In the Linux kernel, the following vulnerability has been resolved: ALSA: pcm: oss: Fix data race at accessing runtime.oss.trigger Currently the runtime.oss.trigger field may be accessed concurrently without protection, which may lead to the data race. And, in this case, it may lead to more severe problem because it's a bit field; as writing the data, it may overwrite other bit fields as well, which confuses the operation completely, as spotted by fuzzing. Fix it by covering runtime.oss.trigger bit fled also with the existing params_lock mutex in both snd_pcm_oss_get_trigger() and snd_pcm_oss_poll().

The remote SUSE Linux SLES12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:2450-1 advisory.

    The SUSE Linux Enterprise 12 SP5 kernel was updated to fix various security issues

    The following security issues were fixed:

    - CVE-2025-10263: arm64: Add workaround for Cortex-A76 erratum 1286807 (bsc#1266290).
    - CVE-2025-40253: s390/ctcm: Fix double-kfree (bsc#1255084).
    - CVE-2025-68822: Input: alps - fix use-after-free bugs caused by dev3_register_work (bsc#1256668).
    - CVE-2026-3150: bcache: fix cached_dev.sb_bio use-after-free and crash (bsc#1263169).
    - CVE-2026-23271: perf: Fix __perf_event_overflow() vs perf_remove_from_context() race (bsc#1260018).
    - CVE-2026-23279: wifi: mac80211: fix NULL pointer dereference in mesh_rx_csa_frame() (bsc#1260468).
    - CVE-2026-23303: smb: client: Don't log plaintext credentials in cifs_set_cifscreds (bsc#1260502).
    - CVE-2026-23367: wifi: radiotap: reject radiotap with unknown bits (bsc#1260731).
    - CVE-2026-23396: wifi: mac80211: fix NULL deref in mesh_matches_local() (bsc#1260729).
    - CVE-2026-23444: wifi: mac80211: always free skb on ieee80211_tx_prepare_skb() failure (bsc#1266307).
    - CVE-2026-23448: net: usb: cdc_ncm: add ndpoffset to NDP16 nframes bounds check (bsc#1261750).
    - CVE-2026-31405: media: dvb-net: fix OOB access in ULE extension header tables (bsc#1261700).
    - CVE-2026-31415: ipv6: avoid overflows in ip6_datagram_send_ctl() (bsc#1262099).
    - CVE-2026-31421: net/sched: cls_fw: fix NULL pointer dereference on shared blocks (bsc#1262061).
    - CVE-2026-31447: ext4: reject mount if bigalloc with s_first_data_block != 0 (bsc#1262614).
    - CVE-2026-31452: ext4: convert inline data to extents when truncate exceeds inline size (bsc#1262620).
    - CVE-2026-31464: scsi: ibmvfc: Fix OOB access in ibmvfc_discover_targets_done() (bsc#1262656).
    - CVE-2026-31469: virtio_net: Fix UAF on dst_ops when IFF_XMIT_DST_RELEASE is cleared and napi_tx is false       (bsc#1267816).
    - CVE-2026-31498: Bluetooth: L2CAP: Fix ERTM re-init and zero pdu_len infinite loop (bsc#1262751).
    - CVE-2026-31500: Bluetooth: btintel: serialize btintel_hw_error() with hci_req_sync_lock (bsc#1262993).
    - CVE-2026-31515: af_key: validate families in pfkey_send_migrate() (bsc#1262752).
    - CVE-2026-31516: xfrm: prevent policy_hthresh.work from racing with netns teardown (bsc#1262755).
    - CVE-2026-31532: can: af_can: export can_sock_destruct() (bsc#1262757).
    - CVE-2026-31540: drm/i915/gt: Check set_default_submission() before deferencing (bsc#1263011).
    - CVE-2026-31546: net: bonding: fix NULL deref in bond_debug_rlb_hash_show (bsc#1263006).
    - CVE-2026-31588: KVM: x86: Use scratch field in MMIO fragment to hold small write values (bsc#1263165).
    - CVE-2026-31590: KVM: SEV: Drop WARN on large size for KVM_MEMORY_ENCRYPT_REG_REGION (bsc#1263152).
    - CVE-2026-31596: ocfs2: handle invalid dinode in ocfs2_group_extend (bsc#1263319).
    - CVE-2026-31629: nfc: llcp: add missing return after LLCP_CLOSED checks (bsc#1263790).
    - CVE-2026-31664: string.h: Introduce memset_after() for wiping trailing members/padding (bsc#1263578).
    - CVE-2026-31668: seg6: separate dst_cache for input and output paths in seg6 lwtunnel (bsc#1263140).
    - CVE-2026-31671: xfrm_user: fix info leak in build_report() (bsc#1263115).
    - CVE-2026-31673: af_unix: read UNIX_DIAG_VFS data under unix_state_lock (bsc#1263143).
    - CVE-2026-31674: netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (bsc#1263568).
    - CVE-2026-31678: openvswitch: defer tunnel netdev_put to RCU release (bsc#1263562).
    - CVE-2026-31759: usb: ulpi: fix double free in ulpi_register_interface() error path (bsc#1264076).
    - CVE-2026-31778: ALSA: caiaq: fix stack out-of-bounds read in init_card (bsc#1263923).
    - CVE-2026-43020: Bluetooth: MGMT: validate LTK enc_size on load (bsc#1264006).
    - CVE-2026-43024: netfilter: nf_tables: reject immediate NF_QUEUE verdict (bsc#1263930).
    - CVE-2026-43026: netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (bsc#1263932).
    - CVE-2026-43028: netfilter: x_tables: ensure names are nul-terminated (bsc#1263934).
    - CVE-2026-43037: ip6_tunnel: clear skb2->cb in ip4ip6_err() (bsc#1263995).
    - CVE-2026-43038: ipv6: icmp: clear skb2->cb in ip6_err_gen_icmpv6_unreach() (bsc#1264097).
    - CVE-2026-43040: net: ipv6: ndisc: fix ndisc_ra_useropt to initialize nduseropt_padX fields to zero to     prevent an info-       leak (bsc#1264091).
    - CVE-2026-43052: wifi: mac80211: check tdls flag in ieee80211_tdls_oper (bsc#1263945).
    - CVE-2026-43077: crypto: algif_aead - Fix minimum RX size check for decryption (bsc#1264470).
    - CVE-2026-43140: HID: magicmouse: Do not crash on missing msc->input (bsc#1264630).
    - CVE-2026-43158: xfs: fix freemap adjustments when adding xattrs to leaf blocks (bsc#1264595).
    - CVE-2026-43187: xfs: delete attr leaf freemap entries when empty (bsc#1264603).
    - CVE-2026-43198: tcp: fix potential race in tcp_v6_syn_recv_sock() (bsc#1264610).
    - CVE-2026-43206: drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (bsc#1264551).
    - CVE-2026-43234: team: avoid NETDEV_CHANGEMTU event when unregistering slave (bsc#1264409).
    - CVE-2026-43338: btrfs: reserve enough transaction items for qgroup ioctls (bsc#1264716).
    - CVE-2026-43339: ipv6: prevent possible UaF in addrconf_permanent_addr() (bsc#1264763).
    - CVE-2026-43359: btrfs: fix transaction abort on set received ioctl due to item overflow (bsc#1264719).
    - CVE-2026-43361: btrfs: fix transaction abort when snapshotting received subvolumes (bsc#1264722).
    - CVE-2026-43407: libceph: Fix potential out-of-bounds access in ceph_handle_auth_reply() (bsc#1265020).
    - CVE-2026-43413: scsi: hisi_sas: Fix NULL pointer exception during user_scan() (bsc#1264671).
    - CVE-2026-43414: scsi: qla2xxx: Completely fix fcport double free (bsc#1264669).
    - CVE-2026-43499: rtmutex: Use waiter::task instead of current in remove_waiter() (bsc#1266001).
    - CVE-2026-43503: net: skbuff: propagate shared-frag marker through frag-transfer helpers (bsc#1265960).
    - CVE-2026-45835: Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (bsc#1266411).
    - CVE-2026-45841: netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO (bsc#1266390).
    - CVE-2026-45842: slip: reject VJ receive packets on instances with no rstate array (bsc#1266400).
    - CVE-2026-45843: slip: bound decode() reads against the compressed packet length (bsc#1266395).
    - CVE-2026-45852: RDMA/rxe: Fix double free in rxe_srq_from_init (bsc#1266711).
    - CVE-2026-45870: SUNRPC: auth_gss: fix memory leaks in XDR decoding error paths (bsc#1266704).
    - CVE-2026-45970: bonding: alb: fix UAF in rlb_arp_recv during bond up/down (bsc#1267205).
    - CVE-2026-45983: nfsd: never defer requests during idmap lookup (bsc#1266697).
    - CVE-2026-46021: thermal: core: Fix thermal zone governor cleanup issues (bsc#1267220).
    - CVE-2026-46024: libceph: Prevent potential null-ptr-deref in ceph_handle_auth_reply() (bsc#1267218).
    - CVE-2026-46043: RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (bsc#1266901).
    - CVE-2026-46090: ALSA: aloop: Fix peer runtime UAF during format-change stop (bsc#1267531).
    - CVE-2026-46113: KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (bsc#1266969).
    - CVE-2026-46116: xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (bsc#1267369).
    - CVE-2026-46150: fanotify: fix false positive on permission events (bsc#1267387).
    - CVE-2026-46157: ALSA: pcm: oss: Fix data race at accessing runtime.oss.trigger (bsc#1267726).
    - CVE-2026-46159: btrfs: fix btrfs_ioctl_space_info() slot_count TOCTOU which can lead to info-leak     (bsc#1267652).
    - CVE-2026-46160: btrfs: fix missing last_unlink_trans update when removing a directory (bsc#1267624).
    - CVE-2026-46169: hfsplus: fix uninit-value by validating catalog record size (bsc#1267713).
    - CVE-2026-46181: RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (bsc#1266826).
    - CVE-2026-46243: smb: client: reject userspace cifs.spnego descriptions (bsc#1266238).
    - CVE-2026-46259: procfs: fix missing RCU protection when reading real_parent in do_task_stat()     (bsc#1267685).
    - CVE-2026-46273: ibmveth: Disable GSO for packets with small MSS (bsc#1267651).

    The following non security issues were fixed:

    - arm64: tlb: Allow XZR argument to TLBI ops (git-fixes).
    - arm64: tlb: Optimize ARM64_WORKAROUND_REPEAT_TLBI (git-fixes).
    - bcache: fix uninitialized closure object (git-fixes).
    - check-for-config-changes: Exclude CC_MS_EXTENSIONS.
    - check-for-config-changes: Exclude HAVE_CFI_ICALL_NORMALIZE_INTEGERS{,_RUSTC}.
    - kvm/svm: PKU not currently supported (bsc#1263887).
    - KVM: x86: Handle PKU CPUID adjustment in VMX code (bsc#1263887).
    - mkspec: Add signature to source list only when it exists.
    - net/sched: cls_fw: fix NULL dereference of 'old' filters before change() (git-fixes).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - ALSA: pcm: oss: Fix data race at accessing runtime.oss.trigger Currently the runtime.oss.trigger field may     be accessed concurrently without protection, which may lead to the data race. And, in this case, it may     lead to more severe problem because it's a bit field; as writing the data, it may overwrite other bit     fields as well, which confuses the operation completely, as spotted by fuzzing. Fix it by covering     runtime.oss.trigger bit fled also with the existing params_lock mutex in both snd_pcm_oss_get_trigger()     and snd_pcm_oss_poll(). (CVE-2026-46157)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
323086	SUSE SLED15: cluster-md-kmp-default / dlm-kmp-default / gfs2-kmp-default / etc (SUSE-SU-2026:2482-1)	Nessus	SuSE Local Security Checks	high
321690	SUSE SLES12 Security Update : kernel (SUSE-SU-2026:2450-1)	Nessus	SuSE Local Security Checks	medium
317589	Linux Distros Unpatched Vulnerability : CVE-2026-46157	Nessus	Misc.	high

Detections

Analytics

CVE-2026-46157

high

Tenable Plugins

high

medium

high