In the Linux kernel, the following vulnerability has been resolved: sctp: disable BH before calling udp_tunnel_xmit_skb() udp_tunnel_xmit_skb() / udp_tunnel6_xmit_skb() are expected to run with BH disabled. After commit 6f1a9140ecda ("add xmit recursion limit to tunnel xmit functions"), on the path: udp(6)_tunnel_xmit_skb() -> ip(6)tunnel_xmit() dev_xmit_recursion_inc()/dec() must stay balanced on the same CPU. Without local_bh_disable(), the context may move between CPUs, which can break the inc/dec pairing. This may lead to incorrect recursion level detection and cause packets to be dropped in ip(6)_tunnel_xmit() or __dev_queue_xmit(). Fix it by disabling BH around both IPv4 and IPv6 SCTP UDP xmit paths. In my testing, after enabling the SCTP over UDP: # ip net exec ha sysctl -w net.sctp.udp_port=9899 # ip net exec ha sysctl -w net.sctp.encap_port=9899 # ip net exec hb sysctl -w net.sctp.udp_port=9899 # ip net exec hb sysctl -w net.sctp.encap_port=9899 # ip net exec ha iperf3 -s - without this patch: # ip net exec hb iperf3 -c 192.168.0.1 --sctp [ 5] 0.00-10.00 sec 37.2 MBytes 31.2 Mbits/sec sender [ 5] 0.00-10.00 sec 37.1 MBytes 31.1 Mbits/sec receiver - with this patch: # ip net exec hb iperf3 -c 192.168.0.1 --sctp [ 5] 0.00-10.00 sec 3.14 GBytes 2.69 Gbits/sec sender [ 5] 0.00-10.00 sec 3.14 GBytes 2.69 Gbits/sec receiver

An update of the linux package has been released.

According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    netdevsim: zero initialize struct iphdr in dummy sk_buff(CVE-2026-52985)

    drm/amd/display: Wrap DCN32 phantom-plane allocation in DC_RUN_WITH_PREEMPTION_ENABLED(CVE-2026-53285)

    ipv4: restrict IPOPT_SSRR and IPOPT_LSRR options(CVE-2026-53249)

    RDMA: During rereg_mr ensure that REREG_ACCESS is compatible(CVE-2026-52908)

    sctp: disable BH before calling udp_tunnel_xmit_skb()(CVE-2026-53070)

    thermal: core: Fix thermal zone device registration error path(CVE-2026-43332)

    vrf: Fix a potential NPD when removing a port from a VRF(CVE-2026-52925)

    netfilter: nfnetlink_osf: fix out-of-bounds read on option matching(CVE-2026-52999)

    USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr()(CVE-2026-53195)

    netfilter: nft_fib: fix stale stack leak via the OIFNAME register(CVE-2026-53134)

    crypto: ccp - copy IV using skcipher ivsize(CVE-2026-53016)

    KVM: x86: Fix shadow paging use-after-free due to unexpected GFN(CVE-2026-46113)

    signal: clear JOBCTL_PENDING_MASK for caller in zap_other_threads()(CVE-2026-53352)

    netfilter: nf_conntrack_sip: don't use simple_strtoul(CVE-2026-52986)

    inet: frags: fix use-after-free caused by the fqdir_pre_exit() flush(CVE-2026-53175)

    ipc/shm: serialize orphan cleanup with shm_nattch updates(CVE-2026-52930)

    Improper isolation of shared resources within the CPU operation cache on Zen 2-based products could allow     an attacker to corrupt instructions executed at a different privilege level, potentially resulting in     privilege escalation.(CVE-2025-54518)

    netfilter: x_tables: avoid leaking percpu counter pointers(CVE-2026-53219)

    fs/fcntl: fix SOFTIRQ-unsafe lock order in fasync signaling(CVE-2026-52946)

    net/sched: act_api: use RCU with deferred freeing for action lifecycle(CVE-2026-53264)

    udp: clear skb-dev before running a sockmap verdict(CVE-2026-53184)

    block: add pgmap check to biovec_phys_mergeable(CVE-2026-46115)

    bpf, sockmap: Fix af_unix null-ptr-deref in proto update(CVE-2026-53034)

    nfs: return EISDIR on nfs3_proc_create if d_alias is a dir(CVE-2026-43470)

    netfilter: nf_tables: use list_del_rcu for netlink hooks(CVE-2026-46324)

    mm/huge_memory: update file PMD counter before folio_put()(CVE-2026-53189)

    bpf, arm64: Fix off-by-one in check_imm signed range check(CVE-2026-53036)

    fsnotify: fix inode reference leak in fsnotify_recalc_mask()(CVE-2026-52990)

    drm/amd/display: Avoid NULL dereference in dc_dmub_srv error paths(CVE-2026-53313)

    macvlan: fix macvlan_get_size() not reserving space for IFLA_MACVLAN_BC_CUTOFF(CVE-2026-53013)

    mm/memory-failure: fix hugetlb_lock AA deadlock in get_huge_page_for_hwpoison(CVE-2026-53207)

    i2c: dev: prevent integer overflow in I2C_TIMEOUT ioctl(CVE-2026-52948)

    USB: serial: omninet: fix memory corruption with small endpoint(CVE-2026-63928)

    netfilter: ip6t_hbh: reject oversized option lists(CVE-2026-52915)

    ice: fix NULL pointer dereference in ice_reset_all_vfs()(CVE-2026-53289)

    sctp: purge outqueue on stale COOKIE-ECHO handling(CVE-2026-52924)

    dm cache: fix dirty mapping checking in passthrough mode switching(CVE-2026-53061)

    md: wake raid456 reshape waiters before suspend(CVE-2026-53123)

    apparmor: fix rlimit for posix cpu timers(CVE-2026-46328)

    KVM: x86: check for nEPT/nNPT in slow flush hypercalls(CVE-2026-46131)

    dm cache policy smq: check allocation under invalidate lock(CVE-2026-53265)

    crypto: af_alg - Cap AEAD AD length to 0x80000000(CVE-2026-52972)

    thunderbolt: Bound root directory content to block size(CVE-2026-53149)

    dm cache: fix null-deref with concurrent writes in passthrough mode(CVE-2026-53064)

    sctp: validate embedded INIT chunk and address list lengths in cookie(CVE-2026-53224)

    mm/damon/sysfs-schemes: protect memcg_path kfree() with damon_sysfs_lock(CVE-2026-46121)

    smb/client: fix possible infinite loop and oob read in symlink_data()(CVE-2026-52967)

    ALSA: hda/conexant: Fix missing error check for jack detection(CVE-2026-53291)

    nexthop: fix IPv6 route referencing IPv4 nexthop(CVE-2026-53012)

    mailbox: add sanity check for channel array(CVE-2026-53295)

    USB: serial: cypress_m8: fix memory corruption with small endpoint(CVE-2026-63956)

    bpf: Free reuseport cBPF prog after RCU grace period.(CVE-2026-52910)

    ipv6: sit: reload inner IPv6 header after GSO offloads(CVE-2026-53228)

    crypto: hisilicon/sec2 - prevent req used-after-free for sec(CVE-2026-53055)

    drm/virtio: fix dma_fence refcount leak on error in virtio_gpu_dma_fence_wait()(CVE-2026-53190)

    iommu/vt-d: Fix oops due to out of scope access(CVE-2026-52953)

    netfilter: bridge: make ebt_snat ARP rewrite writable(CVE-2026-53266)

    bpf: Fix same-register dst/src OOB read and pointer leak in sock_ops(CVE-2026-53078)

    thunderbolt: Validate XDomain request packet size before type cast(CVE-2026-53147)

    sched/psi: fix race between file release and pressure write(CVE-2026-52991)

    fuse: limit FUSE_NOTIFY_RETRIEVE to uptodate folios(CVE-2026-53167)

    hv_netvsc: use kmap_local_page in netvsc_copy_to_send_buf(CVE-2026-53199)

    drm/amd/display: Fix out-of-bounds read in dp_get_eq_aux_rd_interval()(CVE-2026-53330)

    ipc: limit next_id allocation to the valid ID range(CVE-2026-52923)

    dm cache: fix write hang in passthrough mode(CVE-2026-53063)

    sctp: diag: reject stale associations in dump_one path(CVE-2026-52917)

    bpf: Fix OOB in pcpu_init_value(CVE-2026-53076)

    net/802/mrp: fix vector attribute parsing in mrp_pdu_parse_vecattr(CVE-2026-53245)

    sctp: stream: fully roll back denied add-stream state(CVE-2026-52929)

    selinux: allow multiple opens of /sys/fs/selinux/policy(CVE-2026-46302)

    vsock/virtio: fix potential unbounded skb queue(CVE-2026-53132)

    scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf(CVE-2026-63887)

    ipv6: fix possible UAF in icmpv6_rcv()(CVE-2026-53006)

    bpf: Fix NULL deref in map_kptr_match_type for scalar regs(CVE-2026-53032)

    apparmor: Fix  Optimize table creation from possibly unaligned memory(CVE-2026-45893)

    l2tp: pppol2tp: hold reference to session in pppol2tp_ioctl()(CVE-2026-53262)

    mm/hugetlb: restore reservation on error in hugetlb folio copy paths(CVE-2026-53154)

    thunderbolt: Reject zero-length property entries in validator(CVE-2026-53150)

    crypto: caam - guard HMAC key hex dumps in hash_digest_key(CVE-2026-46291)

    netfilter: revalidate bridge ports(CVE-2026-53220)

    padata: Put CPU offline callback in ONLINE section to allow failure(CVE-2026-53314)

    USB: serial: keyspan: fix missing indat transfer sanity check(CVE-2026-63900)

    bpf, sockmap: Fix af_unix iter deadlock(CVE-2026-53035)

    drm/amd/display: Clamp VBIOS HDMI retimer register count to array size(CVE-2026-53136)

    scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd()(CVE-2026-63888)

    bpf, sockmap: Take state lock for af_unix iter(CVE-2026-53033)

    bpf: Use RCU-safe iteration in dev_map_redirect_multi() SKB path(CVE-2026-53096)

    bonding: fix type confusion in bond_setup_by_slave()(CVE-2026-43456)

    USB: serial: belkin_sa: validate interrupt status length(CVE-2026-63903)

    netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check(CVE-2026-52998)

    scsi: target: iscsi: Validate CHAP_R length before base64 decode(CVE-2026-63886)

    net: phy: clean the sfp upstream if phy probing fails(CVE-2026-53232)

    netfilter: nf_queue: hold bridge skb-dev while queued(CVE-2026-52912)

    netfilter: nf_conntrack: destroy stale expectfn expectations on unregister(CVE-2026-53349)

    netfilter: nft_exthdr: fix register tracking for F_PRESENT flag(CVE-2026-53218)

    selinux: fix overlayfs mmap() and mprotect() access checks(CVE-2026-46054)

    futex: Prevent lockup in requeue-PI during signal/ timeout wakeup(CVE-2026-52977)

    Arm C1-Ultra, C1-Premium, Neoverse V3  V3AE, Neoverse V2, Neoverse V1, Neoverse-N2, Neoverse-N1,     Cortex-X925, Cortex-X4, Cortex-X3, Cortex-X2, Cortex-X1  X1C, Cortex-A710, Cortex-A78, A78AE  A78C,     Cortex-A77, Cortex-A76  A76A may allow writes to resources owned by a higher exception     level.(CVE-2025-10263)

    netfilter: nft_tunnel: fix use-after-free on object destroy(CVE-2026-53212)

    io-wq: check that the predecessor is hashed in io_wq_remove_pending()(CVE-2026-46274)

    thunderbolt: Limit XDomain response copy to actual frame size(CVE-2026-53146)

    ipv6: Fix out-of-bound access in fib6_add_rt2node().(CVE-2026-46260)

    sctp: fix uninit-value in __sctp_rcv_asconf_lookup()(CVE-2026-53225)

    fuse: reject fuse_notify() pagecache ops on directories(CVE-2026-53168)

    USB: serial: cypress_m8: validate interrupt packet headers(CVE-2026-63902)

    ACPI: processor: Fix previous acpi_processor_errata_piix4() fix(CVE-2026-23443)

    netfilter: nft_inner: Fix IPv6 inner_thoff desync(CVE-2026-46244)

    af_unix: Drop all SCM attributes for SOCKMAP.(CVE-2026-53005)

    tun: free page on build_skb failure in tun_xdp_one()(CVE-2026-46322)

    netfilter: synproxy: add mutex to guard hook reference counting(CVE-2026-53269)

    udf: reject descriptors with oversized CRC length(CVE-2026-53369)

    ext4: fix bounds check in check_xattrs() to prevent out-of-bounds access(CVE-2026-46094)

    crypto: jitterentropy - replace long-held spinlock with mutex(CVE-2026-52936)

    ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup()(CVE-2026-53221)

    zram: fix use-after-free in zram_bvec_write_partial()(CVE-2026-53185)

    af_unix: Reject SIOCATMARK on non-stream sockets(CVE-2026-52928)

    efi: Fix reservation of unaccepted memory table(CVE-2026-45851)

    netfilter: nft_ct: fix missing expect put in obj eval(CVE-2026-52970)

    net/sched: netem: fix queue limit check to include reordered packets(CVE-2026-52984)

    ACPICA: Fix NULL pointer dereference in acpi_ev_address_space_dispatch()(CVE-2026-45982)

    qed: fix double free in qed_cxt_tables_alloc()(CVE-2026-64118)

    regulator: core: fix locking in regulator_resolve_supply() error path(CVE-2026-46252)

    mm/vmalloc: take vmap_purge_lock in shrinker(CVE-2026-46093)

    netfilter: require Ethernet MAC header before using eth_hdr()(CVE-2026-53131)

    sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing(CVE-2026-53246)

    net: guard timestamp cmsgs to real error queue skbs(CVE-2026-53223)

    quota: Fix race of dquot_scan_active() with quota deactivation(CVE-2026-53050)

    RDMA/umem: Fix truncation for block sizes = 4G(CVE-2026-53133)

    vdpa: use generic driver_override infrastructure(CVE-2026-53118)

    drm/amd/display: Use krealloc_array() in dal_vector_reserve()(CVE-2026-53329)

    io_uring/poll: fix signed comparison in io_poll_get_ownership()(CVE-2026-52933)

    net: gro: don't merge zcopy skbs(CVE-2026-46323)

    netfilter: ebtables: fix OOB read in compat_mtw_from_user(CVE-2026-52927)

    netfilter: conntrack: remove sprintf usage(CVE-2026-53002)

    tap: fix stack info leak in tap_ioctl() SIOCGIFHWADDR(CVE-2026-52937)

    dm log: fix out-of-bounds write due to region_count overflow(CVE-2026-53059)

    inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP(CVE-2026-46266)

    netfilter: xt_policy: fix strict mode inbound policy matching(CVE-2026-52920)

    iommu/amd: Fix clone_alias() to use the original device's devid(CVE-2026-53053)

    bpf: Fix stale offload-prog pointer after constant blinding(CVE-2026-53094)

    netlabel: validate unlabeled address and mask attribute lengths(CVE-2026-53238)

    media: videobuf2: Set vma_flags in vb2_dma_sg_mmap(CVE-2026-46312)

    pmdomain: core: Fix detach procedure for virtual devices in genpd(CVE-2026-46292)

    erofs: fix use-after-free on sbi-sync_decompress(CVE-2026-53272)

    audit: fix incorrect inheritable capability in CAPSET records(CVE-2026-53287)

    nvmet-tcp: propagate nvmet_tcp_build_pdu_iovec() errors to its callers(CVE-2026-52989)

    ipvs: clear the svc scheduler ptr early on edit(CVE-2026-53270)

    net: pull headers in qdisc_pkt_len_segs_init()(CVE-2026-53091)

    sctp: fix OOB write to userspace in sctp_getsockopt_peer_auth_chunks(CVE-2026-53004)

    bpf: test_run: Fix the null pointer dereference issue in bpf_lwt_xmit_push_encap(CVE-2026-53111)

    ixgbevf: fix use-after-free in VEPA multicast source pruning(CVE-2026-64113)

    netfilter: xtables: restrict several matches to inet family(CVE-2026-53001)

    usb: typec: altmodes/displayport: validate count before reading Status Update VDO(CVE-2026-63961)

    ppp: require CAP_NET_ADMIN in target netns for unattached ioctls(CVE-2026-53075)

    net: tls: fix strparser anchor skb leak on offload RX setup failure(CVE-2026-52974)

    thunderbolt: Clamp XDomain response data copy to allocation size(CVE-2026-53148)

    locking/rtmutex: Skip remove_waiter() when waiter is not enqueued(CVE-2026-53163)

    bpf: Fix ld_{abs,ind} failure path analysis in subprogs(CVE-2026-53090)

    ice: fix double-free of tx_buf skb(CVE-2026-53009)

    net: openvswitch: fix possible kfree_skb of ERR_PTR(CVE-2026-53227)

    xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx()(CVE-2026-53239)

    USB: serial: mct_u232: fix missing interrupt-in transfer sanity check(CVE-2026-63897)

    ip6_vti: set netns_immutable on the fallback device.(CVE-2026-52909)

    HID: usbhid: fix deadlock in hid_post_reset()(CVE-2026-53037)

    smb: client: fix potential UAF and double free in smb2_open_file()(CVE-2026-45972)

    bnxt_en: Fix NULL pointer dereference(CVE-2026-53177)

    netfilter: nf_log: validate MAC header was set before dumping it(CVE-2026-52942)

    dm cache policy smq: fix missing locks in invalidating cache blocks(CVE-2026-53062)

    USB: serial: io_ti: fix heap overflow in get_manuf_info()(CVE-2026-53196)

    netfilter: ipset: stop hash:* range iteration at end(CVE-2026-52921)

    bpf: reject short IPv4/IPv6 inputs in bpf_prog_test_run_skb(CVE-2026-53074)

    netfilter: conntrack_irc: fix possible out-of-bounds read(CVE-2026-53268)

    drm/amd/display: Bound VBIOS record-chain walk loops(CVE-2026-53138)

    scsi: target: core: Fix integer overflow in UNMAP bounds check(CVE-2026-53021)

    erofs: unify lcn as u64 for 32-bit platforms(CVE-2026-53015)

    dm cache metadata: fix memory leak on metadata abort retry(CVE-2026-53060)

    nfsd: fix posix_acl leak on SETACL decode failure(CVE-2026-53397)

    USB: serial: kl5kusb105: fix bulk-out buffer overflow(CVE-2026-53194)

    net, bpf: fix null-ptr-deref in xdp_master_redirect() for down master(CVE-2026-53069)

    bonding: 3ad: implement proper RCU rules for port-aggregator(CVE-2026-52975)

    scsi: sg: Resolve soft lockup issue when opening /dev/sgX(CVE-2026-53304)

    fs/mbcache: cancel shrink work before destroying the cache(CVE-2026-53129)

    lib/scatterlist: fix length calculations in extract_kvec_to_sg(CVE-2026-46289)

    fuse: re-lock request before replacing page cache folio(CVE-2026-53388)

    neigh: let neigh_xmit take skb ownership(CVE-2026-52981)

    netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase(CVE-2026-52988)

    tcp: restrict SO_ATTACH_FILTER to priv users(CVE-2026-53236)

    netfilter: nft_ct: bail out on template ct in get eval(CVE-2026-53267)

    ipv6: mcast: Fix use-after-free when processing MLD queries(CVE-2026-53275)

    net: skbuff: fix missing zerocopy reference in pskb_carve helpers(CVE-2026-52943)

    net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list(CVE-2026-53230)

    net/mlx5e: xsk: Fix DMA and xdp_frame leak on XDP_TX xmit failure(CVE-2026-53229)

    netfilter: nat: use kfree_rcu to release ops(CVE-2026-53000)

    tcp: secure_seq: add back ports to TS offset(CVE-2026-23247)

Tenable has extracted the preceding description block directly from the EulerOS kernel security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - In the Linux kernel, the following vulnerability has been resolved: sctp: disable BH before calling
    udp_tunnel_xmit_skb() udp_tunnel_xmit_skb() / udp_tunnel6_xmit_skb() are expected to run with BH disabled.
    After commit 6f1a9140ecda ("add xmit recursion limit to tunnel xmit functions"), on the path:
    udp(6)_tunnel_xmit_skb() -> ip(6)tunnel_xmit() dev_xmit_recursion_inc()/dec() must stay balanced on the
    same CPU. Without local_bh_disable(), the context may move between CPUs, which can break the inc/dec
    pairing. This may lead to incorrect recursion level detection and cause packets to be dropped in
    ip(6)_tunnel_xmit() or __dev_queue_xmit(). Fix it by disabling BH around both IPv4 and IPv6 SCTP UDP xmit
    paths. In my testing, after enabling the SCTP over UDP: # ip net exec ha sysctl -w net.sctp.udp_port=9899
    # ip net exec ha sysctl -w net.sctp.encap_port=9899 # ip net exec hb sysctl -w net.sctp.udp_port=9899 # ip
    net exec hb sysctl -w net.sctp.encap_port=9899 # ip net exec ha iperf3 -s - without this patch: # ip net
    exec hb iperf3 -c 192.168.0.1 --sctp [ 5] 0.00-10.00 sec 37.2 MBytes 31.2 Mbits/sec sender [ 5] 0.00-10.00
    sec 37.1 MBytes 31.1 Mbits/sec receiver - with this patch: # ip net exec hb iperf3 -c 192.168.0.1 --sctp [
    5] 0.00-10.00 sec 3.14 GBytes 2.69 Gbits/sec sender [ 5] 0.00-10.00 sec 3.14 GBytes 2.69 Gbits/sec
    receiver (CVE-2026-53070)

The remote Ubuntu 24.04 LTS / Pro Realtime 24.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-8781-1 advisory.

    It was discovered that some Arm processors could complete a broadcast translation lookaside buffer (TLB)     invalidation before memory writes made through the invalidated translation were globally observed. A local     attacker could possibly use this to write to memory after permission to do so had been revoked, bypassing     memory protections or escalating privileges. (CVE-2025-10263)

    Several security issues were discovered in the Linux kernel. An attacker could possibly use these to     compromise the system. This update corrects flaws in the following subsystems:

    - ARM64 architecture;

    - User-space API (UAPI);

    - Kernel build system;

    - ARM32 architecture;

    - PowerPC architecture;

    - RISC-V architecture;

    - S390 architecture;

    - User-Mode Linux (UML);

    - x86 architecture;

    - Cryptographic API;

    - Intel NPU Driver;

    - Compute Acceleration Framework;

    - ACPI drivers;

    - Drivers core;

    - DRBD Distributed Replicated Block Device drivers;

    - Rados block device (RBD) driver;

    - Ublk userspace block driver;

    - Compressed RAM block device driver;

    - Bluetooth drivers;

    - Hardware crypto device drivers;

    - CXL (Compute Express Link) drivers;

    - Arm Firmware Framework for ARMv8-A(FFA);

    - EFI core;

    - FPGA Framework;

    - GPU drivers;

    - HID subsystem;

    - Hardware monitoring drivers;

    - I2C subsystem;

    - I3C subsystem;

    - InfiniBand drivers;

    - Input Device core drivers;

    - Input Device (Mouse) drivers;

    - IOMMU subsystem;

    - Multiple devices driver;

    - Media drivers;

    - Fastrpc Driver;

    - Network drivers;

    - Mellanox network drivers;

    - Microsoft Azure Network Adapter (MANA) driver;

    - MediaTek network drivers;

    - NVME drivers;

    - Operating Performance Points (OPP) driver;

    - PCI subsystem;

    - PTP clock framework;

    - RPMSG subsystem;

    - SCSI subsystem;

    - SoundWire subsystem;

    - SPI subsystem;

    - Greybus lights staging drivers;

    - Media staging drivers;

    - NVIDIA Tegra embedded controller (NVEC) staging driver;

    - Realtek RTL8723BS SDIO drivers;

    - TCM subsystem;

    - Trusted Execution Environment drivers;

    - Thunderbolt and USB4 drivers;

    - TTY drivers;

    - USB Gadget drivers;

    - USB Dual Role (OTG-ready) Controller drivers;

    - USB Serial drivers;

    - vDPA drivers;

    - VFIO drivers;

    - Virtio Host (VHOST) subsystem;

    - Virtio drivers;

    - Xen hypervisor drivers;

    - 9P distributed file system;

    - AFS file system;

    - File systems infrastructure;

    - BTRFS file system;

    - Ceph distributed file system;

    - exFAT file system;

    - F2FS file system;

    - GFS2 file system;

    - HFS file system;

    - HFS+ file system;

    - JFS file system;

    - Network file systems library;

    - Network file system (NFS) client;

    - Network file system (NFS) server daemon;

    - NTFS3 file system;

    - OCFS2 file system;

    - OrangeFS file system;

    - SMB network file system;

    - BPF subsystem;

    - File system encryption (fscrypt);

    - Software nodes and device properties;

    - IPv4 networking;

    - KVM subsystem;

    - Mellanox drivers;

    - Memory management;

    - Networking core;

    - Netfilter;

    - Socket messages infrastructure;

    - MediaTek SoC drivers;

    - Sun RPC protocol;

    - Network traffic control;

    - IPv6 networking;

    - Amateur Radio drivers;

    - Bluetooth subsystem;

    - IP tunnels definitions;

    - KCM (Kernel Connection Multiplexor) sockets driver;

    - MultiProtocol Label Switching driver;

    - TCP network protocol;

    - XFRM subsystem;

    - Tracing infrastructure;

    - io_uring subsystem;

    - Control group (cgroup);

    - Perf events;

    - IRQ subsystem;

    - Locking primitives;

    - KProbes tracing;

    - 9P file system network protocol;

    - B.A.T.M.A.N. meshing protocol;

    - Ethernet bridge;

    - CAN network layer;

    - Ceph Core library;

    - Handshake API;

    - HSR network protocol;

    - IFE protocol;

    - L2TP protocol;

    - MAC80211 subsystem;

    - IEEE 802.15.4 subsystem;

    - Multipath TCP;

    - NFC subsystem;

    - Open vSwitch;

    - Phonet protocol;

    - RDS protocol;

    - RxRPC session sockets;

    - SCTP protocol;

    - SMC sockets;

    - TIPC protocol;

    - TLS protocol;

    - Unix domain sockets;

    - VMware vSockets driver;

    - Wireless networking;

    - X.25 network layer;

    - eXpress Data Path;

    - Rust bindings mechanism;

    - AppArmor security module;

    - Key management;

    - Linux Security Modules (LSM) Framework;

    - SELinux security module;

    - ALSA framework;

    - AudioScience HPI driver;

    - Intel ASoC drivers;

    - USB sound devices; (CVE-2024-14040, CVE-2024-35948, CVE-2024-41008, CVE-2024-43872, CVE-2024-44932,     CVE-2024-44964, CVE-2024-49932, CVE-2024-49940, CVE-2024-50106, CVE-2024-50217, CVE-2024-52560,     CVE-2024-53098, CVE-2024-56552, CVE-2024-56591, CVE-2024-57857, CVE-2024-58089, CVE-2024-58094,     CVE-2024-58098, CVE-2024-58100, CVE-2024-58241, CVE-2025-21687, CVE-2025-21693, CVE-2025-21984,     CVE-2025-21985, CVE-2025-22104, CVE-2025-22108, CVE-2025-22109, CVE-2025-23132, CVE-2025-37776,     CVE-2025-37876, CVE-2025-37906, CVE-2025-38064, CVE-2025-38069, CVE-2025-38187, CVE-2025-38204,     CVE-2025-38206, CVE-2025-38242, CVE-2025-38498, CVE-2025-38563, CVE-2025-38565, CVE-2025-38636,     CVE-2025-38717, CVE-2025-39677, CVE-2025-39789, CVE-2025-39859, CVE-2025-39862, CVE-2025-39896,     CVE-2025-39933, CVE-2025-39958, CVE-2025-39990, CVE-2025-40025, CVE-2025-40040, CVE-2025-40054,     CVE-2025-40064, CVE-2025-40074, CVE-2025-40075, CVE-2025-40139, CVE-2025-40158, CVE-2025-40168,     CVE-2025-40170, CVE-2025-40203, CVE-2025-40274, CVE-2025-40344, CVE-2025-40354, CVE-2025-68174,     CVE-2025-68304, CVE-2025-68360, CVE-2025-68745, CVE-2025-68822, CVE-2025-71073, CVE-2025-71074,     CVE-2025-71202, CVE-2025-71289, CVE-2026-23208, CVE-2026-23239, CVE-2026-23240, CVE-2026-23327,     CVE-2026-23393, CVE-2026-23469, CVE-2026-31420, CVE-2026-31479, CVE-2026-31486, CVE-2026-31493,     CVE-2026-31560, CVE-2026-31568, CVE-2026-31630, CVE-2026-31663, CVE-2026-31771, CVE-2026-43009,     CVE-2026-43029, CVE-2026-43042, CVE-2026-43048, CVE-2026-43101, CVE-2026-43116, CVE-2026-43126,     CVE-2026-43172, CVE-2026-43213, CVE-2026-43263, CVE-2026-43303, CVE-2026-43352, CVE-2026-43353,     CVE-2026-43464, CVE-2026-45850, CVE-2026-45894, CVE-2026-45932, CVE-2026-45944, CVE-2026-46054,     CVE-2026-46130, CVE-2026-46158, CVE-2026-46170, CVE-2026-46175, CVE-2026-46181, CVE-2026-46203,     CVE-2026-46275, CVE-2026-46315, CVE-2026-46320, CVE-2026-46324, CVE-2026-46330, CVE-2026-52908,     CVE-2026-52909, CVE-2026-52910, CVE-2026-52912, CVE-2026-52915, CVE-2026-52916, CVE-2026-52918,     CVE-2026-52919, CVE-2026-52921, CVE-2026-52922, CVE-2026-52926, CVE-2026-52934, CVE-2026-52941,     CVE-2026-52956, CVE-2026-52988, CVE-2026-52991, CVE-2026-53000, CVE-2026-53005, CVE-2026-53009,     CVE-2026-53024, CVE-2026-53025, CVE-2026-53053, CVE-2026-53070, CVE-2026-53078, CVE-2026-53089,     CVE-2026-53090, CVE-2026-53091, CVE-2026-53109, CVE-2026-53118, CVE-2026-53120, CVE-2026-53129,     CVE-2026-53131, CVE-2026-53132, CVE-2026-53133, CVE-2026-53148, CVE-2026-53159, CVE-2026-53182,     CVE-2026-53183, CVE-2026-53185, CVE-2026-53186, CVE-2026-53196, CVE-2026-53198, CVE-2026-53216,     CVE-2026-53217, CVE-2026-53221, CVE-2026-53230, CVE-2026-53232, CVE-2026-53239, CVE-2026-53250,     CVE-2026-53254, CVE-2026-53256, CVE-2026-53262, CVE-2026-53264, CVE-2026-53266, CVE-2026-53269,     CVE-2026-53270, CVE-2026-53273, CVE-2026-53275, CVE-2026-53281, CVE-2026-53284, CVE-2026-53354,     CVE-2026-53355, CVE-2026-53357, CVE-2026-53358, CVE-2026-53361, CVE-2026-53368, CVE-2026-53384,     CVE-2026-53398, CVE-2026-53399, CVE-2026-63795, CVE-2026-63796, CVE-2026-63797, CVE-2026-63800,     CVE-2026-63801, CVE-2026-63804, CVE-2026-63807, CVE-2026-63808, CVE-2026-63815, CVE-2026-63818,     CVE-2026-63825, CVE-2026-63828, CVE-2026-63829, CVE-2026-63830, CVE-2026-63831, CVE-2026-63853,     CVE-2026-63858, CVE-2026-63886, CVE-2026-63887, CVE-2026-63888, CVE-2026-63893, CVE-2026-63906,     CVE-2026-63912, CVE-2026-63914, CVE-2026-63915, CVE-2026-63916, CVE-2026-63917, CVE-2026-63919,     CVE-2026-63921, CVE-2026-63922, CVE-2026-63924, CVE-2026-63926, CVE-2026-63940, CVE-2026-63944,     CVE-2026-63945, CVE-2026-63946, CVE-2026-63947, CVE-2026-63948, CVE-2026-63952, CVE-2026-63974,     CVE-2026-63975, CVE-2026-63976, CVE-2026-63978, CVE-2026-63979, CVE-2026-63980, CVE-2026-63984,     CVE-2026-63992, CVE-2026-63993, CVE-2026-63994, CVE-2026-64000, CVE-2026-64007, CVE-2026-64010,     CVE-2026-64011, CVE-2026-64015, CVE-2026-64018, CVE-2026-64025, CVE-2026-64029, CVE-2026-64032,     CVE-2026-64033, CVE-2026-64034, CVE-2026-64039, CVE-2026-64046, CVE-2026-64047, CVE-2026-64048,     CVE-2026-64051, CVE-2026-64055, CVE-2026-64056, CVE-2026-64064, CVE-2026-64073, CVE-2026-64076,     CVE-2026-64077, CVE-2026-64082, CVE-2026-64083, CVE-2026-64084, CVE-2026-64085, CVE-2026-64086,     CVE-2026-64087, CVE-2026-64088, CVE-2026-64089, CVE-2026-64091, CVE-2026-64092, CVE-2026-64093,     CVE-2026-64096, CVE-2026-64097, CVE-2026-64098, CVE-2026-64099, CVE-2026-64102, CVE-2026-64103,     CVE-2026-64106, CVE-2026-64108, CVE-2026-64109, CVE-2026-64111, CVE-2026-64112, CVE-2026-64113,     CVE-2026-64114, CVE-2026-64115, CVE-2026-64116, CVE-2026-64117, CVE-2026-64118, CVE-2026-64121,     CVE-2026-64125, CVE-2026-64126, CVE-2026-64127, CVE-2026-64128, CVE-2026-64133, CVE-2026-64134,     CVE-2026-64135, CVE-2026-64136, CVE-2026-64137, CVE-2026-64138, CVE-2026-64144, CVE-2026-64147,     CVE-2026-64148, CVE-2026-64153, CVE-2026-64155, CVE-2026-64160, CVE-2026-64163, CVE-2026-64165,     CVE-2026-64166, CVE-2026-64168, CVE-2026-64170, CVE-2026-64173, CVE-2026-64174, CVE-2026-64177,     CVE-2026-64178, CVE-2026-64179, CVE-2026-64180, CVE-2026-64182, CVE-2026-64183, CVE-2026-64184,     CVE-2026-64185, CVE-2026-64191, CVE-2026-64206, CVE-2026-64214, CVE-2026-64217, CVE-2026-64218,     CVE-2026-64219, CVE-2026-64220, CVE-2026-64221, CVE-2026-64225, CVE-2026-64231, CVE-2026-64237,     CVE-2026-64247, CVE-2026-64249, CVE-2026-64268, CVE-2026-64269, CVE-2026-64280, CVE-2026-64303,     CVE-2026-64313, CVE-2026-64315, CVE-2026-64319, CVE-2026-64320, CVE-2026-64355, CVE-2026-64361,     CVE-2026-64364, CVE-2026-64382, CVE-2026-64383, CVE-2026-64384, CVE-2026-64385, CVE-2026-64386,     CVE-2026-64387, CVE-2026-64390, CVE-2026-64391, CVE-2026-64392, CVE-2026-64393, CVE-2026-64394,     CVE-2026-64396, CVE-2026-64397, CVE-2026-64399, CVE-2026-64400, CVE-2026-64408, CVE-2026-64438,     CVE-2026-64441, CVE-2026-64445, CVE-2026-64450, CVE-2026-64475, CVE-2026-64510, CVE-2026-64518,     CVE-2026-64523, CVE-2026-64529, CVE-2026-64530, CVE-2026-64534, CVE-2026-64535, CVE-2026-64541,     CVE-2026-64548, CVE-2026-64551, CVE-2026-64552, CVE-2026-64554, CVE-2026-64555, CVE-2026-64557,     CVE-2026-64561, CVE-2026-64562, CVE-2026-64564, CVE-2026-64586, CVE-2026-64597, CVE-2026-64598,     CVE-2026-68082, CVE-2026-68083, CVE-2026-68117, CVE-2026-68123, CVE-2026-68124, CVE-2026-68127,     CVE-2026-68136, CVE-2026-68137, CVE-2026-68138, CVE-2026-68144, CVE-2026-68147, CVE-2026-68152,     CVE-2026-68154, CVE-2026-68156, CVE-2026-68158, CVE-2026-68159, CVE-2026-68160, CVE-2026-68161,     CVE-2026-68162, CVE-2026-68198, CVE-2026-68206, CVE-2026-68209, CVE-2026-68210, CVE-2026-68213,     CVE-2026-68228, CVE-2026-68229, CVE-2026-68300, CVE-2026-68302, CVE-2026-68343, CVE-2026-68381,     CVE-2026-68388, CVE-2026-68426, CVE-2026-68431, CVE-2026-68457, CVE-2026-68461, CVE-2026-68470,     CVE-2026-68476, CVE-2026-68477, CVE-2026-72014, CVE-2026-72020, CVE-2026-72033, CVE-2026-72041,     CVE-2026-72065, CVE-2026-72069, CVE-2026-72071, CVE-2026-72083, CVE-2026-72084, CVE-2026-72085,     CVE-2026-72098, CVE-2026-72111, CVE-2026-72124, CVE-2026-72125, CVE-2026-72126, CVE-2026-72129,     CVE-2026-72130, CVE-2026-72191, CVE-2026-72192, CVE-2026-72194, CVE-2026-72200, CVE-2026-72217,     CVE-2026-72221, CVE-2026-72222, CVE-2026-72226, CVE-2026-72234, CVE-2026-72251, CVE-2026-72255,     CVE-2026-72288, CVE-2026-72289, CVE-2026-72296, CVE-2026-72299, CVE-2026-72317, CVE-2026-72318,     CVE-2026-72319, CVE-2026-72320, CVE-2026-72322, CVE-2026-72323, CVE-2026-72329, CVE-2026-72339,     CVE-2026-72348, CVE-2026-72351, CVE-2026-72380, CVE-2026-72383, CVE-2026-72398, CVE-2026-72399,     CVE-2026-72421, CVE-2026-72422, CVE-2026-72434, CVE-2026-72436, CVE-2026-72451, CVE-2026-72454,     CVE-2026-72466, CVE-2026-72472, CVE-2026-72473, CVE-2026-72487, CVE-2026-72488, CVE-2026-72489,     CVE-2026-72491, CVE-2026-72494, CVE-2026-72495, CVE-2026-72496, CVE-2026-72499, CVE-2026-74255,     CVE-2026-74264, CVE-2026-74267, CVE-2026-74268, CVE-2026-74269, CVE-2026-74279, CVE-2026-74280,     CVE-2026-74287, CVE-2026-74302, CVE-2026-74305, CVE-2026-74310, CVE-2026-74345, CVE-2026-74350,     CVE-2026-74376, CVE-2026-74384, CVE-2026-74394, CVE-2026-74398, CVE-2026-74401, CVE-2026-74405,     CVE-2026-74406, CVE-2026-74407, CVE-2026-74408, CVE-2026-74410, CVE-2026-74411, CVE-2026-74417,     CVE-2026-74427, CVE-2026-74436, CVE-2026-74439, CVE-2026-74440, CVE-2026-74473, CVE-2026-74474,     CVE-2026-74475, CVE-2026-74476, CVE-2026-74478, CVE-2026-74480, CVE-2026-74493, CVE-2026-74495,     CVE-2026-74521, CVE-2026-74538, CVE-2026-74541, CVE-2026-74556, CVE-2026-74569)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2014 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    ipv6: use RCU in ip6_output() (CVE-2025-40158)

    In the Linux kernel, the following vulnerability has been resolved:

    gpio: Fix resource leaks on errors in gpiochip_add_data_with_key() (CVE-2026-31732)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf: Reject sleepable kprobe_multi programs at attach time (CVE-2026-43010)

    In the Linux kernel, the following vulnerability has been resolved:

    net: Drop the lock in skb_may_tx_timestamp() (CVE-2026-43216)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf: Fix tcx/netkit detach permissions when prog fd isn't given (CVE-2026-45932)

    In the Linux kernel, the following vulnerability has been resolved:

    ip6_vti: set netns_immutable on the fallback device. (CVE-2026-52909)

    In the Linux kernel, the following vulnerability has been resolved:

    bonding: 3ad: implement proper RCU rules for port->aggregator (CVE-2026-52975)

    In the Linux kernel, the following vulnerability has been resolved:

    sched/psi: fix race between file release and pressure write (CVE-2026-52991)

    In the Linux kernel, the following vulnerability has been resolved:

    sctp: disable BH before calling udp_tunnel_xmit_skb() (CVE-2026-53070)

    In the Linux kernel, the following vulnerability has been resolved:

    fuse: limit FUSE_NOTIFY_RETRIEVE to uptodate folios (CVE-2026-53167)

    In the Linux kernel, the following vulnerability has been resolved:

    sctp: validate embedded INIT chunk and address list lengths in cookie (CVE-2026-53224)

    In the Linux kernel, the following vulnerability has been resolved:

    sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (CVE-2026-53246)

    In the Linux kernel, the following vulnerability has been resolved:

    fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (CVE-2026-53341)

    In the Linux kernel, the following vulnerability has been resolved:

    af_unix: Set gc_in_progress to true in unix_gc(). (CVE-2026-53361)

    In the Linux kernel, the following vulnerability has been resolved:

    virtiofs: fix UAF on submount umount

    iput() called from fuse_release_end() can Oops if the super block hasalready been destroyed.  Normally     this is prevented by waiting fornum_waiting to go down to zero before commencing with super block     shutdown.

    This only works, however, for the last submount instance, as the waitcounter is per connection, not per     superblock.

    Revert to using synchronous release requests for the auto_submounts case,which is virtiofs only at this     time. (CVE-2026-53381)

    In the Linux kernel, the following vulnerability has been resolved:

    vc_screen: fix null-ptr-deref in vcs_notifier() during concurrent vcs_write

    A KASAN null-ptr-deref was observed in vcs_notifier():

    BUG: KASAN: null-ptr-deref in vcs_notifier+0x98/0x130Read of size 2 at addr qmp_cmd_name:
    qmp_capabilities, arguments: {}

    The issue is a race condition in vcs_write(). When the console_lock istemporarily dropped (to copy data     from userspace), the vc_data pointerobtained from vcs_vc() may become stale. After re-acquiring the     lock,vcs_vc() is called again to re-validate the pointer. If the vc has beendeallocated in the meantime,     vcs_vc() returns NULL, and the while loopbreaks (with written > 0). However, after the loop,     vcs_scr_updated(vc)is still called with the now-NULL vc pointer, leading to a null pointerdereference in     the notifier chain (vcs_notifier dereferences param->vc).

    Fix this by adding a NULL check for vc before calling vcs_scr_updated(). (CVE-2026-53385)

    In the Linux kernel, the following vulnerability has been resolved:

    fuse: re-lock request before replacing page cache folio

    fuse_try_move_folio() unlocks the request on entry but does notre-lock it on the success path. This means     fuse_chan_abort() can end therequest and free the fuse_io_args (eg fuse_readpages_end()) while     thesubsequent copy chain logic after fuse_try_move_folio() accesses thefuse_io_args, leading to use-after-     free issues.

    Fix this by calling lock_request() before replace_page_cache_folio().This ensures the request is locked on     the success path which willprevent the fuse_io_args from being freed while the later copying logicruns,     and also ensures that the ap->folios[i]->mapping is never nullsince ap->folios[i] will always point to the     newfolio afterreplace_page_cache_folio(). (CVE-2026-53388)

    In the Linux kernel, the following vulnerability has been resolved:

    NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CVE-2026-53391)

    In the Linux kernel, the following vulnerability has been resolved:

    nfsd: reset write verifier on deferred writeback errors (CVE-2026-53393)

    In the Linux kernel, the following vulnerability has been resolved:

    nfsd: avoid leaking pre-allocated openowner on unconfirmed retry race (CVE-2026-53394)

    In the Linux kernel, the following vulnerability has been resolved:

    nfsd: fix posix_acl leak on SETACL decode failure (CVE-2026-53397)

    In the Linux kernel, the following vulnerability has been resolved:

    NFSD: Fix SECINFO_NO_NAME decode error cleanup (CVE-2026-53398)

    In the Linux kernel, the following vulnerability has been resolved:

    i2c: core: fix adapter registration race

    Adapters can be looked up based on their id using i2c_get_adapter()which takes a reference to the embedded     struct device.

    Make sure that the adapter (including its struct device) has beeninitialised before adding it to the IDR     to avoid accessing uninitialiseddata which could, for example, lead to NULL-pointer dereferences oruse-     after-free.

    Note that the i2c-dev chardev, which is registered from a bus notifier,currently uses i2c_get_adapter() so     the adapter needs to be added to theIDR before registration. (CVE-2026-53400)

    In the Linux kernel, the following vulnerability has been resolved:

    fbdev: Fix fb_new_modelist to prevent null-ptr-deref in fb_videomode_to_var

    info->var, a framebuffer's current mode, is expected to have a matchingentry in info->modelist.
    var_to_display() relies on this and treats afailed fb_match_mode() as This should not happen.
    fb_set_var() keeps ittrue by adding the mode to the list on every change, anddo_register_framebuffer()     does the same at registration.

    store_modes() replaces the modelist from userspace. fb_new_modelist()validates the new modes but does not     check that info->var still has amatch. It relies on fbcon_new_modelist() to re-point consoles, but     thatonly handles consoles mapped to the framebuffer. With fbcon unbound thereare none, so info->var is     left describing a mode that is no longer in thelist.

    A later console takeover runs var_to_display(), where fb_match_mode()returns NULL and leaves     fb_display[i].mode NULL. fbcon_switch() passes itto display_to_var(), and fb_videomode_to_var()     dereferences the NULL mode.

    Keep the current mode in the list in fb_new_modelist(), the same wayfb_set_var() does. (CVE-2026-53403)

    In the Linux kernel, the following vulnerability has been resolved:

    pNFS: Fix use-after-free in pnfs_update_layout() (CVE-2026-63800)

    In the Linux kernel, the following vulnerability has been resolved:

    tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (CVE-2026-63801)

    In the Linux kernel, the following vulnerability has been resolved:

    blk-cgroup: fix UAF in __blkcg_rstat_flush() (CVE-2026-63802)

    In the Linux kernel, the following vulnerability has been resolved:

    KVM: Replace guest-triggerable BUG_ON() in ioeventfd datamatch with get_unaligned() (CVE-2026-63806)

    In the Linux kernel, the following vulnerability has been resolved:

    KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (CVE-2026-63807)

    In the Linux kernel, the following vulnerability has been resolved:

    exfat: fix potential use-after-free in exfat_find_dir_entry() (CVE-2026-63808)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf: use kvfree() for replaced sysctl write buffer (CVE-2026-63809)

    In the Linux kernel, the following vulnerability has been resolved:

    block: Avoid mounting the bdev pseudo-filesystem in userspace (CVE-2026-63810)

    In the Linux kernel, the following vulnerability has been resolved:

    keys: Pin request_key_auth payload in instantiate paths (CVE-2026-63823)

    In the Linux kernel, the following vulnerability has been resolved:

    KEYS: fix overflow in keyctl_pkey_params_get_2() (CVE-2026-63824)

    In the Linux kernel, the following vulnerability has been resolved:

    fbdev: fix use-after-free in store_modes() (CVE-2026-63826)

    In the Linux kernel, the following vulnerability has been resolved:

    net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (CVE-2026-63829)

    In the Linux kernel, the following vulnerability has been resolved:

    net: skmsg: preserve sg.copy across SG transforms (CVE-2026-63830)

    In the Linux kernel, the following vulnerability has been resolved:

    ntfs3: reject direct userspace writes to reserved $LX* xattrs

    NTFS3 uses $LXUID, $LXGID, $LXMOD and $LXDEV as internal WSLpermission metadata and reloads them into     i_uid, i_gid and i_modefrom ntfs_get_wsl_perm().

    Because the empty-prefix xattr handler also lets file owners callsetxattr() on these names directly, an     unprivileged writer on awritable ntfs3 mount can plant root ownership and S_ISUID on their ownfile and     gain euid 0 after inode reload.

    Reject direct userspace writes to the reserved $LX* names. Internalntfs3 metadata updates are unchanged     because ntfs_save_wsl_perm()writes them via ntfs_set_ea() directly.

    [almaz.alexandrovich@paragon-software.com: added an additional check for non privileged users]     (CVE-2026-63833)

    In the Linux kernel, the following vulnerability has been resolved:

    drivers/base/memory: set mem->altmap after successful device registration (CVE-2026-64244)

    In the Linux kernel, the following vulnerability has been resolved:

    fbdev: modedb: fix a possible UAF in fb_find_mode() (CVE-2026-64245)

    In the Linux kernel, the following vulnerability has been resolved:

    KVM: x86: hyper-v: Bound the bank index when querying sparse banks (CVE-2026-64247)

    In the Linux kernel, the following vulnerability has been resolved:

    MIPS: smp: report dying CPU to RCU in stop_this_cpu() (CVE-2026-64248)

    In the Linux kernel, the following vulnerability has been resolved:

    LoongArch: Report dying CPU to RCU in stop_this_cpu() (CVE-2026-64250)

    In the Linux kernel, the following vulnerability has been resolved:

    kernel/fork: clear PF_BLOCK_TS in copy_process() (CVE-2026-64253)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1969 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    sctp: disable BH before calling udp_tunnel_xmit_skb() (CVE-2026-53070)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf: Fix same-register dst/src OOB read and pointer leak in sock_ops (CVE-2026-53078)

    In the Linux kernel, the following vulnerability has been resolved:

    KVM: x86: Fix shadow paging use-after-free due to unexpected role (CVE-2026-53359)

    In the Linux kernel, the following vulnerability has been resolved:

    af_unix: Set gc_in_progress to true in unix_gc(). (CVE-2026-53361)

    In the Linux kernel, the following vulnerability has been resolved:

    virtiofs: fix UAF on submount umount

    iput() called from fuse_release_end() can Oops if the super block hasalready been destroyed.  Normally     this is prevented by waiting fornum_waiting to go down to zero before commencing with super block     shutdown.

    This only works, however, for the last submount instance, as the waitcounter is per connection, not per     superblock.

    Revert to using synchronous release requests for the auto_submounts case,which is virtiofs only at this     time. (CVE-2026-53381)

    In the Linux kernel, the following vulnerability has been resolved:

    vc_screen: fix null-ptr-deref in vcs_notifier() during concurrent vcs_write

    A KASAN null-ptr-deref was observed in vcs_notifier():

    BUG: KASAN: null-ptr-deref in vcs_notifier+0x98/0x130Read of size 2 at addr qmp_cmd_name:
    qmp_capabilities, arguments: {}

    The issue is a race condition in vcs_write(). When the console_lock istemporarily dropped (to copy data     from userspace), the vc_data pointerobtained from vcs_vc() may become stale. After re-acquiring the     lock,vcs_vc() is called again to re-validate the pointer. If the vc has beendeallocated in the meantime,     vcs_vc() returns NULL, and the while loopbreaks (with written > 0). However, after the loop,     vcs_scr_updated(vc)is still called with the now-NULL vc pointer, leading to a null pointerdereference in     the notifier chain (vcs_notifier dereferences param->vc).

    Fix this by adding a NULL check for vc before calling vcs_scr_updated(). (CVE-2026-53385)

    In the Linux kernel, the following vulnerability has been resolved:

    fuse: re-lock request before replacing page cache folio

    fuse_try_move_folio() unlocks the request on entry but does notre-lock it on the success path. This means     fuse_chan_abort() can end therequest and free the fuse_io_args (eg fuse_readpages_end()) while     thesubsequent copy chain logic after fuse_try_move_folio() accesses thefuse_io_args, leading to use-after-     free issues.

    Fix this by calling lock_request() before replace_page_cache_folio().This ensures the request is locked on     the success path which willprevent the fuse_io_args from being freed while the later copying logicruns,     and also ensures that the ap->folios[i]->mapping is never nullsince ap->folios[i] will always point to the     newfolio afterreplace_page_cache_folio(). (CVE-2026-53388)

    In the Linux kernel, the following vulnerability has been resolved:

    net/tcp-ao: fix use-after-free of key in del_async path (CVE-2026-53389)

    In the Linux kernel, the following vulnerability has been resolved:

    NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CVE-2026-53391)

    In the Linux kernel, the following vulnerability has been resolved:

    NFSv4/flexfiles: reject zero filehandle version count (CVE-2026-53392)

    In the Linux kernel, the following vulnerability has been resolved:

    nfsd: reset write verifier on deferred writeback errors (CVE-2026-53393)

    In the Linux kernel, the following vulnerability has been resolved:

    nfsd: avoid leaking pre-allocated openowner on unconfirmed retry race (CVE-2026-53394)

    In the Linux kernel, the following vulnerability has been resolved:

    nfsd: fix posix_acl leak on SETACL decode failure (CVE-2026-53397)

    In the Linux kernel, the following vulnerability has been resolved:

    NFSD: Fix SECINFO_NO_NAME decode error cleanup (CVE-2026-53398)

    In the Linux kernel, the following vulnerability has been resolved:

    i2c: core: fix adapter registration race

    Adapters can be looked up based on their id using i2c_get_adapter()which takes a reference to the embedded     struct device.

    Make sure that the adapter (including its struct device) has beeninitialised before adding it to the IDR     to avoid accessing uninitialiseddata which could, for example, lead to NULL-pointer dereferences oruse-     after-free.

    Note that the i2c-dev chardev, which is registered from a bus notifier,currently uses i2c_get_adapter() so     the adapter needs to be added to theIDR before registration. (CVE-2026-53400)

    In the Linux kernel, the following vulnerability has been resolved:

    fbdev: Fix fb_new_modelist to prevent null-ptr-deref in fb_videomode_to_var

    info->var, a framebuffer's current mode, is expected to have a matchingentry in info->modelist.
    var_to_display() relies on this and treats afailed fb_match_mode() as This should not happen.
    fb_set_var() keeps ittrue by adding the mode to the list on every change, anddo_register_framebuffer()     does the same at registration.

    store_modes() replaces the modelist from userspace. fb_new_modelist()validates the new modes but does not     check that info->var still has amatch. It relies on fbcon_new_modelist() to re-point consoles, but     thatonly handles consoles mapped to the framebuffer. With fbcon unbound thereare none, so info->var is     left describing a mode that is no longer in thelist.

    A later console takeover runs var_to_display(), where fb_match_mode()returns NULL and leaves     fb_display[i].mode NULL. fbcon_switch() passes itto display_to_var(), and fb_videomode_to_var()     dereferences the NULL mode.

    Keep the current mode in the list in fb_new_modelist(), the same wayfb_set_var() does. (CVE-2026-53403)

    In the Linux kernel, the following vulnerability has been resolved:

    pNFS: Fix use-after-free in pnfs_update_layout() (CVE-2026-63800)

    In the Linux kernel, the following vulnerability has been resolved:

    tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (CVE-2026-63801)

    In the Linux kernel, the following vulnerability has been resolved:

    blk-cgroup: fix UAF in __blkcg_rstat_flush() (CVE-2026-63802)

    In the Linux kernel, the following vulnerability has been resolved:

    KVM: Replace guest-triggerable BUG_ON() in ioeventfd datamatch with get_unaligned() (CVE-2026-63806)

    In the Linux kernel, the following vulnerability has been resolved:

    KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (CVE-2026-63807)

    In the Linux kernel, the following vulnerability has been resolved:

    exfat: fix potential use-after-free in exfat_find_dir_entry() (CVE-2026-63808)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf: use kvfree() for replaced sysctl write buffer (CVE-2026-63809)

    In the Linux kernel, the following vulnerability has been resolved:

    block: Avoid mounting the bdev pseudo-filesystem in userspace (CVE-2026-63810)

    In the Linux kernel, the following vulnerability has been resolved:

    keys: Pin request_key_auth payload in instantiate paths (CVE-2026-63823)

    In the Linux kernel, the following vulnerability has been resolved:

    KEYS: fix overflow in keyctl_pkey_params_get_2() (CVE-2026-63824)

    In the Linux kernel, the following vulnerability has been resolved:

    fbdev: fix use-after-free in store_modes() (CVE-2026-63826)

    In the Linux kernel, the following vulnerability has been resolved:

    apparmor: mediate the implicit connect of TCP fast open sendmsg (CVE-2026-63828)

    In the Linux kernel, the following vulnerability has been resolved:

    net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (CVE-2026-63829)

    In the Linux kernel, the following vulnerability has been resolved:

    net: skmsg: preserve sg.copy across SG transforms (CVE-2026-63830)

    In the Linux kernel, the following vulnerability has been resolved:

    ntfs3: reject direct userspace writes to reserved $LX* xattrs

    NTFS3 uses $LXUID, $LXGID, $LXMOD and $LXDEV as internal WSLpermission metadata and reloads them into     i_uid, i_gid and i_modefrom ntfs_get_wsl_perm().

    Because the empty-prefix xattr handler also lets file owners callsetxattr() on these names directly, an     unprivileged writer on awritable ntfs3 mount can plant root ownership and S_ISUID on their ownfile and     gain euid 0 after inode reload.

    Reject direct userspace writes to the reserved $LX* names. Internalntfs3 metadata updates are unchanged     because ntfs_save_wsl_perm()writes them via ntfs_set_ea() directly.

    [almaz.alexandrovich@paragon-software.com: added an additional check for non privileged users]     (CVE-2026-63833)

    In the Linux kernel, the following vulnerability has been resolved:

    drivers/base/memory: set mem->altmap after successful device registration (CVE-2026-64244)

    In the Linux kernel, the following vulnerability has been resolved:

    fbdev: modedb: fix a possible UAF in fb_find_mode() (CVE-2026-64245)

    In the Linux kernel, the following vulnerability has been resolved:

    KVM: x86: hyper-v: Bound the bank index when querying sparse banks (CVE-2026-64247)

    In the Linux kernel, the following vulnerability has been resolved:

    MIPS: smp: report dying CPU to RCU in stop_this_cpu() (CVE-2026-64248)

    In the Linux kernel, the following vulnerability has been resolved:

    LoongArch: Report dying CPU to RCU in stop_this_cpu() (CVE-2026-64250)

    In the Linux kernel, the following vulnerability has been resolved:

    kernel/fork: clear PF_BLOCK_TS in copy_process() (CVE-2026-64253)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6381 advisory.

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-6381-1                   security@debian.org     https://www.debian.org/security/                     Salvatore Bonaccorso     July 05, 2026                         https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : linux     CVE ID         : CVE-2025-23131 CVE-2026-31419 CVE-2026-31732 CVE-2026-43010                      CVE-2026-43216 CVE-2026-43355 CVE-2026-46054 CVE-2026-46242                      CVE-2026-46252 CVE-2026-52975 CVE-2026-53070 CVE-2026-53101                      CVE-2026-53139 CVE-2026-53142 CVE-2026-53151 CVE-2026-53157                      CVE-2026-53163 CVE-2026-53167 CVE-2026-53179 CVE-2026-53325                      CVE-2026-53327 CVE-2026-53341 CVE-2026-53359 CVE-2026-53361                      CVE-2026-53362     Debian Bug     : 1136179 1139686

    Several vulnerabilities have been discovered in the Linux kernel that     may lead to a privilege escalation, denial of service or information     leaks.

    For the stable distribution (trixie), these problems have been fixed in     version 6.12.95-1.

    We recommend that you upgrade your linux packages.

    For the detailed security status of linux please refer to its security     tracker page at:
    https://security-tracker.debian.org/tracker/linux

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - sctp: disable BH before calling udp_tunnel_xmit_skb() udp_tunnel_xmit_skb() / udp_tunnel6_xmit_skb() are     expected to run with BH disabled. After commit 6f1a9140ecda (add xmit recursion limit to tunnel xmit     functions), on the path: udp(6)_tunnel_xmit_skb() -> ip(6)tunnel_xmit() dev_xmit_recursion_inc()/dec()     must stay balanced on the same CPU. Without local_bh_disable(), the context may move between CPUs, which     can break the inc/dec pairing. This may lead to incorrect recursion level detection and cause packets to     be dropped in ip(6)_tunnel_xmit() or __dev_queue_xmit(). Fix it by disabling BH around both IPv4 and IPv6     SCTP UDP xmit paths. In my testing, after enabling the SCTP over UDP: # ip net exec ha sysctl -w     net.sctp.udp_port=9899 # ip net exec ha sysctl -w net.sctp.encap_port=9899 # ip net exec hb sysctl -w     net.sctp.udp_port=9899 # ip net exec hb sysctl -w net.sctp.encap_port=9899 # ip net exec ha iperf3 -s -     without this patch: # ip net exec hb iperf3 -c 192.168.0.1 --sctp [ 5] 0.00-10.00 sec 37.2 MBytes 31.2     Mbits/sec sender [ 5] 0.00-10.00 sec 37.1 MBytes 31.1 Mbits/sec receiver - with this patch: # ip net exec     hb iperf3 -c 192.168.0.1 --sctp [ 5] 0.00-10.00 sec 3.14 GBytes 2.69 Gbits/sec sender [ 5] 0.00-10.00 sec     3.14 GBytes 2.69 Gbits/sec receiver (CVE-2026-53070)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
375639	Photon OS 5.0: Linux PHSA-2026-5.0-91-0960	Nessus	PhotonOS Local Security Checks	Local	high
365525	Ubuntu 24.04 LTS : Linux kernel (Azure) vulnerabilities (USN-8918-1)	Nessus	Ubuntu Local Security Checks	Local	medium
365522	Ubuntu 24.04 LTS : Linux kernel vulnerabilities (USN-8917-1)	Nessus	Ubuntu Local Security Checks	Local	medium
364092	EulerOS 2.0 SP15 : kernel (EulerOS-SA-2026-3916)	Nessus	Huawei Local Security Checks	Local	high
364076	EulerOS 2.0 SP15 : kernel (EulerOS-SA-2026-3982)	Nessus	Huawei Local Security Checks	Local	high
464898	Echo: linux: security update to 6.12.95-1	Tenable Cloud Security	Echo Local Security Checks	Local	high
464898	Echo: linux: security update to 6.12.95-1	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	high
348386	Ubuntu 24.04 LTS / Pro Realtime 24.04 LTS : Linux kernel (NVIDIA Tegra) vulnerabilities (USN-8781-1)	Nessus	Ubuntu Local Security Checks	Local	high
343532	Ubuntu 24.04 LTS / Pro Realtime 24.04 LTS : Linux kernel (GCP) vulnerabilities (USN-8728-1)	Nessus	Ubuntu Local Security Checks	Local	high
340681	Ubuntu 24.04 LTS / 26.04 LTS : Linux kernel (NVIDIA) vulnerabilities (USN-8663-1)	Nessus	Ubuntu Local Security Checks	Local	high
340045	Ubuntu 26.04 LTS : Linux kernel (NVIDIA BaseOS) vulnerabilities (USN-8664-1)	Nessus	Ubuntu Local Security Checks	Local	high
335080	openSUSE 16: cluster-md-kmp-64kb / cluster-md-kmp-azure / cluster-md-kmp-default / etc (openSUSE-SU-2026:21555-1)	Nessus	SuSE Local Security Checks	Local	high
333954	Photon OS 5.0: Linux PHSA-2026-5.0-92-0916	Nessus	PhotonOS Local Security Checks	Local	high
332511	Photon OS 5.0: Linux PHSA-2026-5.0-91-0916	Nessus	PhotonOS Local Security Checks	Local	high
332042	Amazon Linux 2023 : bpftool6.12, kernel6.12, kernel6.12-devel (ALAS2023-2026-2014)	Nessus	Amazon Linux Local Security Checks	Local	high
329149	SUSE SLED15 / SLES15 : Security update for the Linux Kernel (SUSE-SU-2026:3166-1)	Nessus	SuSE Local Security Checks	Local	medium
328468	Amazon Linux 2023 : bpftool6.18, kernel6.18, kernel6.18-devel (ALAS2023-2026-1969)	Nessus	Amazon Linux Local Security Checks	Local	high
326038	Photon OS 5.0: Linux PHSA-2026-5.0-0916	Nessus	PhotonOS Local Security Checks	Local	high
325146	Debian dsa-6381 : ata-modules-6.12.90+deb13-armmp-di - security update	Nessus	Debian Local Security Checks	Local	high
322699	Linux Distros Unpatched Vulnerability : CVE-2026-53070	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2026-53070

high

Tenable Plugins

high

medium

medium

high

high

high

high

high

high

high

high

high

high

high

high

medium

high

high

high

high