In the Linux kernel, the following vulnerability has been resolved: net: pull headers in qdisc_pkt_len_segs_init() Most ndo_start_xmit() methods expects headers of gso packets to be already in skb->head. net/core/tso.c users are particularly at risk, because tso_build_hdr() does a memcpy(hdr, skb->data, hdr_len); qdisc_pkt_len_segs_init() already does a dissection of gso packets. Use pskb_may_pull() instead of skb_header_pointer() to make sure drivers do not have to reimplement this. Some malicious packets could be fed, detect them so that we can drop them sooner with a new SKB_DROP_REASON_SKB_BAD_GSO drop_reason.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:65334 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CVE-2026-43133)

    * kernel: Bluetooth: SMP: force responder MITM requirements before building the pairing response     (CVE-2026-43334)

    * kernel: Bluetooth: virtio_bt: clamp rx length before skb_put (CVE-2026-46123)

    * kernel: Bluetooth: serialize accept_q access (CVE-2026-52918)

    * kernel: net: pull headers in qdisc_pkt_len_segs_init() (CVE-2026-53091)

    * kernel: Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CVE-2026-53072)

    * kernel: net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (CVE-2026-52947)

    * kernel: Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CVE-2026-53256)

    * kernel: wifi: nl80211: reject oversized EMA RNR lists (CVE-2026-53182)

    * kernel: Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CVE-2026-53209)

    * kernel: Bluetooth: RFCOMM: validate skb length in MCC handlers (CVE-2026-53254)

    * kernel: vfio/pci: Clean up DMABUFs before disabling function (CVE-2026-53322)

    * kernel: Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CVE-2026-63975)

    * kernel: security/keys: fix missed RCU read section on lookup (CVE-2026-64015)

    * kernel: Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CVE-2026-63947)

    * kernel: Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CVE-2026-63944)

    * kernel: Bluetooth: ISO: fix UAF in iso_recv_frame (CVE-2026-63946)

    * kernel: wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (CVE-2026-64117)

    * kernel: wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (CVE-2026-64037)

    * kernel: ixgbevf: fix use-after-free in VEPA multicast source pruning (CVE-2026-64113)

    * kernel: vfio/pci: Check BAR resources before exporting a DMABUF (CVE-2026-64042)

    * kernel: accel/qaic: Add overflow check to remap_pfn_range during mmap (CVE-2026-64051)

    * kernel: wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (CVE-2026-64255)

    * kernel: wifi: mac80211: fix MLE defragmentation (CVE-2026-64515)

    * kernel: wifi: mac80211: defer link RX stats percpu free to RCU (CVE-2026-68409)

    * kernel: wifi: mt76: mt7925: fix crash in reset link replay (CVE-2026-68307)

    * kernel: wifi: mt76: mt7925: drop TXRX_NOTIFY on non-mmio buses (CVE-2026-68193)

    * kernel: dm-verity: fix buffer overflow in FEC calculation (CVE-2026-72098)

    * kernel: nvmet-rdma: handle inline data with a nonzero offset (CVE-2026-72129)

    Bug Fix(es) and Enhancement(s):

    * rtla-timerlat-top doesn't stop properly when threshold is reached on multiple CPUs at once [rhel-10.2.z]     (JIRA:RHEL-193027)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-098879 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    net: pull headers in qdisc_pkt_len_segs_init()

    Most ndo_start_xmit() methods expects headers of gso packets     to be already in skb->head.

    net/core/tso.c users are particularly at risk, because tso_build_hdr()     does a memcpy(hdr, skb->data, hdr_len);

    qdisc_pkt_len_segs_init() already does a dissection of gso packets.

    Use pskb_may_pull() instead of skb_header_pointer() to make     sure drivers do not have to reimplement this.

    Some malicious packets could be fed, detect them so that we can     drop them sooner with a new SKB_DROP_REASON_SKB_BAD_GSO drop_reason.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-101983 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    net: pull headers in qdisc_pkt_len_segs_init()

    Most ndo_start_xmit() methods expects headers of gso packets     to be already in skb->head.

    net/core/tso.c users are particularly at risk, because tso_build_hdr()     does a memcpy(hdr, skb->data, hdr_len);

    qdisc_pkt_len_segs_init() already does a dissection of gso packets.

    Use pskb_may_pull() instead of skb_header_pointer() to make     sure drivers do not have to reimplement this.

    Some malicious packets could be fed, detect them so that we can     drop them sooner with a new SKB_DROP_REASON_SKB_BAD_GSO drop_reason.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - net: pull headers in qdisc_pkt_len_segs_init() Most ndo_start_xmit() methods expects headers of gso     packets to be already in skb->head. net/core/tso.c users are particularly at risk, because tso_build_hdr()     does a memcpy(hdr, skb->data, hdr_len); qdisc_pkt_len_segs_init() already does a dissection of gso     packets. Use pskb_may_pull() instead of skb_header_pointer() to make sure drivers do not have to     reimplement this. Some malicious packets could be fed, detect them so that we can drop them sooner with a     new SKB_DROP_REASON_SKB_BAD_GSO drop_reason. (CVE-2026-53091)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
343886	RHEL 10 : kernel (RHSA-2026:65334)	Nessus	Red Hat Local Security Checks	Local	critical
343532	Ubuntu 24.04 LTS / Pro Realtime 24.04 LTS : Linux kernel (GCP) vulnerabilities (USN-8728-1)	Nessus	Ubuntu Local Security Checks	Local	high
340681	Ubuntu 24.04 LTS / 26.04 LTS / Pro Realtime 24.04 LTS : Linux kernel (NVIDIA) vulnerabilities (USN-8663-1)	Nessus	Ubuntu Local Security Checks	Local	high
340452	Unity Linux 20.1050a Security Update: kernel (UTSA-2026-098879)	Nessus	Unity Linux Local Security Checks	Local	high
340045	Ubuntu 26.04 LTS : Linux kernel (NVIDIA BaseOS) vulnerabilities (USN-8664-1)	Nessus	Ubuntu Local Security Checks	Local	high
337290	Unity Linux 20.1050e Security Update: kernel (UTSA-2026-101983)	Nessus	Unity Linux Local Security Checks	Local	high
322677	Linux Distros Unpatched Vulnerability : CVE-2026-53091	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2026-53091

high

Tenable Plugins

critical

high

high

high

high

high

high