt (RHSA-2026:27812)	Nessus	Red Hat Local Security Checks	high
320938	RockyLinux 10 : kernel (RLSA-2026:25191)	Nessus	Rocky Linux Local Security Checks	high
320691	AlmaLinux 10 : kernel (ALSA-2026:25191)	Nessus	Alma Linux Local Security Checks	high
320562	RHEL 10 : kernel (RHSA-2026:25191)	Nessus	Red Hat Local Security Checks	high
317222	Linux Distros Unpatched Vulnerability : CVE-2026-46054	Nessus	Misc.	high

Detections

Analytics

CVE-2026-46054

high

Tenable Plugins

high

high

high

high

high

high