In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE The current implementation incorrectly handles memory regions (MRs) with page sizes different from the system PAGE_SIZE. The core issue is that rxe_set_page() is called with mr->page_size step increments, but the page_list stores individual struct page pointers, each representing PAGE_SIZE of memory. ib_sg_to_page() has ensured that when i>=1 either a) SG[i-1].dma_end and SG[i].dma_addr are contiguous or b) SG[i-1].dma_end and SG[i].dma_addr are mr->page_size aligned. This leads to incorrect iova-to-va conversion in scenarios: 1) page_size < PAGE_SIZE (e.g., MR: 4K, system: 64K): ibmr->iova = 0x181800 sg[0]: dma_addr=0x181800, len=0x800 sg[1]: dma_addr=0x173000, len=0x1000 Access iova = 0x181800 + 0x810 = 0x182010 Expected VA: 0x173010 (second SG, offset 0x10) Before fix: - index = (0x182010 >> 12) - (0x181800 >> 12) = 1 - page_offset = 0x182010 & 0xFFF = 0x10 - xarray[1] stores system page base 0x170000 - Resulting VA: 0x170000 + 0x10 = 0x170010 (wrong) 2) page_size > PAGE_SIZE (e.g., MR: 64K, system: 4K): ibmr->iova = 0x18f800 sg[0]: dma_addr=0x18f800, len=0x800 sg[1]: dma_addr=0x170000, len=0x1000 Access iova = 0x18f800 + 0x810 = 0x190010 Expected VA: 0x170010 (second SG, offset 0x10) Before fix: - index = (0x190010 >> 16) - (0x18f800 >> 16) = 1 - page_offset = 0x190010 & 0xFFFF = 0x10 - xarray[1] stores system page for dma_addr 0x170000 - Resulting VA: system page of 0x170000 + 0x10 = 0x170010 (wrong) Yi Zhang reported a kernel panic[1] years ago related to this defect. Solution: 1. Replace xarray with pre-allocated rxe_mr_page array for sequential indexing (all MR page indices are contiguous) 2. Each rxe_mr_page stores both struct page* and offset within the system page 3. Handle MR page_size != PAGE_SIZE relationships: - page_size > PAGE_SIZE: Split MR pages into multiple system pages - page_size <= PAGE_SIZE: Store offset within system page 4. Add boundary checks and compatibility validation This ensures correct iova-to-va conversion regardless of MR page size and system PAGE_SIZE relationship, while improving performance through array-based sequential access. Tests on 4K and 64K PAGE_SIZE hosts: - rdma-core/pytests $ ./build/bin/run_tests.py --dev eth0_rxe - blktest: $ TIMEOUT=30 QUICK_RUN=1 USE_RXE=1 NVMET_TRTYPES=rdma ./check nvme srp rnbd [1] https://lore.kernel.org/all/CAHj4cs9XRqE25jyVw9rj9YugffLn5+f=1znaBEnu1usLOciD+g@mail.gmail.com/T/

ubuntu_linux USN-8630-1: Ubuntu 22.04 LTS / Ubuntu 24.04 LTS / Ubuntu Pro Realtime 22.04 LTS / Ubuntu Pro Realtime 24.04 LTS : Linux kernel vulnerabilities (USN-8630-1)

The remote CentOS Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the kernel-5.14.0-756.el9 build changelog.

  - In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: bound element ID read     when checking non-inheritance cfg80211_is_element_inherited() reads the first data octet of the candidate     element (id = elem->data[0]) to look it up in an extension non-inheritance list. It does so after testing     elem->id, but without verifying that the element actually has a data octet. A zero-length extension     element (WLAN_EID_EXTENSION with length 0) therefore makes it read one octet past the end of the element.
    _ieee802_11_parse_elems_full() runs this check for every element of a frame once a non-inheritance context     exists -- e.g. while parsing a per-STA profile of a Multi-Link element in a (re)association response, or a     non-transmitted BSS profile -- so a crafted frame from an AP can trigger a one-octet slab-out-of-bounds     read during element parsing: BUG: KASAN: slab-out-of-bounds in cfg80211_is_element_inherited Read of size     1 ... in net/wireless/scan.c Return early (treat the element as inherited) when an extension element     carries no data, mirroring the existing handling of empty ID lists. The bug was found by fuzzing     ieee802_11_parse_elems_full() under KASAN. (CVE-2026-68402)

  - In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: Reject MPA FPDU length     underflow before signed receive math A malicious connected siw peer can send an iWARP FPDU whose MPA     length field (c_hdr->mpa_len, 16 bit big-endian, peer-controlled) is smaller than the fixed DDP/RDMAP     header for the announced opcode. Soft-iWARP parses the full header in siw_get_hdr() based on     iwarp_pktinfo[opcode] .hdr_len, but never compares mpa_len against that header length. siw_tcp_rx_data()     then derives srx->fpdu_part_rem = be16_to_cpu(mpa_len) - fpdu_part_rcvd + MPA_HDR_SIZE; where     fpdu_part_rcvd equals iwarp_pktinfo[opcode].hdr_len at this point. For a tagged WRITE (hdr_len 16,     MPA_HDR_SIZE 2) the smallest on-wire mpa_len of 0 yields fpdu_part_rem = -14, and any mpa_len below     hdr_len - MPA_HDR_SIZE underflows to a negative int. The signed value then flows into     siw_proc_write()/siw_proc_rresp() as bytes = min(srx->fpdu_part_rem, srx->skb_new); is handed to     siw_check_mem() as an int len (whose interval check addr + len > mem->va + mem->len is satisfied for a     valid base when len is negative), and reaches siw_rx_data() -> siw_rx_kva() / siw_rx_umem() ->     skb_copy_bits() as a signed copy length. The header copy branch in skb_copy_bits() promotes that to     size_t, producing a multi-gigabyte read. KASAN under a KUnit harness that drives the real kernel TCP     receive path -- a loopback AF_INET socketpair, the malformed FPDU written via kernel_sendmsg,     sk_data_ready firing in softirq, tcp_read_sock dispatching to siw_tcp_rx_data -- reports: BUG: KASAN: use-     after-free in skb_copy_bits+0x284/0x480 Read of size 4294967295 at addr ffff888... Call Trace:
    skb_copy_bits siw_rx_kva siw_rx_data siw_check_mem siw_proc_write siw_tcp_rx_data __tcp_read_sock     siw_qp_llp_data_ready tcp_data_ready tcp_data_queue Add the missing invariant at the earliest point where     the peer header is fully assembled. iwarp_pktinfo[*].hdr_len - MPA_HDR_SIZE is exactly the value the siw     transmitter uses as the minimum mpa_len for each opcode (drivers/infiniband/sw/siw/siw_qp.c:33), so this     matches the protocol contract. Out-of-range FPDUs terminate the connection with TERM_ERROR_LAYER_LLP /     LLP_ETYPE_MPA / LLP_ECODE_FPDU_START -- which is RFC 5044 Section 8 error code 3 (Marker and ULPDU Length     fields do not agree on the start of an FPDU), the correct framing-error class for this inconsistency.
    (CVE-2026-64102)

  - In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix race condition in QP     timer handlers I encontered the following warning: WARNING: drivers/infiniband/sw/rxe/rxe_task.c:249 at     rxe_sched_task+0x1c8/0x238 [rdma_rxe], CPU#0: swapper/0/0 ... libsha1 [last unloaded: ip6_udp_tunnel] CPU:
    0 UID: 0 PID: 0 Comm: swapper/0 Tainted: G C 6.19.0-rc5-64k-v8+ #37 PREEMPT Tainted: [C]=CRAP Hardware     name: Raspberry Pi 4 Model B Rev 1.2 Call trace: rxe_sched_task+0x1c8/0x238 [rdma_rxe] (P)     retransmit_timer+0x130/0x188 [rdma_rxe] call_timer_fn+0x68/0x4d0 __run_timers+0x630/0x888 ... WARNING:
    drivers/infiniband/sw/rxe/rxe_task.c:38 at rxe_sched_task+0x1c0/0x238 [rdma_rxe], CPU#0: swapper/0/0 ...
    WARNING: drivers/infiniband/sw/rxe/rxe_task.c:111 at do_work+0x488/0x5c8 [rdma_rxe], CPU#3:
    kworker/u17:4/93400 ... refcount_t: underflow; use-after-free. WARNING: lib/refcount.c:28 at     refcount_warn_saturate+0x138/0x1a0, CPU#3: kworker/u17:4/93400 The issue is caused by a race condition     between retransmit_timer() and rxe_destroy_qp, leading to the Queue Pair's (QP) reference count dropping     to zero during timer handler execution. It seems this warning is harmless because rxe_qp_do_cleanup() will     flush all pending timers and requests. Example of flow causing the issue: CPU0 CPU1 retransmit_timer() {     spin_lock_irqsave rxe_destroy_qp() __rxe_cleanup() __rxe_put() // qp->ref_count decrease to 0     rxe_qp_do_cleanup() { if (qp->valid) { rxe_sched_task() { WARN_ON(rxe_read(task->qp) <= 0); } }     spin_unlock_irqrestore } spin_lock_irqsave qp->valid = 0 spin_unlock_irqrestore } Ensure the QP's     reference count is maintained and its validity is checked within the timer callbacks by adding calls to     rxe_get(qp) and corresponding rxe_put(qp) after use. (CVE-2026-45910)

  - In the Linux kernel, the following vulnerability has been resolved: ext4: fix e4b bitmap inconsistency     reports A bitmap inconsistency issue was observed during stress tests under mixed huge-page workloads.
    Ext4 reported multiple e4b bitmap check failures like: ext4_mb_complex_scan_group:2508: group 350, 8179     free clusters as per group info. But got 8192 blocks Analysis and experimentation confirmed that the issue     is caused by a race condition between page migration and bitmap modification. Although this timing window     is extremely narrow, it is still hit in practice: folio_lock ext4_mb_load_buddy __migrate_folio check ref     count folio_mc_copy __filemap_get_folio folio_try_get(folio) ...... mb_mark_used ext4_mb_unload_buddy
    __folio_migrate_mapping folio_ref_freeze folio_unlock The root cause of this issue is that the fast path     of load_buddy only increments the folio's reference count, which is insufficient to prevent concurrent     folio migration. We observed that the folio migration process acquires the folio lock. Therefore, we can     determine whether to take the fast path in load_buddy by checking the lock status. If the folio is locked,     we opt for the slow path (which acquires the lock) to close this concurrency window. Additionally, this     change addresses the following issues: When the DOUBLE_CHECK macro is enabled to inspect bitmap-related     issues, the following error may be triggered: corruption in group 324 at byte 784(6272): f in copy != ff     on disk/prealloc Analysis reveals that this is a false positive. There is a specific race window where the     bitmap and the group descriptor become momentarily inconsistent, leading to this error report:
    ext4_mb_load_buddy ext4_mb_load_buddy __filemap_get_folio(create|lock) folio_lock ext4_mb_init_cache     folio_mark_uptodate __filemap_get_folio(no lock) ...... mb_mark_used mb_mark_used_double mb_cmp_bitmaps     mb_set_bits(e4b->bd_bitmap) folio_unlock The original logic assumed that since mb_cmp_bitmaps is called     when the bitmap is newly loaded from disk, the folio lock would be sufficient to prevent concurrent     access. However, this overlooks a specific race condition: if another process attempts to load buddy and     finds the folio is already in an uptodate state, it will immediately begin using it without holding folio     lock. (CVE-2026-45942)

  - In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Validate pad and ICRC before     payload_size() in rxe_rcv rxe_rcv() currently checks only that the incoming packet is at least     header_size(pkt) bytes long before payload_size() is used. However, payload_size() subtracts both the     attacker-controlled BTH pad field and RXE_ICRC_SIZE from pkt->paylen: payload_size = pkt->paylen -     offset[RXE_PAYLOAD] - bth_pad(pkt) - RXE_ICRC_SIZE This means a short packet can still make payload_size()     underflow even if it includes enough bytes for the fixed headers. Simply requiring header_size(pkt) +     RXE_ICRC_SIZE is not sufficient either, because a packet with a forged non-zero BTH pad can still leave     payload_size() negative and pass an underflowed value to later receive-path users. Fix this by validating     pkt->paylen against the full minimum length required by payload_size(): header_size(pkt) + bth_pad(pkt) +     RXE_ICRC_SIZE. (CVE-2026-46043)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:72623 advisory.

    * kernel: ext4: fix e4b bitmap inconsistency reports (CVE-2026-45942)
      * kernel: RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (CVE-2026-46325)
      * kernel: crypto: af_alg - Cap AEAD AD length to 0x80000000 (CVE-2026-52972)
      * kernel: fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (CVE-2026-53341)
      * kernel: arm64: tlb: Flush walk cache when unsharing PMD tables (CVE-2026-63875)
      * kernel: RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CVE-2026-64102)
      * kernel: perf/core: Detach event groups during remove_on_exec (CVE-2026-64556)
      * kernel: crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CVE-2026-80522)
      * kernel: perf: Reject exited events as group leaders (CVE-2026-74753)


    Bug Fix(es) and Enhancement(s):

      * KVM: s390: Limit adapter indicator access to mapped page [almalinux-9.8.z] (JIRA:AlmaLinux-188656)
      * crypto: xxhash64 should not be fips approved [almalinux-9.8.z] (JIRA:AlmaLinux-256437)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-2026_72623 advisory.

    * kernel: ext4: fix e4b bitmap inconsistency reports (CVE-2026-45942)

    * kernel: RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (CVE-2026-46325)

    * kernel: crypto: af_alg - Cap AEAD AD length to 0x80000000 (CVE-2026-52972)

    * kernel: fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (CVE-2026-53341)

    * kernel: arm64: tlb: Flush walk cache when unsharing PMD tables (CVE-2026-63875)

    * kernel: RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CVE-2026-64102)

    * kernel: perf/core: Detach event groups during remove_on_exec (CVE-2026-64556)

    * kernel: crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CVE-2026-80522)

    * kernel: perf: Reject exited events as group leaders (CVE-2026-74753)

    Bug Fix(es) and Enhancement(s):

    * KVM: s390: Limit adapter indicator access to mapped page [rhel-9.8.z] (JIRA:Rocky Linux-188656)

    * crypto: xxhash64 should not be fips approved [rhel-9.8.z] (JIRA:Rocky Linux-256437)

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-72623 advisory.

    - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875}
    - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753}
    - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556}
    - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942}
    - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972}
    - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391]     {CVE-2026-53341}
    - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot)     [RHEL-254308] {CVE-2026-80522}
    - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788]     {CVE-2026-46325}
    - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566]     {CVE-2026-64102}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:72623 advisory.

    * kernel: ext4: fix e4b bitmap inconsistency reports (CVE-2026-45942)

    * kernel: RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (CVE-2026-46325)

    * kernel: crypto: af_alg - Cap AEAD AD length to 0x80000000 (CVE-2026-52972)

    * kernel: fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (CVE-2026-53341)

    * kernel: arm64: tlb: Flush walk cache when unsharing PMD tables (CVE-2026-63875)

    * kernel: RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CVE-2026-64102)

    * kernel: perf/core: Detach event groups during remove_on_exec (CVE-2026-64556)

    * kernel: crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CVE-2026-80522)

    * kernel: perf: Reject exited events as group leaders (CVE-2026-74753)

    Bug Fix(es) and Enhancement(s):

    * KVM: s390: Limit adapter indicator access to mapped page [rhel-9.8.z] (JIRA:Rocky Linux-188656)

    * crypto: xxhash64 should not be fips approved [rhel-9.8.z] (JIRA:Rocky Linux-256437)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:72623 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: ext4: fix e4b bitmap inconsistency reports (CVE-2026-45942)

    * kernel: RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (CVE-2026-46325)

    * kernel: crypto: af_alg - Cap AEAD AD length to 0x80000000 (CVE-2026-52972)

    * kernel: fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (CVE-2026-53341)

    * kernel: arm64: tlb: Flush walk cache when unsharing PMD tables (CVE-2026-63875)

    * kernel: RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CVE-2026-64102)

    * kernel: perf/core: Detach event groups during remove_on_exec (CVE-2026-64556)

    * kernel: crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CVE-2026-80522)

    * kernel: perf: Reject exited events as group leaders (CVE-2026-74753)

    Bug Fix(es) and Enhancement(s):

    * KVM: s390: Limit adapter indicator access to mapped page [rhel-9.8.z] (JIRA:RHEL-188656)

    * crypto: xxhash64 should not be fips approved [rhel-9.8.z] (JIRA:RHEL-256437)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 22.04 LTS / Pro Realtime 22.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-8656-1 advisory.

    Several security issues were discovered in the Linux kernel. An attacker could possibly use these to     compromise the system. This update corrects flaws in the following subsystems:

    - x86 architecture;

    - InfiniBand drivers;

    - Network drivers;

    - Mellanox network drivers;

    - File systems infrastructure;

    - IPv4 networking;

    - Network traffic control;

    - TCP network protocol;

    - B.A.T.M.A.N. meshing protocol;

    - IPv6 networking;

    - Multipath TCP;

    - Netfilter;

    - Open vSwitch;

    - RxRPC session sockets;

    - SCTP protocol;

    - SMC sockets; (CVE-2026-43083, CVE-2026-43197, CVE-2026-43198, CVE-2026-43465, CVE-2026-46242,     CVE-2026-46325, CVE-2026-46331, CVE-2026-52914, CVE-2026-52924, CVE-2026-52931, CVE-2026-53151,     CVE-2026-53176, CVE-2026-53212, CVE-2026-53215, CVE-2026-53224, CVE-2026-53225, CVE-2026-53228,     CVE-2026-53246, CVE-2026-53247, CVE-2026-53359, CVE-2026-64531)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 24.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-8545-1 advisory.

    Several security issues were discovered in the Linux kernel. An attacker could possibly use these to     compromise the system. This update corrects flaws in the following subsystems:

    - ARM64 architecture;

    - Block layer subsystem;

    - Cryptographic API;

    - DMA engine subsystem;

    - InfiniBand drivers;

    - STMicroelectronics network drivers;

    - Network drivers;

    - NVME drivers;

    - SCSI subsystem;

    - USB over IP driver;

    - File systems infrastructure;

    - Ext4 file system;

    - Network file system (NFS) server daemon;

    - SMB network file system;

    - Kernel thread helper (kthread);

    - IPv6 networking;

    - Tracing infrastructure;

    - Kernel exit() syscall;

    - Scatterlist API;

    - B.A.T.M.A.N. meshing protocol;

    - Ethernet bridge;

    - Ceph Core library;

    - IPv4 networking;

    - Multipath TCP;

    - Netfilter;

    - RxRPC session sockets;

    - SMC sockets;

    - X.25 network layer; (CVE-2026-22984, CVE-2026-23272, CVE-2026-23278, CVE-2026-23392, CVE-2026-23427,     CVE-2026-23428, CVE-2026-23450, CVE-2026-23455, CVE-2026-31402, CVE-2026-31418, CVE-2026-31436,     CVE-2026-31448, CVE-2026-31478, CVE-2026-31607, CVE-2026-31635, CVE-2026-31637, CVE-2026-31649,     CVE-2026-31657, CVE-2026-31659, CVE-2026-31668, CVE-2026-31669, CVE-2026-31682, CVE-2026-31685,     CVE-2026-31718, CVE-2026-43011, CVE-2026-43037, CVE-2026-43038, CVE-2026-43071, CVE-2026-43083,     CVE-2026-43114, CVE-2026-43117, CVE-2026-43125, CVE-2026-43185, CVE-2026-43186, CVE-2026-43197,     CVE-2026-43304, CVE-2026-43341, CVE-2026-43376, CVE-2026-43378, CVE-2026-43383, CVE-2026-43384,     CVE-2026-43402, CVE-2026-43406, CVE-2026-43407, CVE-2026-43414, CVE-2026-43493, CVE-2026-43501,     CVE-2026-45898, CVE-2026-45988, CVE-2026-46039, CVE-2026-46043, CVE-2026-46115, CVE-2026-46119,     CVE-2026-46135, CVE-2026-46185, CVE-2026-46195, CVE-2026-46243, CVE-2026-46244, CVE-2026-46266,     CVE-2026-46289, CVE-2026-46316, CVE-2026-46325)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 24.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-8508-1 advisory.

    Several security issues were discovered in the Linux kernel. An attacker could possibly use these to     compromise the system. This update corrects flaws in the following subsystems:

    - ARM64 architecture;

    - S390 architecture;

    - Block layer subsystem;

    - Cryptographic API;

    - DMA engine subsystem;

    - GPU drivers;

    - InfiniBand drivers;

    - Ethernet bonding driver;

    - STMicroelectronics network drivers;

    - Network drivers;

    - NVME drivers;

    - SCSI subsystem;

    - USB over IP driver;

    - File systems infrastructure;

    - Ext4 file system;

    - Network file system (NFS) server daemon;

    - SMB network file system;

    - Kernel thread helper (kthread);

    - Distributed Switch Architecture;

    - IPv6 networking;

    - Netfilter;

    - Tracing infrastructure;

    - Control group (cgroup);

    - Kernel exit() syscall;

    - Scatterlist API;

    - Memory management;

    - B.A.T.M.A.N. meshing protocol;

    - Ethernet bridge;

    - Ceph Core library;

    - IPv4 networking;

    - MAC80211 subsystem;

    - Multipath TCP;

    - Packet sockets;

    - RxRPC session sockets;

    - SMC sockets;

    - TLS protocol;

    - Unix domain sockets;

    - X.25 network layer;

    - AppArmor security module; (CVE-2025-71088, CVE-2025-71090, CVE-2025-71127, CVE-2025-71134,     CVE-2025-71141, CVE-2025-71142, CVE-2025-71144, CVE-2025-71152, CVE-2025-71155, CVE-2026-22984,     CVE-2026-23112, CVE-2026-23231, CVE-2026-23272, CVE-2026-23273, CVE-2026-23274, CVE-2026-23278,     CVE-2026-23351, CVE-2026-23392, CVE-2026-23394, CVE-2026-23427, CVE-2026-23428, CVE-2026-23450,     CVE-2026-23455, CVE-2026-31402, CVE-2026-31418, CVE-2026-31419, CVE-2026-31436, CVE-2026-31448,     CVE-2026-31478, CVE-2026-31504, CVE-2026-31533, CVE-2026-31607, CVE-2026-31635, CVE-2026-31637,     CVE-2026-31649, CVE-2026-31657, CVE-2026-31659, CVE-2026-31668, CVE-2026-31669, CVE-2026-31682,     CVE-2026-31685, CVE-2026-31718, CVE-2026-43011, CVE-2026-43033, CVE-2026-43037, CVE-2026-43038,     CVE-2026-43071, CVE-2026-43077, CVE-2026-43078, CVE-2026-43083, CVE-2026-43114, CVE-2026-43117,     CVE-2026-43125, CVE-2026-43186, CVE-2026-43197, CVE-2026-43304, CVE-2026-43341, CVE-2026-43376,     CVE-2026-43378, CVE-2026-43383, CVE-2026-43384, CVE-2026-43402, CVE-2026-43406, CVE-2026-43407,     CVE-2026-43414, CVE-2026-43493, CVE-2026-43501, CVE-2026-45898, CVE-2026-45966, CVE-2026-45988,     CVE-2026-46028, CVE-2026-46039, CVE-2026-46043, CVE-2026-46115, CVE-2026-46119, CVE-2026-46135,     CVE-2026-46185, CVE-2026-46195, CVE-2026-46243, CVE-2026-46244, CVE-2026-46266, CVE-2026-46289,     CVE-2026-46316, CVE-2026-46325)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 24.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-8491-1 advisory.

    Several security issues were discovered in the Linux kernel. An attacker could possibly use these to     compromise the system. This update corrects flaws in the following subsystems:

    - ARM64 architecture;

    - x86 architecture;

    - Block layer subsystem;

    - Cryptographic API;

    - DMA engine subsystem;

    - InfiniBand drivers;

    - STMicroelectronics network drivers;

    - Network drivers;

    - NVME drivers;

    - SCSI subsystem;

    - USB over IP driver;

    - File systems infrastructure;

    - Ext4 file system;

    - Network file system (NFS) server daemon;

    - SMB network file system;

    - Kernel thread helper (kthread);

    - IPv6 networking;

    - Tracing infrastructure;

    - Kernel exit() syscall;

    - Scatterlist API;

    - B.A.T.M.A.N. meshing protocol;

    - Ethernet bridge;

    - Ceph Core library;

    - IPv4 networking;

    - Multipath TCP;

    - Netfilter;

    - RxRPC session sockets;

    - SMC sockets;

    - X.25 network layer; (CVE-2026-22984, CVE-2026-23272, CVE-2026-23278, CVE-2026-23392, CVE-2026-23427,     CVE-2026-23428, CVE-2026-23450, CVE-2026-23455, CVE-2026-31402, CVE-2026-31418, CVE-2026-31436,     CVE-2026-31448, CVE-2026-31478, CVE-2026-31607, CVE-2026-31635, CVE-2026-31637, CVE-2026-31649,     CVE-2026-31657, CVE-2026-31659, CVE-2026-31668, CVE-2026-31669, CVE-2026-31682, CVE-2026-31685,     CVE-2026-31718, CVE-2026-43011, CVE-2026-43037, CVE-2026-43038, CVE-2026-43071, CVE-2026-43083,     CVE-2026-43114, CVE-2026-43117, CVE-2026-43125, CVE-2026-43186, CVE-2026-43197, CVE-2026-43304,     CVE-2026-43341, CVE-2026-43376, CVE-2026-43378, CVE-2026-43383, CVE-2026-43384, CVE-2026-43402,     CVE-2026-43406, CVE-2026-43407, CVE-2026-43414, CVE-2026-43493, CVE-2026-43501, CVE-2026-45898,     CVE-2026-45988, CVE-2026-46039, CVE-2026-46043, CVE-2026-46115, CVE-2026-46119, CVE-2026-46135,     CVE-2026-46185, CVE-2026-46195, CVE-2026-46243, CVE-2026-46244, CVE-2026-46266, CVE-2026-46289,     CVE-2026-46290, CVE-2026-46316, CVE-2026-46325)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 24.04 LTS / 25.10 host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-8490-1 advisory.

    Several security issues were discovered in the Linux kernel. An attacker could possibly use these to     compromise the system. This update corrects flaws in the following subsystems:

    - ARM64 architecture;

    - Block layer subsystem;

    - Cryptographic API;

    - DMA engine subsystem;

    - InfiniBand drivers;

    - STMicroelectronics network drivers;

    - Network drivers;

    - NVME drivers;

    - SCSI subsystem;

    - USB over IP driver;

    - File systems infrastructure;

    - Ext4 file system;

    - Network file system (NFS) server daemon;

    - SMB network file system;

    - Kernel thread helper (kthread);

    - IPv6 networking;

    - Tracing infrastructure;

    - Kernel exit() syscall;

    - Scatterlist API;

    - B.A.T.M.A.N. meshing protocol;

    - Ethernet bridge;

    - Ceph Core library;

    - IPv4 networking;

    - Multipath TCP;

    - Netfilter;

    - RxRPC session sockets;

    - SMC sockets;

    - X.25 network layer; (CVE-2026-22984, CVE-2026-23272, CVE-2026-23278, CVE-2026-23392, CVE-2026-23427,     CVE-2026-23428, CVE-2026-23450, CVE-2026-23455, CVE-2026-31402, CVE-2026-31418, CVE-2026-31436,     CVE-2026-31448, CVE-2026-31478, CVE-2026-31607, CVE-2026-31635, CVE-2026-31637, CVE-2026-31649,     CVE-2026-31657, CVE-2026-31659, CVE-2026-31668, CVE-2026-31669, CVE-2026-31682, CVE-2026-31685,     CVE-2026-31718, CVE-2026-43011, CVE-2026-43037, CVE-2026-43038, CVE-2026-43071, CVE-2026-43083,     CVE-2026-43114, CVE-2026-43117, CVE-2026-43125, CVE-2026-43186, CVE-2026-43197, CVE-2026-43304,     CVE-2026-43341, CVE-2026-43376, CVE-2026-43378, CVE-2026-43383, CVE-2026-43384, CVE-2026-43402,     CVE-2026-43406, CVE-2026-43407, CVE-2026-43414, CVE-2026-43493, CVE-2026-43501, CVE-2026-45898,     CVE-2026-45988, CVE-2026-46039, CVE-2026-46043, CVE-2026-46115, CVE-2026-46119, CVE-2026-46135,     CVE-2026-46185, CVE-2026-46195, CVE-2026-46243, CVE-2026-46244, CVE-2026-46266, CVE-2026-46289,     CVE-2026-46316, CVE-2026-46325)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE The current implementation incorrectly     handles memory regions (MRs) with page sizes different from the system PAGE_SIZE. The core issue is that     rxe_set_page() is called with mr->page_size step increments, but the page_list stores individual struct     page pointers, each representing PAGE_SIZE of memory. ib_sg_to_page() has ensured that when i>=1 either a)     SG[i-1].dma_end and SG[i].dma_addr are contiguous or b) SG[i-1].dma_end and SG[i].dma_addr are     mr->page_size aligned. This leads to incorrect iova-to-va conversion in scenarios: 1) page_size <     PAGE_SIZE (e.g., MR: 4K, system: 64K): ibmr->iova = 0x181800 sg[0]: dma_addr=0x181800, len=0x800 sg[1]:
    dma_addr=0x173000, len=0x1000 Access iova = 0x181800 + 0x810 = 0x182010 Expected VA: 0x173010 (second SG,     offset 0x10) Before fix: - index = (0x182010 >> 12) - (0x181800 >> 12) = 1 - page_offset = 0x182010 &     0xFFF = 0x10 - xarray[1] stores system page base 0x170000 - Resulting VA: 0x170000 + 0x10 = 0x170010     (wrong) 2) page_size > PAGE_SIZE (e.g., MR: 64K, system: 4K): ibmr->iova = 0x18f800 sg[0]:
    dma_addr=0x18f800, len=0x800 sg[1]: dma_addr=0x170000, len=0x1000 Access iova = 0x18f800 + 0x810 =     0x190010 Expected VA: 0x170010 (second SG, offset 0x10) Before fix: - index = (0x190010 >> 16) - (0x18f800     >> 16) = 1 - page_offset = 0x190010 & 0xFFFF = 0x10 - xarray[1] stores system page for dma_addr 0x170000 -     Resulting VA: system page of 0x170000 + 0x10 = 0x170010 (wrong) Yi Zhang reported a kernel panic[1] years     ago related to this defect. Solution: 1. Replace xarray with pre-allocated rxe_mr_page array for     sequential indexing (all MR page indices are contiguous) 2. Each rxe_mr_page stores both struct page* and     offset within the system page 3. Handle MR page_size != PAGE_SIZE relationships: - page_size > PAGE_SIZE:
    Split MR pages into multiple system pages - page_size <= PAGE_SIZE: Store offset within system page 4. Add     boundary checks and compatibility validation This ensures correct iova-to-va conversion regardless of MR     page size and system PAGE_SIZE relationship, while improving performance through array-based sequential     access. Tests on 4K and 64K PAGE_SIZE hosts: - rdma-core/pytests $ ./build/bin/run_tests.py --dev eth0_rxe
    - blktest: $ TIMEOUT=30 QUICK_RUN=1 USE_RXE=1 NVMET_TRTYPES=rdma ./check nvme srp rnbd [1]     https://lore.kernel.org/all/CAHj4cs9XRqE25jyVw9rj9YugffLn5+f=1znaBEnu1usLOciD+g@mail.gmail.com/T/     (CVE-2026-46325)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
363461	CentOS 9 : kernel-5.14.0-756.el9	Nessus	CentOS Local Security Checks	Local	critical
362419	AlmaLinux 9 : kernel (ALSA-2026:72623)	Nessus	Alma Linux Local Security Checks	Local	medium
359523	Rocky Linux 9 [CIQ] Security Update: kernel / kernel-64k / kernel-64k-core / kernel-64k-debug / etc Multiple Vulnerabilities (crlsa-2026_72623)	Nessus	Rocky Linux Local Security Checks	Local	medium
351477	Oracle Linux 9 : kernel (ELSA-2026-72623)	Nessus	Oracle Linux Local Security Checks	Local	medium
351446	RockyLinux 9 : kernel (RLSA-2026:72623)	Nessus	Rocky Linux Local Security Checks	Local	medium
351102	RHEL 9 : kernel (RHSA-2026:72623)	Nessus	Red Hat Local Security Checks	Local	medium
340687	Ubuntu 22.04 LTS / Pro Realtime 22.04 LTS : Linux kernel (HWE) vulnerabilities (USN-8656-1)	Nessus	Ubuntu Local Security Checks	Local	critical
327340	Ubuntu 24.04 LTS : Linux kernel (HWE) vulnerabilities (USN-8545-1)	Nessus	Ubuntu Local Security Checks	Local	high
325425	Ubuntu 24.04 LTS : Linux kernel (NVIDIA) vulnerabilities (USN-8508-1)	Nessus	Ubuntu Local Security Checks	Local	critical
325015	Ubuntu 24.04 LTS : Linux kernel (OEM) vulnerabilities (USN-8491-1)	Nessus	Ubuntu Local Security Checks	Local	high
325007	Ubuntu 24.04 LTS / 25.10 : Linux kernel vulnerabilities (USN-8490-1)	Nessus	Ubuntu Local Security Checks	Local	high
320144	Linux Distros Unpatched Vulnerability : CVE-2026-46325	Nessus	Misc.	Local	critical

Detections

Analytics

CVE-2026-46325

critical

Tenable Plugins

Coming Soon

critical

medium

medium

medium

medium

medium

critical

high

critical

high

high

critical