In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry vgic_its_invalidate_cache() walks the per-ITS translation cache with xa_for_each() and drops the cache's reference on each entry with vgic_put_irq(). It puts the iterated pointer, though, rather than the value returned by xa_erase(). The function is called from contexts that do not exclude one another: the ITS command handlers hold its_lock, the GITS_CTLR write path holds cmd_lock, and the path that clears EnableLPIs in a redistributor's GICR_CTLR holds neither. Two or more of them can drain the same cache concurrently, and if each one observes the same entry, erases it and then puts it, the single reference the cache holds on that entry is dropped more than once. The entry can then be freed while an ITE still maps it. xa_erase() is atomic and returns the previous entry, so put only the entry that this context actually removed. The cache reference is then dropped exactly once per entry even when the invalidations run concurrently, and the behavior is unchanged when only one context runs.

The remote Ubuntu 24.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-8545-1 advisory.

    Several security issues were discovered in the Linux kernel. An attacker could possibly use these to     compromise the system. This update corrects flaws in the following subsystems:

    - ARM64 architecture;

    - Block layer subsystem;

    - Cryptographic API;

    - DMA engine subsystem;

    - InfiniBand drivers;

    - STMicroelectronics network drivers;

    - Network drivers;

    - NVME drivers;

    - SCSI subsystem;

    - USB over IP driver;

    - File systems infrastructure;

    - Ext4 file system;

    - Network file system (NFS) server daemon;

    - SMB network file system;

    - Kernel thread helper (kthread);

    - IPv6 networking;

    - Tracing infrastructure;

    - Kernel exit() syscall;

    - Scatterlist API;

    - B.A.T.M.A.N. meshing protocol;

    - Ethernet bridge;

    - Ceph Core library;

    - IPv4 networking;

    - Multipath TCP;

    - Netfilter;

    - RxRPC session sockets;

    - SMC sockets;

    - X.25 network layer; (CVE-2026-22984, CVE-2026-23272, CVE-2026-23278, CVE-2026-23392, CVE-2026-23427,     CVE-2026-23428, CVE-2026-23450, CVE-2026-23455, CVE-2026-31402, CVE-2026-31418, CVE-2026-31436,     CVE-2026-31448, CVE-2026-31478, CVE-2026-31607, CVE-2026-31635, CVE-2026-31637, CVE-2026-31649,     CVE-2026-31657, CVE-2026-31659, CVE-2026-31668, CVE-2026-31669, CVE-2026-31682, CVE-2026-31685,     CVE-2026-31718, CVE-2026-43011, CVE-2026-43037, CVE-2026-43038, CVE-2026-43071, CVE-2026-43083,     CVE-2026-43114, CVE-2026-43117, CVE-2026-43125, CVE-2026-43185, CVE-2026-43186, CVE-2026-43197,     CVE-2026-43304, CVE-2026-43341, CVE-2026-43376, CVE-2026-43378, CVE-2026-43383, CVE-2026-43384,     CVE-2026-43402, CVE-2026-43406, CVE-2026-43407, CVE-2026-43414, CVE-2026-43493, CVE-2026-43501,     CVE-2026-45898, CVE-2026-45988, CVE-2026-46039, CVE-2026-46043, CVE-2026-46115, CVE-2026-46119,     CVE-2026-46135, CVE-2026-46185, CVE-2026-46195, CVE-2026-46243, CVE-2026-46244, CVE-2026-46266,     CVE-2026-46289, CVE-2026-46316, CVE-2026-46325)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 10 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-500004 advisory.

    - xfrm: hold dev ref until after transport_finish NF_HOOK (Qi Tang)  [Orabug: 39727259]  {CVE-2026-31663}
    - KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (Hyunwoo Kim)     [Orabug: 39727258]  {CVE-2026-46316}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:39371 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al     (CVE-2025-38653)

    * kernel: ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (CVE-2025-68183)

    * kernel: crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CVE-2025-68724)

    * kernel: Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (CVE-2026-31408)

    * kernel: netfilter: nf_conntrack_helper: pass helper to expect cleanup (CVE-2026-43027)

    * kernel: eventpoll: defer struct eventpoll free to RCU grace period (CVE-2026-43074)

    * kernel: crypto: caam - fix overflow on long hmac keys (CVE-2026-43330)

    * kernel: scsi: qla2xxx: Completely fix fcport double free (CVE-2026-43414)

    * kernel: xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (CVE-2026-46116)

    * kernel: exit: prevent preemption of oopsing TASK_DEAD task (CVE-2026-46173)

    * kernel: nvmet-tcp: fix race between ICReq handling and queue teardown (CVE-2026-46135)

    * kernel: eventpoll: fix ep_remove struct eventpoll / struct file UAF (CVE-2026-46242)

    * kernel: KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry     (CVE-2026-46316)

    * kernel: KVM: x86: Fix shadow paging use-after-free due to unexpected role (CVE-2026-53359)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:38902 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (CVE-2025-68183)

    * kernel: Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (CVE-2026-31408)

    * kernel: eventpoll: defer struct eventpoll free to RCU grace period (CVE-2026-43074)

    * kernel: ALSA: usb-audio: Add sanity check for OOB writes at silencing (CVE-2026-43279)

    * kernel: gfs2: Fix use-after-free in iomap inline data write path (CVE-2026-45984)

    * kernel: wifi: mac80211: drop stray 'static' from fast-RX rx_result (CVE-2026-46152)

    * kernel: RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CVE-2026-46189)

    * kernel: nvmet-tcp: fix race between ICReq handling and queue teardown (CVE-2026-46135)

    * kernel: eventpoll: fix ep_remove struct eventpoll / struct file UAF (CVE-2026-46242)

    * kernel: KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry     (CVE-2026-46316)

    * kernel: KVM: x86: Fix shadow paging use-after-free due to unexpected role (CVE-2026-53359)

    Bug Fix(es) and Enhancement(s):

    * Possible THP Stalls on Multi-NUMA Systems for HANA on RHEL [rhel-9.6.z] (JIRA:RHEL-164774)

    * crypto: testmgr - allow authenc(hmac(sha{256,384}),cts(cbc(aes))) in FIPS mode [rhel-9.6.z]     (JIRA:RHEL-182539)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:36018 advisory.

    * kernel: fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CVE-2026-43112)

    * kernel: net: mana: Fix double destroy_workqueue on service rescan PCI path (CVE-2026-43276)

    * kernel: Linux kernel: Use-After-Free in net/gro due to improper handling of zerocopy skbs     (CVE-2026-46323)

    * kernel: xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (CVE-2026-46116)

    * kernel: sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CVE-2026-46227)

    * kernel: drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs()     (CVE-2026-46209)

    * kernel: smb/client: fix out-of-bounds read in smb2_compound_op() (CVE-2026-46155)

    * kernel: netfilter: nft_inner: Fix IPv6 inner_thoff desync (CVE-2026-46244)

    * kernel: procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CVE-2026-46259)

    * kernel: Arm Processors: Privilege escalation or information disclosure via writes to higher exception     level resources (CVE-2025-10263)

    * kernel: KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry     (CVE-2026-46316)

    Bug Fix(es) and Enhancement(s):

    * WARNING at drivers/gpu/drm/nouveau/nvkm/subdev/gsp/r535.c:1585 r535_gsp_fini+0x2fb/0x310 [nouveau]     [rhel-9.8.z] (JIRA:Rocky Linux-160966)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:36018 advisory.

    * kernel: fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CVE-2026-43112)
      * kernel: net: mana: Fix double destroy_workqueue on service rescan PCI path (CVE-2026-43276)
      * kernel: Linux kernel: Use-After-Free in net/gro due to improper handling of zerocopy skbs     (CVE-2026-46323)
      * kernel: xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (CVE-2026-46116)
      * kernel: sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CVE-2026-46227)
      * kernel: drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs()     (CVE-2026-46209)
      * kernel: smb/client: fix out-of-bounds read in smb2_compound_op() (CVE-2026-46155)
      * kernel: netfilter: nft_inner: Fix IPv6 inner_thoff desync (CVE-2026-46244)
      * kernel: procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CVE-2026-46259)
      * kernel: Arm Processors: Privilege escalation or information disclosure via writes to higher exception     level resources (CVE-2025-10263)
      * kernel: KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry     (CVE-2026-46316)


    Bug Fix(es) and Enhancement(s):

      * WARNING at drivers/gpu/drm/nouveau/nvkm/subdev/gsp/r535.c:1585 r535_gsp_fini+0x2fb/0x310 [nouveau]     [almalinux-9.8.z] (JIRA:AlmaLinux-160966)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-36018 advisory.

    - smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180041]     {CVE-2026-46155}
    - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180176]     {CVE-2026-46116}
    - net: gro: don't merge zcopy skbs (Sabrina Dubroca) [RHEL-177878] {CVE-2026-46323}
    - net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180271]     {CVE-2026-43276}
    - net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180271]     {CVE-2026-43276}
    - fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189503]     {CVE-2026-43112}
    - Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183625] {CVE-2025-10263}
    - arm64: cputype: Add NVIDIA Olympus definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
    - arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183625]     {CVE-2025-10263}
    - arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263}
    - arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183625] {CVE-2025-10263}
    - arm64: errata: Apply workarounds for Neoverse-V3AE (Mark Salter) [RHEL-183625] {CVE-2025-10263}
    - arm64: cputype: Add Neoverse-V3AE definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
    - arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
    - arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
    - arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
    - Clean up documentation mess left by previous backport (Mark Salter) [RHEL-183625] {CVE-2025-10263}
    - KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CKI Backport Bot)     [RHEL-183969] {CVE-2026-46316}
    - netfilter: nft_inner: Fix IPv6 inner_thoff desync (CKI Backport Bot) [RHEL-181929] {CVE-2026-46244}
    - procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot)     [RHEL-181907] {CVE-2026-46259}
    - drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot)     [RHEL-179909] {CVE-2026-46209}
    - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot)     [RHEL-179865] {CVE-2026-46227}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 24.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-8508-1 advisory.

    Several security issues were discovered in the Linux kernel. An attacker could possibly use these to     compromise the system. This update corrects flaws in the following subsystems:

    - ARM64 architecture;

    - S390 architecture;

    - Block layer subsystem;

    - Cryptographic API;

    - DMA engine subsystem;

    - GPU drivers;

    - InfiniBand drivers;

    - Ethernet bonding driver;

    - STMicroelectronics network drivers;

    - Network drivers;

    - NVME drivers;

    - SCSI subsystem;

    - USB over IP driver;

    - File systems infrastructure;

    - Ext4 file system;

    - Network file system (NFS) server daemon;

    - SMB network file system;

    - Kernel thread helper (kthread);

    - Distributed Switch Architecture;

    - IPv6 networking;

    - Netfilter;

    - Tracing infrastructure;

    - Control group (cgroup);

    - Kernel exit() syscall;

    - Scatterlist API;

    - Memory management;

    - B.A.T.M.A.N. meshing protocol;

    - Ethernet bridge;

    - Ceph Core library;

    - IPv4 networking;

    - MAC80211 subsystem;

    - Multipath TCP;

    - Packet sockets;

    - RxRPC session sockets;

    - SMC sockets;

    - TLS protocol;

    - Unix domain sockets;

    - X.25 network layer;

    - AppArmor security module; (CVE-2025-71088, CVE-2025-71090, CVE-2025-71127, CVE-2025-71134,     CVE-2025-71141, CVE-2025-71142, CVE-2025-71144, CVE-2025-71152, CVE-2025-71155, CVE-2026-22984,     CVE-2026-23112, CVE-2026-23231, CVE-2026-23272, CVE-2026-23273, CVE-2026-23274, CVE-2026-23278,     CVE-2026-23351, CVE-2026-23392, CVE-2026-23394, CVE-2026-23427, CVE-2026-23428, CVE-2026-23450,     CVE-2026-23455, CVE-2026-31402, CVE-2026-31418, CVE-2026-31419, CVE-2026-31436, CVE-2026-31448,     CVE-2026-31478, CVE-2026-31504, CVE-2026-31533, CVE-2026-31607, CVE-2026-31635, CVE-2026-31637,     CVE-2026-31649, CVE-2026-31657, CVE-2026-31659, CVE-2026-31668, CVE-2026-31669, CVE-2026-31682,     CVE-2026-31685, CVE-2026-31718, CVE-2026-43011, CVE-2026-43033, CVE-2026-43037, CVE-2026-43038,     CVE-2026-43071, CVE-2026-43077, CVE-2026-43078, CVE-2026-43083, CVE-2026-43114, CVE-2026-43117,     CVE-2026-43125, CVE-2026-43186, CVE-2026-43197, CVE-2026-43304, CVE-2026-43341, CVE-2026-43376,     CVE-2026-43378, CVE-2026-43383, CVE-2026-43384, CVE-2026-43402, CVE-2026-43406, CVE-2026-43407,     CVE-2026-43414, CVE-2026-43493, CVE-2026-43501, CVE-2026-45898, CVE-2026-45966, CVE-2026-45988,     CVE-2026-46028, CVE-2026-46039, CVE-2026-46043, CVE-2026-46115, CVE-2026-46119, CVE-2026-46135,     CVE-2026-46185, CVE-2026-46195, CVE-2026-46243, CVE-2026-46244, CVE-2026-46266, CVE-2026-46289,     CVE-2026-46316, CVE-2026-46325)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 26.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-8507-1 advisory.

    It was discovered that some AMD processors did not properly clear data in the floating point divider unit     during speculative execution. A local attacker could use this to expose sensitive information.
    (CVE-2025-54505)

    Several security issues were discovered in the Linux kernel. An attacker could possibly use these to     compromise the system. This update corrects flaws in the following subsystems:

    - ARM64 architecture;

    - x86 architecture;

    - Block layer subsystem;

    - Cryptographic API;

    - Rados block device (RBD) driver;

    - Compressed RAM block device driver;

    - Character device driver;

    - TPM device driver;

    - Hardware crypto device drivers;

    - EDAC drivers;

    - GPU drivers;

    - Greybus drivers;

    - HID subsystem;

    - Microsoft Hyper-V drivers;

    - Hardware monitoring drivers;

    - I2C subsystem;

    - IIO subsystem;

    - InfiniBand drivers;

    - Input Device core drivers;

    - LED subsystem;

    - Multiple devices driver;

    - Media drivers;

    - IBM Advanced System Management driver;

    - MTD block device drivers;

    - Network drivers;

    - Microsoft Azure Network Adapter (MANA) driver;

    - NTB driver;

    - NVME drivers;

    - Device tree and open firmware driver;

    - PCI subsystem;

    - Remote Processor subsystem;

    - SCSI subsystem;

    - SPI subsystem;

    - Realtek RTL8723BS SDIO drivers;

    - SM750 framebuffer staging driver;

    - Thermal drivers;

    - USB Gadget drivers;

    - USB over IP driver;

    - VFIO drivers;

    - Framebuffer layer;

    - 9P distributed file system;

    - AFS file system;

    - Ceph distributed file system;

    - File systems infrastructure;

    - EROFS file system;

    - Ext4 file system;

    - F2FS file system;

    - FUSE (File system in Userspace);

    - Journaling layer for block devices (JBD2);

    - NILFS2 file system;

    - File system notification infrastructure;

    - NTFS3 file system;

    - OCFS2 file system;

    - SMB network file system;

    - UDF file system;

    - XFS file system;

    - Codetag library;

    - Memory management;

    - Memory Management;

    - KVM subsystem;

    - Tracing infrastructure;

    - User-space API (UAPI);

    - io_uring subsystem;

    - Locking primitives;

    - Timer subsystem;

    - Scatterlist API;

    - Heterogeneous memory management;

    - KASAN memory debugging framework;

    - Bluetooth subsystem;

    - Ethernet bridge;

    - CAIF protocol;

    - CAN network layer;

    - Ceph Core library;

    - IPv4 networking;

    - IPv6 networking;

    - Multipath TCP;

    - Netfilter;

    - NFC subsystem;

    - Packet sockets;

    - Qualcomm IPC Router (QRTR);

    - RDS protocol;

    - RxRPC session sockets;

    - SMC sockets;

    - Stream parser;

    - Landlock security;

    - SELinux security module;

    - ALSA framework;

    - Generic PCM loopback sound driver;

    - FireWire sound drivers;

    - Creative Sound Blaster X-Fi driver;

    - QCOM ASoC drivers;

    - USB sound devices;

    - Objtool; (CVE-2026-31532, CVE-2026-31574, CVE-2026-31575, CVE-2026-31576, CVE-2026-31577,     CVE-2026-31578, CVE-2026-31579, CVE-2026-31580, CVE-2026-31581, CVE-2026-31582, CVE-2026-31583,     CVE-2026-31584, CVE-2026-31585, CVE-2026-31586, CVE-2026-31587, CVE-2026-31588, CVE-2026-31589,     CVE-2026-31590, CVE-2026-31591, CVE-2026-31592, CVE-2026-31593, CVE-2026-31594, CVE-2026-31595,     CVE-2026-31596, CVE-2026-31597, CVE-2026-31598, CVE-2026-31599, CVE-2026-31600, CVE-2026-31601,     CVE-2026-31602, CVE-2026-31603, CVE-2026-31604, CVE-2026-31605, CVE-2026-31606, CVE-2026-31607,     CVE-2026-31608, CVE-2026-31609, CVE-2026-31610, CVE-2026-31611, CVE-2026-31612, CVE-2026-31613,     CVE-2026-31614, CVE-2026-31615, CVE-2026-31616, CVE-2026-31617, CVE-2026-31618, CVE-2026-31619,     CVE-2026-31620, CVE-2026-31621, CVE-2026-31622, CVE-2026-31623, CVE-2026-31624, CVE-2026-31625,     CVE-2026-31626, CVE-2026-31627, CVE-2026-31628, CVE-2026-31629, CVE-2026-31686, CVE-2026-31694,     CVE-2026-31696, CVE-2026-31697, CVE-2026-31698, CVE-2026-31699, CVE-2026-31700, CVE-2026-31701,     CVE-2026-31702, CVE-2026-31703, CVE-2026-31704, CVE-2026-31705, CVE-2026-31706, CVE-2026-31707,     CVE-2026-31708, CVE-2026-31709, CVE-2026-31710, CVE-2026-31711, CVE-2026-31712, CVE-2026-31713,     CVE-2026-31714, CVE-2026-31715, CVE-2026-31716, CVE-2026-31717, CVE-2026-31718, CVE-2026-31719,     CVE-2026-43058, CVE-2026-43071, CVE-2026-43072, CVE-2026-43073, CVE-2026-43348, CVE-2026-43349,     CVE-2026-43350, CVE-2026-43491, CVE-2026-43493, CVE-2026-43499, CVE-2026-43501, CVE-2026-45986,     CVE-2026-45987, CVE-2026-45988, CVE-2026-45989, CVE-2026-45990, CVE-2026-45991, CVE-2026-45994,     CVE-2026-45995, CVE-2026-45996, CVE-2026-45997, CVE-2026-45999, CVE-2026-46001, CVE-2026-46002,     CVE-2026-46003, CVE-2026-46004, CVE-2026-46005, CVE-2026-46006, CVE-2026-46007, CVE-2026-46008,     CVE-2026-46009, CVE-2026-46010, CVE-2026-46011, CVE-2026-46012, CVE-2026-46013, CVE-2026-46014,     CVE-2026-46015, CVE-2026-46016, CVE-2026-46018, CVE-2026-46019, CVE-2026-46020, CVE-2026-46021,     CVE-2026-46022, CVE-2026-46023, CVE-2026-46024, CVE-2026-46025, CVE-2026-46026, CVE-2026-46027,     CVE-2026-46028, CVE-2026-46029, CVE-2026-46030, CVE-2026-46031, CVE-2026-46032, CVE-2026-46033,     CVE-2026-46034, CVE-2026-46035, CVE-2026-46036, CVE-2026-46037, CVE-2026-46038, CVE-2026-46039,     CVE-2026-46040, CVE-2026-46041, CVE-2026-46042, CVE-2026-46043, CVE-2026-46044, CVE-2026-46045,     CVE-2026-46046, CVE-2026-46047, CVE-2026-46049, CVE-2026-46050, CVE-2026-46051, CVE-2026-46052,     CVE-2026-46053, CVE-2026-46054, CVE-2026-46056, CVE-2026-46057, CVE-2026-46058, CVE-2026-46059,     CVE-2026-46060, CVE-2026-46061, CVE-2026-46062, CVE-2026-46063, CVE-2026-46064, CVE-2026-46065,     CVE-2026-46066, CVE-2026-46067, CVE-2026-46068, CVE-2026-46069, CVE-2026-46070, CVE-2026-46071,     CVE-2026-46072, CVE-2026-46073, CVE-2026-46074, CVE-2026-46075, CVE-2026-46076, CVE-2026-46077,     CVE-2026-46078, CVE-2026-46079, CVE-2026-46080, CVE-2026-46081, CVE-2026-46082, CVE-2026-46083,     CVE-2026-46084, CVE-2026-46085, CVE-2026-46086, CVE-2026-46087, CVE-2026-46088, CVE-2026-46089,     CVE-2026-46090, CVE-2026-46091, CVE-2026-46092, CVE-2026-46093, CVE-2026-46094, CVE-2026-46095,     CVE-2026-46096, CVE-2026-46097, CVE-2026-46098, CVE-2026-46099, CVE-2026-46100, CVE-2026-46101,     CVE-2026-46102, CVE-2026-46103, CVE-2026-46115, CVE-2026-46119, CVE-2026-46135, CVE-2026-46137,     CVE-2026-46155, CVE-2026-46185, CVE-2026-46195, CVE-2026-46243, CVE-2026-46244, CVE-2026-46276,     CVE-2026-46277, CVE-2026-46278, CVE-2026-46279, CVE-2026-46280, CVE-2026-46281, CVE-2026-46282,     CVE-2026-46283, CVE-2026-46284, CVE-2026-46285, CVE-2026-46286, CVE-2026-46287, CVE-2026-46288,     CVE-2026-46289, CVE-2026-46316, CVE-2026-46332, CVE-2026-52904, CVE-2026-52905, CVE-2026-52906,     CVE-2026-52907, CVE-2026-52933)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:36018 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CVE-2026-43112)

    * kernel: net: mana: Fix double destroy_workqueue on service rescan PCI path (CVE-2026-43276)

    * kernel: Linux kernel: Use-After-Free in net/gro due to improper handling of zerocopy skbs     (CVE-2026-46323)

    * kernel: xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (CVE-2026-46116)

    * kernel: sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CVE-2026-46227)

    * kernel: drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs()     (CVE-2026-46209)

    * kernel: smb/client: fix out-of-bounds read in smb2_compound_op() (CVE-2026-46155)

    * kernel: netfilter: nft_inner: Fix IPv6 inner_thoff desync (CVE-2026-46244)

    * kernel: procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CVE-2026-46259)

    * kernel: Arm Processors: Privilege escalation or information disclosure via writes to higher exception     level resources (CVE-2025-10263)

    * kernel: KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry     (CVE-2026-46316)

    Bug Fix(es) and Enhancement(s):

    * WARNING at drivers/gpu/drm/nouveau/nvkm/subdev/gsp/r535.c:1585 r535_gsp_fini+0x2fb/0x310 [nouveau]     [rhel-9.8.z] (JIRA:RHEL-160966)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:34911 advisory.

    * kernel: fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CVE-2026-43112)
      * kernel: rxrpc: Fix potential UAF after skb_unshare() failure (CVE-2026-45998)
      * kernel: drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs()     (CVE-2026-46209)
      * kernel: netfilter: nft_inner: Fix IPv6 inner_thoff desync (CVE-2026-46244)
      * kernel: Arm Processors: Privilege escalation or information disclosure via writes to higher exception     level resources (CVE-2025-10263)
      * kernel: KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry     (CVE-2026-46316)
      * kernel: kernel: ipv6 frag escape ()


    Bug Fix(es) and Enhancement(s):

      * crypto: testmgr - allow authenc(hmac(sha{256,384}),cts(cbc(aes))) in FIPS mode [almalinux-10.2.z]     (JIRA:AlmaLinux-182537)
      * [ThinkPad Avon/Mario +AlmaLinux 10.2]The OS hang up with CapsLock fliker (JIRA:AlmaLinux-185110)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 26.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-8488-1 advisory.

    It was discovered that some AMD processors did not properly clear data in the floating point divider unit     during speculative execution. A local attacker could use this to expose sensitive information.
    (CVE-2025-54505)

    Several security issues were discovered in the Linux kernel. An attacker could possibly use these to     compromise the system. This update corrects flaws in the following subsystems:

    - ARM64 architecture;

    - x86 architecture;

    - Block layer subsystem;

    - Cryptographic API;

    - Rados block device (RBD) driver;

    - Compressed RAM block device driver;

    - Character device driver;

    - TPM device driver;

    - Hardware crypto device drivers;

    - EDAC drivers;

    - GPU drivers;

    - Greybus drivers;

    - HID subsystem;

    - Microsoft Hyper-V drivers;

    - Hardware monitoring drivers;

    - I2C subsystem;

    - IIO subsystem;

    - InfiniBand drivers;

    - Input Device core drivers;

    - LED subsystem;

    - Multiple devices driver;

    - Media drivers;

    - IBM Advanced System Management driver;

    - MTD block device drivers;

    - Network drivers;

    - Microsoft Azure Network Adapter (MANA) driver;

    - NTB driver;

    - NVME drivers;

    - Device tree and open firmware driver;

    - PCI subsystem;

    - Remote Processor subsystem;

    - SCSI subsystem;

    - SPI subsystem;

    - Realtek RTL8723BS SDIO drivers;

    - SM750 framebuffer staging driver;

    - Thermal drivers;

    - USB Gadget drivers;

    - USB over IP driver;

    - VFIO drivers;

    - Framebuffer layer;

    - 9P distributed file system;

    - AFS file system;

    - Ceph distributed file system;

    - File systems infrastructure;

    - EROFS file system;

    - Ext4 file system;

    - F2FS file system;

    - FUSE (File system in Userspace);

    - Journaling layer for block devices (JBD2);

    - NILFS2 file system;

    - File system notification infrastructure;

    - NTFS3 file system;

    - OCFS2 file system;

    - SMB network file system;

    - UDF file system;

    - XFS file system;

    - Codetag library;

    - Memory management;

    - Memory Management;

    - KVM subsystem;

    - Tracing infrastructure;

    - User-space API (UAPI);

    - io_uring subsystem;

    - Locking primitives;

    - Timer subsystem;

    - Scatterlist API;

    - Heterogeneous memory management;

    - KASAN memory debugging framework;

    - Bluetooth subsystem;

    - Ethernet bridge;

    - CAIF protocol;

    - CAN network layer;

    - Ceph Core library;

    - IPv4 networking;

    - IPv6 networking;

    - Multipath TCP;

    - Netfilter;

    - NFC subsystem;

    - Packet sockets;

    - Qualcomm IPC Router (QRTR);

    - RDS protocol;

    - RxRPC session sockets;

    - SMC sockets;

    - Stream parser;

    - Landlock security;

    - SELinux security module;

    - ALSA framework;

    - Generic PCM loopback sound driver;

    - FireWire sound drivers;

    - Creative Sound Blaster X-Fi driver;

    - QCOM ASoC drivers;

    - USB sound devices;

    - Objtool; (CVE-2026-31532, CVE-2026-31574, CVE-2026-31575, CVE-2026-31576, CVE-2026-31577,     CVE-2026-31578, CVE-2026-31579, CVE-2026-31580, CVE-2026-31581, CVE-2026-31582, CVE-2026-31583,     CVE-2026-31584, CVE-2026-31585, CVE-2026-31586, CVE-2026-31587, CVE-2026-31588, CVE-2026-31589,     CVE-2026-31590, CVE-2026-31591, CVE-2026-31592, CVE-2026-31593, CVE-2026-31594, CVE-2026-31595,     CVE-2026-31596, CVE-2026-31597, CVE-2026-31598, CVE-2026-31599, CVE-2026-31600, CVE-2026-31601,     CVE-2026-31602, CVE-2026-31603, CVE-2026-31604, CVE-2026-31605, CVE-2026-31606, CVE-2026-31607,     CVE-2026-31608, CVE-2026-31609, CVE-2026-31610, CVE-2026-31611, CVE-2026-31612, CVE-2026-31613,     CVE-2026-31614, CVE-2026-31615, CVE-2026-31616, CVE-2026-31617, CVE-2026-31618, CVE-2026-31619,     CVE-2026-31620, CVE-2026-31621, CVE-2026-31622, CVE-2026-31623, CVE-2026-31624, CVE-2026-31625,     CVE-2026-31626, CVE-2026-31627, CVE-2026-31628, CVE-2026-31629, CVE-2026-31686, CVE-2026-31694,     CVE-2026-31696, CVE-2026-31697, CVE-2026-31698, CVE-2026-31699, CVE-2026-31700, CVE-2026-31701,     CVE-2026-31702, CVE-2026-31703, CVE-2026-31704, CVE-2026-31705, CVE-2026-31706, CVE-2026-31707,     CVE-2026-31708, CVE-2026-31709, CVE-2026-31710, CVE-2026-31711, CVE-2026-31712, CVE-2026-31713,     CVE-2026-31714, CVE-2026-31715, CVE-2026-31716, CVE-2026-31717, CVE-2026-31718, CVE-2026-31719,     CVE-2026-43058, CVE-2026-43071, CVE-2026-43072, CVE-2026-43073, CVE-2026-43348, CVE-2026-43349,     CVE-2026-43350, CVE-2026-43491, CVE-2026-43493, CVE-2026-43499, CVE-2026-43501, CVE-2026-45986,     CVE-2026-45987, CVE-2026-45988, CVE-2026-45989, CVE-2026-45990, CVE-2026-45991, CVE-2026-45994,     CVE-2026-45995, CVE-2026-45996, CVE-2026-45997, CVE-2026-45999, CVE-2026-46001, CVE-2026-46002,     CVE-2026-46003, CVE-2026-46004, CVE-2026-46005, CVE-2026-46006, CVE-2026-46007, CVE-2026-46008,     CVE-2026-46009, CVE-2026-46010, CVE-2026-46011, CVE-2026-46012, CVE-2026-46013, CVE-2026-46014,     CVE-2026-46015, CVE-2026-46016, CVE-2026-46018, CVE-2026-46019, CVE-2026-46020, CVE-2026-46021,     CVE-2026-46022, CVE-2026-46023, CVE-2026-46024, CVE-2026-46025, CVE-2026-46026, CVE-2026-46027,     CVE-2026-46028, CVE-2026-46029, CVE-2026-46030, CVE-2026-46031, CVE-2026-46032, CVE-2026-46033,     CVE-2026-46034, CVE-2026-46035, CVE-2026-46036, CVE-2026-46037, CVE-2026-46038, CVE-2026-46039,     CVE-2026-46040, CVE-2026-46041, CVE-2026-46042, CVE-2026-46043, CVE-2026-46044, CVE-2026-46045,     CVE-2026-46046, CVE-2026-46047, CVE-2026-46049, CVE-2026-46050, CVE-2026-46051, CVE-2026-46052,     CVE-2026-46053, CVE-2026-46054, CVE-2026-46056, CVE-2026-46057, CVE-2026-46058, CVE-2026-46059,     CVE-2026-46060, CVE-2026-46061, CVE-2026-46062, CVE-2026-46063, CVE-2026-46064, CVE-2026-46065,     CVE-2026-46066, CVE-2026-46067, CVE-2026-46068, CVE-2026-46069, CVE-2026-46070, CVE-2026-46071,     CVE-2026-46072, CVE-2026-46073, CVE-2026-46074, CVE-2026-46075, CVE-2026-46076, CVE-2026-46077,     CVE-2026-46078, CVE-2026-46079, CVE-2026-46080, CVE-2026-46081, CVE-2026-46082, CVE-2026-46083,     CVE-2026-46084, CVE-2026-46085, CVE-2026-46086, CVE-2026-46087, CVE-2026-46088, CVE-2026-46089,     CVE-2026-46090, CVE-2026-46091, CVE-2026-46092, CVE-2026-46093, CVE-2026-46094, CVE-2026-46095,     CVE-2026-46096, CVE-2026-46097, CVE-2026-46098, CVE-2026-46099, CVE-2026-46100, CVE-2026-46101,     CVE-2026-46102, CVE-2026-46103, CVE-2026-46115, CVE-2026-46119, CVE-2026-46135, CVE-2026-46137,     CVE-2026-46155, CVE-2026-46185, CVE-2026-46195, CVE-2026-46243, CVE-2026-46244, CVE-2026-46276,     CVE-2026-46277, CVE-2026-46278, CVE-2026-46279, CVE-2026-46280, CVE-2026-46281, CVE-2026-46282,     CVE-2026-46283, CVE-2026-46284, CVE-2026-46285, CVE-2026-46286, CVE-2026-46287, CVE-2026-46288,     CVE-2026-46289, CVE-2026-46316, CVE-2026-46332, CVE-2026-52904, CVE-2026-52905, CVE-2026-52906,     CVE-2026-52907, CVE-2026-52933)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 26.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-8489-1 advisory.

    It was discovered that the Linux kernel did not properly handle shared page fragments during socket buffer     operations, collectively known as Dirty Frag. A logic flaw existed in the XFRM ESP-in-TCP subsystem and in     the RxRPC networking subsystem when processing paged fragments. A local attacker could use this to     escalate privileges, or possibly escape a container. (CVE-2026-43284, CVE-2026-43500, CVE-2026-45998,     CVE-2026-46000)

    It was discovered that a logic flaw existed in the XFRM ESP-in-TCP subsystem in the Linux kernel when     handling socket buffer fragments. This flaw is known as Fragnesia. A local attacker could use this to     escalate privileges, or possibly escape a container. (CVE-2026-43503, CVE-2026-46300)

    Qualys discovered that a race condition existed in the ptrace subsystem of the Linux kernel when     privileged processes are exiting. An unprivileged local attacker could use this issue to expose sensitive     information. (CVE-2026-46333)

    Tristan Madani discovered that Ubuntu Linux kernel 6.8, 6.17 and 7.0 contain a memory leak when handling     AppArmor notifications. A local attacker could use this to cause resource exhaustion. (CVE-2026-47326)

    Tristan Madani discovered that Ubuntu Linux kernel 6.8, 6.17 and 7.0 contain a NULL pointer dereference     when handling AppArmor notifications. A local attacker could use this to cause a kernel oops.
    (CVE-2026-47327)

    Tristan Madani discovered that Ubuntu Linux kernel 6.8, 6.17 and 7.0 contained an invalid free when     handling AppArmor notifications. A local attacker could use this to corrupt kernel memory.
    (CVE-2026-47328)

    Tristan Madani discovered that Ubuntu Linux kernel 6.8, 6.17 and 7.0 contained insufficient validation of     AppArmor notification responses. A local attacker could use this to allow crafted responses to be     processed. (CVE-2026-47329)

    Tristan Madani discovered that Ubuntu Linux kernel 6.8, 6.17 and 7.0 used an uninitialized variable when     handling AppArmor notifications. A local attacker could use this to cause incorrect caching of data.
    (CVE-2026-47330)

    Tristan Madani discovered that Ubuntu Linux kernel 6.8, 6.17 and 7.0 contained an out-of-bounds (OOB) read     when handling AppArmor notifications. A local attacker could use this to cause information disclosure of     kernel memory. (CVE-2026-47332)

    Tristan Madani discovered that Ubuntu Linux kernel 6.8, 6.17 and 7.0 contained a out-of-bounds (OOB) read     when handling AppArmor notifications. A local attacker could use this to cause kernel memory corruption     and, theoretically, influence processing of AppArmor policies. (CVE-2026-47333)

    Tristan Madani discovered that Ubuntu Linux kernel 6.8, 6.17 and 7.0 contained incorrect holding of locks     when handling AppArmor notifications. A local attacker could use this to cause a kernel panic or deadlock.
    (CVE-2026-47334)

    Tristan Madani and Trevor Lawrence have each independently discovered that Ubuntu Linux kernel 6.8, 6.17     and 7.0 contained a NULL pointer dereference when handling AppArmor network socket mediation. A local     attacker could use this to cause a kernel oops. (CVE-2026-47337)

    Several security issues were discovered in the Linux kernel. An attacker could possibly use these to     compromise the system. This update corrects flaws in the following subsystems:

    - ARM64 architecture;

    - x86 architecture;

    - Block layer subsystem;

    - Cryptographic API;

    - Rados block device (RBD) driver;

    - Compressed RAM block device driver;

    - Character device driver;

    - TPM device driver;

    - Hardware crypto device drivers;

    - EDAC drivers;

    - GPU drivers;

    - Greybus drivers;

    - Hardware monitoring drivers;

    - IIO subsystem;

    - InfiniBand drivers;

    - Input Device core drivers;

    - LED subsystem;

    - Multiple devices driver;

    - Media drivers;

    - IBM Advanced System Management driver;

    - MTD block device drivers;

    - Network drivers;

    - Microsoft Azure Network Adapter (MANA) driver;

    - NVME drivers;

    - Device tree and open firmware driver;

    - PCI subsystem;

    - Remote Processor subsystem;

    - SCSI subsystem;

    - SPI subsystem;

    - Thermal drivers;

    - VFIO drivers;

    - Framebuffer layer;

    - 9P distributed file system;

    - AFS file system;

    - Ceph distributed file system;

    - EROFS file system;

    - File systems infrastructure;

    - Ext4 file system;

    - Journaling layer for block devices (JBD2);

    - File system notification infrastructure;

    - NTFS3 file system;

    - OCFS2 file system;

    - Overlay file system;

    - SMB network file system;

    - UDF file system;

    - XFS file system;

    - Codetag library;

    - Memory management;

    - Tracing infrastructure;

    - io_uring subsystem;

    - Locking primitives;

    - Scatterlist API;

    - Heterogeneous memory management;

    - Bluetooth subsystem;

    - Ethernet bridge;

    - CAIF protocol;

    - Ceph Core library;

    - Networking core;

    - IPv4 networking;

    - IPv6 networking;

    - Multipath TCP;

    - Netfilter;

    - Qualcomm IPC Router (QRTR);

    - RDS protocol;

    - RxRPC session sockets;

    - SMC sockets;

    - Stream parser;

    - Landlock security;

    - SELinux security module;

    - ALSA framework;

    - Generic PCM loopback sound driver;

    - Creative Sound Blaster X-Fi driver;

    - USB sound devices; (CVE-2026-43491, CVE-2026-43493, CVE-2026-43494, CVE-2026-43499, CVE-2026-43501,     CVE-2026-45986, CVE-2026-45987, CVE-2026-45988, CVE-2026-45989, CVE-2026-45990, CVE-2026-45991,     CVE-2026-45994, CVE-2026-45995, CVE-2026-45996, CVE-2026-45997, CVE-2026-45999, CVE-2026-46001,     CVE-2026-46002, CVE-2026-46003, CVE-2026-46004, CVE-2026-46005, CVE-2026-46006, CVE-2026-46007,     CVE-2026-46008, CVE-2026-46009, CVE-2026-46010, CVE-2026-46011, CVE-2026-46012, CVE-2026-46013,     CVE-2026-46014, CVE-2026-46015, CVE-2026-46016, CVE-2026-46018, CVE-2026-46019, CVE-2026-46020,     CVE-2026-46021, CVE-2026-46022, CVE-2026-46023, CVE-2026-46024, CVE-2026-46025, CVE-2026-46026,     CVE-2026-46027, CVE-2026-46028, CVE-2026-46029, CVE-2026-46030, CVE-2026-46031, CVE-2026-46032,     CVE-2026-46033, CVE-2026-46034, CVE-2026-46035, CVE-2026-46036, CVE-2026-46037, CVE-2026-46038,     CVE-2026-46039, CVE-2026-46040, CVE-2026-46041, CVE-2026-46042, CVE-2026-46043, CVE-2026-46044,     CVE-2026-46045, CVE-2026-46046, CVE-2026-46047, CVE-2026-46048, CVE-2026-46049, CVE-2026-46050,     CVE-2026-46051, CVE-2026-46052, CVE-2026-46053, CVE-2026-46054, CVE-2026-46056, CVE-2026-46057,     CVE-2026-46058, CVE-2026-46059, CVE-2026-46060, CVE-2026-46061, CVE-2026-46062, CVE-2026-46063,     CVE-2026-46064, CVE-2026-46065, CVE-2026-46066, CVE-2026-46067, CVE-2026-46068, CVE-2026-46069,     CVE-2026-46070, CVE-2026-46071, CVE-2026-46072, CVE-2026-46073, CVE-2026-46074, CVE-2026-46075,     CVE-2026-46076, CVE-2026-46077, CVE-2026-46078, CVE-2026-46079, CVE-2026-46080, CVE-2026-46081,     CVE-2026-46082, CVE-2026-46083, CVE-2026-46084, CVE-2026-46085, CVE-2026-46086, CVE-2026-46087,     CVE-2026-46088, CVE-2026-46089, CVE-2026-46090, CVE-2026-46091, CVE-2026-46092, CVE-2026-46093,     CVE-2026-46094, CVE-2026-46095, CVE-2026-46096, CVE-2026-46097, CVE-2026-46098, CVE-2026-46099,     CVE-2026-46100, CVE-2026-46101, CVE-2026-46102, CVE-2026-46103, CVE-2026-46115, CVE-2026-46119,     CVE-2026-46135, CVE-2026-46137, CVE-2026-46155, CVE-2026-46185, CVE-2026-46195, CVE-2026-46243,     CVE-2026-46244, CVE-2026-46276, CVE-2026-46277, CVE-2026-46278, CVE-2026-46279, CVE-2026-46280,     CVE-2026-46281, CVE-2026-46282, CVE-2026-46283, CVE-2026-46284, CVE-2026-46285, CVE-2026-46286,     CVE-2026-46287, CVE-2026-46288, CVE-2026-46289, CVE-2026-46316, CVE-2026-46323, CVE-2026-46332,     CVE-2026-52904, CVE-2026-52905, CVE-2026-52906, CVE-2026-52907, CVE-2026-52933, CVE-2026-53174)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 24.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-8491-1 advisory.

    Several security issues were discovered in the Linux kernel. An attacker could possibly use these to     compromise the system. This update corrects flaws in the following subsystems:

    - ARM64 architecture;

    - x86 architecture;

    - Block layer subsystem;

    - Cryptographic API;

    - DMA engine subsystem;

    - InfiniBand drivers;

    - STMicroelectronics network drivers;

    - Network drivers;

    - NVME drivers;

    - SCSI subsystem;

    - USB over IP driver;

    - File systems infrastructure;

    - Ext4 file system;

    - Network file system (NFS) server daemon;

    - SMB network file system;

    - Kernel thread helper (kthread);

    - IPv6 networking;

    - Tracing infrastructure;

    - Kernel exit() syscall;

    - Scatterlist API;

    - B.A.T.M.A.N. meshing protocol;

    - Ethernet bridge;

    - Ceph Core library;

    - IPv4 networking;

    - Multipath TCP;

    - Netfilter;

    - RxRPC session sockets;

    - SMC sockets;

    - X.25 network layer; (CVE-2026-22984, CVE-2026-23272, CVE-2026-23278, CVE-2026-23392, CVE-2026-23427,     CVE-2026-23428, CVE-2026-23450, CVE-2026-23455, CVE-2026-31402, CVE-2026-31418, CVE-2026-31436,     CVE-2026-31448, CVE-2026-31478, CVE-2026-31607, CVE-2026-31635, CVE-2026-31637, CVE-2026-31649,     CVE-2026-31657, CVE-2026-31659, CVE-2026-31668, CVE-2026-31669, CVE-2026-31682, CVE-2026-31685,     CVE-2026-31718, CVE-2026-43011, CVE-2026-43037, CVE-2026-43038, CVE-2026-43071, CVE-2026-43083,     CVE-2026-43114, CVE-2026-43117, CVE-2026-43125, CVE-2026-43186, CVE-2026-43197, CVE-2026-43304,     CVE-2026-43341, CVE-2026-43376, CVE-2026-43378, CVE-2026-43383, CVE-2026-43384, CVE-2026-43402,     CVE-2026-43406, CVE-2026-43407, CVE-2026-43414, CVE-2026-43493, CVE-2026-43501, CVE-2026-45898,     CVE-2026-45988, CVE-2026-46039, CVE-2026-46043, CVE-2026-46115, CVE-2026-46119, CVE-2026-46135,     CVE-2026-46185, CVE-2026-46195, CVE-2026-46243, CVE-2026-46244, CVE-2026-46266, CVE-2026-46289,     CVE-2026-46290, CVE-2026-46316, CVE-2026-46325)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 24.04 LTS / 25.10 host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-8490-1 advisory.

    Several security issues were discovered in the Linux kernel. An attacker could possibly use these to     compromise the system. This update corrects flaws in the following subsystems:

    - ARM64 architecture;

    - Block layer subsystem;

    - Cryptographic API;

    - DMA engine subsystem;

    - InfiniBand drivers;

    - STMicroelectronics network drivers;

    - Network drivers;

    - NVME drivers;

    - SCSI subsystem;

    - USB over IP driver;

    - File systems infrastructure;

    - Ext4 file system;

    - Network file system (NFS) server daemon;

    - SMB network file system;

    - Kernel thread helper (kthread);

    - IPv6 networking;

    - Tracing infrastructure;

    - Kernel exit() syscall;

    - Scatterlist API;

    - B.A.T.M.A.N. meshing protocol;

    - Ethernet bridge;

    - Ceph Core library;

    - IPv4 networking;

    - Multipath TCP;

    - Netfilter;

    - RxRPC session sockets;

    - SMC sockets;

    - X.25 network layer; (CVE-2026-22984, CVE-2026-23272, CVE-2026-23278, CVE-2026-23392, CVE-2026-23427,     CVE-2026-23428, CVE-2026-23450, CVE-2026-23455, CVE-2026-31402, CVE-2026-31418, CVE-2026-31436,     CVE-2026-31448, CVE-2026-31478, CVE-2026-31607, CVE-2026-31635, CVE-2026-31637, CVE-2026-31649,     CVE-2026-31657, CVE-2026-31659, CVE-2026-31668, CVE-2026-31669, CVE-2026-31682, CVE-2026-31685,     CVE-2026-31718, CVE-2026-43011, CVE-2026-43037, CVE-2026-43038, CVE-2026-43071, CVE-2026-43083,     CVE-2026-43114, CVE-2026-43117, CVE-2026-43125, CVE-2026-43186, CVE-2026-43197, CVE-2026-43304,     CVE-2026-43341, CVE-2026-43376, CVE-2026-43378, CVE-2026-43383, CVE-2026-43384, CVE-2026-43402,     CVE-2026-43406, CVE-2026-43407, CVE-2026-43414, CVE-2026-43493, CVE-2026-43501, CVE-2026-45898,     CVE-2026-45988, CVE-2026-46039, CVE-2026-46043, CVE-2026-46115, CVE-2026-46119, CVE-2026-46135,     CVE-2026-46185, CVE-2026-46195, CVE-2026-46243, CVE-2026-46244, CVE-2026-46266, CVE-2026-46289,     CVE-2026-46316, CVE-2026-46325)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:34911 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CVE-2026-43112)

    * kernel: rxrpc: Fix potential UAF after skb_unshare() failure (CVE-2026-45998)

    * kernel: drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs()     (CVE-2026-46209)

    * kernel: netfilter: nft_inner: Fix IPv6 inner_thoff desync (CVE-2026-46244)

    * kernel: Arm Processors: Privilege escalation or information disclosure via writes to higher exception     level resources (CVE-2025-10263)

    * kernel: KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry     (CVE-2026-46316)

    * kernel: kernel: ipv6 frag escape ()

    Bug Fix(es) and Enhancement(s):

    * crypto: testmgr - allow authenc(hmac(sha{256,384}),cts(cbc(aes))) in FIPS mode [rhel-10.2.z]     (JIRA:RHEL-182537)

    * [ThinkPad Avon/Mario +RHEL 10.2]The OS hang up with CapsLock fliker (JIRA:RHEL-185110)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1894 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    fs/ntfs3: handle attr_set_size() errors when truncating files (CVE-2025-71289)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: nf_tables: unconditionally bump set->nelems before insertion (CVE-2026-23272)

    In the Linux kernel, the following vulnerability has been resolved:

    smb: client: fix OOB reads parsing symlink error response (CVE-2026-31613)

    In the Linux kernel, the following vulnerability has been resolved:

    xfrm: hold dev ref until after transport_finish NF_HOOK (CVE-2026-31663)

    In the Linux kernel, the following vulnerability has been resolved:

    rtnetlink: add missing netlink_ns_capable() check for peer netns (CVE-2026-31692)

    In the Linux kernel, the following vulnerability has been resolved:

    net: ioam6: fix OOB and missing lock (CVE-2026-43083)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: ctnetlink: ensure safe access to master conntrack (CVE-2026-43116)

    In the Linux kernel, the following vulnerability has been resolved:

    ntfs: ->d_compare() must not block (CVE-2026-43245)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf: fix end-of-list detection in cgroup_storage_get_next_key() (CVE-2026-45838)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf: reject negative CO-RE accessor indices in bpf_core_parse_spec() (CVE-2026-45839)

    In the Linux kernel, the following vulnerability has been resolved:

    openvswitch: cap upcall PID array size and pre-size vport replies (CVE-2026-45840)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO (CVE-2026-45841)

    In the Linux kernel, the following vulnerability has been resolved:

    slip: reject VJ receive packets on instances with no rstate array (CVE-2026-45842)

    In the Linux kernel, the following vulnerability has been resolved:

    slip: bound decode() reads against the compressed packet length (CVE-2026-45843)

    In the Linux kernel, the following vulnerability has been resolved:

    mptcp: pm: ADD_ADDR rtx: fix potential data-race (CVE-2026-46137)

    In the Linux kernel, the following vulnerability has been resolved:

    mptcp: pm: ADD_ADDR rtx: always decrease sk refcount (CVE-2026-46158)

    In the Linux kernel, the following vulnerability has been resolved:

    btrfs: fix missing last_unlink_trans update when removing a directory (CVE-2026-46160)

    In the Linux kernel, the following vulnerability has been resolved:

    mptcp: pm: ADD_ADDR rtx: free sk if last (CVE-2026-46170)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: nft_inner: Fix IPv6 inner_thoff desync (CVE-2026-46244)

    In the Linux kernel, the following vulnerability has been resolved:

    io-wq: check that the predecessor is hashed in io_wq_remove_pending() (CVE-2026-46274)

    In the Linux kernel, the following vulnerability has been resolved:

    io_uring/waitid: clear waitid info before copying it to userspace (CVE-2026-46315)

    In the Linux kernel, the following vulnerability has been resolved:

    KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CVE-2026-46316)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: nf_queue: hold bridge skb->dev while queued (CVE-2026-52912)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: ip6t_hbh: reject oversized option lists (CVE-2026-52915)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: xt_policy: fix strict mode inbound policy matching (CVE-2026-52920)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: ipset: stop hash:* range iteration at end (CVE-2026-52921)

    In the Linux kernel, the following vulnerability has been resolved:

    vrf: Fix a potential NPD when removing a port from a VRF (CVE-2026-52925)

    In the Linux kernel, the following vulnerability has been resolved:

    crypto: jitterentropy - replace long-held spinlock with mutex (CVE-2026-52936)

    In the Linux kernel, the following vulnerability has been resolved:

    libceph: handle rbtree insertion error in decode_choose_args() (CVE-2026-52954)

    In the Linux kernel, the following vulnerability has been resolved:

    libceph: Fix potential out-of-bounds access in crush_decode() (CVE-2026-52955)

    In the Linux kernel, the following vulnerability has been resolved:

    libceph: Fix potential null-ptr-deref in decode_choose_args() (CVE-2026-52957)

    In the Linux kernel, the following vulnerability has been resolved:

    libceph: Fix potential out-of-bounds access in osdmap_decode() (CVE-2026-52958)

    In the Linux kernel, the following vulnerability has been resolved:

    ceph: fix BUG_ON in __ceph_build_xattrs_blob() due to stale blob size (CVE-2026-52961)

    In the Linux kernel, the following vulnerability has been resolved:

    ceph: fix a buffer leak in __ceph_setxattr() (CVE-2026-52962)

    In the Linux kernel, the following vulnerability has been resolved:

    smb/client: fix possible infinite loop and oob read in symlink_data() (CVE-2026-52967)

    In the Linux kernel, the following vulnerability has been resolved:

    KVM: Reject wrapped offset in kvm_reset_dirty_gfn() (CVE-2026-52969)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: nft_ct: fix missing expect put in obj eval (CVE-2026-52970)

    In the Linux kernel, the following vulnerability has been resolved:

    crypto: af_alg - Cap AEAD AD length to 0x80000000 (CVE-2026-52972)

    In the Linux kernel, the following vulnerability has been resolved:

    net: tls: fix strparser anchor skb leak on offload RX setup failure (CVE-2026-52974)

    In the Linux kernel, the following vulnerability has been resolved:

    futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (CVE-2026-52977)

    In the Linux kernel, the following vulnerability has been resolved:

    sched/fair: Clear rel_deadline when initializing forked entities (CVE-2026-52980)

    In the Linux kernel, the following vulnerability has been resolved:

    neigh: let neigh_xmit take skb ownership (CVE-2026-52981)

    In the Linux kernel, the following vulnerability has been resolved:

    net/sched: netem: fix queue limit check to include reordered packets

    The queue limit check in netem_enqueue() uses q->t_len which onlycounts packets in the internal tfifo.
    Packets placed in sch->q bythe reorder path (__qdisc_enqueue_head) are not counted, allowingthe total     queue occupancy to exceed sch->limit under reordering.

    Include sch->q.qlen in the limit check. (CVE-2026-52984)

    In the Linux kernel, the following vulnerability has been resolved:

    netdevsim: zero initialize struct iphdr in dummy sk_buff (CVE-2026-52985)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: nf_conntrack_sip: don't use simple_strtoul (CVE-2026-52986)

    In the Linux kernel, the following vulnerability has been resolved:

    fsnotify: fix inode reference leak in fsnotify_recalc_mask() (CVE-2026-52990)

    In the Linux kernel, the following vulnerability has been resolved:

    tipc: fix double-free in tipc_buf_append() (CVE-2026-52993)

    In the Linux kernel, the following vulnerability has been resolved:

    net/rds: zero per-item info buffer before handing it to visitors (CVE-2026-52995)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (CVE-2026-52998)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (CVE-2026-52999)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: xtables: restrict several matches to inet family (CVE-2026-53001)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: conntrack: remove sprintf usage (CVE-2026-53002)

    In the Linux kernel, the following vulnerability has been resolved:

    pppoe: drop PFC frames (CVE-2026-53003)

    In the Linux kernel, the following vulnerability has been resolved:

    sctp: fix OOB write to userspace in sctp_getsockopt_peer_auth_chunks (CVE-2026-53004)

    In the Linux kernel, the following vulnerability has been resolved:

    ipv6: fix possible UAF in icmpv6_rcv() (CVE-2026-53006)

    In the Linux kernel, the following vulnerability has been resolved:

    ice: fix double-free of tx_buf skb (CVE-2026-53009)

    In the Linux kernel, the following vulnerability has been resolved:

    nexthop: fix IPv6 route referencing IPv4 nexthop (CVE-2026-53012)

    In the Linux kernel, the following vulnerability has been resolved:

    macvlan: fix macvlan_get_size() not reserving space for IFLA_MACVLAN_BC_CUTOFF (CVE-2026-53013)

    In the Linux kernel, the following vulnerability has been resolved:

    net/sched: act_mirred: fix wrong device for mac_header_xmit check in tcf_blockcast_redir (CVE-2026-53014)

    In the Linux kernel, the following vulnerability has been resolved:

    erofs: unify lcn as u64 for 32-bit platforms (CVE-2026-53015)

    In the Linux kernel, the following vulnerability has been resolved:

    scsi: target: core: Fix integer overflow in UNMAP bounds check (CVE-2026-53021)

    In the Linux kernel, the following vulnerability has been resolved:

    fs/ntfs3: terminate the cached volume label after UTF-8 conversion (CVE-2026-53023)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf: Validate node_id in arena_alloc_pages() (CVE-2026-53031)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf: Fix NULL deref in map_kptr_match_type for scalar regs (CVE-2026-53032)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf, sockmap: Take state lock for af_unix iter (CVE-2026-53033)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf, sockmap: Fix af_unix null-ptr-deref in proto update (CVE-2026-53034)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf, sockmap: Fix af_unix iter deadlock (CVE-2026-53035)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf, arm64: Fix off-by-one in check_imm signed range check (CVE-2026-53036)

    In the Linux kernel, the following vulnerability has been resolved:

    HID: usbhid: fix deadlock in hid_post_reset() (CVE-2026-53037)

    In the Linux kernel, the following vulnerability has been resolved:

    ima_fs: Correctly create securityfs files for unsupported hash algos (CVE-2026-53038)

    In the Linux kernel, the following vulnerability has been resolved:

    quota: Fix race of dquot_scan_active() with quota deactivation (CVE-2026-53050)

    In the Linux kernel, the following vulnerability has been resolved:

    iommu/amd: Fix clone_alias() to use the original device's devid (CVE-2026-53053)

    In the Linux kernel, the following vulnerability has been resolved:

    dm log: fix out-of-bounds write due to region_count overflow (CVE-2026-53059)

    In the Linux kernel, the following vulnerability has been resolved:

    dm cache metadata: fix memory leak on metadata abort retry (CVE-2026-53060)

    In the Linux kernel, the following vulnerability has been resolved:

    dm cache: fix dirty mapping checking in passthrough mode switching (CVE-2026-53061)

    In the Linux kernel, the following vulnerability has been resolved:

    dm cache policy smq: fix missing locks in invalidating cache blocks (CVE-2026-53062)

    In the Linux kernel, the following vulnerability has been resolved:

    dm cache: fix write hang in passthrough mode (CVE-2026-53063)

    In the Linux kernel, the following vulnerability has been resolved:

    dm cache: fix null-deref with concurrent writes in passthrough mode (CVE-2026-53064)

    In the Linux kernel, the following vulnerability has been resolved:

    net, bpf: fix null-ptr-deref in xdp_master_redirect() for down master (CVE-2026-53069)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf: reject short IPv4/IPv6 inputs in bpf_prog_test_run_skb (CVE-2026-53074)

    In the Linux kernel, the following vulnerability has been resolved:

    ppp: require CAP_NET_ADMIN in target netns for unattached ioctls (CVE-2026-53075)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf: Fix OOB in pcpu_init_value (CVE-2026-53076)

    In the Linux kernel, the following vulnerability has been resolved:

    net/rds: Restrict use of RDS/IB to the initial network namespace (CVE-2026-53077)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf: Enforce regsafe base id consistency for BPF_ADD_CONST scalars (CVE-2026-53081)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf: Fix RCU stall in bpf_fd_array_map_clear() (CVE-2026-53083)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf: return VMA snapshot from task_vma iterator (CVE-2026-53084)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf: fix mm lifecycle in open-coded task_vma iterator (CVE-2026-53085)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf: Fix stale offload->prog pointer after constant blinding (CVE-2026-53094)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf: Use RCU-safe iteration in dev_map_redirect_multi() SKB path (CVE-2026-53096)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf: test_run: Fix the null pointer dereference issue in bpf_lwt_xmit_push_encap (CVE-2026-53111)

    In the Linux kernel, the following vulnerability has been resolved:

    platform/wmi: use generic driver_override infrastructure (CVE-2026-53119)

    In the Linux kernel, the following vulnerability has been resolved:

    PCI: use generic driver_override infrastructure (CVE-2026-53120)

    In the Linux kernel, the following vulnerability has been resolved:

    btrfs: fix deadlock between reflink and transaction commit when using flushoncommit (CVE-2026-53122)

    In the Linux kernel, the following vulnerability has been resolved:

    md: wake raid456 reshape waiters before suspend (CVE-2026-53123)

    In the Linux kernel, the following vulnerability has been resolved:

    blk-cgroup: fix disk reference leak in blkcg_maybe_throttle_current() (CVE-2026-53126)

    In the Linux kernel, the following vulnerability has been resolved:

    drbd: Balance RCU calls in drbd_adm_dump_devices() (CVE-2026-53128)

    In the Linux kernel, the following vulnerability has been resolved:

    fs/mbcache: cancel shrink work before destroying the cache (CVE-2026-53129)

    In the Linux kernel, the following vulnerability has been resolved:

    audit: fix incorrect inheritable capability in CAPSET records

    __audit_log_capset() records the effective capability set into theinheritable field due to a copy-paste     error. Every CAPSET auditrecord therefore reports cap_pi (process inheritable) with the valueof     cap_effective instead of cap_inheritable.

    This silently corrupts audit data used for compliance and forensicanalysis: an attacker who modifies     inheritable capabilities toprepare for a privilege-escalating exec would have the change maskedin the     audit trail.

    The bug has been present since the original introduction of CAPSETaudit records in 2008. (CVE-2026-53287)

    In the Linux kernel, the following vulnerability has been resolved:

    arm64: Reserve an extra page for early kernel mapping (CVE-2026-53288)

    In the Linux kernel, the following vulnerability has been resolved:

    ice: fix NULL pointer dereference in ice_reset_all_vfs() (CVE-2026-53289)

    In the Linux kernel, the following vulnerability has been resolved:

    mailbox: add sanity check for channel array

    Fail gracefully if there is no channel array attached to the mailboxcontroller. Otherwise the later     dereference will cause an OOPS whichmight not be seen because mailbox controllers might instantiate     veryearly. Remove the comment explaining the obvious while here. (CVE-2026-53295)

    In the Linux kernel, the following vulnerability has been resolved:

    scsi: sg: Resolve soft lockup issue when opening /dev/sgX (CVE-2026-53304)

    In the Linux kernel, the following vulnerability has been resolved:

    padata: Put CPU offline callback in ONLINE section to allow failure

    syzbot reported the following warning:

    DEAD callback error for CPU1WARNING: kernel/cpu.c:1463 at _cpu_down+0x759/0x1020 kernel/cpu.c:1463, CPU#0:
    syz.0.1960/14614

    at commit 4ae12d8bd9a8 (Merge tag 'kbuild-fixes-7.0-2' of     git://git.kernel.org/pub/scm/linux/kernel/git/kbuild/linux)which tglx traced to padata_cpu_dead() given     it's the onlysub-CPUHP_TEARDOWN_CPU callback that returns an error.

    Failure isn't allowed in hotplug states before CPUHP_TEARDOWN_CPUso move the CPU offline callback to the     ONLINE section where failure ispossible. (CVE-2026-53314)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1881 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    fs/ntfs3: handle attr_set_size() errors when truncating files (CVE-2025-71289)

    In the Linux kernel, the following vulnerability has been resolved:

    smb: client: validate the whole DACL before rewriting it in cifsacl (CVE-2026-31709)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: nft_inner: Fix IPv6 inner_thoff desync (CVE-2026-46244)

    In the Linux kernel, the following vulnerability has been resolved:

    io_uring/waitid: clear waitid info before copying it to userspace (CVE-2026-46315)

    In the Linux kernel, the following vulnerability has been resolved:

    KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CVE-2026-46316)

    In the Linux kernel, the following vulnerability has been resolved:

    KVM: arm64: Reassign nested_mmus array behind mmu_lock (CVE-2026-46317)

    In the Linux kernel, the following vulnerability has been resolved:

    tun: free page on short-frame rejection in tun_xdp_one() (CVE-2026-46321)

    In the Linux kernel, the following vulnerability has been resolved:

    tun: free page on build_skb failure in tun_xdp_one() (CVE-2026-46322)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: nf_queue: hold bridge skb->dev while queued (CVE-2026-52912)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: ip6t_hbh: reject oversized option lists (CVE-2026-52915)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: ipset: stop hash:* range iteration at end (CVE-2026-52921)

    In the Linux kernel, the following vulnerability has been resolved:

    ipc: limit next_id allocation to the valid ID range (CVE-2026-52923)

    In the Linux kernel, the following vulnerability has been resolved:

    xfrm: ipcomp: Free destination pages on acomp errors (CVE-2026-52932)

    In the Linux kernel, the following vulnerability has been resolved:

    tap: fix stack info leak in tap_ioctl() SIOCGIFHWADDR (CVE-2026-52937)

    In the Linux kernel, the following vulnerability has been resolved:

    net: skbuff: fix missing zerocopy reference in pskb_carve helpers (CVE-2026-52943)

    In the Linux kernel, the following vulnerability has been resolved:

    KVM: arm64: Take the SRCU lock for page table walks in fault injection and AT emulation (CVE-2026-53277)

    In the Linux kernel, the following vulnerability has been resolved:

    fuse: fix uninit-value in fuse_dentry_revalidate() (CVE-2026-53311)

    In the Linux kernel, the following vulnerability has been resolved:

    KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (CVE-2026-53360)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6355 advisory.

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-6355-1                   security@debian.org     https://www.debian.org/security/                     Salvatore Bonaccorso     June 21, 2026                         https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : linux     CVE ID         : CVE-2025-22069 CVE-2025-68251 CVE-2025-68768 CVE-2025-71289                      CVE-2026-23247 CVE-2026-23272 CVE-2026-23346 CVE-2026-23394                      CVE-2026-23469 CVE-2026-31420 CVE-2026-31486 CVE-2026-31560                      CVE-2026-31613 CVE-2026-31663 CVE-2026-31717 CVE-2026-43116                      CVE-2026-43219 CVE-2026-43245 CVE-2026-43303 CVE-2026-43331                      CVE-2026-45838 CVE-2026-45839 CVE-2026-45840 CVE-2026-45841                      CVE-2026-45842 CVE-2026-45843 CVE-2026-45844 CVE-2026-45845                      CVE-2026-45846 CVE-2026-45850 CVE-2026-45930 CVE-2026-46117                      CVE-2026-46137 CVE-2026-46158 CVE-2026-46160 CVE-2026-46170                      CVE-2026-46203 CVE-2026-46216 CVE-2026-46244 CVE-2026-46274                      CVE-2026-46275 CVE-2026-46315 CVE-2026-46316 CVE-2026-46319                      CVE-2026-46320 CVE-2026-46321 CVE-2026-46322 CVE-2026-46323                      CVE-2026-46331 CVE-2026-52908 CVE-2026-52909 CVE-2026-52910                      CVE-2026-52911

    Several vulnerabilities have been discovered in the Linux kernel that     may lead to a privilege escalation, denial of service or information     leaks.

    For the stable distribution (trixie), these problems have been fixed in     version 6.12.94-1.

    We recommend that you upgrade your linux packages.

    For the detailed security status of linux please refer to its security     tracker page at:
    https://security-tracker.debian.org/tracker/linux

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES16 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:22099-1 advisory.

    The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues

    The following security issues were fixed:

    - CVE-2026-23254: net: gro: fix outer network offset (bsc#1259884).
    - CVE-2026-23303: smb: client: Don't log plaintext credentials in cifs_set_cifscreds (bsc#1260502).
    - CVE-2026-23327: cxl/mbox: validate payload size before accessing       contents in cxl_payload_from_user_allowed() (bsc#1260548).
    - CVE-2026-23438: net: mvpp2: guard flow control update with global_tx_fc in buffer switching     (bsc#1261619).
    - CVE-2026-31396: net: macb: fix use-after-free access to PTP clock (bsc#1261791).
    - CVE-2026-31401: HID: bpf: prevent buffer overflow in hid_hw_request (bsc#1261603).
    - CVE-2026-31446: ext4: fix use-after-free in update_super_work when racing with umount (bsc#1262619).
    - CVE-2026-31448: ext4: avoid infinite loops caused by residual data (bsc#1262622).
    - CVE-2026-31454: xfs: save ailp before dropping the AIL lock in push callbacks (bsc#1262624).
    - CVE-2026-31455: xfs: stop reclaim before pushing AIL during unmount (bsc#1262615).
    - CVE-2026-31518: esp: fix skb leak with espintcp and async crypto (bsc#1262606).
    - CVE-2026-31546: net: bonding: fix NULL deref in bond_debug_rlb_hash_show (bsc#1263006).
    - CVE-2026-31556: xfs: scrub: unlock dquot before early return in quota scrub (bsc#1263062).
    - CVE-2026-31562: drm/mediatek: dsi: Store driver data before invoking mipi_dsi_host_register     (bsc#1263058).
    - CVE-2026-31584: media: mediatek: vcodec: fix use-after-free in encoder release path (bsc#1263180).
    - CVE-2026-31645: net: lan966x: fix page pool leak in error paths (bsc#1263794).
    - CVE-2026-31648: mm: filemap: fix nr_pages calculation overflow in filemap_map_pages() (bsc#1263579).
    - CVE-2026-31655: pmdomain: imx8mp-blk-ctrl: Keep the NOC_HDCP clock enabled (bsc#1263724).
    - CVE-2026-31671: xfrm_user: fix info leak in build_report() (bsc#1263115).
    - CVE-2026-31683: batman-adv: avoid OGM aggregation when skb tailroom is insufficient (bsc#1263594).
    - CVE-2026-31703: writeback: Fix use after free in inode_switch_wbs_work_fn() (bsc#1263883).
    - CVE-2026-31774: io_uring/net: fix slab-out-of-bounds read in io_bundle_nbufs() (bsc#1264040).
    - CVE-2026-43026: netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (bsc#1263932).
    - CVE-2026-43030: bpf: Fix regsafe() for pointers to packet (bsc#1264000).
    - CVE-2026-43040: net: ipv6: ndisc: fix ndisc_ra_useropt to initialize       nduseropt_padX fields to zero to prevent an info-leak (bsc#1264091).
    - CVE-2026-43063: xfs: don't irele after failing to iget in xfs_attri_recover_work (bsc#1264196).
    - CVE-2026-43065: ext4: always drain queued discard work in ext4_mb_release() (bsc#1264243).
    - CVE-2026-43066: ext4: fix iloc.bh leak in ext4_fc_replay_inode() error paths (bsc#1264245).
    - CVE-2026-43068: ext4: avoid allocate block from corrupted group in ext4_mb_find_by_goal() (bsc#1264255).
    - CVE-2026-43109: x86: shadow stacks: proper error handling for mmap lock (bsc#1264484).
    - CVE-2026-43150: perf/arm-cmn: Reject unsupported hardware configurations (bsc#1264415).
    - CVE-2026-43184: rnbd-srv: Zero the rsp buffer before using it (bsc#1264622).
    - CVE-2026-43197: netconsole: avoid OOB reads, msg is not nul-terminated (bsc#1264609).
    - CVE-2026-43332: thermal: core: Fix thermal zone device registration error path (bsc#1265114).
    - CVE-2026-43393: btrfs: fix chunk map leak in btrfs_map_block() after btrfs_chunk_map_num_copies()     (bsc#1264723).
    - CVE-2026-43394: nfsd: Fix cred ref leak in nfsd_nl_listener_set_doit() (bsc#1265081).
    - CVE-2026-43411: tipc: fix divide-by-zero in tipc_sk_filter_connect() (bsc#1264672).
    - CVE-2026-43455: net: mctp: Ensure keys maintain only one ref to corresponding dev (bsc#1264765).
    - CVE-2026-45842: slip: reject VJ receive packets on instances with no rstate array (bsc#1266400).
    - CVE-2026-45846: bareudp: fix NULL pointer dereference in bareudp_fill_metadata_dst() (bsc#1266394).
    - CVE-2026-45852: RDMA/rxe: Fix double free in rxe_srq_from_init (bsc#1266711).
    - CVE-2026-45856: RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (bsc#1266720).
    - CVE-2026-45886: bpf: Fix bpf_xdp_store_bytes proto for read-only arg (bsc#1266810).
    - CVE-2026-45898: RDMA/iwcm: Fix workqueue list corruption by removing work_list (bsc#1266888).
    - CVE-2026-45910: RDMA/rxe: Fix race condition in QP timer handlers (bsc#1266889).
    - CVE-2026-45932: bpf: Fix tcx/netkit detach permissions when prog fd isn't given (bsc#1266827).
    - CVE-2026-45942: ext4: fix e4b bitmap inconsistency reports (bsc#1266914).
    - CVE-2026-45970: bonding: alb: fix UAF in rlb_arp_recv during bond up/down (bsc#1267205).
    - CVE-2026-45984: gfs2: Fix use-after-free in iomap inline data write path (bsc#1267214).
    - CVE-2026-46021: thermal: core: Fix thermal zone governor cleanup issues (bsc#1267220).
    - CVE-2026-46043: RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (bsc#1266901).
    - CVE-2026-46083: spi: fix resource leaks on device setup failure (bsc#1266696).
    - CVE-2026-46090: ALSA: aloop: Use guard() for spin locks (bsc#1267531).
    - CVE-2026-46094: ext4: fix bounds check in check_xattrs() to prevent out-of-bounds access (bsc#1266927).
    - CVE-2026-46114: RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (bsc#1266972).
    - CVE-2026-46159: btrfs: fix btrfs_ioctl_space_info() slot_count TOCTOU which can lead to info-leak     (bsc#1267652).
    - CVE-2026-46176: RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (bsc#1266816).
    - CVE-2026-46181: RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (bsc#1266826).

    The following non security issues were fixed:

    - accel/ivpu: Add bounds checks for firmware log indices (git-fixes).
    - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (git-fixes).
    - ALSA: PCM: Fix wait queue list corruption in snd_pcm_drain() on linked streams (git-fixes).
    - ALSA: seq: dummy: fix UMP event stack overread (git-fixes).
    - arm64: tlb: Allow XZR argument to TLBI ops (git-fixes).
    - arm64: tlb: Optimize ARM64_WORKAROUND_REPEAT_TLBI (git-fixes).
    - Bluetooth: bnep: reject short frames before parsing (git-fixes).
    - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (git-fixes).
    - Bluetooth: ISO: Fix not releasing hdev reference on iso_conn_big_sync (git-fixes).
    - Bluetooth: MGMT: Fix backward compatibility with userspace (git-fixes).
    - Bluetooth: MGMT: validate advertising TLV before type checks (git-fixes).
    - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (git-fixes).
    - Bluetooth: RFCOMM: validate skb length in MCC handlers (git-fixes).
    - config: remove DEBUG_FS_DISALLOW_MOUNT
    - debugfs: Remove broken no-mount mode (bsc#1265186).
    - debugfs: Fix default access mode config check (bsc#1265186).
    - debugfs: Remove broken no-mount mode (bsc#1265186).
    - debugfs: Remove redundant access mode checks (bsc#1265186).
    - drm/amd/display: Bound VBIOS record-chain walk loops (git-fixes).
    - drm/amd/display: Clamp HDMI HDCP2 rx_id_list read to buffer size (git-fixes).
    - drm/amd/display: Fix NULL deref and buffer over-read in SDP debugfs (git-fixes).
    - drm/amd/display: Reject gpio_bitshift >= 32 in bios_parser_get_gpio_pin_info() (git-fixes).
    - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (git-fixes).
    - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (git-fixes).
    - drm/amdkfd: fix NULL dereference in get_queue_ids() (git-fixes).
    - drm/imx: Fix three kernel-doc warnings in dcss-scaler.c (git-fixes).
    - drm/v3d: Fix vaddr leak when indirect CSD has zeroed workgroups (git-fixes).
    - drm/xe: Clear pending_disable before signaling suspend fence (git-fixes).
    - ima: return error early if file xattr cannot be changed (bsc#1261041).
    - Input: atkbd - skip deactivate for HONOR BCC-N's internal keyboard (git-fixes).
    - KVM: arm64: Reassign nested_mmus array behind mmu_lock (git-fixes).
    - KVM: arm64: Take the SRCU lock for page table walks in fault injection and AT emulation (git-fixes).
    - KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (git-fixes).
    - KVM: SEV: Check PSC request indices against the actual size of the buffer (git-fixes).
    - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (git-fixes).
    - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (git-fixes).
    - KVM: SEV: Ignore MMIO requests of length '0' (git-fixes).
    - KVM: SEV: Ignore Port I/O requests of length '0' (git-fixes).
    - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (git-fixes).
    - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (git-fixes).
    - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (git-fixes).
    - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (git-fixes).
    - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (git-fixes).
    - KVM: SVM: Convert plain error code numbers to defines (git-fixes).
    - KVM: SVM: Flush the current TLB when transitioning from xAVIC => x2AVIC (git-fixes).
    - KVM: SVM: Provide helpers to set the error code (git-fixes).
    - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (git-fixes).
    - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (git-fixes).
    - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (git-fixes).
    - KVM: x86: Move MMIO write tracing into vcpu_mmio_write() (git-fixes).
    - KVM: x86: Open code handling of completed MMIO reads in emulator_read_write() (git-fixes).
    - KVM: x86: Open code read vs. write userspace MMIO exits in emulator_read_write() (git-fixes).
    - KVM: x86: Trace unsatisfied MMIO reads on a per-page basis (git-fixes).
    - KVM: x86: Use local MMIO fragment variable to clean up emulator_read_write() (git-fixes).
    - mmc: core: Fix host controller programming for fixed driver type (git-fixes).
    - mmc: dw_mmc-rockchip: Add missing private data for very old controllers (git-fixes).
    - mmc: litex_mmc: Set mandatory idle clocks before CMD0 (git-fixes).
    - mmc: litex_mmc: Use DIV_ROUND_UP for more accurate clock calculation (git-fixes).
    - mmc: renesas_sdhi: Add OF entry for RZ/G2H SoC (git-fixes).
    - mmc: sdhci: add signal voltage switch in sdhci_resume_host (git-fixes).
    - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (git-fixes).
    - wifi: nl80211: reject oversized EMA RNR lists (git-fixes).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES16 / SLES_SAP16 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:22127-1 advisory.

    The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues

    The following security issues were fixed:

    - CVE-2026-23254: net: gro: fix outer network offset (bsc#1259884).
    - CVE-2026-23303: smb: client: Don't log plaintext credentials in cifs_set_cifscreds (bsc#1260502).
    - CVE-2026-23327: cxl/mbox: validate payload size before accessing       contents in cxl_payload_from_user_allowed() (bsc#1260548).
    - CVE-2026-23438: net: mvpp2: guard flow control update with global_tx_fc in buffer switching     (bsc#1261619).
    - CVE-2026-31396: net: macb: fix use-after-free access to PTP clock (bsc#1261791).
    - CVE-2026-31401: HID: bpf: prevent buffer overflow in hid_hw_request (bsc#1261603).
    - CVE-2026-31446: ext4: fix use-after-free in update_super_work when racing with umount (bsc#1262619).
    - CVE-2026-31448: ext4: avoid infinite loops caused by residual data (bsc#1262622).
    - CVE-2026-31454: xfs: save ailp before dropping the AIL lock in push callbacks (bsc#1262624).
    - CVE-2026-31455: xfs: stop reclaim before pushing AIL during unmount (bsc#1262615).
    - CVE-2026-31518: esp: fix skb leak with espintcp and async crypto (bsc#1262606).
    - CVE-2026-31546: net: bonding: fix NULL deref in bond_debug_rlb_hash_show (bsc#1263006).
    - CVE-2026-31556: xfs: scrub: unlock dquot before early return in quota scrub (bsc#1263062).
    - CVE-2026-31562: drm/mediatek: dsi: Store driver data before invoking mipi_dsi_host_register     (bsc#1263058).
    - CVE-2026-31584: media: mediatek: vcodec: fix use-after-free in encoder release path (bsc#1263180).
    - CVE-2026-31645: net: lan966x: fix page pool leak in error paths (bsc#1263794).
    - CVE-2026-31648: mm: filemap: fix nr_pages calculation overflow in filemap_map_pages() (bsc#1263579).
    - CVE-2026-31655: pmdomain: imx8mp-blk-ctrl: Keep the NOC_HDCP clock enabled (bsc#1263724).
    - CVE-2026-31671: xfrm_user: fix info leak in build_report() (bsc#1263115).
    - CVE-2026-31683: batman-adv: avoid OGM aggregation when skb tailroom is insufficient (bsc#1263594).
    - CVE-2026-31703: writeback: Fix use after free in inode_switch_wbs_work_fn() (bsc#1263883).
    - CVE-2026-31774: io_uring/net: fix slab-out-of-bounds read in io_bundle_nbufs() (bsc#1264040).
    - CVE-2026-43026: netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (bsc#1263932).
    - CVE-2026-43030: bpf: Fix regsafe() for pointers to packet (bsc#1264000).
    - CVE-2026-43040: net: ipv6: ndisc: fix ndisc_ra_useropt to initialize       nduseropt_padX fields to zero to prevent an info-leak (bsc#1264091).
    - CVE-2026-43063: xfs: don't irele after failing to iget in xfs_attri_recover_work (bsc#1264196).
    - CVE-2026-43065: ext4: always drain queued discard work in ext4_mb_release() (bsc#1264243).
    - CVE-2026-43066: ext4: fix iloc.bh leak in ext4_fc_replay_inode() error paths (bsc#1264245).
    - CVE-2026-43068: ext4: avoid allocate block from corrupted group in ext4_mb_find_by_goal() (bsc#1264255).
    - CVE-2026-43109: x86: shadow stacks: proper error handling for mmap lock (bsc#1264484).
    - CVE-2026-43150: perf/arm-cmn: Reject unsupported hardware configurations (bsc#1264415).
    - CVE-2026-43184: rnbd-srv: Zero the rsp buffer before using it (bsc#1264622).
    - CVE-2026-43197: netconsole: avoid OOB reads, msg is not nul-terminated (bsc#1264609).
    - CVE-2026-43332: thermal: core: Fix thermal zone device registration error path (bsc#1265114).
    - CVE-2026-43393: btrfs: fix chunk map leak in btrfs_map_block() after btrfs_chunk_map_num_copies()     (bsc#1264723).
    - CVE-2026-43394: nfsd: Fix cred ref leak in nfsd_nl_listener_set_doit() (bsc#1265081).
    - CVE-2026-43411: tipc: fix divide-by-zero in tipc_sk_filter_connect() (bsc#1264672).
    - CVE-2026-43455: net: mctp: Ensure keys maintain only one ref to corresponding dev (bsc#1264765).
    - CVE-2026-45842: slip: reject VJ receive packets on instances with no rstate array (bsc#1266400).
    - CVE-2026-45846: bareudp: fix NULL pointer dereference in bareudp_fill_metadata_dst() (bsc#1266394).
    - CVE-2026-45852: RDMA/rxe: Fix double free in rxe_srq_from_init (bsc#1266711).
    - CVE-2026-45856: RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (bsc#1266720).
    - CVE-2026-45886: bpf: Fix bpf_xdp_store_bytes proto for read-only arg (bsc#1266810).
    - CVE-2026-45898: RDMA/iwcm: Fix workqueue list corruption by removing work_list (bsc#1266888).
    - CVE-2026-45910: RDMA/rxe: Fix race condition in QP timer handlers (bsc#1266889).
    - CVE-2026-45932: bpf: Fix tcx/netkit detach permissions when prog fd isn't given (bsc#1266827).
    - CVE-2026-45942: ext4: fix e4b bitmap inconsistency reports (bsc#1266914).
    - CVE-2026-45970: bonding: alb: fix UAF in rlb_arp_recv during bond up/down (bsc#1267205).
    - CVE-2026-45984: gfs2: Fix use-after-free in iomap inline data write path (bsc#1267214).
    - CVE-2026-46021: thermal: core: Fix thermal zone governor cleanup issues (bsc#1267220).
    - CVE-2026-46043: RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (bsc#1266901).
    - CVE-2026-46083: spi: fix resource leaks on device setup failure (bsc#1266696).
    - CVE-2026-46090: ALSA: aloop: Use guard() for spin locks (bsc#1267531).
    - CVE-2026-46094: ext4: fix bounds check in check_xattrs() to prevent out-of-bounds access (bsc#1266927).
    - CVE-2026-46114: RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (bsc#1266972).
    - CVE-2026-46159: btrfs: fix btrfs_ioctl_space_info() slot_count TOCTOU which can lead to info-leak     (bsc#1267652).
    - CVE-2026-46176: RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (bsc#1266816).
    - CVE-2026-46181: RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (bsc#1266826).

    The following non security issues were fixed:

    - accel/ivpu: Add bounds checks for firmware log indices (git-fixes).
    - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (git-fixes).
    - ALSA: PCM: Fix wait queue list corruption in snd_pcm_drain() on linked streams (git-fixes).
    - ALSA: seq: dummy: fix UMP event stack overread (git-fixes).
    - arm64: tlb: Allow XZR argument to TLBI ops (git-fixes).
    - arm64: tlb: Optimize ARM64_WORKAROUND_REPEAT_TLBI (git-fixes).
    - Bluetooth: bnep: reject short frames before parsing (git-fixes).
    - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (git-fixes).
    - Bluetooth: ISO: Fix not releasing hdev reference on iso_conn_big_sync (git-fixes).
    - Bluetooth: MGMT: Fix backward compatibility with userspace (git-fixes).
    - Bluetooth: MGMT: validate advertising TLV before type checks (git-fixes).
    - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (git-fixes).
    - Bluetooth: RFCOMM: validate skb length in MCC handlers (git-fixes).
    - config: remove DEBUG_FS_DISALLOW_MOUNT
    - debugfs: Remove broken no-mount mode (bsc#1265186).
    - debugfs: Fix default access mode config check (bsc#1265186).
    - debugfs: Remove broken no-mount mode (bsc#1265186).
    - debugfs: Remove redundant access mode checks (bsc#1265186).
    - drm/amd/display: Bound VBIOS record-chain walk loops (git-fixes).
    - drm/amd/display: Clamp HDMI HDCP2 rx_id_list read to buffer size (git-fixes).
    - drm/amd/display: Fix NULL deref and buffer over-read in SDP debugfs (git-fixes).
    - drm/amd/display: Reject gpio_bitshift >= 32 in bios_parser_get_gpio_pin_info() (git-fixes).
    - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (git-fixes).
    - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (git-fixes).
    - drm/amdkfd: fix NULL dereference in get_queue_ids() (git-fixes).
    - drm/imx: Fix three kernel-doc warnings in dcss-scaler.c (git-fixes).
    - drm/v3d: Fix vaddr leak when indirect CSD has zeroed workgroups (git-fixes).
    - drm/xe: Clear pending_disable before signaling suspend fence (git-fixes).
    - ima: return error early if file xattr cannot be changed (bsc#1261041).
    - Input: atkbd - skip deactivate for HONOR BCC-N's internal keyboard (git-fixes).
    - KVM: arm64: Reassign nested_mmus array behind mmu_lock (git-fixes).
    - KVM: arm64: Take the SRCU lock for page table walks in fault injection and AT emulation (git-fixes).
    - KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (git-fixes).
    - KVM: SEV: Check PSC request indices against the actual size of the buffer (git-fixes).
    - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (git-fixes).
    - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (git-fixes).
    - KVM: SEV: Ignore MMIO requests of length '0' (git-fixes).
    - KVM: SEV: Ignore Port I/O requests of length '0' (git-fixes).
    - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (git-fixes).
    - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (git-fixes).
    - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (git-fixes).
    - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (git-fixes).
    - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (git-fixes).
    - KVM: SVM: Convert plain error code numbers to defines (git-fixes).
    - KVM: SVM: Flush the current TLB when transitioning from xAVIC => x2AVIC (git-fixes).
    - KVM: SVM: Provide helpers to set the error code (git-fixes).
    - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (git-fixes).
    - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (git-fixes).
    - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (git-fixes).
    - KVM: x86: Move MMIO write tracing into vcpu_mmio_write() (git-fixes).
    - KVM: x86: Open code handling of completed MMIO reads in emulator_read_write() (git-fixes).
    - KVM: x86: Open code read vs. write userspace MMIO exits in emulator_read_write() (git-fixes).
    - KVM: x86: Trace unsatisfied MMIO reads on a per-page basis (git-fixes).
    - KVM: x86: Use local MMIO fragment variable to clean up emulator_read_write() (git-fixes).
    - mmc: core: Fix host controller programming for fixed driver type (git-fixes).
    - mmc: dw_mmc-rockchip: Add missing private data for very old controllers (git-fixes).
    - mmc: litex_mmc: Set mandatory idle clocks before CMD0 (git-fixes).
    - mmc: litex_mmc: Use DIV_ROUND_UP for more accurate clock calculation (git-fixes).
    - mmc: renesas_sdhi: Add OF entry for RZ/G2H SoC (git-fixes).
    - mmc: sdhci: add signal voltage switch in sdhci_resume_host (git-fixes).
    - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (git-fixes).
    - wifi: nl80211: reject oversized EMA RNR lists (git-fixes).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: vgic-its: Drop the     translation cache reference only for the erased entry vgic_its_invalidate_cache() walks the per-ITS     translation cache with xa_for_each() and drops the cache's reference on each entry with vgic_put_irq(). It     puts the iterated pointer, though, rather than the value returned by xa_erase(). The function is called     from contexts that do not exclude one another: the ITS command handlers hold its_lock, the GITS_CTLR write     path holds cmd_lock, and the path that clears EnableLPIs in a redistributor's GICR_CTLR holds neither. Two     or more of them can drain the same cache concurrently, and if each one observes the same entry, erases it     and then puts it, the single reference the cache holds on that entry is dropped more than once. The entry     can then be freed while an ITE still maps it. xa_erase() is atomic and returns the previous entry, so put     only the entry that this context actually removed. The cache reference is then dropped exactly once per     entry even when the invalidations run concurrently, and the behavior is unchanged when only one context     runs. (CVE-2026-46316)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
327340	Ubuntu 24.04 LTS : Linux kernel (HWE) vulnerabilities (USN-8545-1)	Nessus	Ubuntu Local Security Checks	high
327119	Oracle Linux 10 / 9 : Unbreakable Enterprise kernel (ELSA-2026-500004)	Nessus	Oracle Linux Local Security Checks	high
326895	RHEL 10 : kernel (RHSA-2026:39371)	Nessus	Red Hat Local Security Checks	high
326517	RHEL 9 : kernel (RHSA-2026:38902)	Nessus	Red Hat Local Security Checks	high
326383	RockyLinux 9 : kernel (RLSA-2026:36018)	Nessus	Rocky Linux Local Security Checks	high
326054	AlmaLinux 9 : kernel (ALSA-2026:36018)	Nessus	Alma Linux Local Security Checks	high
325873	Oracle Linux 9 : kernel (ELSA-2026-36018)	Nessus	Oracle Linux Local Security Checks	high
325425	Ubuntu 24.04 LTS : Linux kernel (NVIDIA) vulnerabilities (USN-8508-1)	Nessus	Ubuntu Local Security Checks	critical
325421	Ubuntu 26.04 LTS : Linux kernel (NVIDIA) vulnerabilities (USN-8507-1)	Nessus	Ubuntu Local Security Checks	low
325304	RHEL 9 : kernel (RHSA-2026:36018)	Nessus	Red Hat Local Security Checks	high
325272	AlmaLinux 10 : kernel (ALSA-2026:34911)	Nessus	Alma Linux Local Security Checks	high
325017	Ubuntu 26.04 LTS : Linux kernel vulnerabilities (USN-8488-1)	Nessus	Ubuntu Local Security Checks	low
325016	Ubuntu 26.04 LTS : Linux kernel (OEM) vulnerabilities (USN-8489-1)	Nessus	Ubuntu Local Security Checks	high
325015	Ubuntu 24.04 LTS : Linux kernel (OEM) vulnerabilities (USN-8491-1)	Nessus	Ubuntu Local Security Checks	high
325007	Ubuntu 24.04 LTS / 25.10 : Linux kernel vulnerabilities (USN-8490-1)	Nessus	Ubuntu Local Security Checks	high
324922	RHEL 10 : kernel (RHSA-2026:34911)	Nessus	Red Hat Local Security Checks	high
322107	Amazon Linux 2023 : bpftool6.12, kernel6.12, kernel6.12-devel (ALAS2023-2026-1894)	Nessus	Amazon Linux Local Security Checks	high
322087	Amazon Linux 2023 : bpftool6.18, kernel6.18, kernel6.18-devel (ALAS2023-2026-1881)	Nessus	Amazon Linux Local Security Checks	medium
321868	Debian dsa-6355 : ata-modules-6.12.90+deb13-armmp-di - security update	Nessus	Debian Local Security Checks	high
321697	SUSE SLES16 Security Update : kernel (SUSE-SU-2026:22099-1)	Nessus	SuSE Local Security Checks	high
321588	SUSE SLES16 Security Update : kernel (SUSE-SU-2026:22127-1)	Nessus	SuSE Local Security Checks	high
320149	Linux Distros Unpatched Vulnerability : CVE-2026-46316	Nessus	Misc.	high

Detections

Analytics

CVE-2026-46316

high

Tenable Plugins

high

high

high

high

high

high

high

critical

low

high

high

low

high

high

high

high

high

medium

high

high

high

high