In the Linux kernel, the following vulnerability has been resolved: net: ethernet: mtk_eth_soc: Fix use-after-free in metadata dst teardown mtk_free_dev() calls metadata_dst_free() which frees the metadata_dst with kfree() immediately, bypassing the RCU grace period. In the RX path, skb_dst_set_noref() sets a non-refcounted pointer from the skb to the metadata_dst. This function requires RCU read-side protection and the dst must remain valid until all RCU readers complete. Since metadata_dst_free() calls kfree() directly, a use-after-free can occur if any skb still holds a noref pointer to the dst when the driver tears it down. Replace metadata_dst_free() with dst_release() which properly goes through the refcount path: when the refcount drops to zero, it schedules the actual free via call_rcu_hurry(), ensuring all RCU readers have completed before the memory is freed.

The remote Ubuntu 22.04 LTS / Pro Realtime 22.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-8656-1 advisory.

    Several security issues were discovered in the Linux kernel. An attacker could possibly use these to     compromise the system. This update corrects flaws in the following subsystems:

    - x86 architecture;

    - InfiniBand drivers;

    - Network drivers;

    - Mellanox network drivers;

    - File systems infrastructure;

    - IPv4 networking;

    - Network traffic control;

    - TCP network protocol;

    - B.A.T.M.A.N. meshing protocol;

    - IPv6 networking;

    - Multipath TCP;

    - Netfilter;

    - Open vSwitch;

    - RxRPC session sockets;

    - SCTP protocol;

    - SMC sockets; (CVE-2026-43083, CVE-2026-43197, CVE-2026-43198, CVE-2026-43465, CVE-2026-46242,     CVE-2026-46325, CVE-2026-46331, CVE-2026-52914, CVE-2026-52924, CVE-2026-52931, CVE-2026-53151,     CVE-2026-53176, CVE-2026-53212, CVE-2026-53215, CVE-2026-53224, CVE-2026-53225, CVE-2026-53228,     CVE-2026-53246, CVE-2026-53247, CVE-2026-53359, CVE-2026-64531)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 26.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-8660-1 advisory.

    Several security issues were discovered in the Linux kernel. An attacker could possibly use these to     compromise the system. This update corrects flaws in the following subsystems:

    - x86 architecture;

    - InfiniBand drivers;

    - Network drivers;

    - Network traffic control;

    - IPv4 networking;

    - IPv6 networking;

    - Netfilter;

    - Open vSwitch;

    - RxRPC session sockets;

    - SCTP protocol; (CVE-2026-46331, CVE-2026-52924, CVE-2026-53131, CVE-2026-53151, CVE-2026-53175,     CVE-2026-53176, CVE-2026-53186, CVE-2026-53212, CVE-2026-53215, CVE-2026-53216, CVE-2026-53221,     CVE-2026-53224, CVE-2026-53225, CVE-2026-53228, CVE-2026-53246, CVE-2026-53247, CVE-2026-53260,     CVE-2026-53359, CVE-2026-64531)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the linux package has been released.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - net: ethernet: mtk_eth_soc: Fix use-after-free in metadata dst teardown mtk_free_dev() calls     metadata_dst_free() which frees the metadata_dst with kfree() immediately, bypassing the RCU grace period.
    In the RX path, skb_dst_set_noref() sets a non-refcounted pointer from the skb to the metadata_dst. This     function requires RCU read-side protection and the dst must remain valid until all RCU readers complete.
    Since metadata_dst_free() calls kfree() directly, a use-after-free can occur if any skb still holds a     noref pointer to the dst when the driver tears it down. Replace metadata_dst_free() with dst_release()     which properly goes through the refcount path: when the refcount drops to zero, it schedules the actual     free via call_rcu_hurry(), ensuring all RCU readers have completed before the memory is freed.
    (CVE-2026-53247)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
340687	Ubuntu 22.04 LTS / Pro Realtime 22.04 LTS : Linux kernel (HWE) vulnerabilities (USN-8656-1)	Nessus	Ubuntu Local Security Checks	Local	critical
340681	Ubuntu 24.04 LTS / 26.04 LTS / Pro Realtime 24.04 LTS : Linux kernel (NVIDIA) vulnerabilities (USN-8663-1)	Nessus	Ubuntu Local Security Checks	Local	high
340045	Ubuntu 26.04 LTS : Linux kernel (NVIDIA BaseOS) vulnerabilities (USN-8664-1)	Nessus	Ubuntu Local Security Checks	Local	high
340044	Ubuntu 26.04 LTS : Linux kernel vulnerabilities (USN-8660-1)	Nessus	Ubuntu Local Security Checks	Local	critical
335080	openSUSE 16: cluster-md-kmp-64kb / cluster-md-kmp-azure / cluster-md-kmp-default / etc (openSUSE-SU-2026:21555-1)	Nessus	SuSE Local Security Checks	Local	high
333762	Photon OS 5.0: Linux PHSA-2026-5.0-92-0895	Nessus	PhotonOS Local Security Checks	Local	high
323383	Linux Distros Unpatched Vulnerability : CVE-2026-53247	Nessus	Misc.	Local	critical
322944	Photon OS 5.0: Linux PHSA-2026-5.0-0895	Nessus	PhotonOS Local Security Checks	Local	high

Detections

Analytics

CVE-2026-53247

critical

Tenable Plugins

critical

high

high

critical

high

high

critical

high