In the Linux kernel, the following vulnerability has been resolved: netfilter: nat: use kfree_rcu to release ops Florian Westphal says: "Historically this is not an issue, even for normal base hooks: the data path doesn't use the original nf_hook_ops that are used to register the callbacks. However, in v5.14 I added the ability to dump the active netfilter hooks from userspace. This code will peek back into the nf_hook_ops that are available at the tail of the pointer-array blob used by the datapath. The nat hooks are special, because they are called indirectly from the central nat dispatcher hook. They are currently invisible to the nfnl hook dump subsystem though. But once that changes the nat ops structures have to be deferred too." Update nf_nat_register_fn() to deal with partial exposition of the hooks from error path which can be also an issue for nfnetlink_hook.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:55445 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: iommu: disable SVA when CONFIG_X86 is set (CVE-2025-71089)

    * kernel: crypto: seqiv - Do not use req->iv after crypto_aead_encrypt (CVE-2025-71131)

    * kernel: scsi: core: Wake up the error handler when final completions race against each other     (CVE-2026-23110)

    * kernel: mm: thp: deny THP for files on anonymous inodes (CVE-2026-23375)

    * kernel: netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CVE-2026-23455)

    * kernel: drm/amd/display: Do not skip unrelated mode changes in DSC validation (CVE-2026-31488)

    * kernel: ALSA: usb-audio: Add sanity check for OOB writes at silencing (CVE-2026-43279)

    * kernel: rxrpc: Fix potential UAF after skb_unshare() failure (CVE-2026-45998)

    * kernel: Arm Processors: Privilege escalation or information disclosure via writes to higher exception     level resources (CVE-2025-10263)

    * kernel: netfilter: nat: use kfree_rcu to release ops (CVE-2026-53000)

    * kernel: dm log: fix out-of-bounds write due to region_count overflow (CVE-2026-53059)

    * kernel: net/sched: act_api: use RCU with deferred freeing for action lifecycle (CVE-2026-53264)

    Bug Fix(es) and Enhancement(s):

    * backport make module and modules-core provides use variant [rhel-10.0.z] (JIRA:RHEL-219433)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - netfilter: nat: use kfree_rcu to release ops Florian Westphal says: Historically this is not an issue,     even for normal base hooks: the data path doesn't use the original nf_hook_ops that are used to register     the callbacks. However, in v5.14 I added the ability to dump the active netfilter hooks from userspace.
    This code will peek back into the nf_hook_ops that are available at the tail of the pointer-array blob     used by the datapath. The nat hooks are special, because they are called indirectly from the central nat     dispatcher hook. They are currently invisible to the nfnl hook dump subsystem though. But once that     changes the nat ops structures have to be deferred too. Update nf_nat_register_fn() to deal with partial     exposition of the hooks from error path which can be also an issue for nfnetlink_hook. (CVE-2026-53000)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
341024	SUSE SLED15: cluster-md-kmp-default / dlm-kmp-default / gfs2-kmp-default / etc (SUSE-SU-2026:3790-1)	Nessus	SuSE Local Security Checks	Local	high
340681	Ubuntu 24.04 LTS / 26.04 LTS / Pro Realtime 24.04 LTS : Linux kernel (NVIDIA) vulnerabilities (USN-8663-1)	Nessus	Ubuntu Local Security Checks	Local	high
340045	Ubuntu 26.04 LTS : Linux kernel (NVIDIA BaseOS) vulnerabilities (USN-8664-1)	Nessus	Ubuntu Local Security Checks	Local	high
335963	RHEL 10 : kernel (RHSA-2026:55445)	Nessus	Red Hat Local Security Checks	Local	high
335080	openSUSE 16: cluster-md-kmp-64kb / cluster-md-kmp-azure / cluster-md-kmp-default / etc (openSUSE-SU-2026:21555-1)	Nessus	SuSE Local Security Checks	Local	high
322718	Linux Distros Unpatched Vulnerability : CVE-2026-53000	Nessus	Misc.	Local	high
322020	Amazon Linux 2023 : bpftool6.18, kernel6.18, kernel6.18-devel (ALAS2023-2026-1866)	Nessus	Amazon Linux Local Security Checks	Local	high

Detections

Analytics

CVE-2026-53000

high

Tenable Plugins

high

high

high

high

high

high

high