In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Bound VBIOS record-chain walk loops [Why & How] All record-chain walk loops in bios_parser.c and bios_parser2.c use for(;;) and only terminate on a 0xFF record_type sentinel or zero record_size. A malformed VBIOS image missing the terminator record causes unbounded iteration at probe time, potentially hundreds of thousands of iterations with record_size=1. In the final iterations near the BIOS image boundary, struct casts beyond the 2-byte header validated by GET_IMAGE can also read out of bounds. Cap all 14 record-chain walk loops to BIOS_MAX_NUM_RECORD (256) iterations. The atombios.h defines up to 22 distinct record types and atomfirmware.h has 13. Assuming an average of less than 10 records per type (which is reasonable since most are connector- based) 256 is a generous upper bound. (cherry picked from commit 95700a3d660287ed657d6892f7be9ffc0e294a93)

The remote Debian 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4688 advisory.

    -------------------------------------------------------------------------     Debian LTS Advisory DLA-4688-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                        Ben Hutchings     July 18, 2026                                 https://wiki.debian.org/LTS
    -------------------------------------------------------------------------

    Package        : linux     Version        : 6.1.177-1     CVE ID         : CVE-2025-23131 CVE-2026-23272 CVE-2026-23278 CVE-2026-23302                      CVE-2026-31451 CVE-2026-46252 CVE-2026-52928 CVE-2026-53138                      CVE-2026-53139 CVE-2026-53157 CVE-2026-53158 CVE-2026-53163                      CVE-2026-53167 CVE-2026-53325 CVE-2026-53327 CVE-2026-53359                      CVE-2026-53362 CVE-2026-53366     Debian Bug     : 1130365

    Several vulnerabilities have been discovered in the Linux kernel that     may lead to a privilege escalation, denial of service or information     leaks.

    For Debian 12 bookworm, these problems have been fixed in version     6.1.177-1.  This version additionally updates the Microsoft Azure     Network Adapter (mana) driver, and includes many more bug fixes from     stable update 6.1.177.

    We recommend that you upgrade your linux packages.

    For the detailed security status of linux please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/linux

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS     Attachment:
    signature.asc     Description: PGP signature

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the linux package has been released.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - drm/amd/display: Bound VBIOS record-chain walk loops [Why & How] All record-chain walk loops in     bios_parser.c and bios_parser2.c use for(;;) and only terminate on a 0xFF record_type sentinel or zero     record_size. A malformed VBIOS image missing the terminator record causes unbounded iteration at probe     time, potentially hundreds of thousands of iterations with record_size=1. In the final iterations near the     BIOS image boundary, struct casts beyond the 2-byte header validated by GET_IMAGE can also read out of     bounds. Cap all 14 record-chain walk loops to BIOS_MAX_NUM_RECORD (256) iterations. The atombios.h defines     up to 22 distinct record types and atomfirmware.h has 13. Assuming an average of less than 10 records per     type (which is reasonable since most are connector- based) 256 is a generous upper bound. (cherry picked     from commit 95700a3d660287ed657d6892f7be9ffc0e294a93) (CVE-2026-53138)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
327788	Debian dla-4688 : ata-modules-6.1.0-48-armmp-di - security update	Nessus	Debian Local Security Checks	high
326306	Photon OS 4.0: Linux PHSA-2026-4.0-1054	Nessus	PhotonOS Local Security Checks	high
326000	SUSE SLED15: cluster-md-kmp-default / dlm-kmp-default / gfs2-kmp-default / etc (SUSE-SU-2026:2800-1)	Nessus	SuSE Local Security Checks	high
323365	Linux Distros Unpatched Vulnerability : CVE-2026-53138	Nessus	Misc.	high

Detections

Analytics

CVE-2026-53138

high

Tenable Plugins

high

high

high

high