In the Linux kernel, the following vulnerability has been resolved: ice: fix double-free of tx_buf skb If ice_tso() or ice_tx_csum() fail, the error path in ice_xmit_frame_ring() frees the skb, but the 'first' tx_buf still points to it and is marked as valid (ICE_TX_BUF_SKB). 'next_to_use' remains unchanged, so the potential problem will likely fix itself when the next packet is transmitted and the tx_buf gets overwritten. But if there is no next packet and the interface is brought down instead, ice_clean_tx_ring() -> ice_unmap_and_free_tx_buf() will find the tx_buf and free the skb for the second time. The fix is to reset the tx_buf type to ICE_TX_BUF_EMPTY in the error path, so that ice_unmap_and_free_tx_buf(). Move the initialization of 'first' up, to ensure it's already valid in case we hit the linearization error path. The bug was spotted by AI while I had it looking for something else. It also proposed an initial version of the patch. I reproduced the bug and tested the fix by adding code to inject failures, on a build with KASAN. I looked for similar bugs in related Intel drivers and did not find any.

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-099005 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    ice: fix double-free of tx_buf skb

    If ice_tso() or ice_tx_csum() fail, the error path in     ice_xmit_frame_ring() frees the skb, but the 'first' tx_buf still points     to it and is marked as valid (ICE_TX_BUF_SKB).
    'next_to_use' remains unchanged, so the potential problem will     likely fix itself when the next packet is transmitted and the tx_buf     gets overwritten. But if there is no next packet and the interface is     brought down instead, ice_clean_tx_ring() -> ice_unmap_and_free_tx_buf()     will find the tx_buf and free the skb for the second time.

    The fix is to reset the tx_buf type to ICE_TX_BUF_EMPTY in the error     path, so that ice_unmap_and_free_tx_buf().
    Move the initialization of 'first' up, to ensure it's already valid in     case we hit the linearization error path.

    The bug was spotted by AI while I had it looking for something else.
    It also proposed an initial version of the patch.

    I reproduced the bug and tested the fix by adding code to inject     failures, on a build with KASAN.

    I looked for similar bugs in related Intel drivers and did not find any.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-54246 advisory.

    - udf: fix partition descriptor append bookkeeping (Ravi Singh) [RHEL-179571] {CVE-2026-45991}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:54247 advisory.

    * kernel: udf: fix partition descriptor append bookkeeping (CVE-2026-45991)
      * kernel: ice: fix double-free of tx_buf skb (CVE-2026-53009)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:54246 advisory.

    * kernel: udf: fix partition descriptor append bookkeeping (CVE-2026-45991)

    * kernel: ice: fix double-free of tx_buf skb (CVE-2026-53009)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:54247 advisory.

    * kernel: udf: fix partition descriptor append bookkeeping (CVE-2026-45991)

    * kernel: ice: fix double-free of tx_buf skb (CVE-2026-53009)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:54246 advisory.

    * kernel: udf: fix partition descriptor append bookkeeping (CVE-2026-45991)
      * kernel: ice: fix double-free of tx_buf skb (CVE-2026-53009)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:54246 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: udf: fix partition descriptor append bookkeeping (CVE-2026-45991)

    * kernel: ice: fix double-free of tx_buf skb (CVE-2026-53009)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:54247 advisory.

    The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with     extremely high determinism requirements.

    Security Fix(es):

    * kernel: udf: fix partition descriptor append bookkeeping (CVE-2026-45991)

    * kernel: ice: fix double-free of tx_buf skb (CVE-2026-53009)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the linux package has been released.

The remote AlmaLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:42919 advisory.

    * kernel: crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CVE-2025-71113)
      * kernel: Linux kernel: Denial of Service due to memory leak in tpm2_load_cmd (CVE-2025-71147)
      * kernel: flex_proportions: make fprop_new_period() hardirq safe (CVE-2026-23168)
      * kernel: cxl/port: Fix use after free of parent_port in cxl_detach_ep() (CVE-2026-31530)
      * kernel: xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (CVE-2026-46116)
      * kernel: fanotify: fix false positive on permission events (CVE-2026-46150)
      * kernel: drm: Set old handle to NULL before prime swap in change_handle (CVE-2026-46215)
      * kernel: drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CVE-2026-52976)
      * kernel: drm/xe/dma-buf: fix UAF with retry loop (CVE-2026-52950)
      * kernel: ice: fix double-free of tx_buf skb (CVE-2026-53009)
      * kernel: Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CVE-2026-53071)
      * kernel: can: bcm: thrtimer use-after-free during RX operation teardown ()


    Bug Fix(es) and Enhancement(s):

      * nfsd_file slab cache objects remaining on kmem_cache_shutdown during nfsd teardown while running     bz1477872 testcase (JIRA:AlmaLinux-173103)
      * tools/lib/perf/Makefile: libperf includes appended after CFLAGS causes parallel build race, breaking     kernel builds [almalinux-10.2.z] (JIRA:AlmaLinux-183975)
      * [AlmaLinux10-debug]: BUG: KASAN: slab-use-after-free in __pv_queued_spin_lock_slowpath     [almalinux-10.2.z] (JIRA:AlmaLinux-186311)
      * ice: driver update 2026-06, part 1 [almalinux-10.2.z] (JIRA:AlmaLinux-191324)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-42919 advisory.

    - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150}
    - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-191324 RHEL-192200] {CVE-2026-53009}
    - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-191324]     {CVE-2026-46162}
    - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-191324]     {CVE-2026-43346}
    - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Jakub Ramaseuski) [RHEL-191324]     {CVE-2026-23166}
    - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (CKI Backport Bot) [RHEL-189604] {CVE-2025-71147}
    - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CKI Backport Bot) [RHEL-189576]     {CVE-2025-71113}
    - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188644]     {CVE-2026-52976}
    - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180167]     {CVE-2026-46116}
    - drm/xe/dma-buf: fix UAF with retry loop (Karol Herbst) [RHEL-192232] {CVE-2026-52950}
    - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179887]     {CVE-2026-46215}
    - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180697]     {CVE-2026-31530}
    - flex_proportions: make fprop_new_period() hardirq safe (CKI Backport Bot) [RHEL-189658] {CVE-2026-23168}
    - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188331]     {CVE-2026-53071}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:42919 advisory.

    * kernel: crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CVE-2025-71113)

    * kernel: Linux kernel: Denial of Service due to memory leak in tpm2_load_cmd (CVE-2025-71147)

    * kernel: flex_proportions: make fprop_new_period() hardirq safe (CVE-2026-23168)

    * kernel: cxl/port: Fix use after free of parent_port in cxl_detach_ep() (CVE-2026-31530)

    * kernel: xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (CVE-2026-46116)

    * kernel: fanotify: fix false positive on permission events (CVE-2026-46150)

    * kernel: drm: Set old handle to NULL before prime swap in change_handle (CVE-2026-46215)

    * kernel: drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CVE-2026-52976)

    * kernel: drm/xe/dma-buf: fix UAF with retry loop (CVE-2026-52950)

    * kernel: ice: fix double-free of tx_buf skb (CVE-2026-53009)

    * kernel: Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CVE-2026-53071)

    * kernel: can: bcm: thrtimer use-after-free during RX operation teardown ()

    Bug Fix(es) and Enhancement(s):

    * nfsd_file slab cache objects remaining on kmem_cache_shutdown during nfsd teardown while running     bz1477872 testcase (JIRA:Rocky Linux-173103)

    * tools/lib/perf/Makefile: libperf includes appended after CFLAGS causes parallel build race, breaking     kernel builds [rhel-10.2.z] (JIRA:Rocky Linux-183975)

    * [Rocky Linux10-debug]: BUG: KASAN: slab-use-after-free in __pv_queued_spin_lock_slowpath [rhel-10.2.z]     (JIRA:Rocky Linux-186311)

    * ice: driver update 2026-06, part 1 [rhel-10.2.z] (JIRA:Rocky Linux-191324)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:42919 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CVE-2025-71113)

    * kernel: Linux kernel: Denial of Service due to memory leak in tpm2_load_cmd (CVE-2025-71147)

    * kernel: flex_proportions: make fprop_new_period() hardirq safe (CVE-2026-23168)

    * kernel: cxl/port: Fix use after free of parent_port in cxl_detach_ep() (CVE-2026-31530)

    * kernel: xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (CVE-2026-46116)

    * kernel: fanotify: fix false positive on permission events (CVE-2026-46150)

    * kernel: drm: Set old handle to NULL before prime swap in change_handle (CVE-2026-46215)

    * kernel: drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CVE-2026-52976)

    * kernel: drm/xe/dma-buf: fix UAF with retry loop (CVE-2026-52950)

    * kernel: ice: fix double-free of tx_buf skb (CVE-2026-53009)

    * kernel: Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CVE-2026-53071)

    * kernel: can: bcm: thrtimer use-after-free during RX operation teardown ()

    Bug Fix(es) and Enhancement(s):

    * nfsd_file slab cache objects remaining on kmem_cache_shutdown during nfsd teardown while running     bz1477872 testcase (JIRA:RHEL-173103)

    * tools/lib/perf/Makefile: libperf includes appended after CFLAGS causes parallel build race, breaking     kernel builds [rhel-10.2.z] (JIRA:RHEL-183975)

    * [RHEL10-debug]: BUG: KASAN: slab-use-after-free in __pv_queued_spin_lock_slowpath [rhel-10.2.z]     (JIRA:RHEL-186311)

    * ice: driver update 2026-06, part 1 [rhel-10.2.z] (JIRA:RHEL-191324)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - ice: fix double-free of tx_buf skb If ice_tso() or ice_tx_csum() fail, the error path in     ice_xmit_frame_ring() frees the skb, but the 'first' tx_buf still points to it and is marked as valid     (ICE_TX_BUF_SKB). 'next_to_use' remains unchanged, so the potential problem will likely fix itself when     the next packet is transmitted and the tx_buf gets overwritten. But if there is no next packet and the     interface is brought down instead, ice_clean_tx_ring() -> ice_unmap_and_free_tx_buf() will find the tx_buf     and free the skb for the second time. The fix is to reset the tx_buf type to ICE_TX_BUF_EMPTY in the error     path, so that ice_unmap_and_free_tx_buf(). Move the initialization of 'first' up, to ensure it's already     valid in case we hit the linearization error path. The bug was spotted by AI while I had it looking for     something else. It also proposed an initial version of the patch. I reproduced the bug and tested the fix     by adding code to inject failures, on a build with KASAN. I looked for similar bugs in related Intel     drivers and did not find any. (CVE-2026-53009)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
340681	Ubuntu 24.04 LTS / 26.04 LTS / Pro Realtime 24.04 LTS : Linux kernel (NVIDIA) vulnerabilities (USN-8663-1)	Nessus	Ubuntu Local Security Checks	Local	high
340270	Unity Linux 20.1050a Security Update: kernel (UTSA-2026-099005)	Nessus	Unity Linux Local Security Checks	Local	high
340045	Ubuntu 26.04 LTS : Linux kernel (NVIDIA BaseOS) vulnerabilities (USN-8664-1)	Nessus	Ubuntu Local Security Checks	Local	high
337881	Oracle Linux 8 : kernel (ELSA-2026-54246)	Nessus	Oracle Linux Local Security Checks	Local	high
335191	AlmaLinux 8 : kernel-rt (ALSA-2026:54247)	Nessus	Alma Linux Local Security Checks	Local	high
335120	RockyLinux 8 : kernel (RLSA-2026:54246)	Nessus	Rocky Linux Local Security Checks	Local	high
335119	RockyLinux 8 : kernel-rt (RLSA-2026:54247)	Nessus	Rocky Linux Local Security Checks	Local	high
335080	openSUSE 16: cluster-md-kmp-64kb / cluster-md-kmp-azure / cluster-md-kmp-default / etc (openSUSE-SU-2026:21555-1)	Nessus	SuSE Local Security Checks	Local	high
334945	AlmaLinux 8 : kernel (ALSA-2026:54246)	Nessus	Alma Linux Local Security Checks	Local	high
334851	RHEL 8 : kernel (RHSA-2026:54246)	Nessus	Red Hat Local Security Checks	Local	high
334846	RHEL 8 : kernel-rt (RHSA-2026:54247)	Nessus	Red Hat Local Security Checks	Local	high
333944	Photon OS 5.0: Linux PHSA-2026-5.0-92-0864	Nessus	PhotonOS Local Security Checks	Local	high
329317	AlmaLinux 10 : kernel (ALSA-2026:42919)	Nessus	Alma Linux Local Security Checks	Local	high
329205	Oracle Linux 10 : kernel (ELSA-2026-42919)	Nessus	Oracle Linux Local Security Checks	Local	high
329181	RockyLinux 10 : kernel (RLSA-2026:42919)	Nessus	Rocky Linux Local Security Checks	Local	high
329149	SUSE SLED15: cluster-md-kmp-default / dlm-kmp-default / gfs2-kmp-default / etc (SUSE-SU-2026:3166-1)	Nessus	SuSE Local Security Checks	Local	medium
328856	RHEL 10 : kernel (RHSA-2026:42919)	Nessus	Red Hat Local Security Checks	Local	high
322691	Linux Distros Unpatched Vulnerability : CVE-2026-53009	Nessus	Misc.	Local	high
322107	Amazon Linux 2023 : bpftool6.12, kernel6.12, kernel6.12-devel (ALAS2023-2026-1894)	Nessus	Amazon Linux Local Security Checks	Local	high
322020	Amazon Linux 2023 : bpftool6.18, kernel6.18, kernel6.18-devel (ALAS2023-2026-1866)	Nessus	Amazon Linux Local Security Checks	Local	high
318773	Photon OS 5.0: Linux PHSA-2026-5.0-0864	Nessus	PhotonOS Local Security Checks	Local	high

Detections

Analytics

CVE-2026-53009

high

Tenable Plugins

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

medium

high

high

high

high

high