In the Linux kernel, the following vulnerability has been resolved: smb/client: fix out-of-bounds read in smb2_compound_op() If a server sends a truncated response but a large OutputBufferLength, and terminates the EA list early, check_wsl_eas() returns success without validating that the entire OutputBufferLength fits within iov_len. Then smb2_compound_op() does: memcpy(idata->wsl.eas, data[0], size[0]); Where size[0] is OutputBufferLength. If iov_len is smaller than size[0], memcpy can read beyond the end of the rsp_iov allocation and leak adjacent kernel heap memory.

According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath(CVE-2026-43112)

    lib/crypto: chacha: Zeroize permuted_state before it leaves scope(CVE-2026-43336)

    MIPS: Work around LLVM bug when gp is used as global register variable(CVE-2026-46250)

    bridge: br_nd_send: validate ND option lengths(CVE-2026-31752)

    iommu/vt-d: Clear Present bit before tearing down PASID entry(CVE-2026-45894)

    xfs: remove xfs_attr_leaf_hasname(CVE-2026-43153)

    smb: client: reject userspace cifs.spnego descriptions(CVE-2026-46243)

    usb: ulpi: fix double free in ulpi_register_interface() error path(CVE-2026-31759)

    crypto: ccp: Don't attempt to copy PDH cert to userspace if PSP command failed(CVE-2026-31698)

    RDMA/hns: Fix WQ_MEM_RECLAIM warning(CVE-2026-46265)

    KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1(CVE-2026-46076)

    netfilter: nfnetlink_queue: do shared-unconfirmed check before segmentation(CVE-2026-45859)

    RDMA/umem: Fix double dma_buf_unpin in failure path(CVE-2026-43128)

    mm/page_alloc: change all pageblocks migrate type on coalescing(CVE-2025-71134)

    slip: reject VJ receive packets on instances with no rstate array(CVE-2026-45842)

    net/tcp-md5: Fix MAC comparison to be constant-time(CVE-2026-43383)

    scsi: smartpqi: Fix memory leak in pqi_report_phys_luns()(CVE-2026-45872)

    netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table()(CVE-2026-43450)

    tracepoint: balance regfunc() on func_add() failure in tracepoint_add_func()(CVE-2026-46196)

    tpm: tpm_i2c_infineon: Fix locality leak on get_burstcount() failure(CVE-2026-45941)

    zram: do not forget to endio for partial discard requests(CVE-2026-46089)

    KVM: SVM: Inject #UD for INVLPGA if EFER.SVME=0(CVE-2026-46082)

    vsock: fix buffer size clamping order(CVE-2026-46234)

    ipv4: icmp: validate reply type before using icmp_pointers(CVE-2026-46037)

    powerpc/smp: Add check for kcalloc() failure in parse_thread_groups()(CVE-2026-43148)

    ipmi: Check event message buffer response for bad data(CVE-2026-46128)

    netfilter: arp_tables: fix IEEE1394 ARP payload parsing(CVE-2026-45844)

    ext4: move ext4_percpu_param_init() before ext4_mb_init()(CVE-2026-43288)

    usb: typec: ucsi: validate connector number in ucsi_notify_common()(CVE-2026-31729)

    dm: remove fake timeout to avoid leak request(CVE-2026-43314)

    nvmet: avoid recursive nvmet-wq flush in nvmet_ctrl_free(CVE-2026-46304)

    xfrm: Wait for RCU readers during policy netns exit(CVE-2026-43091)

    netfilter: nf_conntrack_h323: fix OOB read in decode_choice()(CVE-2026-43233)

    scsi: core: Fix refcount leak for tagset_refcnt(CVE-2026-23296)

    md/raid10: fix deadlock with check operation and nowait requests(CVE-2026-46050)

    netfilter: nf_conncount: increase the connection clean up limit to 64(CVE-2026-45860)

    crypto: ccp: Don't attempt to copy ID to userspace if PSP command failed(CVE-2026-31697)

    net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ(CVE-2026-43465)

    fanotify: fix false positive on permission events(CVE-2026-46150)

    ipv6: icmp: clear skb2-cb[] in ip6_err_gen_icmpv6_unreach()(CVE-2026-43038)

    APEI/GHES: ensure that won't go past CPER allocated record(CVE-2026-43277)

    openvswitch: cap upcall PID array size and pre-size vport replies(CVE-2026-45840)

    AppArmor: Allow apparmor to handle unaligned dfa tables(CVE-2026-46254)

    tun: free page on short-frame rejection in tun_xdp_one()(CVE-2026-46321)

    smb: client: validate dacloffset before building DACL pointers(CVE-2026-46195)

    bpf: sockmap: Fix use-after-free of sk-sk_socket in sk_psock_verdict_data_ready().(CVE-2026-43016)

    net: af_key: zero aligned sockaddr tail in PF_KEY exports(CVE-2026-43088)

    iommu/amd: move wait_on_sem() out of spinlock(CVE-2026-43253)

    fs/buffer: add alert in try_to_free_buffers() for folios without buffers(CVE-2025-71295)

    ext4: don't zero the entire extent if EXT4_EXT_DATA_PARTIAL_VALID1(CVE-2026-45858)

    fat: avoid parent link count underflow in rmdir(CVE-2026-45915)

    mtd: spi-nor: debugfs: fix out-of-bounds read in spi_nor_params_show()(CVE-2026-46190)

    tcp: call sk_data_ready() after listener migration(CVE-2026-46015)

    sched/rt: Skip currently executing CPU in rto_next_cpu()(CVE-2026-45919)

    xfrm6: fix uninitialized saddr in xfrm6_get_saddr()(CVE-2026-43139)

    rtmutex: Use waiter::task instead of current in remove_waiter()(CVE-2026-43499)

    bpf: Fix bpf_xdp_store_bytes proto for read-only arg(CVE-2026-45886)

    ext4: don't set EXT4_GET_BLOCKS_CONVERT when splitting before submitting I/O(CVE-2026-45985)

    netfilter: xt_tcpmss: check remaining length before reading optlen(CVE-2026-43190)

    crypto: pcrypt - Fix handling of MAY_BACKLOG requests(CVE-2026-43493)

    ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data()(CVE-2026-43186)

    media: saa7164: add ioremap return checks and cleanups(CVE-2026-46235)

    l2tp: Drop large packets with UDP encap(CVE-2026-43080)

    md/raid5: validate payload size before accessing journal metadata(CVE-2026-46070)

    smb: client: fix in-place encryption corruption in SMB2_write()(CVE-2026-43362)

    drm/display/dp_mst: Add protection against 0 vcpi(CVE-2025-71305)

    x86-64: rename misleadingly named '__copy_user_nocache()' function(CVE-2026-43073)

    serial: 8250: Fix TX deadlock when using DMA(CVE-2026-43061)

    md raid: fix hang when stopping arrays with metadata through dm-raid(CVE-2026-43309)

    iommu/vt-d: Clear Present bit before tearing down context entry(CVE-2026-45944)

    netfilter: nft_ct: drop pending enqueued packets on removal(CVE-2026-43060)

    xfrm: always flush state and policy upon NETDEV_UNREGISTER event(CVE-2026-43167)

    KVM: nSVM: Triple fault if restore host CR3 fails on nested #VMEXIT(CVE-2026-46032)

    nfsd: never defer requests during idmap lookup(CVE-2026-45983)

    exit: prevent preemption of oopsing TASK_DEAD task(CVE-2026-46173)

    md/raid10: fix divide-by-zero in setup_geo() with zero far_copies(CVE-2026-46161)

    APEI/GHES: ARM processor Error: don't go past allocated memory(CVE-2026-43201)

    netfilter: nf_conntrack_helper: pass helper to expect cleanup(CVE-2026-43027)

    net: consume xmit errors of GSO frames(CVE-2026-43194)

    net/mlx5: lag: Check for LAG device before creating debugfs(CVE-2026-43013)

    net: sched: cls_api: fix tc_chain_fill_node to initialize tcm_info to zero to prevent an info-     leak(CVE-2026-43035)

    ipmi: Add limits to event and receive message requests(CVE-2026-46177)

    nouveau/dpcd: return EBUSY for aux xfer if the device is asleep(CVE-2026-43381)

    perf: sched: Fix perf crash with new is_user_task() helper(CVE-2026-23159)

    netfilter: x_tables: guard option walkers against 1-byte tail reads(CVE-2026-43452)

    mmc: core: Avoid bitfield RMW for claim/retune flags(CVE-2026-43484)

    unshare: fix unshare_fs() handling(CVE-2026-43472)

    net: strparser: fix skb_head leak in strp_abort_strp()(CVE-2026-46102)

    vsock/virtio: fix accept queue count leak on transport mismatch(CVE-2026-46214)

    scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show()(CVE-2026-46149)

    scsi: sd: fix missing put_disk() when device_add(disk_dev) fails(CVE-2026-45997)

    crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption(CVE-2026-43033)

    smb: client: require a full NFS mode SID before reading mode bits(CVE-2026-43350)

    xfrm_user: fix info leak in build_mapping()(CVE-2026-43089)

    ext4: drop extent cache when splitting extent fails(CVE-2026-45899)

    net/mlx5: Fix deadlock between devlink lock and esw-wq(CVE-2026-43468)

    smb: client: validate the whole DACL before rewriting it in cifsacl(CVE-2026-31709)

    ip6_tunnel: clear skb2-cb[] in ip4ip6_err()(CVE-2026-43037)

    net: correctly handle tunneled traffic on IPV6_CSUM GSO fallback(CVE-2026-43057)

    ipv6: ioam: fix potential NULL dereferences in __ioam6_fill_trace_data()(CVE-2026-43101)

    netfilter: ctnetlink: ignore explicit helper on new expectations(CVE-2026-43025)

    net: Drop the lock in skb_may_tx_timestamp()(CVE-2026-43216)

    dm mirror: fix integer overflow in create_dirty_log()(CVE-2026-46023)

    usb: image: mdc800: kill download URB on timeout(CVE-2026-43425)

    netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path(CVE-2026-43451)

    usb: class: cdc-wdm: fix reordering issue in read code path(CVE-2026-43427)

    net/packet: fix TOCTOU race on mmap'd vnet_hdr in tpacket_snd()(CVE-2026-31700)

    smb/client: fix out-of-bounds read in symlink_data()(CVE-2026-46185)

    xsk: validate MTU against usable frame size on bind(CVE-2026-43092)

    fuse: reject oversized dirents in page cache(CVE-2026-31694)

    net: ioam6: fix OOB and missing lock(CVE-2026-43083)

    usb: usbtmc: Flush anchored URBs in usbtmc_release(CVE-2026-31758)

    usb: usblp: fix uninitialized heap leak via LPGETSTATUS ioctl(CVE-2026-46167)

    ext4: fix iloc.bh leak in ext4_fc_replay_inode() error paths(CVE-2026-43066)

    ipv6: prevent possible UaF in addrconf_permanent_addr()(CVE-2026-43339)

    net: hns3: fix double free issue for tx spare buffer(CVE-2026-45891)

    8021q: delete cleared egress QoS mappings(CVE-2026-46153)

    cpufreq: governor: fix double free in cpufreq_dbs_governor_init() error path(CVE-2026-43328)

    apparmor: fix NULL sock in aa_sock_file_perm(CVE-2026-45848)

    net: rtnetlink: zero ifla_vf_broadcast to avoid stack infoleak in rtnl_fill_vfinfo(CVE-2026-46132)

    usb: usblp: fix heap leak in IEEE 1284 device ID via short response(CVE-2026-46151)

    xfs: delete attr leaf freemap entries when empty(CVE-2026-43187)

    PCI: Fix pci_slot_trylock() error handling(CVE-2026-43211)

    pstore/ram: fix buffer overflow in persistent_ram_save_old()(CVE-2026-46253)

    ima: verify the previous kernel's IMA buffer lies in addressable RAM(CVE-2026-43129)

    net: bridge: use a stable FDB dst snapshot in RCU readers(CVE-2026-46086)

    iommu/vt-d: Flush cache for PASID table before using it(CVE-2026-45862)

    KVM: nSVM: Remove a user-triggerable WARN on nested_svm_load_cr3() succeeding(CVE-2026-43315)

    xfrm: ah: account for ESN high bits in async callbacks(CVE-2026-46193)

    ext4: don't cache extent during splitting extent(CVE-2026-45912)

    io_uring/kbuf: check if target buffer list is still legacy on recycle(CVE-2026-43366)

    ipvs: fix NULL deref in ip_vs_add_service error path(CVE-2026-43086)

    md/raid5: fix soft lockup in retry_aligned_read()(CVE-2026-46051)

    ipmi:si: Return state to normal if message allocation fails(CVE-2026-46108)

    isofs: validate Rock Ridge CE continuation extent against volume size(CVE-2026-46303)

    crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl(CVE-2026-43078)

    xfrm: account XFRMA_IF_ID in aevent size calculation(CVE-2026-43107)

    ext4: fix memory leak in ext4_ext_shift_extents()(CVE-2026-45948)

    xsk: tighten UMEM headroom validation to account for tailroom and min frame(CVE-2026-43093)

    drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs()(CVE-2026-46209)

    eventfs: Hold eventfs_mutex and SRCU when remount walks events(CVE-2026-46106)

    udf: fix partition descriptor append bookkeeping(CVE-2026-45991)

    md/bitmap: fix GPF in write_page caused by resize race(CVE-2026-43163)

    xfs: fix freemap adjustments when adding xattrs to leaf blocks(CVE-2026-43158)

    procfs: fix missing RCU protection when reading real_parent in do_task_stat()(CVE-2026-46259)

    KVM: SVM: Add missing save/restore handling of LBR MSRs(CVE-2026-46014)

    apparmor: fix invalid deref of rawdata when export_binary is unset(CVE-2026-45965)

    KVM: nSVM: Always use NextRIP as vmcb02's NextRIP after first L2 VMRUN(CVE-2026-46059)

    media: pvrusb2: fix URB leak in pvr2_send_request_ex(CVE-2026-43223)

    xprtrdma: Decrement re_receiving on the early exit paths(CVE-2026-43469)

    tcp: fix potential race in tcp_v6_syn_recv_sock()(CVE-2026-43198)

    x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache(CVE-2026-46174)

    netfilter: x_tables: ensure names are nul-terminated(CVE-2026-43028)

    dlm: validate length in dlm_search_rsb_tree(CVE-2026-43125)

    ipvs: do not keep dest_dst if dev is going down(CVE-2026-45917)

    ipv4: icmp: fix null-ptr-deref in icmp_build_probe()(CVE-2026-43099)

    eventpoll: fix ep_remove struct eventpoll / struct file UAF(CVE-2026-46242)

    RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event()(CVE-2026-46181)

    drm/nouveau: fix u32 overflow in pushbuf reloc bounds check(CVE-2026-46006)

    ata: libata-scsi: avoid Non-NCQ command starvation(CVE-2026-45855)

    net: bonding: Fix nd_tbl NULL dereference when IPv6 is disabled(CVE-2026-43441)

    drm/amd/display: Fix dc_link NULL handling in HPD init(CVE-2026-46245)

    fbcon: Avoid OOB font access if console rotation fails(CVE-2026-46191)

    net: remove WARN_ON_ONCE when accessing forward path array(CVE-2026-45847)

    xfrm: fix ip_rt_bug race in icmp_route_lookup reverse path(CVE-2026-45905)

    xfs: fix a resource leak in xfs_alloc_buftarg()(CVE-2026-46005)

    net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery(CVE-2026-43466)

    HID: logitech-hidpp: Check maxfield in hidpp_get_report_length()(CVE-2026-43136)

    mm/page_alloc: clear page-private in free_pages_prepare()(CVE-2026-43303)

    crypto: authencesn - reject short ahash digests during instance creation(CVE-2026-46033)

    eventpoll: defer struct eventpoll free to RCU grace period(CVE-2026-43074)

    cpuidle: Skip governor when only one idle state is available(CVE-2026-45968)

    netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop()(CVE-2026-43453)

    crypto: algif_aead - Fix minimum RX size check for decryption(CVE-2026-43077)

    cgroup: fix race between task migration and iteration(CVE-2026-43439)

    thermal: core: Fix thermal zone governor cleanup issues(CVE-2026-46021)

    scsi: storvsc: Fix scheduling while atomic on PREEMPT_RT(CVE-2026-43475)

    quota: fix livelock between quotactl and freeze_super(CVE-2026-45895)

    net/ipv6: ioam6: prevent schema length wraparound in trace fill(CVE-2026-43341)

    KVM: nSVM: Sync interrupt shadow to cached vmcb12 after VMRUN of L2(CVE-2026-45987)

    dm-thin: fix metadata refcount underflow(CVE-2026-46107)

    flow_dissector: do not dissect PPPoE PFC frames(CVE-2026-46306)

    RDMA/hns: Fix unlocked call to hns_roce_qp_remove()(CVE-2026-46112)

    netfilter: ctnetlink: ensure safe access to master conntrack(CVE-2026-43116)

    ext4: fix e4b bitmap inconsistency reports(CVE-2026-45942)

    smb: client: use kzalloc to zero-initialize security descriptor buffer(CVE-2026-46139)

    EFI/CPER: don't go past the ARM processor CPER record buffer(CVE-2026-43266)

    nvmet-tcp: fix race between ICReq handling and queue teardown(CVE-2026-46135)

    netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry(CVE-2026-43114)

    (CVE-2026-46320)

    ext4: fix missing brelse() in ext4_xattr_inode_dec_ref_all()(CVE-2026-46046)

    SUNRPC: fix gss_auth kref leak in gss_alloc_msg error path(CVE-2026-45964)

    ipv6: xfrm6: release dst on error in xfrm6_rcv_encap()(CVE-2026-46172)

    dm: fix a buffer overflow in ioctl processing(CVE-2026-46294)

    ext4: drop extent cache after doing PARTIAL_VALID1 zeroout(CVE-2026-45892)

    SUNRPC: auth_gss: fix memory leaks in XDR decoding error paths(CVE-2026-45870)

    sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL(CVE-2026-46227)

    x86/kexec: add a sanity check on previous kernel's ima kexec buffer(CVE-2026-43240)

    Revert 'PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV'(CVE-2026-43147)

    netfilter: nft_set_rbtree: check for partial overlaps in anonymous sets(CVE-2026-45873)

    xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete(CVE-2026-46116)

    spi: fix resource leaks on device setup failure(CVE-2026-46083)

    mailbox: Prevent out-of-bounds access in fw_mbox_index_xlate()(CVE-2026-43281)

    fbdev: defio: Disconnect deferred I/O from the lifetime of struct fb_info(CVE-2026-46065)

    inotify: fix watch count leak when fsnotify_add_inode_mark_locked() fails(CVE-2026-46040)

    smb/client: fix out-of-bounds read in smb2_compound_op()(CVE-2026-46155)

    vxlan: validate ND option lengths in vxlan_na_create(CVE-2026-31738)

    drm: Account property blob allocations to memcg(CVE-2026-43287)

    crypto: algif_aead - snapshot IV for async AEAD requests(CVE-2026-46028)

    netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator(CVE-2026-43085)

    netfilter: nf_tables: reject immediate NF_QUEUE verdict(CVE-2026-43024)

    scsi: csiostor: Fix dereference of null pointer rn(CVE-2026-45857)

    bonding: alb: fix UAF in rlb_arp_recv during bond up/down(CVE-2026-45970)

    usb: xhci: Fix memory leak in xhci_disable_slot()(CVE-2026-43432)

    bpf: Fix tcx/netkit detach permissions when prog fd isn't given(CVE-2026-45932)

    netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO(CVE-2026-45841)

    ext4: fix dirtyclusters double decrement on fs shutdown(CVE-2026-45920)

    slip: bound decode() reads against the compressed packet length(CVE-2026-45843)

    net: use skb_header_pointer() for TCPv4 GSO frag_off check(CVE-2026-43036)

    net: bridge: mcast: always update mdb_n_entries for vlan contexts(CVE-2026-45913)

    net: ipv6: ndisc: fix ndisc_ra_useropt to initialize nduseropt_padX fields to zero to prevent an info-     leak(CVE-2026-43040)

    bpf: reject negative CO-RE accessor indices in bpf_core_parse_spec()(CVE-2026-45839)

    iommu/vt-d: Flush dev-IOTLB only when PCIe device is accessible in scalable mode(CVE-2026-43130)

    PCI/P2PDMA: Release per-CPU pgmap ref when vm_insert_page() fails(CVE-2026-45880)

    bpf: fix end-of-list detection in cgroup_storage_get_next_key()(CVE-2026-45838)

    ipvs: skip ipv6 extension headers for csum checks(CVE-2026-45850)

    netfilter: reject zero shift in nft_bitwise(CVE-2026-46101)

    RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send(CVE-2026-45856)

    sched/fair: Fix zero_vruntime tracking fix(CVE-2026-43323)

    crypto: ccp: Don't attempt to copy CSR to userspace if PSP command failed(CVE-2026-31699)

    netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent(CVE-2026-43026)

    net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ(CVE-2026-43464)

    isofs: validate block number from NFS file handle in isofs_export_iget(CVE-2026-46124)

    ipmi:ssif: Clean up kthread on errors(CVE-2026-46044)

    erofs: fix unsigned underflow in z_erofs_lz4_handle_overlap()(CVE-2026-45999)

    ipv6: rpl: reserve mac_len headroom when recompressed SRH grows(CVE-2026-43501)

    erofs: fix inline data read failure for ztailpacking pclusters(CVE-2026-45943)

    erofs: fix the out-of-bounds nameoff handling for trailing dirents(CVE-2026-46078)

Tenable has extracted the preceding description block directly from the EulerOS kernel security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:65708 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: rxrpc: Fix potential UAF after skb_unshare() failure (CVE-2026-45998)

    * kernel: smb/client: fix out-of-bounds read in smb2_compound_op() (CVE-2026-46155)

    * kernel: io_uring/poll: fix signed comparison in io_poll_get_ownership() (CVE-2026-52933)

    * kernel: zram: fix use-after-free in zram_bvec_write_partial() (CVE-2026-53185)

    * kernel: USB: serial: io_ti: fix heap overflow in get_manuf_info() (CVE-2026-53196)

    * kernel: scsi: target: iscsi: Validate CHAP_R length before base64 decode (CVE-2026-63886)

    * kernel: i2c: stub: Reject I2C block transfers with invalid length (CVE-2026-64191)

    * kernel: posix-cpu-timers: Prevent UAF caused by non-leader exec() race (CVE-2026-64560)

    Bug Fix(es) and Enhancement(s):

    * [HPEMC RHEL 9 BUG] tick/sched: Limit non-timkeeper CPUs calling jiffies upda [rhel-9.6.z]     (JIRA:RHEL-141460)

    * ibmveth Adapter Freeze with Small MSS [rhel-9.6.z] (JIRA:RHEL-178307)

    * RT scheduler livelock caused by missing backport of 94894c9c477e [rhel-9.6.z] (JIRA:RHEL-244409)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:64767 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock() (CVE-2025-40149)

    * kernel: netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CVE-2026-43114)

    * kernel: net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (CVE-2026-46099)

    * kernel: Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CVE-2026-46056)

    * kernel: RDMA/mana: Validate rx_hash_key_len (CVE-2026-46145)

    * kernel: smb/client: fix out-of-bounds read in smb2_compound_op() (CVE-2026-46155)

    * kernel: crypto: ccp - copy IV using skcipher ivsize (CVE-2026-53016)

    * kernel: ipv6: fix possible UAF in icmpv6_rcv() (CVE-2026-53006)

    * kernel: scsi: target: iscsi: Validate CHAP_R length before base64 decode (CVE-2026-63886)

    * kernel: crypto: qat - validate RSA CRT component lengths (CVE-2026-64304)

    Bug Fix(es) and Enhancement(s):

    * Memory leak in metadata_dst leading to OOM [rhel-10.0.z] (JIRA:RHEL-125758)

    * Kernel panic in cached_dir_offload_close [rhel-10.0.z] (JIRA:RHEL-128580)

    * RHEL10.0 - s390/pci: Fix __pcilg_mio_inuser() inline assembly [rhel-10.0.z] (JIRA:RHEL-161485)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1543:61 advisory.

    * kernel: fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CVE-2026-43112)
      * kernel: net: mana: Fix double destroy_workqueue on service rescan PCI path (CVE-2026-43276)
      * kernel: Linux kernel: Use-After-Free in net/gro due to improper handling of zerocopy skbs     (CVE-2026-46323)
      * kernel: xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (CVE-2026-46116)
      * kernel: sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CVE-2026-46227)
      * kernel: drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs()     (CVE-2026-46209)
      * kernel: smb/client: fix out-of-bounds read in smb2_compound_op() (CVE-2026-46155)
      * kernel: netfilter: nft_inner: Fix IPv6 inner_thoff desync (CVE-2026-46244)
      * kernel: procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CVE-2026-46259)
      * kernel: Arm Processors: Privilege escalation or information disclosure via writes to higher exception     level resources (CVE-2025-10263)
      * kernel: KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry     (CVE-2026-46316)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-36541 advisory.

    - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188463] {CVE-2026-53016}
    - futex/requeue: Revert 'Prevent NULL pointer dereference in remove_waiter() on self-deadlock'' (CKI     Backport Bot) [RHEL-193250] {CVE-2026-53166}
    - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (CKI Backport Bot)     [RHEL-193250] {CVE-2026-43499}
    - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (CKI Backport Bot) [RHEL-193153]     {CVE-2026-43499}
    - rtmutex: Use waiter::task instead of current in remove_waiter() (CKI Backport Bot) [RHEL-193153]     {CVE-2026-43499}
    - md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174092] {CVE-2026-43163}
    - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192407]     {CVE-2026-53359}
    - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186698]     {CVE-2026-46113}
    - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport     Bot) [RHEL-183007] {CVE-2025-71066}
    - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot)     [RHEL-179854] {CVE-2026-46227}
    - eventpoll: Fix semi-unbounded recursion (Ian Kent) [RHEL-180776] {CVE-2025-38614}
    - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180776] {CVE-2026-46242}
    - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173832] {CVE-2026-43074}
    - smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180048]     {CVE-2026-46155}
    - procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot)     [RHEL-181902] {CVE-2026-46259}
    - net/ipv6: ioam6: prevent schema length wraparound in trace fill (Antoine Tenart) [RHEL-174786]     {CVE-2026-43341}
    - net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180277]     {CVE-2026-43276}
    - net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180277]     {CVE-2026-43276}
    - fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189491]     {CVE-2026-43112}
    - Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183592] {CVE-2025-10263}
    - arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183592]     {CVE-2025-10263}
    - arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183592] {CVE-2025-10263}
    - arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183592] {CVE-2025-10263}
    - arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183592] {CVE-2025-10263}
    - arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183592] {CVE-2025-10263}
    - arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183592] {CVE-2025-10263}
    - KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CKI Backport Bot)     [RHEL-183965] {CVE-2026-46316}
    - netfilter: nft_inner: Fix IPv6 inner_thoff desync (CKI Backport Bot) [RHEL-181936] {CVE-2026-46244}
    - drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot)     [RHEL-179912] {CVE-2026-46209}
    - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (CKI Backport Bot) [RHEL-179566]     {CVE-2026-45998}
    - rxrpc: Fix potential UAF after skb_unshare() failure (CKI Backport Bot) [RHEL-179566] {CVE-2026-45998}
    - RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-180001]     {CVE-2026-46176}
    - crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182759] {CVE-2026-31739}
    - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179965]     {CVE-2026-46189}
    - ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179317]     {CVE-2026-46090}
    - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173937]     {CVE-2026-43279}
    - tcp: fix potential race in tcp_v6_syn_recv_sock() (Paolo Abeni) [RHEL-174242] {CVE-2026-43198}
    - scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179755] {CVE-2026-43414}
    - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180155]     {CVE-2026-46117}
    - RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179665]     {CVE-2026-45898}
    - rxrpc: fix RESPONSE authenticator parser OOB read (CKI Backport Bot) [RHEL-171456] {CVE-2026-31636}
    - nvmet-tcp: fix race between ICReq handling and queue teardown (CKI Backport Bot) [RHEL-180106]     {CVE-2026-46135}
    - RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180090] {CVE-2026-46145}
    - ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172675]     {CVE-2026-43038}
    - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177380]     {CVE-2026-46331}
    - exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180009] {CVE-2026-46173}
    - crypto: caam - fix overflow on long hmac keys (CKI Backport Bot) [RHEL-179769] {CVE-2026-43330}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:36018 advisory.

    * kernel: fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CVE-2026-43112)

    * kernel: net: mana: Fix double destroy_workqueue on service rescan PCI path (CVE-2026-43276)

    * kernel: Linux kernel: Use-After-Free in net/gro due to improper handling of zerocopy skbs     (CVE-2026-46323)

    * kernel: xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (CVE-2026-46116)

    * kernel: sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CVE-2026-46227)

    * kernel: drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs()     (CVE-2026-46209)

    * kernel: smb/client: fix out-of-bounds read in smb2_compound_op() (CVE-2026-46155)

    * kernel: netfilter: nft_inner: Fix IPv6 inner_thoff desync (CVE-2026-46244)

    * kernel: procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CVE-2026-46259)

    * kernel: Arm Processors: Privilege escalation or information disclosure via writes to higher exception     level resources (CVE-2025-10263)

    * kernel: KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry     (CVE-2026-46316)

    Bug Fix(es) and Enhancement(s):

    * WARNING at drivers/gpu/drm/nouveau/nvkm/subdev/gsp/r535.c:1585 r535_gsp_fini+0x2fb/0x310 [nouveau]     [rhel-9.8.z] (JIRA:Rocky Linux-160966)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:36541 advisory.

    * kernel: eventpoll: defer struct eventpoll free to RCU grace period (CVE-2026-43074)
      * kernel: net: mana: Fix double destroy_workqueue on service rescan PCI path (CVE-2026-43276)
      * kernel: net/ipv6: ioam6: prevent schema length wraparound in trace fill (CVE-2026-43341)
      * kernel: smb/client: fix out-of-bounds read in smb2_compound_op() (CVE-2026-46155)
      * kernel: eventpoll: fix ep_remove struct eventpoll / struct file UAF (CVE-2026-46242)
      * kernel: procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CVE-2026-46259)


    Bug Fix(es) and Enhancement(s):

      * CNB103: net: page_pool: avoid false positive warning if NAPI was never added [almalinux-10.2.z]     (JIRA:AlmaLinux-162140)
      * [AlmaLinux 10] Bonding reports unknown speed/duplex for tg3 interface [almalinux-10.2.z]     (JIRA:AlmaLinux-182770)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:36018 advisory.

    * kernel: fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CVE-2026-43112)
      * kernel: net: mana: Fix double destroy_workqueue on service rescan PCI path (CVE-2026-43276)
      * kernel: Linux kernel: Use-After-Free in net/gro due to improper handling of zerocopy skbs     (CVE-2026-46323)
      * kernel: xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (CVE-2026-46116)
      * kernel: sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CVE-2026-46227)
      * kernel: drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs()     (CVE-2026-46209)
      * kernel: smb/client: fix out-of-bounds read in smb2_compound_op() (CVE-2026-46155)
      * kernel: netfilter: nft_inner: Fix IPv6 inner_thoff desync (CVE-2026-46244)
      * kernel: procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CVE-2026-46259)
      * kernel: Arm Processors: Privilege escalation or information disclosure via writes to higher exception     level resources (CVE-2025-10263)
      * kernel: KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry     (CVE-2026-46316)


    Bug Fix(es) and Enhancement(s):

      * WARNING at drivers/gpu/drm/nouveau/nvkm/subdev/gsp/r535.c:1585 r535_gsp_fini+0x2fb/0x310 [nouveau]     [almalinux-9.8.z] (JIRA:AlmaLinux-160966)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-36018 advisory.

    - smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180041]     {CVE-2026-46155}
    - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180176]     {CVE-2026-46116}
    - net: gro: don't merge zcopy skbs (Sabrina Dubroca) [RHEL-177878] {CVE-2026-46323}
    - net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180271]     {CVE-2026-43276}
    - net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180271]     {CVE-2026-43276}
    - fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189503]     {CVE-2026-43112}
    - Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183625] {CVE-2025-10263}
    - arm64: cputype: Add NVIDIA Olympus definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
    - arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183625]     {CVE-2025-10263}
    - arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263}
    - arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183625] {CVE-2025-10263}
    - arm64: errata: Apply workarounds for Neoverse-V3AE (Mark Salter) [RHEL-183625] {CVE-2025-10263}
    - arm64: cputype: Add Neoverse-V3AE definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
    - arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
    - arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
    - arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
    - Clean up documentation mess left by previous backport (Mark Salter) [RHEL-183625] {CVE-2025-10263}
    - KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CKI Backport Bot)     [RHEL-183969] {CVE-2026-46316}
    - netfilter: nft_inner: Fix IPv6 inner_thoff desync (CKI Backport Bot) [RHEL-181929] {CVE-2026-46244}
    - procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot)     [RHEL-181907] {CVE-2026-46259}
    - drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot)     [RHEL-179909] {CVE-2026-46209}
    - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot)     [RHEL-179865] {CVE-2026-46227}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:36541 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: eventpoll: defer struct eventpoll free to RCU grace period (CVE-2026-43074)

    * kernel: net: mana: Fix double destroy_workqueue on service rescan PCI path (CVE-2026-43276)

    * kernel: net/ipv6: ioam6: prevent schema length wraparound in trace fill (CVE-2026-43341)

    * kernel: smb/client: fix out-of-bounds read in smb2_compound_op() (CVE-2026-46155)

    * kernel: eventpoll: fix ep_remove struct eventpoll / struct file UAF (CVE-2026-46242)

    * kernel: procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CVE-2026-46259)

    Bug Fix(es) and Enhancement(s):

    * CNB103: net: page_pool: avoid false positive warning if NAPI was never added [rhel-10.2.z]     (JIRA:RHEL-162140)

    * [RHEL 10] Bonding reports unknown speed/duplex for tg3 interface [rhel-10.2.z] (JIRA:RHEL-182770)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 26.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-8507-1 advisory.

    It was discovered that some AMD processors did not properly clear data in the floating point divider unit     during speculative execution. A local attacker could use this to expose sensitive information.
    (CVE-2025-54505)

    Several security issues were discovered in the Linux kernel. An attacker could possibly use these to     compromise the system. This update corrects flaws in the following subsystems:

    - ARM64 architecture;

    - x86 architecture;

    - Block layer subsystem;

    - Cryptographic API;

    - Rados block device (RBD) driver;

    - Compressed RAM block device driver;

    - Character device driver;

    - TPM device driver;

    - Hardware crypto device drivers;

    - EDAC drivers;

    - GPU drivers;

    - Greybus drivers;

    - HID subsystem;

    - Microsoft Hyper-V drivers;

    - Hardware monitoring drivers;

    - I2C subsystem;

    - IIO subsystem;

    - InfiniBand drivers;

    - Input Device core drivers;

    - LED subsystem;

    - Multiple devices driver;

    - Media drivers;

    - IBM Advanced System Management driver;

    - MTD block device drivers;

    - Network drivers;

    - Microsoft Azure Network Adapter (MANA) driver;

    - NTB driver;

    - NVME drivers;

    - Device tree and open firmware driver;

    - PCI subsystem;

    - Remote Processor subsystem;

    - SCSI subsystem;

    - SPI subsystem;

    - Realtek RTL8723BS SDIO drivers;

    - SM750 framebuffer staging driver;

    - Thermal drivers;

    - USB Gadget drivers;

    - USB over IP driver;

    - VFIO drivers;

    - Framebuffer layer;

    - 9P distributed file system;

    - AFS file system;

    - Ceph distributed file system;

    - File systems infrastructure;

    - EROFS file system;

    - Ext4 file system;

    - F2FS file system;

    - FUSE (File system in Userspace);

    - Journaling layer for block devices (JBD2);

    - NILFS2 file system;

    - File system notification infrastructure;

    - NTFS3 file system;

    - OCFS2 file system;

    - SMB network file system;

    - UDF file system;

    - XFS file system;

    - Codetag library;

    - Memory management;

    - Memory Management;

    - KVM subsystem;

    - Tracing infrastructure;

    - User-space API (UAPI);

    - io_uring subsystem;

    - Locking primitives;

    - Timer subsystem;

    - Scatterlist API;

    - Heterogeneous memory management;

    - KASAN memory debugging framework;

    - Bluetooth subsystem;

    - Ethernet bridge;

    - CAIF protocol;

    - CAN network layer;

    - Ceph Core library;

    - IPv4 networking;

    - IPv6 networking;

    - Multipath TCP;

    - Netfilter;

    - NFC subsystem;

    - Packet sockets;

    - Qualcomm IPC Router (QRTR);

    - RDS protocol;

    - RxRPC session sockets;

    - SMC sockets;

    - Stream parser;

    - Landlock security;

    - SELinux security module;

    - ALSA framework;

    - Generic PCM loopback sound driver;

    - FireWire sound drivers;

    - Creative Sound Blaster X-Fi driver;

    - QCOM ASoC drivers;

    - USB sound devices;

    - Objtool; (CVE-2026-31532, CVE-2026-31574, CVE-2026-31575, CVE-2026-31576, CVE-2026-31577,     CVE-2026-31578, CVE-2026-31579, CVE-2026-31580, CVE-2026-31581, CVE-2026-31582, CVE-2026-31583,     CVE-2026-31584, CVE-2026-31585, CVE-2026-31586, CVE-2026-31587, CVE-2026-31588, CVE-2026-31589,     CVE-2026-31590, CVE-2026-31591, CVE-2026-31592, CVE-2026-31593, CVE-2026-31594, CVE-2026-31595,     CVE-2026-31596, CVE-2026-31597, CVE-2026-31598, CVE-2026-31599, CVE-2026-31600, CVE-2026-31601,     CVE-2026-31602, CVE-2026-31603, CVE-2026-31604, CVE-2026-31605, CVE-2026-31606, CVE-2026-31607,     CVE-2026-31608, CVE-2026-31609, CVE-2026-31610, CVE-2026-31611, CVE-2026-31612, CVE-2026-31613,     CVE-2026-31614, CVE-2026-31615, CVE-2026-31616, CVE-2026-31617, CVE-2026-31618, CVE-2026-31619,     CVE-2026-31620, CVE-2026-31621, CVE-2026-31622, CVE-2026-31623, CVE-2026-31624, CVE-2026-31625,     CVE-2026-31626, CVE-2026-31627, CVE-2026-31628, CVE-2026-31629, CVE-2026-31686, CVE-2026-31694,     CVE-2026-31696, CVE-2026-31697, CVE-2026-31698, CVE-2026-31699, CVE-2026-31700, CVE-2026-31701,     CVE-2026-31702, CVE-2026-31703, CVE-2026-31704, CVE-2026-31705, CVE-2026-31706, CVE-2026-31707,     CVE-2026-31708, CVE-2026-31709, CVE-2026-31710, CVE-2026-31711, CVE-2026-31712, CVE-2026-31713,     CVE-2026-31714, CVE-2026-31715, CVE-2026-31716, CVE-2026-31717, CVE-2026-31718, CVE-2026-31719,     CVE-2026-43058, CVE-2026-43071, CVE-2026-43072, CVE-2026-43073, CVE-2026-43348, CVE-2026-43349,     CVE-2026-43350, CVE-2026-43491, CVE-2026-43493, CVE-2026-43499, CVE-2026-43501, CVE-2026-45986,     CVE-2026-45987, CVE-2026-45988, CVE-2026-45989, CVE-2026-45990, CVE-2026-45991, CVE-2026-45994,     CVE-2026-45995, CVE-2026-45996, CVE-2026-45997, CVE-2026-45999, CVE-2026-46001, CVE-2026-46002,     CVE-2026-46003, CVE-2026-46004, CVE-2026-46005, CVE-2026-46006, CVE-2026-46007, CVE-2026-46008,     CVE-2026-46009, CVE-2026-46010, CVE-2026-46011, CVE-2026-46012, CVE-2026-46013, CVE-2026-46014,     CVE-2026-46015, CVE-2026-46016, CVE-2026-46018, CVE-2026-46019, CVE-2026-46020, CVE-2026-46021,     CVE-2026-46022, CVE-2026-46023, CVE-2026-46024, CVE-2026-46025, CVE-2026-46026, CVE-2026-46027,     CVE-2026-46028, CVE-2026-46029, CVE-2026-46030, CVE-2026-46031, CVE-2026-46032, CVE-2026-46033,     CVE-2026-46034, CVE-2026-46035, CVE-2026-46036, CVE-2026-46037, CVE-2026-46038, CVE-2026-46039,     CVE-2026-46040, CVE-2026-46041, CVE-2026-46042, CVE-2026-46043, CVE-2026-46044, CVE-2026-46045,     CVE-2026-46046, CVE-2026-46047, CVE-2026-46049, CVE-2026-46050, CVE-2026-46051, CVE-2026-46052,     CVE-2026-46053, CVE-2026-46054, CVE-2026-46056, CVE-2026-46057, CVE-2026-46058, CVE-2026-46059,     CVE-2026-46060, CVE-2026-46061, CVE-2026-46062, CVE-2026-46063, CVE-2026-46064, CVE-2026-46065,     CVE-2026-46066, CVE-2026-46067, CVE-2026-46068, CVE-2026-46069, CVE-2026-46070, CVE-2026-46071,     CVE-2026-46072, CVE-2026-46073, CVE-2026-46074, CVE-2026-46075, CVE-2026-46076, CVE-2026-46077,     CVE-2026-46078, CVE-2026-46079, CVE-2026-46080, CVE-2026-46081, CVE-2026-46082, CVE-2026-46083,     CVE-2026-46084, CVE-2026-46085, CVE-2026-46086, CVE-2026-46087, CVE-2026-46088, CVE-2026-46089,     CVE-2026-46090, CVE-2026-46091, CVE-2026-46092, CVE-2026-46093, CVE-2026-46094, CVE-2026-46095,     CVE-2026-46096, CVE-2026-46097, CVE-2026-46098, CVE-2026-46099, CVE-2026-46100, CVE-2026-46101,     CVE-2026-46102, CVE-2026-46103, CVE-2026-46115, CVE-2026-46119, CVE-2026-46135, CVE-2026-46137,     CVE-2026-46155, CVE-2026-46185, CVE-2026-46195, CVE-2026-46243, CVE-2026-46244, CVE-2026-46276,     CVE-2026-46277, CVE-2026-46278, CVE-2026-46279, CVE-2026-46280, CVE-2026-46281, CVE-2026-46282,     CVE-2026-46283, CVE-2026-46284, CVE-2026-46285, CVE-2026-46286, CVE-2026-46287, CVE-2026-46288,     CVE-2026-46289, CVE-2026-46316, CVE-2026-46332, CVE-2026-52904, CVE-2026-52905, CVE-2026-52906,     CVE-2026-52907, CVE-2026-52933)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:36018 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CVE-2026-43112)

    * kernel: net: mana: Fix double destroy_workqueue on service rescan PCI path (CVE-2026-43276)

    * kernel: Linux kernel: Use-After-Free in net/gro due to improper handling of zerocopy skbs     (CVE-2026-46323)

    * kernel: xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (CVE-2026-46116)

    * kernel: sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CVE-2026-46227)

    * kernel: drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs()     (CVE-2026-46209)

    * kernel: smb/client: fix out-of-bounds read in smb2_compound_op() (CVE-2026-46155)

    * kernel: netfilter: nft_inner: Fix IPv6 inner_thoff desync (CVE-2026-46244)

    * kernel: procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CVE-2026-46259)

    * kernel: Arm Processors: Privilege escalation or information disclosure via writes to higher exception     level resources (CVE-2025-10263)

    * kernel: KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry     (CVE-2026-46316)

    Bug Fix(es) and Enhancement(s):

    * WARNING at drivers/gpu/drm/nouveau/nvkm/subdev/gsp/r535.c:1585 r535_gsp_fini+0x2fb/0x310 [nouveau]     [rhel-9.8.z] (JIRA:RHEL-160966)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 26.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-8488-1 advisory.

    It was discovered that some AMD processors did not properly clear data in the floating point divider unit     during speculative execution. A local attacker could use this to expose sensitive information.
    (CVE-2025-54505)

    Several security issues were discovered in the Linux kernel. An attacker could possibly use these to     compromise the system. This update corrects flaws in the following subsystems:

    - ARM64 architecture;

    - x86 architecture;

    - Block layer subsystem;

    - Cryptographic API;

    - Rados block device (RBD) driver;

    - Compressed RAM block device driver;

    - Character device driver;

    - TPM device driver;

    - Hardware crypto device drivers;

    - EDAC drivers;

    - GPU drivers;

    - Greybus drivers;

    - HID subsystem;

    - Microsoft Hyper-V drivers;

    - Hardware monitoring drivers;

    - I2C subsystem;

    - IIO subsystem;

    - InfiniBand drivers;

    - Input Device core drivers;

    - LED subsystem;

    - Multiple devices driver;

    - Media drivers;

    - IBM Advanced System Management driver;

    - MTD block device drivers;

    - Network drivers;

    - Microsoft Azure Network Adapter (MANA) driver;

    - NTB driver;

    - NVME drivers;

    - Device tree and open firmware driver;

    - PCI subsystem;

    - Remote Processor subsystem;

    - SCSI subsystem;

    - SPI subsystem;

    - Realtek RTL8723BS SDIO drivers;

    - SM750 framebuffer staging driver;

    - Thermal drivers;

    - USB Gadget drivers;

    - USB over IP driver;

    - VFIO drivers;

    - Framebuffer layer;

    - 9P distributed file system;

    - AFS file system;

    - Ceph distributed file system;

    - File systems infrastructure;

    - EROFS file system;

    - Ext4 file system;

    - F2FS file system;

    - FUSE (File system in Userspace);

    - Journaling layer for block devices (JBD2);

    - NILFS2 file system;

    - File system notification infrastructure;

    - NTFS3 file system;

    - OCFS2 file system;

    - SMB network file system;

    - UDF file system;

    - XFS file system;

    - Codetag library;

    - Memory management;

    - Memory Management;

    - KVM subsystem;

    - Tracing infrastructure;

    - User-space API (UAPI);

    - io_uring subsystem;

    - Locking primitives;

    - Timer subsystem;

    - Scatterlist API;

    - Heterogeneous memory management;

    - KASAN memory debugging framework;

    - Bluetooth subsystem;

    - Ethernet bridge;

    - CAIF protocol;

    - CAN network layer;

    - Ceph Core library;

    - IPv4 networking;

    - IPv6 networking;

    - Multipath TCP;

    - Netfilter;

    - NFC subsystem;

    - Packet sockets;

    - Qualcomm IPC Router (QRTR);

    - RDS protocol;

    - RxRPC session sockets;

    - SMC sockets;

    - Stream parser;

    - Landlock security;

    - SELinux security module;

    - ALSA framework;

    - Generic PCM loopback sound driver;

    - FireWire sound drivers;

    - Creative Sound Blaster X-Fi driver;

    - QCOM ASoC drivers;

    - USB sound devices;

    - Objtool; (CVE-2026-31532, CVE-2026-31574, CVE-2026-31575, CVE-2026-31576, CVE-2026-31577,     CVE-2026-31578, CVE-2026-31579, CVE-2026-31580, CVE-2026-31581, CVE-2026-31582, CVE-2026-31583,     CVE-2026-31584, CVE-2026-31585, CVE-2026-31586, CVE-2026-31587, CVE-2026-31588, CVE-2026-31589,     CVE-2026-31590, CVE-2026-31591, CVE-2026-31592, CVE-2026-31593, CVE-2026-31594, CVE-2026-31595,     CVE-2026-31596, CVE-2026-31597, CVE-2026-31598, CVE-2026-31599, CVE-2026-31600, CVE-2026-31601,     CVE-2026-31602, CVE-2026-31603, CVE-2026-31604, CVE-2026-31605, CVE-2026-31606, CVE-2026-31607,     CVE-2026-31608, CVE-2026-31609, CVE-2026-31610, CVE-2026-31611, CVE-2026-31612, CVE-2026-31613,     CVE-2026-31614, CVE-2026-31615, CVE-2026-31616, CVE-2026-31617, CVE-2026-31618, CVE-2026-31619,     CVE-2026-31620, CVE-2026-31621, CVE-2026-31622, CVE-2026-31623, CVE-2026-31624, CVE-2026-31625,     CVE-2026-31626, CVE-2026-31627, CVE-2026-31628, CVE-2026-31629, CVE-2026-31686, CVE-2026-31694,     CVE-2026-31696, CVE-2026-31697, CVE-2026-31698, CVE-2026-31699, CVE-2026-31700, CVE-2026-31701,     CVE-2026-31702, CVE-2026-31703, CVE-2026-31704, CVE-2026-31705, CVE-2026-31706, CVE-2026-31707,     CVE-2026-31708, CVE-2026-31709, CVE-2026-31710, CVE-2026-31711, CVE-2026-31712, CVE-2026-31713,     CVE-2026-31714, CVE-2026-31715, CVE-2026-31716, CVE-2026-31717, CVE-2026-31718, CVE-2026-31719,     CVE-2026-43058, CVE-2026-43071, CVE-2026-43072, CVE-2026-43073, CVE-2026-43348, CVE-2026-43349,     CVE-2026-43350, CVE-2026-43491, CVE-2026-43493, CVE-2026-43499, CVE-2026-43501, CVE-2026-45986,     CVE-2026-45987, CVE-2026-45988, CVE-2026-45989, CVE-2026-45990, CVE-2026-45991, CVE-2026-45994,     CVE-2026-45995, CVE-2026-45996, CVE-2026-45997, CVE-2026-45999, CVE-2026-46001, CVE-2026-46002,     CVE-2026-46003, CVE-2026-46004, CVE-2026-46005, CVE-2026-46006, CVE-2026-46007, CVE-2026-46008,     CVE-2026-46009, CVE-2026-46010, CVE-2026-46011, CVE-2026-46012, CVE-2026-46013, CVE-2026-46014,     CVE-2026-46015, CVE-2026-46016, CVE-2026-46018, CVE-2026-46019, CVE-2026-46020, CVE-2026-46021,     CVE-2026-46022, CVE-2026-46023, CVE-2026-46024, CVE-2026-46025, CVE-2026-46026, CVE-2026-46027,     CVE-2026-46028, CVE-2026-46029, CVE-2026-46030, CVE-2026-46031, CVE-2026-46032, CVE-2026-46033,     CVE-2026-46034, CVE-2026-46035, CVE-2026-46036, CVE-2026-46037, CVE-2026-46038, CVE-2026-46039,     CVE-2026-46040, CVE-2026-46041, CVE-2026-46042, CVE-2026-46043, CVE-2026-46044, CVE-2026-46045,     CVE-2026-46046, CVE-2026-46047, CVE-2026-46049, CVE-2026-46050, CVE-2026-46051, CVE-2026-46052,     CVE-2026-46053, CVE-2026-46054, CVE-2026-46056, CVE-2026-46057, CVE-2026-46058, CVE-2026-46059,     CVE-2026-46060, CVE-2026-46061, CVE-2026-46062, CVE-2026-46063, CVE-2026-46064, CVE-2026-46065,     CVE-2026-46066, CVE-2026-46067, CVE-2026-46068, CVE-2026-46069, CVE-2026-46070, CVE-2026-46071,     CVE-2026-46072, CVE-2026-46073, CVE-2026-46074, CVE-2026-46075, CVE-2026-46076, CVE-2026-46077,     CVE-2026-46078, CVE-2026-46079, CVE-2026-46080, CVE-2026-46081, CVE-2026-46082, CVE-2026-46083,     CVE-2026-46084, CVE-2026-46085, CVE-2026-46086, CVE-2026-46087, CVE-2026-46088, CVE-2026-46089,     CVE-2026-46090, CVE-2026-46091, CVE-2026-46092, CVE-2026-46093, CVE-2026-46094, CVE-2026-46095,     CVE-2026-46096, CVE-2026-46097, CVE-2026-46098, CVE-2026-46099, CVE-2026-46100, CVE-2026-46101,     CVE-2026-46102, CVE-2026-46103, CVE-2026-46115, CVE-2026-46119, CVE-2026-46135, CVE-2026-46137,     CVE-2026-46155, CVE-2026-46185, CVE-2026-46195, CVE-2026-46243, CVE-2026-46244, CVE-2026-46276,     CVE-2026-46277, CVE-2026-46278, CVE-2026-46279, CVE-2026-46280, CVE-2026-46281, CVE-2026-46282,     CVE-2026-46283, CVE-2026-46284, CVE-2026-46285, CVE-2026-46286, CVE-2026-46287, CVE-2026-46288,     CVE-2026-46289, CVE-2026-46316, CVE-2026-46332, CVE-2026-52904, CVE-2026-52905, CVE-2026-52906,     CVE-2026-52907, CVE-2026-52933)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 26.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-8489-1 advisory.

    It was discovered that the Linux kernel did not properly handle shared page fragments during socket buffer     operations, collectively known as Dirty Frag. A logic flaw existed in the XFRM ESP-in-TCP subsystem and in     the RxRPC networking subsystem when processing paged fragments. A local attacker could use this to     escalate privileges, or possibly escape a container. (CVE-2026-43284, CVE-2026-43500, CVE-2026-45998,     CVE-2026-46000)

    It was discovered that a logic flaw existed in the XFRM ESP-in-TCP subsystem in the Linux kernel when     handling socket buffer fragments. This flaw is known as Fragnesia. A local attacker could use this to     escalate privileges, or possibly escape a container. (CVE-2026-43503, CVE-2026-46300)

    Qualys discovered that a race condition existed in the ptrace subsystem of the Linux kernel when     privileged processes are exiting. An unprivileged local attacker could use this issue to expose sensitive     information. (CVE-2026-46333)

    Tristan Madani discovered that Ubuntu Linux kernel 6.8, 6.17 and 7.0 contain a memory leak when handling     AppArmor notifications. A local attacker could use this to cause resource exhaustion. (CVE-2026-47326)

    Tristan Madani discovered that Ubuntu Linux kernel 6.8, 6.17 and 7.0 contain a NULL pointer dereference     when handling AppArmor notifications. A local attacker could use this to cause a kernel oops.
    (CVE-2026-47327)

    Tristan Madani discovered that Ubuntu Linux kernel 6.8, 6.17 and 7.0 contained an invalid free when     handling AppArmor notifications. A local attacker could use this to corrupt kernel memory.
    (CVE-2026-47328)

    Tristan Madani discovered that Ubuntu Linux kernel 6.8, 6.17 and 7.0 contained insufficient validation of     AppArmor notification responses. A local attacker could use this to allow crafted responses to be     processed. (CVE-2026-47329)

    Tristan Madani discovered that Ubuntu Linux kernel 6.8, 6.17 and 7.0 used an uninitialized variable when     handling AppArmor notifications. A local attacker could use this to cause incorrect caching of data.
    (CVE-2026-47330)

    Tristan Madani discovered that Ubuntu Linux kernel 6.8, 6.17 and 7.0 contained an out-of-bounds (OOB) read     when handling AppArmor notifications. A local attacker could use this to cause information disclosure of     kernel memory. (CVE-2026-47332)

    Tristan Madani discovered that Ubuntu Linux kernel 6.8, 6.17 and 7.0 contained a out-of-bounds (OOB) read     when handling AppArmor notifications. A local attacker could use this to cause kernel memory corruption     and, theoretically, influence processing of AppArmor policies. (CVE-2026-47333)

    Tristan Madani discovered that Ubuntu Linux kernel 6.8, 6.17 and 7.0 contained incorrect holding of locks     when handling AppArmor notifications. A local attacker could use this to cause a kernel panic or deadlock.
    (CVE-2026-47334)

    Tristan Madani and Trevor Lawrence have each independently discovered that Ubuntu Linux kernel 6.8, 6.17     and 7.0 contained a NULL pointer dereference when handling AppArmor network socket mediation. A local     attacker could use this to cause a kernel oops. (CVE-2026-47337)

    Several security issues were discovered in the Linux kernel. An attacker could possibly use these to     compromise the system. This update corrects flaws in the following subsystems:

    - ARM64 architecture;

    - x86 architecture;

    - Block layer subsystem;

    - Cryptographic API;

    - Rados block device (RBD) driver;

    - Compressed RAM block device driver;

    - Character device driver;

    - TPM device driver;

    - Hardware crypto device drivers;

    - EDAC drivers;

    - GPU drivers;

    - Greybus drivers;

    - Hardware monitoring drivers;

    - IIO subsystem;

    - InfiniBand drivers;

    - Input Device core drivers;

    - LED subsystem;

    - Multiple devices driver;

    - Media drivers;

    - IBM Advanced System Management driver;

    - MTD block device drivers;

    - Network drivers;

    - Microsoft Azure Network Adapter (MANA) driver;

    - NVME drivers;

    - Device tree and open firmware driver;

    - PCI subsystem;

    - Remote Processor subsystem;

    - SCSI subsystem;

    - SPI subsystem;

    - Thermal drivers;

    - VFIO drivers;

    - Framebuffer layer;

    - 9P distributed file system;

    - AFS file system;

    - Ceph distributed file system;

    - EROFS file system;

    - File systems infrastructure;

    - Ext4 file system;

    - Journaling layer for block devices (JBD2);

    - File system notification infrastructure;

    - NTFS3 file system;

    - OCFS2 file system;

    - Overlay file system;

    - SMB network file system;

    - UDF file system;

    - XFS file system;

    - Codetag library;

    - Memory management;

    - Tracing infrastructure;

    - io_uring subsystem;

    - Locking primitives;

    - Scatterlist API;

    - Heterogeneous memory management;

    - Bluetooth subsystem;

    - Ethernet bridge;

    - CAIF protocol;

    - Ceph Core library;

    - Networking core;

    - IPv4 networking;

    - IPv6 networking;

    - Multipath TCP;

    - Netfilter;

    - Qualcomm IPC Router (QRTR);

    - RDS protocol;

    - RxRPC session sockets;

    - SMC sockets;

    - Stream parser;

    - Landlock security;

    - SELinux security module;

    - ALSA framework;

    - Generic PCM loopback sound driver;

    - Creative Sound Blaster X-Fi driver;

    - USB sound devices; (CVE-2026-43491, CVE-2026-43493, CVE-2026-43494, CVE-2026-43499, CVE-2026-43501,     CVE-2026-45986, CVE-2026-45987, CVE-2026-45988, CVE-2026-45989, CVE-2026-45990, CVE-2026-45991,     CVE-2026-45994, CVE-2026-45995, CVE-2026-45996, CVE-2026-45997, CVE-2026-45999, CVE-2026-46001,     CVE-2026-46002, CVE-2026-46003, CVE-2026-46004, CVE-2026-46005, CVE-2026-46006, CVE-2026-46007,     CVE-2026-46008, CVE-2026-46009, CVE-2026-46010, CVE-2026-46011, CVE-2026-46012, CVE-2026-46013,     CVE-2026-46014, CVE-2026-46015, CVE-2026-46016, CVE-2026-46018, CVE-2026-46019, CVE-2026-46020,     CVE-2026-46021, CVE-2026-46022, CVE-2026-46023, CVE-2026-46024, CVE-2026-46025, CVE-2026-46026,     CVE-2026-46027, CVE-2026-46028, CVE-2026-46029, CVE-2026-46030, CVE-2026-46031, CVE-2026-46032,     CVE-2026-46033, CVE-2026-46034, CVE-2026-46035, CVE-2026-46036, CVE-2026-46037, CVE-2026-46038,     CVE-2026-46039, CVE-2026-46040, CVE-2026-46041, CVE-2026-46042, CVE-2026-46043, CVE-2026-46044,     CVE-2026-46045, CVE-2026-46046, CVE-2026-46047, CVE-2026-46048, CVE-2026-46049, CVE-2026-46050,     CVE-2026-46051, CVE-2026-46052, CVE-2026-46053, CVE-2026-46054, CVE-2026-46056, CVE-2026-46057,     CVE-2026-46058, CVE-2026-46059, CVE-2026-46060, CVE-2026-46061, CVE-2026-46062, CVE-2026-46063,     CVE-2026-46064, CVE-2026-46065, CVE-2026-46066, CVE-2026-46067, CVE-2026-46068, CVE-2026-46069,     CVE-2026-46070, CVE-2026-46071, CVE-2026-46072, CVE-2026-46073, CVE-2026-46074, CVE-2026-46075,     CVE-2026-46076, CVE-2026-46077, CVE-2026-46078, CVE-2026-46079, CVE-2026-46080, CVE-2026-46081,     CVE-2026-46082, CVE-2026-46083, CVE-2026-46084, CVE-2026-46085, CVE-2026-46086, CVE-2026-46087,     CVE-2026-46088, CVE-2026-46089, CVE-2026-46090, CVE-2026-46091, CVE-2026-46092, CVE-2026-46093,     CVE-2026-46094, CVE-2026-46095, CVE-2026-46096, CVE-2026-46097, CVE-2026-46098, CVE-2026-46099,     CVE-2026-46100, CVE-2026-46101, CVE-2026-46102, CVE-2026-46103, CVE-2026-46115, CVE-2026-46119,     CVE-2026-46135, CVE-2026-46137, CVE-2026-46155, CVE-2026-46185, CVE-2026-46195, CVE-2026-46243,     CVE-2026-46244, CVE-2026-46276, CVE-2026-46277, CVE-2026-46278, CVE-2026-46279, CVE-2026-46280,     CVE-2026-46281, CVE-2026-46282, CVE-2026-46283, CVE-2026-46284, CVE-2026-46285, CVE-2026-46286,     CVE-2026-46287, CVE-2026-46288, CVE-2026-46289, CVE-2026-46316, CVE-2026-46323, CVE-2026-46332,     CVE-2026-52904, CVE-2026-52905, CVE-2026-52906, CVE-2026-52907, CVE-2026-52933, CVE-2026-53174)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - smb/client: fix out-of-bounds read in smb2_compound_op() If a server sends a truncated response but a     large OutputBufferLength, and terminates the EA list early, check_wsl_eas() returns success without     validating that the entire OutputBufferLength fits within iov_len. Then smb2_compound_op() does:
    memcpy(idata->wsl.eas, data[0], size[0]); Where size[0] is OutputBufferLength. If iov_len is smaller than     size[0], memcpy can read beyond the end of the rsp_iov allocation and leak adjacent kernel heap memory.
    (CVE-2026-46155)

Note that Nessus relies on the presence of the package as reported by the vendor.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1753 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    mm/pagewalk: fix race between concurrent split and refault (CVE-2026-31456)

    In the Linux kernel, the following vulnerability has been resolved:

    fuse: reject oversized dirents in page cache (CVE-2026-31694)

    In the Linux kernel, the following vulnerability has been resolved:

    net/packet: fix TOCTOU race on mmap'd vnet_hdr in tpacket_snd() (CVE-2026-31700)

    In the Linux kernel, the following vulnerability has been resolved:

    smb: client: validate the whole DACL before rewriting it in cifsacl (CVE-2026-31709)

    In the Linux kernel, the following vulnerability has been resolved:

    fs/ntfs3: validate rec->used in journal-replay file record check (CVE-2026-31716)

    In the Linux kernel, the following vulnerability has been resolved:

    x86: shadow stacks: proper error handling for mmap lock (CVE-2026-43109)

    In the Linux kernel, the following vulnerability has been resolved:

    lib/crypto: mpi: Fix integer underflow in mpi_read_raw_from_sgl() (CVE-2026-43492)

    In the Linux kernel, the following vulnerability has been resolved:

    crypto: pcrypt - Fix handling of MAY_BACKLOG requests (CVE-2026-43493)

    In the Linux kernel, the following vulnerability has been resolved:

    net/rds: reset op_nents when zerocopy page pin fails (CVE-2026-43494)

    In the Linux kernel, the following vulnerability has been resolved:

    net/sched: sch_red: Replace direct dequeue call with peek and qdisc_dequeue_peeked (CVE-2026-43496)

    In the Linux kernel, the following vulnerability has been resolved:

    rtmutex: Use waiter::task instead of current in remove_waiter() (CVE-2026-43499)

    In the Linux kernel, the following vulnerability has been resolved:

    ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (CVE-2026-43501)

    In the Linux kernel, the following vulnerability has been resolved:

    net/rds: handle zerocopy send cleanup before the message is queued (CVE-2026-43502)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf: Fix use-after-free in arena_vm_close on fork (CVE-2026-45837)

    In the Linux kernel, the following vulnerability has been resolved:

    KVM: nSVM: Sync interrupt shadow to cached vmcb12 after VMRUN of L2 (CVE-2026-45987)

    In the Linux kernel, the following vulnerability has been resolved:

    rxrpc: Fix re-decryption of RESPONSE packets (CVE-2026-45988)

    In the Linux kernel, the following vulnerability has been resolved:

    of: unittest: fix use-after-free in testdrv_probe() (CVE-2026-45989)

    In the Linux kernel, the following vulnerability has been resolved:

    udf: fix partition descriptor append bookkeeping (CVE-2026-45991)

    In the Linux kernel, the following vulnerability has been resolved:

    scsi: sd: fix missing put_disk() when device_add(&disk_dev) fails (CVE-2026-45997)

    In the Linux kernel, the following vulnerability has been resolved:

    erofs: fix unsigned underflow in z_erofs_lz4_handle_overlap() (CVE-2026-45999)

    In the Linux kernel, the following vulnerability has been resolved:

    rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (CVE-2026-46000)

    In the Linux kernel, the following vulnerability has been resolved:

    xfs: fix a resource leak in xfs_alloc_buftarg() (CVE-2026-46005)

    In the Linux kernel, the following vulnerability has been resolved:

    tcp: call sk_data_ready() after listener migration (CVE-2026-46015)

    In the Linux kernel, the following vulnerability has been resolved:

    thermal: core: Fix thermal zone governor cleanup issues (CVE-2026-46021)

    In the Linux kernel, the following vulnerability has been resolved:

    dm mirror: fix integer overflow in create_dirty_log() (CVE-2026-46023)

    In the Linux kernel, the following vulnerability has been resolved:

    libceph: Prevent potential null-ptr-deref in ceph_handle_auth_reply() (CVE-2026-46024)

    In the Linux kernel, the following vulnerability has been resolved:

    crypto: authencesn - reject short ahash digests during instance creation (CVE-2026-46033)

    In the Linux kernel, the following vulnerability has been resolved:

    ipv4: icmp: validate reply type before using icmp_pointers (CVE-2026-46037)

    In the Linux kernel, the following vulnerability has been resolved:

    inotify: fix watch count leak when fsnotify_add_inode_mark_locked() fails (CVE-2026-46040)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: fix missing brelse() in ext4_xattr_inode_dec_ref_all() (CVE-2026-46046)

    In the Linux kernel, the following vulnerability has been resolved:

    md/raid10: fix deadlock with check operation and nowait requests (CVE-2026-46050)

    In the Linux kernel, the following vulnerability has been resolved:

    md/raid5: fix soft lockup in retry_aligned_read() (CVE-2026-46051)

    In the Linux kernel, the following vulnerability has been resolved:

    ceph: only d_add() negative dentries when they are unhashed (CVE-2026-46052)

    In the Linux kernel, the following vulnerability has been resolved:

    net: rds: fix MR cleanup on copy error (CVE-2026-46053)

    In the Linux kernel, the following vulnerability has been resolved:

    jbd2: fix deadlock in jbd2_journal_cancel_revoke() (CVE-2026-46061)

    In the Linux kernel, the following vulnerability has been resolved:

    ntfs3: fix integer overflow in run_unpack() volume boundary check (CVE-2026-46062)

    In the Linux kernel, the following vulnerability has been resolved:

    fbdev: defio: Disconnect deferred I/O from the lifetime of struct fb_info (CVE-2026-46065)

    In the Linux kernel, the following vulnerability has been resolved:

    md/raid5: validate payload size before accessing journal metadata (CVE-2026-46070)

    In the Linux kernel, the following vulnerability has been resolved:

    ntfs3: add buffer boundary checks to run_unpack() (CVE-2026-46072)

    In the Linux kernel, the following vulnerability has been resolved:

    KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (CVE-2026-46076)

    In the Linux kernel, the following vulnerability has been resolved:

    erofs: fix the out-of-bounds nameoff handling for trailing dirents (CVE-2026-46078)

    In the Linux kernel, the following vulnerability has been resolved:

    rbd: fix null-ptr-deref when device_add_disk() fails (CVE-2026-46079)

    In the Linux kernel, the following vulnerability has been resolved:

    KVM: SVM: Inject #UD for INVLPGA if EFER.SVME=0 (CVE-2026-46082)

    In the Linux kernel, the following vulnerability has been resolved:

    spi: fix resource leaks on device setup failure

    Make sure to call controller cleanup() if spi_setup() fails whileregistering a device to avoid leaking any     resources allocated bysetup(). (CVE-2026-46083)

    In the Linux kernel, the following vulnerability has been resolved:

    RDMA/mana_ib: Disable RX steering on RSS QP destroy (CVE-2026-46084)

    In the Linux kernel, the following vulnerability has been resolved:

    net: bridge: use a stable FDB dst snapshot in RCU readers (CVE-2026-46086)

    In the Linux kernel, the following vulnerability has been resolved:

    zram: do not forget to endio for partial discard requests (CVE-2026-46089)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: fix bounds check in check_xattrs() to prevent out-of-bounds access (CVE-2026-46094)

    In the Linux kernel, the following vulnerability has been resolved:

    net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (CVE-2026-46099)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: reject zero shift in nft_bitwise (CVE-2026-46101)

    In the Linux kernel, the following vulnerability has been resolved:

    net: strparser: fix skb_head leak in strp_abort_strp() (CVE-2026-46102)

    In the Linux kernel, the following vulnerability has been resolved:

    eventfs: Hold eventfs_mutex and SRCU when remount walks events (CVE-2026-46106)

    In the Linux kernel, the following vulnerability has been resolved:

    dm-thin: fix metadata refcount underflow (CVE-2026-46107)

    In the Linux kernel, the following vulnerability has been resolved:

    ipmi:si: Return state to normal if message allocation fails (CVE-2026-46108)

    In the Linux kernel, the following vulnerability has been resolved:

    KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CVE-2026-46113)

    In the Linux kernel, the following vulnerability has been resolved:

    block: add pgmap check to biovec_phys_mergeable (CVE-2026-46115)

    In the Linux kernel, the following vulnerability has been resolved:

    xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (CVE-2026-46116)

    In the Linux kernel, the following vulnerability has been resolved:

    libceph: Fix slab-out-of-bounds access in auth message processing (CVE-2026-46119)

    In the Linux kernel, the following vulnerability has been resolved:

    ip6_gre: Use cached t->net in ip6erspan_changelink(). (CVE-2026-46120)

    In the Linux kernel, the following vulnerability has been resolved:

    mm/damon/sysfs-schemes: protect memcg_path kfree() with damon_sysfs_lock (CVE-2026-46121)

    In the Linux kernel, the following vulnerability has been resolved:

    isofs: validate block number from NFS file handle in isofs_export_iget (CVE-2026-46124)

    In the Linux kernel, the following vulnerability has been resolved:

    ipmi: Check event message buffer response for bad data (CVE-2026-46128)

    In the Linux kernel, the following vulnerability has been resolved:

    btrfs: fix double free in create_space_info() error path (CVE-2026-46129)

    In the Linux kernel, the following vulnerability has been resolved:

    KVM: x86: check for nEPT/nNPT in slow flush hypercalls (CVE-2026-46131)

    In the Linux kernel, the following vulnerability has been resolved:

    net: rtnetlink: zero ifla_vf_broadcast to avoid stack infoleak in rtnl_fill_vfinfo (CVE-2026-46132)

    In the Linux kernel, the following vulnerability has been resolved:

    smb: client: use kzalloc to zero-initialize security descriptor buffer (CVE-2026-46139)

    In the Linux kernel, the following vulnerability has been resolved:

    RDMA/mana: Fix error unwind in mana_ib_create_qp_rss() (CVE-2026-46144)

    In the Linux kernel, the following vulnerability has been resolved:

    RDMA/mana: Validate rx_hash_key_len (CVE-2026-46145)

    In the Linux kernel, the following vulnerability has been resolved:

    scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CVE-2026-46149)

    In the Linux kernel, the following vulnerability has been resolved:

    fanotify: fix false positive on permission events (CVE-2026-46150)

    In the Linux kernel, the following vulnerability has been resolved:

    smb/client: fix out-of-bounds read in smb2_compound_op() (CVE-2026-46155)

    In the Linux kernel, the following vulnerability has been resolved:

    md/raid10: fix divide-by-zero in setup_geo() with zero far_copies (CVE-2026-46161)

    In the Linux kernel, the following vulnerability has been resolved:

    ice: fix double free in ice_sf_eth_activate() error path (CVE-2026-46162)

    In the Linux kernel, the following vulnerability has been resolved:

    openvswitch: vport: fix self-deadlock on release of tunnel ports (CVE-2026-46165)

    In the Linux kernel, the following vulnerability has been resolved:

    mptcp: fix scheduling with atomic in timestamp sockopt (CVE-2026-46168)

    In the Linux kernel, the following vulnerability has been resolved:

    ipv6: xfrm6: release dst on error in xfrm6_rcv_encap() (CVE-2026-46172)

    In the Linux kernel, the following vulnerability has been resolved:

    exit: prevent preemption of oopsing TASK_DEAD task (CVE-2026-46173)

    In the Linux kernel, the following vulnerability has been resolved:

    x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (CVE-2026-46174)

    In the Linux kernel, the following vulnerability has been resolved:

    RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CVE-2026-46176)

    In the Linux kernel, the following vulnerability has been resolved:

    ipmi: Add limits to event and receive message requests (CVE-2026-46177)

    In the Linux kernel, the following vulnerability has been resolved:

    smb/client: fix out-of-bounds read in symlink_data() (CVE-2026-46185)

    In the Linux kernel, the following vulnerability has been resolved:

    mtd: spi-nor: debugfs: fix out-of-bounds read in spi_nor_params_show() (CVE-2026-46190)

    In the Linux kernel, the following vulnerability has been resolved:

    xfrm: ah: account for ESN high bits in async callbacks (CVE-2026-46193)

    In the Linux kernel, the following vulnerability has been resolved:

    smb: client: validate dacloffset before building DACL pointers (CVE-2026-46195)

    In the Linux kernel, the following vulnerability has been resolved:

    tracepoint: balance regfunc() on func_add() failure in tracepoint_add_func() (CVE-2026-46196)

    In the Linux kernel, the following vulnerability has been resolved:

    tpm: Use kfree_sensitive() to free auth session in tpm_dev_release() (CVE-2026-46283)

    In the Linux kernel, the following vulnerability has been resolved:

    lib/scatterlist: fix length calculations in extract_kvec_to_sg (CVE-2026-46289)

    In the Linux kernel, the following vulnerability has been resolved:

    pmdomain: core: Fix detach procedure for virtual devices in genpd (CVE-2026-46292)

    In the Linux kernel, the following vulnerability has been resolved:

    dm: fix a buffer overflow in ioctl processing (CVE-2026-46294)

    In the Linux kernel, the following vulnerability has been resolved:

    isofs: validate Rock Ridge CE continuation extent against volume size (CVE-2026-46303)

    In the Linux kernel, the following vulnerability has been resolved:

    flow_dissector: do not dissect PPPoE PFC frames (CVE-2026-46306)

    In the Linux kernel, the following vulnerability has been resolved:

    ptrace: slightly saner 'get_dumpable()' logic (CVE-2026-46333)

    In the Linux kernel, the following vulnerability has been resolved:

    af_unix: Reject SIOCATMARK on non-stream sockets (CVE-2026-52928)

    In the Linux kernel, the following vulnerability has been resolved:

    io_uring/poll: fix signed comparison in io_poll_get_ownership() (CVE-2026-52933)

    In the Linux kernel, the following vulnerability has been resolved:

    udf: reject descriptors with oversized CRC length

    udf_read_tagged() skips CRC verification when descCRCLength +sizeof(struct tag) exceeds the block size.  A     crafted UDF image canset descCRCLength to an oversized value to bypass CRC validationentirely; the     descriptor is then accepted based solely on the 8-bittag checksum, which is trivially recomputable.

    Reject such descriptors instead of silently accepting them.  Alegitimate single-block descriptor should     never have a CRC length thatexceeds the block. (CVE-2026-53369)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
347154	EulerOS 2.0 SP15 : kernel (EulerOS-SA-2026-3782)	Nessus	Huawei Local Security Checks	Local	high
346773	EulerOS 2.0 SP15 : kernel (EulerOS-SA-2026-3807)	Nessus	Huawei Local Security Checks	Local	high
343985	RHEL 9 : kernel (RHSA-2026:65708)	Nessus	Red Hat Local Security Checks	Local	high
343755	RHEL 10 : kernel (RHSA-2026:64767)	Nessus	Red Hat Local Security Checks	Local	high
343532	Ubuntu 24.04 LTS / Pro Realtime 24.04 LTS : Linux kernel (GCP) vulnerabilities (USN-8728-1)	Nessus	Ubuntu Local Security Checks	Local	high
337353	MiracleLinux 9 : kernel-5.14.0-687.22.1.el9_8 (AXSA:2026-1543:61)	Nessus	Miracle Linux Local Security Checks	Local	high
335212	Oracle Linux 10 : kernel (ELSA-2026-36541)	Nessus	Oracle Linux Local Security Checks	Local	high
326383	RockyLinux 9 : kernel (RLSA-2026:36018)	Nessus	Rocky Linux Local Security Checks	Local	high
326058	AlmaLinux 10 : kernel (ALSA-2026:36541)	Nessus	Alma Linux Local Security Checks	Local	high
326054	AlmaLinux 9 : kernel (ALSA-2026:36018)	Nessus	Alma Linux Local Security Checks	Local	high
325873	Oracle Linux 9 : kernel (ELSA-2026-36018)	Nessus	Oracle Linux Local Security Checks	Local	high
325663	RHEL 10 : kernel (RHSA-2026:36541)	Nessus	Red Hat Local Security Checks	Local	high
325421	Ubuntu 26.04 LTS : Linux kernel (NVIDIA) vulnerabilities (USN-8507-1)	Nessus	Ubuntu Local Security Checks	Local	low
325304	RHEL 9 : kernel (RHSA-2026:36018)	Nessus	Red Hat Local Security Checks	Local	high
325017	Ubuntu 26.04 LTS : Linux kernel vulnerabilities (USN-8488-1)	Nessus	Ubuntu Local Security Checks	Local	low
325016	Ubuntu 26.04 LTS : Linux kernel (OEM) vulnerabilities (USN-8489-1)	Nessus	Ubuntu Local Security Checks	Local	high
318444	Linux Distros Unpatched Vulnerability : CVE-2026-46155	Nessus	Misc.	Local	critical
316975	Amazon Linux 2023 : bpftool6.18, kernel6.18, kernel6.18-devel (ALAS2023-2026-1754)	Nessus	Amazon Linux Local Security Checks	Local	high
316942	Amazon Linux 2023 : bpftool6.12, kernel6.12, kernel6.12-devel (ALAS2023-2026-1753)	Nessus	Amazon Linux Local Security Checks	Local	high

Detections

Analytics

CVE-2026-46155

critical

Tenable Plugins

high

high

high

high

high

high

high

high

high

high

high

high

low

high

low

high

critical

high

high