In the Linux kernel, the following vulnerability has been resolved: bpf: Fix use-after-free in offloaded map/prog info fill When querying info for an offloaded BPF map or program, bpf_map_offload_info_fill_ns() and bpf_prog_offload_info_fill_ns() obtain the network namespace with get_net(dev_net(offmap->netdev)). However, the associated netdev's netns may be racing with teardown during netns destruction. If the netns refcount has already reached 0, get_net() performs a refcount_t increment on 0, triggering: refcount_t: addition on 0; use-after-free. Although rtnl_lock and bpf_devs_lock ensure the netdev pointer remains valid, they cannot prevent the netns refcount from reaching zero. Fix this by using maybe_get_net() instead of get_net(). maybe_get_net() uses refcount_inc_not_zero() and returns NULL if the refcount is already zero, which causes ns_get_path_cb() to fail and the caller to return -ENOENT -- the correct behavior when the netns is being destroyed.

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-098866 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    bpf: Fix use-after-free in offloaded map/prog info fill

    When querying info for an offloaded BPF map or program,     bpf_map_offload_info_fill_ns() and bpf_prog_offload_info_fill_ns()     obtain the network namespace with get_net(dev_net(offmap->netdev)).
    However, the associated netdev's netns may be racing with teardown     during netns destruction. If the netns refcount has already reached 0,     get_net() performs a refcount_t increment on 0, triggering:

      refcount_t: addition on 0; use-after-free.

    Although rtnl_lock and bpf_devs_lock ensure the netdev pointer remains     valid, they cannot prevent the netns refcount from reaching zero.

    Fix this by using maybe_get_net() instead of get_net(). maybe_get_net()     uses refcount_inc_not_zero() and returns NULL if the refcount is already     zero, which causes ns_get_path_cb() to fail and the caller to return
    -ENOENT -- the correct behavior when the netns is being destroyed.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-102045 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    bpf: Fix use-after-free in offloaded map/prog info fill

    When querying info for an offloaded BPF map or program,     bpf_map_offload_info_fill_ns() and bpf_prog_offload_info_fill_ns()     obtain the network namespace with get_net(dev_net(offmap->netdev)).
    However, the associated netdev's netns may be racing with teardown     during netns destruction. If the netns refcount has already reached 0,     get_net() performs a refcount_t increment on 0, triggering:

      refcount_t: addition on 0; use-after-free.

    Although rtnl_lock and bpf_devs_lock ensure the netdev pointer remains     valid, they cannot prevent the netns refcount from reaching zero.

    Fix this by using maybe_get_net() instead of get_net(). maybe_get_net()     uses refcount_inc_not_zero() and returns NULL if the refcount is already     zero, which causes ns_get_path_cb() to fail and the caller to return
    -ENOENT -- the correct behavior when the netns is being destroyed.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - bpf: Fix use-after-free in offloaded map/prog info fill When querying info for an offloaded BPF map or     program, bpf_map_offload_info_fill_ns() and bpf_prog_offload_info_fill_ns() obtain the network namespace     with get_net(dev_net(offmap->netdev)). However, the associated netdev's netns may be racing with teardown     during netns destruction. If the netns refcount has already reached 0, get_net() performs a refcount_t     increment on 0, triggering: refcount_t: addition on 0; use-after-free. Although rtnl_lock and     bpf_devs_lock ensure the netdev pointer remains valid, they cannot prevent the netns refcount from     reaching zero. Fix this by using maybe_get_net() instead of get_net(). maybe_get_net() uses     refcount_inc_not_zero() and returns NULL if the refcount is already zero, which causes ns_get_path_cb() to     fail and the caller to return -ENOENT -- the correct behavior when the netns is being destroyed.
    (CVE-2026-53089)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
340681	Ubuntu 24.04 LTS / 26.04 LTS / Pro Realtime 24.04 LTS : Linux kernel (NVIDIA) vulnerabilities (USN-8663-1)	Nessus	Ubuntu Local Security Checks	Local	high
340253	Unity Linux 20.1050a Security Update: kernel (UTSA-2026-098866)	Nessus	Unity Linux Local Security Checks	Local	high
340045	Ubuntu 26.04 LTS : Linux kernel (NVIDIA BaseOS) vulnerabilities (USN-8664-1)	Nessus	Ubuntu Local Security Checks	Local	high
338522	Unity Linux 20.1050e Security Update: kernel (UTSA-2026-102045)	Nessus	Unity Linux Local Security Checks	Local	high
322703	Linux Distros Unpatched Vulnerability : CVE-2026-53089	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2026-53089

high

Tenable Plugins

high

high

high

high

high