In the Linux kernel, the following vulnerability has been resolved: netfilter: nat: use kfree_rcu to release ops Florian Westphal says: "Historically this is not an issue, even for normal base hooks: the data path doesn't use the original nf_hook_ops that are used to register the callbacks. However, in v5.14 I added the ability to dump the active netfilter hooks from userspace. This code will peek back into the nf_hook_ops that are available at the tail of the pointer-array blob used by the datapath. The nat hooks are special, because they are called indirectly from the central nat dispatcher hook. They are currently invisible to the nfnl hook dump subsystem though. But once that changes the nat ops structures have to be deferred too." Update nf_nat_register_fn() to deal with partial exposition of the hooks from error path which can be also an issue for nfnetlink_hook.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:68100 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: fanotify: fix false positive on permission events (CVE-2026-46150)

    * kernel: io_uring/poll: fix signed comparison in io_poll_get_ownership() (CVE-2026-52933)

    * kernel: netfilter: nat: use kfree_rcu to release ops (CVE-2026-53000)

    * kernel: scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd()     (CVE-2026-63888)

    * kernel: scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (CVE-2026-63887)

    * kernel: Kernel: Remote out-of-bounds write in RDMA/siw (CVE-2026-64268)

    * kernel: crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (CVE-2026-64438)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:67720 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CVE-2026-46117)

    * kernel: fanotify: fix false positive on permission events (CVE-2026-46150)

    * kernel: netfilter: nat: use kfree_rcu to release ops (CVE-2026-53000)

    * kernel: memfd: deny writeable mappings when implying SEAL_WRITE (CVE-2026-63952)

    * kernel: scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd()     (CVE-2026-63888)

    * kernel: scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (CVE-2026-63887)

    * kernel: smb: client: fix double-free in SMB2_open() replay (CVE-2026-64382)

    * kernel: smb: client: fix query directory replay double-free (CVE-2026-64387)

    * kernel: Kernel: Remote out-of-bounds write in RDMA/siw (CVE-2026-64268)

    * kernel: crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (CVE-2026-64438)

    * kernel: Linux kernel: Arbitrary code execution via userfaultfd shadow stack manipulation     (CVE-2026-68166)

    Bug Fix(es) and Enhancement(s):

    * [ice] Unexplained random cTE values on NAC and CF [rhel-9.6.z] (JIRA:RHEL-186494)

    * CLONE - netfilter: nftables CVE and memory safety backports for 9.6 (JIRA:RHEL-240165)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:64808 advisory.

    * kernel: can: bcm: add locking for bcm_op runtime updates (CVE-2025-38004)
      * kernel: io_uring/poll: fix signed comparison in io_poll_get_ownership() (CVE-2026-52933)
      * kernel: netfilter: nat: use kfree_rcu to release ops (CVE-2026-53000)
      * kernel: smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CVE-2026-64136)
      * kernel: nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CVE-2026-64320)
      * kernel: nvmet-auth: validate reply message payload bounds against transfer length (CVE-2026-64319)
      * kernel: KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (CVE-2026-64287)
      * kernel: smb: client: fix change notify replay double-free (CVE-2026-64384)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-648080 advisory.

    - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287}
    - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot)     [RHEL-234145] {CVE-2026-64319}
    - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot)     [RHEL-228852] {CVE-2026-64136}
    - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107]     {CVE-2026-52933}
    - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384}
    - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614]     {CVE-2026-64320}
    - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699]     {CVE-2025-38004}
    - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699]     {CVE-2025-38004}
    - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004}
    - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:64808 advisory.

    * kernel: can: bcm: add locking for bcm_op runtime updates (CVE-2025-38004)

    * kernel: io_uring/poll: fix signed comparison in io_poll_get_ownership() (CVE-2026-52933)

    * kernel: netfilter: nat: use kfree_rcu to release ops (CVE-2026-53000)

    * kernel: smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CVE-2026-64136)

    * kernel: nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CVE-2026-64320)

    * kernel: nvmet-auth: validate reply message payload bounds against transfer length (CVE-2026-64319)

    * kernel: KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (CVE-2026-64287)

    * kernel: smb: client: fix change notify replay double-free (CVE-2026-64384)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:64808 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: can: bcm: add locking for bcm_op runtime updates (CVE-2025-38004)

    * kernel: io_uring/poll: fix signed comparison in io_poll_get_ownership() (CVE-2026-52933)

    * kernel: netfilter: nat: use kfree_rcu to release ops (CVE-2026-53000)

    * kernel: smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CVE-2026-64136)

    * kernel: nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CVE-2026-64320)

    * kernel: nvmet-auth: validate reply message payload bounds against transfer length (CVE-2026-64319)

    * kernel: KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (CVE-2026-64287)

    * kernel: smb: client: fix change notify replay double-free (CVE-2026-64384)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:55445 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: iommu: disable SVA when CONFIG_X86 is set (CVE-2025-71089)

    * kernel: crypto: seqiv - Do not use req->iv after crypto_aead_encrypt (CVE-2025-71131)

    * kernel: scsi: core: Wake up the error handler when final completions race against each other     (CVE-2026-23110)

    * kernel: mm: thp: deny THP for files on anonymous inodes (CVE-2026-23375)

    * kernel: netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CVE-2026-23455)

    * kernel: drm/amd/display: Do not skip unrelated mode changes in DSC validation (CVE-2026-31488)

    * kernel: ALSA: usb-audio: Add sanity check for OOB writes at silencing (CVE-2026-43279)

    * kernel: rxrpc: Fix potential UAF after skb_unshare() failure (CVE-2026-45998)

    * kernel: Arm Processors: Privilege escalation or information disclosure via writes to higher exception     level resources (CVE-2025-10263)

    * kernel: netfilter: nat: use kfree_rcu to release ops (CVE-2026-53000)

    * kernel: dm log: fix out-of-bounds write due to region_count overflow (CVE-2026-53059)

    * kernel: net/sched: act_api: use RCU with deferred freeing for action lifecycle (CVE-2026-53264)

    Bug Fix(es) and Enhancement(s):

    * backport make module and modules-core provides use variant [rhel-10.0.z] (JIRA:RHEL-219433)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - netfilter: nat: use kfree_rcu to release ops Florian Westphal says: Historically this is not an issue,     even for normal base hooks: the data path doesn't use the original nf_hook_ops that are used to register     the callbacks. However, in v5.14 I added the ability to dump the active netfilter hooks from userspace.
    This code will peek back into the nf_hook_ops that are available at the tail of the pointer-array blob     used by the datapath. The nat hooks are special, because they are called indirectly from the central nat     dispatcher hook. They are currently invisible to the nfnl hook dump subsystem though. But once that     changes the nat ops structures have to be deferred too. Update nf_nat_register_fn() to deal with partial     exposition of the hooks from error path which can be also an issue for nfnetlink_hook. (CVE-2026-53000)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
346284	RHEL 9 : kernel (RHSA-2026:68100)	Nessus	Red Hat Local Security Checks	Local	critical
346180	RHEL 9 : kernel (RHSA-2026:67720)	Nessus	Red Hat Local Security Checks	Local	critical
344840	AlmaLinux 9 : kernel (ALSA-2026:64808)	Nessus	Alma Linux Local Security Checks	Local	high
344603	Oracle Linux 9 : ELSA-2026-64808-0: / kernel (ELSA-2026-648080)	Nessus	Oracle Linux Local Security Checks	Local	high
344410	RockyLinux 9 : kernel (RLSA-2026:64808)	Nessus	Rocky Linux Local Security Checks	Local	high
343857	RHEL 9 : kernel (RHSA-2026:64808)	Nessus	Red Hat Local Security Checks	Local	high
343532	Ubuntu 24.04 LTS / Pro Realtime 24.04 LTS : Linux kernel (GCP) vulnerabilities (USN-8728-1)	Nessus	Ubuntu Local Security Checks	Local	high
341024	SUSE SLED15: cluster-md-kmp-default / dlm-kmp-default / gfs2-kmp-default / etc (SUSE-SU-2026:3790-1)	Nessus	SuSE Local Security Checks	Local	high
340681	Ubuntu 24.04 LTS / 26.04 LTS / Pro Realtime 24.04 LTS : Linux kernel (NVIDIA) vulnerabilities (USN-8663-1)	Nessus	Ubuntu Local Security Checks	Local	high
340045	Ubuntu 26.04 LTS : Linux kernel (NVIDIA BaseOS) vulnerabilities (USN-8664-1)	Nessus	Ubuntu Local Security Checks	Local	high
335963	RHEL 10 : kernel (RHSA-2026:55445)	Nessus	Red Hat Local Security Checks	Local	high
335080	openSUSE 16: cluster-md-kmp-64kb / cluster-md-kmp-azure / cluster-md-kmp-default / etc (openSUSE-SU-2026:21555-1)	Nessus	SuSE Local Security Checks	Local	high
322718	Linux Distros Unpatched Vulnerability : CVE-2026-53000	Nessus	Misc.	Local	high
322020	Amazon Linux 2023 : bpftool6.18, kernel6.18, kernel6.18-devel (ALAS2023-2026-1866)	Nessus	Amazon Linux Local Security Checks	Local	high

Detections

Analytics

CVE-2026-53000

high

Tenable Plugins

critical

critical

high

high

high

high

high

high

high

high

high

high

high

high