In the Linux kernel, the following vulnerability has been resolved: io-wq: check that the predecessor is hashed in io_wq_remove_pending() io_wq_remove_pending() needs to fix up wq->hash_tail[] if the cancelled work was the tail of its hash bucket. When doing this, it checks whether the preceding entry in acct->work_list has the same hash value, but never checks that the predecessor is hashed at all. io_get_work_hash() is simply atomic_read(&work->flags) >> IO_WQ_HASH_SHIFT, and the hash bits are never set for non-hashed work, so it returns 0. Thus, when a hashed bucket-0 work is cancelled while a non-hashed work is its list predecessor, the check spuriously passes and a pointer to the non-hashed io_kiocb is stored in wq->hash_tail[0]. Because non-hashed work is dequeued via the fast path in io_get_next_work(), which never touches hash_tail[], the stale pointer is never cleared. Therefore, after the non-hashed io_kiocb completes and is freed back to req_cachep, wq->hash_tail[0] is a dangling pointer. The io_wq is per-task (tctx->io_wq) and survives ring open/close, so the dangling pointer persists for the lifetime of the task; the next hashed bucket-0 enqueue dereferences it in io_wq_insert_work() and wq_list_add_after() writes through freed memory. Add the missing io_wq_is_hashed() check so a non-hashed predecessor never inherits a hash_tail[] slot.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3089-1 advisory.

    The SUSE Linux Enterprise 15 SP5 kernel was updated to fix various security issues

    The following security issues were fixed:

    - CVE-2026-31771: Bluetooth: Ignore HCI_ERROR_CANCELLED_BY_HOST on adv set terminated event (bsc#1264145).
    - CVE-2026-43038: ipv6: icmp: clear skb2->cb in ip6_err_gen_icmpv6_unreach() (bsc#1264097).
    - CVE-2026-46090: ALSA: aloop: Fix peer runtime UAF during format-change stop (bsc#1267531).
    - CVE-2026-46173: exit: prevent preemption of oopsing TASK_DEAD task (bsc#1267722).
    - CVE-2026-46197: drm/amdkfd: validate SVM ioctl nattr against buffer size (bsc#1267381).
    - CVE-2026-46229: drm/amdkfd: Clear VRAM on allocation to prevent stale data exposure (bsc#1267567).
    - CVE-2026-46253: pstore/ram: fix buffer overflow in persistent_ram_save_old() (bsc#1267635).
    - CVE-2026-46266: inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (bsc#1267684).
    - CVE-2026-46319: net/sched: act_ct: Only release RCU read lock after ct_ft (bsc#1268022).
    - CVE-2026-46320: tap: free page on error paths in tap_get_user_xdp() (bsc#1267993).
    - CVE-2026-46331: net/sched: fix pedit partial COW leading to page cache (bsc#1265421).
    - CVE-2026-52909: ip6_vti: set netns_immutable on the fallback device (bsc#1268660).
    - CVE-2026-52918: Bluetooth: serialize accept_q access (bsc#1269100).
    - CVE-2026-52923: ipc: limit next_id allocation to the valid ID range (bsc#1269033).
    - CVE-2026-52924: sctp: purge outqueue on stale COOKIE-ECHO handling (bsc#1269036).
    - CVE-2026-52943: net: skbuff: fix missing zerocopy reference in pskb_carve helpers (bsc#1269022).
    - CVE-2026-52955: libceph: Fix potential out-of-bounds access in crush_decode() (bsc#1269159).
    - CVE-2026-52969: KVM: Reject wrapped offset in kvm_reset_dirty_gfn() (bsc#1269184).
    - CVE-2026-52972: crypto: af_alg - Cap AEAD AD length to 0x80000000 (bsc#1269195).
    - CVE-2026-52993: tipc: fix double-free in tipc_buf_append() (bsc#1269193).
    - CVE-2026-53016: crypto: ccp - copy IV using skcipher ivsize (bsc#1269090).
    - CVE-2026-53041: ocfs2: fix listxattr handling when the buffer is full (bsc#1269398).
    - CVE-2026-53053: iommu/amd: Fix clone_alias() to use the original device's devid (bsc#1269310).
    - CVE-2026-53071: Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (bsc#1269678).
    - CVE-2026-53072: Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (bsc#1269681).
    - CVE-2026-53133: RDMA/umem: Fix truncation for block sizes >= 4G (bsc#1269821).
    - CVE-2026-53253: Bluetooth: bnep: fix incorrect length parsing in bnep_rx_frame() extension handling     (bsc#1269574).
    - CVE-2026-53359: KVM: x86: Fix shadow paging use-after-free due to unexpected role (bsc#1270059).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3044-1 advisory.

    The SUSE Linux Enterprise 15 SP4 kernel was updated to fix various security issues

    The following security issues were fixed:

    - CVE-2026-31771: Bluetooth: hci_event: move wake reason storage into validated event handlers     (bsc#1264145).
    - CVE-2026-43038: ipv6: icmp: clear skb2->cb in ip6_err_gen_icmpv6_unreach() (bsc#1264097).
    - CVE-2026-46090: ALSA: aloop: Fix peer runtime UAF during format-change stop (bsc#1267531).
    - CVE-2026-46173: exit: prevent preemption of oopsing TASK_DEAD task (bsc#1267722).
    - CVE-2026-46229: drm/amdkfd: Clear VRAM on allocation to prevent stale data exposure (bsc#1267567).
    - CVE-2026-46253: pstore/ram: fix buffer overflow in persistent_ram_save_old() (bsc#1267635).
    - CVE-2026-46266: inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (bsc#1267684).
    - CVE-2026-46319: net/sched: act_ct: Only release RCU read lock after ct_ft (bsc#1268022).
    - CVE-2026-46320: tap: free page on error paths in tap_get_user_xdp() (bsc#1267993).
    - CVE-2026-46331: net/sched: fix pedit partial COW leading to page cache (bsc#1265421).
    - CVE-2026-52909: ip6_vti: set netns_immutable on the fallback device (bsc#1268660).
    - CVE-2026-52918: Bluetooth: serialize accept_q access (bsc#1269100).
    - CVE-2026-52923: ipc: limit next_id allocation to the valid ID range (bsc#1269033).
    - CVE-2026-52924: sctp: purge outqueue on stale COOKIE-ECHO handling (bsc#1269036).
    - CVE-2026-52943: net: skbuff: fix missing zerocopy reference in pskb_carve helpers (bsc#1269022).
    - CVE-2026-52955: libceph: Fix potential out-of-bounds access in crush_decode() (bsc#1269159).
    - CVE-2026-52969: KVM: Reject wrapped offset in kvm_reset_dirty_gfn() (bsc#1269184).
    - CVE-2026-52972: crypto: af_alg - Cap AEAD AD length to 0x80000000 (bsc#1269195).
    - CVE-2026-52993: tipc: fix double-free in tipc_buf_append() (bsc#1269193).
    - CVE-2026-53016: crypto: ccp - copy IV using skcipher ivsize (bsc#1269090).
    - CVE-2026-53041: ocfs2: fix listxattr handling when the buffer is full (bsc#1269398).
    - CVE-2026-53053: iommu/amd: Fix clone_alias() to use the original device's devid (bsc#1269310).
    - CVE-2026-53071: Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (bsc#1269678).
    - CVE-2026-53072: Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (bsc#1269681).
    - CVE-2026-53133: RDMA/umem: Fix truncation for block sizes >= 4G (bsc#1269821).
    - CVE-2026-53253: Bluetooth: bnep: fix incorrect length parsing in bnep_rx_frame() extension handling     (bsc#1269574).
    - CVE-2026-53359: KVM: x86: Fix shadow paging use-after-free due to unexpected role (bsc#1270059).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1894 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    fs/ntfs3: handle attr_set_size() errors when truncating files (CVE-2025-71289)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: nf_tables: unconditionally bump set->nelems before insertion (CVE-2026-23272)

    In the Linux kernel, the following vulnerability has been resolved:

    smb: client: fix OOB reads parsing symlink error response (CVE-2026-31613)

    In the Linux kernel, the following vulnerability has been resolved:

    xfrm: hold dev ref until after transport_finish NF_HOOK (CVE-2026-31663)

    In the Linux kernel, the following vulnerability has been resolved:

    rtnetlink: add missing netlink_ns_capable() check for peer netns (CVE-2026-31692)

    In the Linux kernel, the following vulnerability has been resolved:

    net: ioam6: fix OOB and missing lock (CVE-2026-43083)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: ctnetlink: ensure safe access to master conntrack (CVE-2026-43116)

    In the Linux kernel, the following vulnerability has been resolved:

    ntfs: ->d_compare() must not block (CVE-2026-43245)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf: fix end-of-list detection in cgroup_storage_get_next_key() (CVE-2026-45838)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf: reject negative CO-RE accessor indices in bpf_core_parse_spec() (CVE-2026-45839)

    In the Linux kernel, the following vulnerability has been resolved:

    openvswitch: cap upcall PID array size and pre-size vport replies (CVE-2026-45840)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO (CVE-2026-45841)

    In the Linux kernel, the following vulnerability has been resolved:

    slip: reject VJ receive packets on instances with no rstate array (CVE-2026-45842)

    In the Linux kernel, the following vulnerability has been resolved:

    slip: bound decode() reads against the compressed packet length (CVE-2026-45843)

    In the Linux kernel, the following vulnerability has been resolved:

    mptcp: pm: ADD_ADDR rtx: fix potential data-race (CVE-2026-46137)

    In the Linux kernel, the following vulnerability has been resolved:

    mptcp: pm: ADD_ADDR rtx: always decrease sk refcount (CVE-2026-46158)

    In the Linux kernel, the following vulnerability has been resolved:

    btrfs: fix missing last_unlink_trans update when removing a directory (CVE-2026-46160)

    In the Linux kernel, the following vulnerability has been resolved:

    mptcp: pm: ADD_ADDR rtx: free sk if last (CVE-2026-46170)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: nft_inner: Fix IPv6 inner_thoff desync (CVE-2026-46244)

    In the Linux kernel, the following vulnerability has been resolved:

    io-wq: check that the predecessor is hashed in io_wq_remove_pending() (CVE-2026-46274)

    In the Linux kernel, the following vulnerability has been resolved:

    io_uring/waitid: clear waitid info before copying it to userspace (CVE-2026-46315)

    In the Linux kernel, the following vulnerability has been resolved:

    KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CVE-2026-46316)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: nf_queue: hold bridge skb->dev while queued (CVE-2026-52912)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: ip6t_hbh: reject oversized option lists (CVE-2026-52915)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: xt_policy: fix strict mode inbound policy matching (CVE-2026-52920)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: ipset: stop hash:* range iteration at end (CVE-2026-52921)

    In the Linux kernel, the following vulnerability has been resolved:

    vrf: Fix a potential NPD when removing a port from a VRF (CVE-2026-52925)

    In the Linux kernel, the following vulnerability has been resolved:

    crypto: jitterentropy - replace long-held spinlock with mutex (CVE-2026-52936)

    In the Linux kernel, the following vulnerability has been resolved:

    libceph: handle rbtree insertion error in decode_choose_args() (CVE-2026-52954)

    In the Linux kernel, the following vulnerability has been resolved:

    libceph: Fix potential out-of-bounds access in crush_decode() (CVE-2026-52955)

    In the Linux kernel, the following vulnerability has been resolved:

    libceph: Fix potential null-ptr-deref in decode_choose_args() (CVE-2026-52957)

    In the Linux kernel, the following vulnerability has been resolved:

    libceph: Fix potential out-of-bounds access in osdmap_decode() (CVE-2026-52958)

    In the Linux kernel, the following vulnerability has been resolved:

    ceph: fix BUG_ON in __ceph_build_xattrs_blob() due to stale blob size (CVE-2026-52961)

    In the Linux kernel, the following vulnerability has been resolved:

    ceph: fix a buffer leak in __ceph_setxattr() (CVE-2026-52962)

    In the Linux kernel, the following vulnerability has been resolved:

    smb/client: fix possible infinite loop and oob read in symlink_data() (CVE-2026-52967)

    In the Linux kernel, the following vulnerability has been resolved:

    KVM: Reject wrapped offset in kvm_reset_dirty_gfn() (CVE-2026-52969)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: nft_ct: fix missing expect put in obj eval (CVE-2026-52970)

    In the Linux kernel, the following vulnerability has been resolved:

    crypto: af_alg - Cap AEAD AD length to 0x80000000 (CVE-2026-52972)

    In the Linux kernel, the following vulnerability has been resolved:

    net: tls: fix strparser anchor skb leak on offload RX setup failure (CVE-2026-52974)

    In the Linux kernel, the following vulnerability has been resolved:

    futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (CVE-2026-52977)

    In the Linux kernel, the following vulnerability has been resolved:

    sched/fair: Clear rel_deadline when initializing forked entities (CVE-2026-52980)

    In the Linux kernel, the following vulnerability has been resolved:

    neigh: let neigh_xmit take skb ownership (CVE-2026-52981)

    In the Linux kernel, the following vulnerability has been resolved:

    net/sched: netem: fix queue limit check to include reordered packets

    The queue limit check in netem_enqueue() uses q->t_len which onlycounts packets in the internal tfifo.
    Packets placed in sch->q bythe reorder path (__qdisc_enqueue_head) are not counted, allowingthe total     queue occupancy to exceed sch->limit under reordering.

    Include sch->q.qlen in the limit check. (CVE-2026-52984)

    In the Linux kernel, the following vulnerability has been resolved:

    netdevsim: zero initialize struct iphdr in dummy sk_buff (CVE-2026-52985)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: nf_conntrack_sip: don't use simple_strtoul (CVE-2026-52986)

    In the Linux kernel, the following vulnerability has been resolved:

    fsnotify: fix inode reference leak in fsnotify_recalc_mask() (CVE-2026-52990)

    In the Linux kernel, the following vulnerability has been resolved:

    tipc: fix double-free in tipc_buf_append() (CVE-2026-52993)

    In the Linux kernel, the following vulnerability has been resolved:

    net/rds: zero per-item info buffer before handing it to visitors (CVE-2026-52995)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (CVE-2026-52998)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (CVE-2026-52999)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: xtables: restrict several matches to inet family (CVE-2026-53001)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: conntrack: remove sprintf usage (CVE-2026-53002)

    In the Linux kernel, the following vulnerability has been resolved:

    pppoe: drop PFC frames (CVE-2026-53003)

    In the Linux kernel, the following vulnerability has been resolved:

    sctp: fix OOB write to userspace in sctp_getsockopt_peer_auth_chunks (CVE-2026-53004)

    In the Linux kernel, the following vulnerability has been resolved:

    ipv6: fix possible UAF in icmpv6_rcv() (CVE-2026-53006)

    In the Linux kernel, the following vulnerability has been resolved:

    ice: fix double-free of tx_buf skb (CVE-2026-53009)

    In the Linux kernel, the following vulnerability has been resolved:

    nexthop: fix IPv6 route referencing IPv4 nexthop (CVE-2026-53012)

    In the Linux kernel, the following vulnerability has been resolved:

    macvlan: fix macvlan_get_size() not reserving space for IFLA_MACVLAN_BC_CUTOFF (CVE-2026-53013)

    In the Linux kernel, the following vulnerability has been resolved:

    net/sched: act_mirred: fix wrong device for mac_header_xmit check in tcf_blockcast_redir (CVE-2026-53014)

    In the Linux kernel, the following vulnerability has been resolved:

    erofs: unify lcn as u64 for 32-bit platforms (CVE-2026-53015)

    In the Linux kernel, the following vulnerability has been resolved:

    scsi: target: core: Fix integer overflow in UNMAP bounds check (CVE-2026-53021)

    In the Linux kernel, the following vulnerability has been resolved:

    fs/ntfs3: terminate the cached volume label after UTF-8 conversion (CVE-2026-53023)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf: Validate node_id in arena_alloc_pages() (CVE-2026-53031)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf: Fix NULL deref in map_kptr_match_type for scalar regs (CVE-2026-53032)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf, sockmap: Take state lock for af_unix iter (CVE-2026-53033)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf, sockmap: Fix af_unix null-ptr-deref in proto update (CVE-2026-53034)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf, sockmap: Fix af_unix iter deadlock (CVE-2026-53035)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf, arm64: Fix off-by-one in check_imm signed range check (CVE-2026-53036)

    In the Linux kernel, the following vulnerability has been resolved:

    HID: usbhid: fix deadlock in hid_post_reset() (CVE-2026-53037)

    In the Linux kernel, the following vulnerability has been resolved:

    ima_fs: Correctly create securityfs files for unsupported hash algos (CVE-2026-53038)

    In the Linux kernel, the following vulnerability has been resolved:

    quota: Fix race of dquot_scan_active() with quota deactivation (CVE-2026-53050)

    In the Linux kernel, the following vulnerability has been resolved:

    iommu/amd: Fix clone_alias() to use the original device's devid (CVE-2026-53053)

    In the Linux kernel, the following vulnerability has been resolved:

    dm log: fix out-of-bounds write due to region_count overflow (CVE-2026-53059)

    In the Linux kernel, the following vulnerability has been resolved:

    dm cache metadata: fix memory leak on metadata abort retry (CVE-2026-53060)

    In the Linux kernel, the following vulnerability has been resolved:

    dm cache: fix dirty mapping checking in passthrough mode switching (CVE-2026-53061)

    In the Linux kernel, the following vulnerability has been resolved:

    dm cache policy smq: fix missing locks in invalidating cache blocks (CVE-2026-53062)

    In the Linux kernel, the following vulnerability has been resolved:

    dm cache: fix write hang in passthrough mode (CVE-2026-53063)

    In the Linux kernel, the following vulnerability has been resolved:

    dm cache: fix null-deref with concurrent writes in passthrough mode (CVE-2026-53064)

    In the Linux kernel, the following vulnerability has been resolved:

    net, bpf: fix null-ptr-deref in xdp_master_redirect() for down master (CVE-2026-53069)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf: reject short IPv4/IPv6 inputs in bpf_prog_test_run_skb (CVE-2026-53074)

    In the Linux kernel, the following vulnerability has been resolved:

    ppp: require CAP_NET_ADMIN in target netns for unattached ioctls (CVE-2026-53075)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf: Fix OOB in pcpu_init_value (CVE-2026-53076)

    In the Linux kernel, the following vulnerability has been resolved:

    net/rds: Restrict use of RDS/IB to the initial network namespace (CVE-2026-53077)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf: Enforce regsafe base id consistency for BPF_ADD_CONST scalars (CVE-2026-53081)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf: Fix RCU stall in bpf_fd_array_map_clear() (CVE-2026-53083)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf: return VMA snapshot from task_vma iterator (CVE-2026-53084)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf: fix mm lifecycle in open-coded task_vma iterator (CVE-2026-53085)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf: Fix stale offload->prog pointer after constant blinding (CVE-2026-53094)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf: Use RCU-safe iteration in dev_map_redirect_multi() SKB path (CVE-2026-53096)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf: test_run: Fix the null pointer dereference issue in bpf_lwt_xmit_push_encap (CVE-2026-53111)

    In the Linux kernel, the following vulnerability has been resolved:

    platform/wmi: use generic driver_override infrastructure (CVE-2026-53119)

    In the Linux kernel, the following vulnerability has been resolved:

    PCI: use generic driver_override infrastructure (CVE-2026-53120)

    In the Linux kernel, the following vulnerability has been resolved:

    btrfs: fix deadlock between reflink and transaction commit when using flushoncommit (CVE-2026-53122)

    In the Linux kernel, the following vulnerability has been resolved:

    md: wake raid456 reshape waiters before suspend (CVE-2026-53123)

    In the Linux kernel, the following vulnerability has been resolved:

    blk-cgroup: fix disk reference leak in blkcg_maybe_throttle_current() (CVE-2026-53126)

    In the Linux kernel, the following vulnerability has been resolved:

    drbd: Balance RCU calls in drbd_adm_dump_devices() (CVE-2026-53128)

    In the Linux kernel, the following vulnerability has been resolved:

    fs/mbcache: cancel shrink work before destroying the cache (CVE-2026-53129)

    In the Linux kernel, the following vulnerability has been resolved:

    audit: fix incorrect inheritable capability in CAPSET records

    __audit_log_capset() records the effective capability set into theinheritable field due to a copy-paste     error. Every CAPSET auditrecord therefore reports cap_pi (process inheritable) with the valueof     cap_effective instead of cap_inheritable.

    This silently corrupts audit data used for compliance and forensicanalysis: an attacker who modifies     inheritable capabilities toprepare for a privilege-escalating exec would have the change maskedin the     audit trail.

    The bug has been present since the original introduction of CAPSETaudit records in 2008. (CVE-2026-53287)

    In the Linux kernel, the following vulnerability has been resolved:

    arm64: Reserve an extra page for early kernel mapping (CVE-2026-53288)

    In the Linux kernel, the following vulnerability has been resolved:

    ice: fix NULL pointer dereference in ice_reset_all_vfs() (CVE-2026-53289)

    In the Linux kernel, the following vulnerability has been resolved:

    mailbox: add sanity check for channel array

    Fail gracefully if there is no channel array attached to the mailboxcontroller. Otherwise the later     dereference will cause an OOPS whichmight not be seen because mailbox controllers might instantiate     veryearly. Remove the comment explaining the obvious while here. (CVE-2026-53295)

    In the Linux kernel, the following vulnerability has been resolved:

    scsi: sg: Resolve soft lockup issue when opening /dev/sgX (CVE-2026-53304)

    In the Linux kernel, the following vulnerability has been resolved:

    padata: Put CPU offline callback in ONLINE section to allow failure

    syzbot reported the following warning:

    DEAD callback error for CPU1WARNING: kernel/cpu.c:1463 at _cpu_down+0x759/0x1020 kernel/cpu.c:1463, CPU#0:
    syz.0.1960/14614

    at commit 4ae12d8bd9a8 (Merge tag 'kbuild-fixes-7.0-2' of     git://git.kernel.org/pub/scm/linux/kernel/git/kbuild/linux)which tglx traced to padata_cpu_dead() given     it's the onlysub-CPUHP_TEARDOWN_CPU callback that returns an error.

    Failure isn't allowed in hotplug states before CPUHP_TEARDOWN_CPUso move the CPU offline callback to the     ONLINE section where failure ispossible. (CVE-2026-53314)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6355 advisory.

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-6355-1                   security@debian.org     https://www.debian.org/security/                     Salvatore Bonaccorso     June 21, 2026                         https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : linux     CVE ID         : CVE-2025-22069 CVE-2025-68251 CVE-2025-68768 CVE-2025-71289                      CVE-2026-23247 CVE-2026-23272 CVE-2026-23346 CVE-2026-23394                      CVE-2026-23469 CVE-2026-31420 CVE-2026-31486 CVE-2026-31560                      CVE-2026-31613 CVE-2026-31663 CVE-2026-31717 CVE-2026-43116                      CVE-2026-43219 CVE-2026-43245 CVE-2026-43303 CVE-2026-43331                      CVE-2026-45838 CVE-2026-45839 CVE-2026-45840 CVE-2026-45841                      CVE-2026-45842 CVE-2026-45843 CVE-2026-45844 CVE-2026-45845                      CVE-2026-45846 CVE-2026-45850 CVE-2026-45930 CVE-2026-46117                      CVE-2026-46137 CVE-2026-46158 CVE-2026-46160 CVE-2026-46170                      CVE-2026-46203 CVE-2026-46216 CVE-2026-46244 CVE-2026-46274                      CVE-2026-46275 CVE-2026-46315 CVE-2026-46316 CVE-2026-46319                      CVE-2026-46320 CVE-2026-46321 CVE-2026-46322 CVE-2026-46323                      CVE-2026-46331 CVE-2026-52908 CVE-2026-52909 CVE-2026-52910                      CVE-2026-52911

    Several vulnerabilities have been discovered in the Linux kernel that     may lead to a privilege escalation, denial of service or information     leaks.

    For the stable distribution (trixie), these problems have been fixed in     version 6.12.94-1.

    We recommend that you upgrade your linux packages.

    For the detailed security status of linux please refer to its security     tracker page at:
    https://security-tracker.debian.org/tracker/linux

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - io-wq: check that the predecessor is hashed in io_wq_remove_pending() io_wq_remove_pending() needs to fix     up wq->hash_tail[] if the cancelled work was the tail of its hash bucket. When doing this, it checks     whether the preceding entry in acct->work_list has the same hash value, but never checks that the     predecessor is hashed at all. io_get_work_hash() is simply atomic_read(&work->flags) >> IO_WQ_HASH_SHIFT,     and the hash bits are never set for non-hashed work, so it returns 0. Thus, when a hashed bucket-0 work is     cancelled while a non-hashed work is its list predecessor, the check spuriously passes and a pointer to     the non-hashed io_kiocb is stored in wq->hash_tail[0]. Because non-hashed work is dequeued via the fast     path in io_get_next_work(), which never touches hash_tail[], the stale pointer is never cleared.
    Therefore, after the non-hashed io_kiocb completes and is freed back to req_cachep, wq->hash_tail[0] is a     dangling pointer. The io_wq is per-task (tctx->io_wq) and survives ring open/close, so the dangling     pointer persists for the lifetime of the task; the next hashed bucket-0 enqueue dereferences it in     io_wq_insert_work() and wq_list_add_after() writes through freed memory. Add the missing io_wq_is_hashed()     check so a non-hashed predecessor never inherits a hash_tail[] slot. (CVE-2026-46274)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
327728	SUSE SLES15: cluster-md-kmp-default / dlm-kmp-default / gfs2-kmp-default / etc (SUSE-SU-2026:3089-1)	Nessus	SuSE Local Security Checks	high
327300	SUSE SLES15: cluster-md-kmp-default / dlm-kmp-default / gfs2-kmp-default / etc (SUSE-SU-2026:3044-1)	Nessus	SuSE Local Security Checks	high
326000	SUSE SLED15: cluster-md-kmp-default / dlm-kmp-default / gfs2-kmp-default / etc (SUSE-SU-2026:2800-1)	Nessus	SuSE Local Security Checks	high
322107	Amazon Linux 2023 : bpftool6.12, kernel6.12, kernel6.12-devel (ALAS2023-2026-1894)	Nessus	Amazon Linux Local Security Checks	high
322088	Amazon Linux 2023 : bpftool, kernel, kernel-devel (ALAS2023-2026-1882)	Nessus	Amazon Linux Local Security Checks	high
322048	Amazon Linux 2 : kernel, --advisory ALAS2KERNEL-5.15-2026-107 (ALASKERNEL-5.15-2026-107)	Nessus	Amazon Linux Local Security Checks	high
322020	Amazon Linux 2023 : bpftool6.18, kernel6.18, kernel6.18-devel (ALAS2023-2026-1866)	Nessus	Amazon Linux Local Security Checks	high
321988	Amazon Linux 2 : kernel, --advisory ALAS2KERNEL-5.10-2026-123 (ALASKERNEL-5.10-2026-123)	Nessus	Amazon Linux Local Security Checks	high
321868	Debian dsa-6355 : ata-modules-6.12.90+deb13-armmp-di - security update	Nessus	Debian Local Security Checks	high
319691	Linux Distros Unpatched Vulnerability : CVE-2026-46274	Nessus	Misc.	high

Detections

Analytics

CVE-2026-46274

high

Tenable Plugins

high

high

high

high

high

high

high

high

high

high