In the Linux kernel, the following vulnerability has been resolved: zram: fix use-after-free in zram_bvec_write_partial() zram_read_page() picks the sync or async backing device read path based on whether the parent bio is NULL. zram_bvec_write_partial() passes its parent bio down, so for ZRAM_WB slots the read is dispatched asynchronously and zram_read_page() returns 0 while the bio is still in flight. The caller then runs memcpy_from_bvec(), zram_write_page() and __free_page() on the buffer, leaving the async read to write into a freed page. zram_bvec_read_partial() was switched to NULL in commit 4e3c87b9421d ("zram: fix synchronous reads") for the same reason; the write_partial counterpart was missed.

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:59723 advisory.

    * kernel: ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CVE-2025-68211)
      * kernel: ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CVE-2026-23003)
      * kernel: netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CVE-2026-43114)
      * kernel: sctp: purge outqueue on stale COOKIE-ECHO handling (CVE-2026-52924)
      * kernel: netfilter: xt_policy: fix strict mode inbound policy matching (CVE-2026-52920)
      * kernel: zram: fix use-after-free in zram_bvec_write_partial() (CVE-2026-53185)
      * kernel: netfilter: require Ethernet MAC header before using eth_hdr() (CVE-2026-53131)
      * kernel: netfilter: conntrack_irc: fix possible out-of-bounds read (CVE-2026-53268)
      * kernel: i2c: stub: Reject I2C block transfers with invalid length (CVE-2026-64191)
      * kernel: netfilter: ipset: fix race between dump and ip_set_list resize (CVE-2026-64189)
      * kernel: Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CVE-2026-64277)
      * kernel: Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CVE-2026-64276)
      * kernel: net: ipv6: use-after-free in fib6_rule_suppress due to stale res->rt6 pointer (CVE-2026-74581)


    Bug Fix(es) and Enhancement(s):

      * [AlmaLinux-9.8.z] Intel CWF: CPU is unable to obtain cstate1 on idle system (JIRA:AlmaLinux-166118)
      * ss core dumped when there is an SCTP session [almalinux-9.8.z] (JIRA:AlmaLinux-212398)
      * [IBM 9.9 FEAT] zcrypt driver overwrite function - kernel part [almalinux-9.8.z]     (JIRA:AlmaLinux-245333)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:59723 advisory.

    * kernel: ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CVE-2025-68211)

    * kernel: ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CVE-2026-23003)

    * kernel: netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CVE-2026-43114)

    * kernel: sctp: purge outqueue on stale COOKIE-ECHO handling (CVE-2026-52924)

    * kernel: netfilter: xt_policy: fix strict mode inbound policy matching (CVE-2026-52920)

    * kernel: zram: fix use-after-free in zram_bvec_write_partial() (CVE-2026-53185)

    * kernel: netfilter: require Ethernet MAC header before using eth_hdr() (CVE-2026-53131)

    * kernel: netfilter: conntrack_irc: fix possible out-of-bounds read (CVE-2026-53268)

    * kernel: i2c: stub: Reject I2C block transfers with invalid length (CVE-2026-64191)

    * kernel: netfilter: ipset: fix race between dump and ip_set_list resize (CVE-2026-64189)

    * kernel: Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CVE-2026-64277)

    * kernel: Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CVE-2026-64276)

    * kernel: net: ipv6: use-after-free in fib6_rule_suppress due to stale res->rt6 pointer (CVE-2026-74581)

    Bug Fix(es) and Enhancement(s):

    * [Rocky Linux-9.8.z] Intel CWF: CPU is unable to obtain cstate1 on idle system (JIRA:Rocky Linux-166118)

    * ss core dumped when there is an SCTP session [rhel-9.8.z] (JIRA:Rocky Linux-212398)

    * [IBM 9.9 FEAT] zcrypt driver overwrite  function - kernel part [rhel-9.8.z] (JIRA:Rocky Linux-245333)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-59723 advisory.

    - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581}
    - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111]     {CVE-2026-64191}
    - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440]     {CVE-2026-64277}
    - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679]     {CVE-2026-53131}
    - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236]     {CVE-2026-64276}
    - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843]     {CVE-2026-52920}
    - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673]     {CVE-2026-64189}
    - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252]     {CVE-2026-53268}
    - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot)     [RHEL-189901] {CVE-2025-68211}
    - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185}
    - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965]     {CVE-2026-23003}
    - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot)     [RHEL-189532] {CVE-2026-43114}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:59723 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CVE-2025-68211)

    * kernel: ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CVE-2026-23003)

    * kernel: netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CVE-2026-43114)

    * kernel: sctp: purge outqueue on stale COOKIE-ECHO handling (CVE-2026-52924)

    * kernel: netfilter: xt_policy: fix strict mode inbound policy matching (CVE-2026-52920)

    * kernel: zram: fix use-after-free in zram_bvec_write_partial() (CVE-2026-53185)

    * kernel: netfilter: require Ethernet MAC header before using eth_hdr() (CVE-2026-53131)

    * kernel: netfilter: conntrack_irc: fix possible out-of-bounds read (CVE-2026-53268)

    * kernel: i2c: stub: Reject I2C block transfers with invalid length (CVE-2026-64191)

    * kernel: netfilter: ipset: fix race between dump and ip_set_list resize (CVE-2026-64189)

    * kernel: Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CVE-2026-64277)

    * kernel: Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CVE-2026-64276)

    * kernel: net: ipv6: use-after-free in fib6_rule_suppress due to stale res->rt6 pointer (CVE-2026-74581)

    Bug Fix(es) and Enhancement(s):

    * [RHEL-9.8.z] Intel CWF: CPU is unable to obtain cstate1 on idle system (JIRA:RHEL-166118)

    * ss core dumped when there is an SCTP session [rhel-9.8.z] (JIRA:RHEL-212398)

    * [IBM 9.9 FEAT] zcrypt driver overwrite  function - kernel part [rhel-9.8.z] (JIRA:RHEL-245333)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - zram: fix use-after-free in zram_bvec_write_partial() zram_read_page() picks the sync or async backing     device read path based on whether the parent bio is NULL. zram_bvec_write_partial() passes its parent bio     down, so for ZRAM_WB slots the read is dispatched asynchronously and zram_read_page() returns 0 while the     bio is still in flight. The caller then runs memcpy_from_bvec(), zram_write_page() and __free_page() on     the buffer, leaving the async read to write into a freed page. zram_bvec_read_partial() was switched to     NULL in commit 4e3c87b9421d (zram: fix synchronous reads) for the same reason; the write_partial     counterpart was missed. (CVE-2026-53185)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
341365	AlmaLinux 9 : kernel (ALSA-2026:59723)	Nessus	Alma Linux Local Security Checks	Local	medium
341089	RockyLinux 9 : kernel (RLSA-2026:59723)	Nessus	Rocky Linux Local Security Checks	Local	medium
341070	Oracle Linux 9 : kernel (ELSA-2026-59723)	Nessus	Oracle Linux Local Security Checks	Local	medium
341024	SUSE SLED15: cluster-md-kmp-default / dlm-kmp-default / gfs2-kmp-default / etc (SUSE-SU-2026:3790-1)	Nessus	SuSE Local Security Checks	Local	high
339925	RHEL 9 : kernel (RHSA-2026:59723)	Nessus	Red Hat Local Security Checks	Local	medium
335080	openSUSE 16: cluster-md-kmp-64kb / cluster-md-kmp-azure / cluster-md-kmp-default / etc (openSUSE-SU-2026:21555-1)	Nessus	SuSE Local Security Checks	Local	high
323395	Linux Distros Unpatched Vulnerability : CVE-2026-53185	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2026-53185

high

Tenable Plugins

medium

medium

medium

high

medium

high

high