In the Linux kernel, the following vulnerability has been resolved: tcp: Add preempt_{disable,enable}_nested() in reqsk_queue_hash_req(). syzbot reported a weird reqsk->rsk_refcnt underflow in __inet_csk_reqsk_queue_drop(). The captured reqsk_put() in __inet_csk_reqsk_queue_drop() is called only when it successfully removes reqsk from ehash. Moreover, reqsk_timer_handler() calls another reqsk_put() after that. This indicates that the reqsk was missing both refcnts for ehash and the timer itself. Since all the syzbot reports had PREEMPT_RT enabled, the only possible scenario is that reqsk_queue_hash_req() is preempted after mod_timer() and before refcount_set(), and then the timer triggered after 1s aborts the reqsk due to its listener's close(). Let's wrap mod_timer() and refcount_set() with preempt_disable_nested() and preempt_enable_nested(). Note that inet_ehash_insert() holds the normal spin_lock() (mutex in PREEMPT_RT), so it must be called outside of preempt_disable_nested(), but this is fine. The lookup path just ignores 0 sk_refcnt entries in ehash and tries to create another reqsk, but this will fail at inet_ehash_insert(). [0]: refcount_t: underflow; use-after-free. WARNING: lib/refcount.c:28 at refcount_warn_saturate+0xb2/0x110 lib/refcount.c:28, CPU#0: ktimers/0/16 Modules linked in: CPU: 0 UID: 0 PID: 16 Comm: ktimers/0 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} Tainted: [L]=SOFTLOCKUP Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 RIP: 0010:refcount_warn_saturate+0xb2/0x110 lib/refcount.c:28 Code: e4 7d d1 0a 67 48 0f b9 3a eb 4a e8 38 3d 23 fd 48 8d 3d e1 7d d1 0a 67 48 0f b9 3a eb 37 e8 25 3d 23 fd 48 8d 3d de 7d d1 0a <67> 48 0f b9 3a eb 24 e8 12 3d 23 fd 48 8d 3d db 7d d1 0a 67 48 0f RSP: 0000:ffffc90000157948 EFLAGS: 00010246 RAX: ffffffff84a1301b RBX: 0000000000000003 RCX: ffff88801ca98000 RDX: 0000000000000100 RSI: 0000000000000000 RDI: ffffffff8f72ae00 RBP: ffffffff99ae3b01 R08: ffff88801ca98000 R09: 0000000000000005 R10: 0000000000000100 R11: 0000000000000004 R12: ffff8880425ef568 R13: ffff8880425ef4f8 R14: ffff8880425ef578 R15: 0000000000000000 FS: 0000000000000000(0000) GS:ffff888126386000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f7b46710e9c CR3: 000000000dbb6000 CR4: 00000000003526f0 Call Trace: <TASK> __refcount_sub_and_test include/linux/refcount.h:400 [inline] __refcount_dec_and_test include/linux/refcount.h:432 [inline] refcount_dec_and_test include/linux/refcount.h:450 [inline] reqsk_put include/net/request_sock.h:136 [inline] __inet_csk_reqsk_queue_drop+0x3ce/0x440 net/ipv4/inet_connection_sock.c:1007 reqsk_timer_handler+0x651/0xdf0 net/ipv4/inet_connection_sock.c:1137 call_timer_fn+0x192/0x5e0 kernel/time/timer.c:1748 expire_timers kernel/time/timer.c:1799 [inline] __run_timers kernel/time/timer.c:2374 [inline] __run_timer_base+0x6a3/0x9f0 kernel/time/timer.c:2386 run_timer_base kernel/time/timer.c:2395 [inline] run_timer_softirq+0x67/0x170 kernel/time/timer.c:2403 handle_softirqs+0x1de/0x6d0 kernel/softirq.c:622 __do_softirq kernel/softirq.c:656 [inline] run_ktimerd+0x69/0x100 kernel/softirq.c:1151 smpboot_thread_fn+0x541/0xa50 kernel/smpboot.c:160 kthread+0x388/0x470 kernel/kthread.c:436 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 </TASK>

The remote Ubuntu 26.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-8660-1 advisory.

    Several security issues were discovered in the Linux kernel. An attacker could possibly use these to     compromise the system. This update corrects flaws in the following subsystems:

    - x86 architecture;

    - InfiniBand drivers;

    - Network drivers;

    - Network traffic control;

    - IPv4 networking;

    - IPv6 networking;

    - Netfilter;

    - Open vSwitch;

    - RxRPC session sockets;

    - SCTP protocol; (CVE-2026-46331, CVE-2026-52924, CVE-2026-53131, CVE-2026-53151, CVE-2026-53175,     CVE-2026-53176, CVE-2026-53186, CVE-2026-53212, CVE-2026-53215, CVE-2026-53216, CVE-2026-53221,     CVE-2026-53224, CVE-2026-53225, CVE-2026-53228, CVE-2026-53246, CVE-2026-53247, CVE-2026-53260,     CVE-2026-53359, CVE-2026-64531)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3593-1 advisory.

    The SUSE Linux Enterprise 15 SP4 kernel was updated to fix various security issues:

    The following security issues were fixed:

    - CVE-2022-4994: KVM: x86: wean fast IN from emulator_pio_in (bsc#1273097).
    - CVE-2023-53995: net: ipv4: fix one memleak in __inet_del_ifa() (bsc#1255616).
    - CVE-2026-46052: ceph: only d_add() negative dentries when they are unhashed (bsc#1267494).
    - CVE-2026-46056: Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (bsc#1267435).
    - CVE-2026-46145: RDMA/mana: Validate rx_hash_key_len (bsc#1267715).
    - CVE-2026-46193: xfrm: ah: account for ESN high bits in async callbacks (bsc#1267656).
    - CVE-2026-52956: libceph: Fix potential out-of-bounds access in __ceph_x_decrypt() (bsc#1269172).
    - CVE-2026-52958: libceph: Fix potential out-of-bounds access in osdmap_decode() (bsc#1269174).
    - CVE-2026-52967: smb/client: fix possible infinite loop and oob read in symlink_data() (bsc#1269181).
    - CVE-2026-52986: netfilter: nf_conntrack_sip: don't use simple_strtoul (bsc#1269289).
    - CVE-2026-53050: quota: Fix race of dquot_scan_active() with quota deactivation (bsc#1269188).
    - CVE-2026-53131: netfilter: require Ethernet MAC header before using eth_hdr() (bsc#1269773).
    - CVE-2026-53196: USB: serial: io_ti: fix heap overflow in get_manuf_info() (bsc#1269986).
    - CVE-2026-53224: sctp: validate embedded INIT chunk and address list lengths in cookie (bsc#1269997).
    - CVE-2026-53246: sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (bsc#1269988).
    - CVE-2026-53256: Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (bsc#1269993).
    - CVE-2026-53260: preempt: Provide preempt_[dis|en]able_nested() (bsc#1269731).
    - CVE-2026-53267: netfilter: nft_ct: bail out on template ct in get eval (bsc#1269577).
    - CVE-2026-53354: arm64: errata: Mitigate TLBI errata on various Arm CPUs (bsc#1270230).
    - CVE-2026-53357: Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (bsc#1270257).
    - CVE-2026-53375: drm/amdgpu/vce: Prevent partial address patches (bsc#1271899).
    - CVE-2026-53388: fuse: re-lock request before replacing page cache folio (bsc#1271825).
    - CVE-2026-53391: NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (bsc#1271904).
    - CVE-2026-53402: fbdev: fbcon: fix out-of-bounds read in err_out of (bsc#1271908).
    - CVE-2026-63794: KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (bsc#1271964).
    - CVE-2026-63806: KVM: Replace guest-triggerable BUG_ON() in ioeventfd datamatch with get_unaligned()     (bsc#1272268).
    - CVE-2026-63807: KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level     (bsc#1272263).
    - CVE-2026-63824: KEYS: fix overflow in keyctl_pkey_params_get_2() (bsc#1272180).
    - CVE-2026-63829: net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (bsc#1272176).
    - CVE-2026-63893: thunderbolt: property: Reject u32 wrap in tb_property_entry_valid() (bsc#1272607).
    - CVE-2026-63917: ip6: vti: Use ip6_tnl.net in vti6_changelink() (bsc#1272904).
    - CVE-2026-63919: xfrm: input: hold netns during deferred transport reinjection (bsc#1272907).
    - CVE-2026-63921: ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate() (bsc#1272918).
    - CVE-2026-63922,CVE-2026-63924: ipv6: exthdrs: recompute network header pointer once (bsc#1272855).
    - CVE-2026-63971: sctp: fix race between sctp_wait_for_connect and peeloff (bsc#1272678).
    - CVE-2026-63975: Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (bsc#1272694).
    - CVE-2026-63984: ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (bsc#1272865).
    - CVE-2026-63994: tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp()     (bsc#1273035).
    - CVE-2026-64106: KVM: arm64: vgic-its: Reject restored DTE with out-of-range num_eventid_bits     (bsc#1272242).
    - CVE-2026-64189: netfilter: ipset: fix race between dump and ip_set_list resize (bsc#1272207).
    - CVE-2026-64561: KVM: x86: Check for invalid/obsolete root *after* making MMU pages available     (bsc#1273231).
    - CVE-2026-64560: posix-cpu-timers: Prevent UAF caused by non-leader exec() race (bsc#1273004).
    - CVE-2026-64564: sctp: don't free the ASCONF's own transport in DEL-IP processing (bsc#1274072).
    - CVE-2026-64600: xfs: resample the data fork mapping after cycling ILOCK (bsc#1271526).

    The following non security issues were fixed:

    - hrtimers: Introduce hrtimer_setup() to replace hrtimer_init() (bsc#1271912).
    - mkspec-dtb: Skip missing DTBs.
    - pkspec-dtb: Fix dtb-al rename.
    - posix-cpu-timers: Cleanup the firing logic (bsc#1271912).
    - posix-cpu-timers: Correctly update timer status in posix_cpu_timer_del() (bsc#1271912).
    - posix-cpu-timers: Do not arm SIGEV_NONE timers (bsc#1271912).
    - posix-cpu-timers: Handle interval timers correctly in timer_get() (bsc#1271912).
    - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (bsc#1271912).
    - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (bsc#1271912).
    - posix-cpu-timers: Make k_itimer::it_active consistent (bsc#1271912).
    - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (bsc#1271912).
    - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (bsc#1271912).
    - posix-cpu-timers: Simplify posix_cpu_timer_set() (bsc#1271912).
    - posix-cpu-timers: Split up posix_cpu_timer_get() (bsc#1271912).
    - posix-cpu-timers: Use @now instead of @val for clarity (bsc#1271912).
    - posix-timers: Add proper state tracking (bsc#1271912).
    - posix-timers: Avoid direct access to hrtimer clockbase (bsc#1271912).
    - posix-timers: Clarify posix_timer_fn() comments (bsc#1271912).
    - posix-timers: Clear overrun in common_timer_set() (bsc#1271912).
    - posix-timers: Consolidate signal queueing (bsc#1271912).
    - posix-timers: Consolidate timer setup (bsc#1271912).
    - posix-timers: Cure si_sys_private race (bsc#1271912).
    - posix-timers: Document common_clock_get() correctly (bsc#1271912).
    - posix-timers: Expand timer_arm() callbacks with a boolean return value (bsc#1271912).
    - posix-timers: Polish coding style in a few places (bsc#1271912).
    - posix-timers: Retrieve interval in common timer_settime() code (bsc#1271912).
    - sctp: validate embedded address parameter length (git-fixes).
    - time: Switch to hrtimer_setup() (bsc#1271912).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the linux package has been released.

The remote Debian 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4724 advisory.

    -------------------------------------------------------------------------     Debian LTS Advisory DLA-4724-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                        Ben Hutchings     August 07, 2026                               https://wiki.debian.org/LTS
    -------------------------------------------------------------------------

    Package        : linux-6.12     Version        : 6.12.100-1~deb12u1     CVE ID         : CVE-2025-21807 CVE-2026-45944 CVE-2026-46093 CVE-2026-53005                      CVE-2026-53027 CVE-2026-53226 CVE-2026-53260 CVE-2026-53365                      CVE-2026-53392 CVE-2026-53399 CVE-2026-53402 CVE-2026-63815                      CVE-2026-63816 CVE-2026-63818 CVE-2026-63970 CVE-2026-64187                      CVE-2026-64189 CVE-2026-64192 CVE-2026-64206 CVE-2026-64227                      CVE-2026-64241 CVE-2026-64256 CVE-2026-64265 CVE-2026-64266                      CVE-2026-64268 CVE-2026-64269 CVE-2026-64270 CVE-2026-64271                      CVE-2026-64272 CVE-2026-64273 CVE-2026-64274 CVE-2026-64275                      CVE-2026-64276 CVE-2026-64277 CVE-2026-64279 CVE-2026-64284                      CVE-2026-64286 CVE-2026-64287 CVE-2026-64289 CVE-2026-64294                      CVE-2026-64296 CVE-2026-64297 CVE-2026-64298 CVE-2026-64299                      CVE-2026-64301 CVE-2026-64303 CVE-2026-64304 CVE-2026-64305                      CVE-2026-64306 CVE-2026-64307 CVE-2026-64308 CVE-2026-64309                      CVE-2026-64310 CVE-2026-64312 CVE-2026-64313 CVE-2026-64315                      CVE-2026-64316 CVE-2026-64317 CVE-2026-64318 CVE-2026-64319                      CVE-2026-64320 CVE-2026-64321 CVE-2026-64322 CVE-2026-64323                      CVE-2026-64324 CVE-2026-64326 CVE-2026-64327 CVE-2026-64328                      CVE-2026-64329 CVE-2026-64330 CVE-2026-64331 CVE-2026-64332                      CVE-2026-64333 CVE-2026-64334 CVE-2026-64335 CVE-2026-64336                      CVE-2026-64337 CVE-2026-64338 CVE-2026-64340 CVE-2026-64341                      CVE-2026-64342 CVE-2026-64343 CVE-2026-64344 CVE-2026-64345                      CVE-2026-64346 CVE-2026-64347 CVE-2026-64348 CVE-2026-64350                      CVE-2026-64351 CVE-2026-64352 CVE-2026-64354 CVE-2026-64355                      CVE-2026-64357 CVE-2026-64358 CVE-2026-64359 CVE-2026-64360                      CVE-2026-64361 CVE-2026-64362 CVE-2026-64363 CVE-2026-64364                      CVE-2026-64365 CVE-2026-64367 CVE-2026-64368 CVE-2026-64369                      CVE-2026-64370 CVE-2026-64371 CVE-2026-64372 CVE-2026-64373                      CVE-2026-64374 CVE-2026-64375 CVE-2026-64376 CVE-2026-64377                      CVE-2026-64378 CVE-2026-64379 CVE-2026-64380 CVE-2026-64381                      CVE-2026-64382 CVE-2026-64383 CVE-2026-64384 CVE-2026-64385                      CVE-2026-64386 CVE-2026-64387 CVE-2026-64390 CVE-2026-64391                      CVE-2026-64392 CVE-2026-64393 CVE-2026-64394 CVE-2026-64395                      CVE-2026-64396 CVE-2026-64397 CVE-2026-64398 CVE-2026-64399                      CVE-2026-64401 CVE-2026-64402 CVE-2026-64403 CVE-2026-64404                      CVE-2026-64405 CVE-2026-64406 CVE-2026-64407 CVE-2026-64408                      CVE-2026-64409 CVE-2026-64411 CVE-2026-64412 CVE-2026-64413                      CVE-2026-64414 CVE-2026-64415 CVE-2026-64416 CVE-2026-64417                      CVE-2026-64418 CVE-2026-64419 CVE-2026-64420 CVE-2026-64421                      CVE-2026-64422 CVE-2026-64423 CVE-2026-64424 CVE-2026-64425                      CVE-2026-64428 CVE-2026-64429 CVE-2026-64430 CVE-2026-64432                      CVE-2026-64433 CVE-2026-64434 CVE-2026-64435 CVE-2026-64436                      CVE-2026-64437 CVE-2026-64438 CVE-2026-64440 CVE-2026-64441                      CVE-2026-64442 CVE-2026-64443 CVE-2026-64444 CVE-2026-64445                      CVE-2026-64446 CVE-2026-64448 CVE-2026-64449 CVE-2026-64450                      CVE-2026-64452 CVE-2026-64454 CVE-2026-64455 CVE-2026-64456                      CVE-2026-64457 CVE-2026-64458 CVE-2026-64461 CVE-2026-64462                      CVE-2026-64463 CVE-2026-64465 CVE-2026-64468 CVE-2026-64469                      CVE-2026-64470 CVE-2026-64471 CVE-2026-64472 CVE-2026-64473                      CVE-2026-64474 CVE-2026-64475 CVE-2026-64476 CVE-2026-64477                      CVE-2026-64478 CVE-2026-64479 CVE-2026-64480 CVE-2026-64481                      CVE-2026-64482 CVE-2026-64483 CVE-2026-64484 CVE-2026-64486                      CVE-2026-64487 CVE-2026-64488 CVE-2026-64489 CVE-2026-64490                      CVE-2026-64493 CVE-2026-64494 CVE-2026-64495 CVE-2026-64496                      CVE-2026-64497 CVE-2026-64499 CVE-2026-64500 CVE-2026-64503                      CVE-2026-64504 CVE-2026-64505 CVE-2026-64507 CVE-2026-64508                      CVE-2026-64509 CVE-2026-64510 CVE-2026-64511 CVE-2026-64512                      CVE-2026-64514 CVE-2026-64530 CVE-2026-64531 CVE-2026-64532                      CVE-2026-64533 CVE-2026-64534 CVE-2026-64535 CVE-2026-64536                      CVE-2026-64537 CVE-2026-64538 CVE-2026-64539 CVE-2026-64540                      CVE-2026-64541 CVE-2026-64542 CVE-2026-64543 CVE-2026-64544                      CVE-2026-64545 CVE-2026-64546 CVE-2026-64547 CVE-2026-64548                      CVE-2026-64549 CVE-2026-64550 CVE-2026-64551 CVE-2026-64552                      CVE-2026-64553 CVE-2026-64554 CVE-2026-64555 CVE-2026-64556                      CVE-2026-64557 CVE-2026-64558 CVE-2026-64559 CVE-2026-64560                      CVE-2026-64582 CVE-2026-64585 CVE-2026-64589 CVE-2026-64590                      CVE-2026-64592 CVE-2026-64593 CVE-2026-64594 CVE-2026-64597                      CVE-2026-64598 CVE-2026-64599 CVE-2026-64600 CVE-2026-64602                      CVE-2026-64603 CVE-2026-64604     Debian Bug     : 1130336 1140651

    Linux 6.12 has been packaged for Debian 12 bookworm as linux-6.12.
    This provides a supported upgrade path for systems that currently use     kernel packages from the bookworm-backports suite.

    There is no need to upgrade systems using Linux 6.1, as that kernel     version will also continue to be supported in the LTS period.

    The apt full-upgrade command will *not* automatically install the     updated kernel packages.  You should explicitly install one of the     following metapackages first, as appropriate for your system:

        linux-image-6.12-amd64         linux-image-6.12-arm64         linux-image-6.12-arm64-16k         linux-image-6.12-armmp         linux-image-6.12-armmp-lpae         linux-image-6.12-cloud-amd64         linux-image-6.12-cloud-arm64         linux-image-6.12-powerpc64le         linux-image-6.12-powerpc64le-64k         linux-image-6.12-rt-amd64         linux-image-6.12-rt-arm64         linux-image-6.12-rt-armmp

    For example, if the command uname -r currently shows     6.12.95+deb12-amd64, you should install linux-image-6.12-amd64.

    This backport does not include the following binary packages:

        bpftool hyperv-daemons intel-sdsi libcpupower-dev libcpupower1         linux-cpupower linux-libc-dev linux-perf rtla usbip

    Older versions of most of those are built from the linux source     package in Debian 12.

    Several vulnerabilities have been discovered in the Linux kernel that     may lead to a privilege escalation, denial of service or information     leaks.

    For Debian 12 bookworm, these problems have been fixed in version     6.12.100-1~deb12u1.  This update also fixes several bugs reported to     Debian.  It additionally includes many more bug fixes from stable     updates 6.12.96-6.12.100.

    We recommend that you upgrade your linux-6.12 packages.

    For the detailed security status of linux-6.12 please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/linux-6.12

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS     Attachment:
    signature.asc     Description: PGP signature

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6405 advisory.

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-6405-1                   security@debian.org     https://www.debian.org/security/                     Salvatore Bonaccorso     July 31, 2026                         https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : linux     CVE ID         : CVE-2026-45944 CVE-2026-53005 CVE-2026-53260 CVE-2026-53365                      CVE-2026-63970 CVE-2026-64192 CVE-2026-64206 CVE-2026-64227                      CVE-2026-64286 CVE-2026-64287 CVE-2026-64307 CVE-2026-64341                      CVE-2026-64352 CVE-2026-64361 CVE-2026-64363 CVE-2026-64364                      CVE-2026-64369 CVE-2026-64371 CVE-2026-64375 CVE-2026-64390                      CVE-2026-64401 CVE-2026-64405 CVE-2026-64413 CVE-2026-64416                      CVE-2026-64421 CVE-2026-64428 CVE-2026-64434 CVE-2026-64438                      CVE-2026-64441 CVE-2026-64461 CVE-2026-64462 CVE-2026-64472                      CVE-2026-64481 CVE-2026-64488 CVE-2026-64493 CVE-2026-64507                      CVE-2026-64508 CVE-2026-64509 CVE-2026-64510 CVE-2026-64530                      CVE-2026-64531 CVE-2026-64532 CVE-2026-64533 CVE-2026-64534                      CVE-2026-64535 CVE-2026-64537 CVE-2026-64538 CVE-2026-64539                      CVE-2026-64540 CVE-2026-64541 CVE-2026-64542 CVE-2026-64543                      CVE-2026-64544 CVE-2026-64545 CVE-2026-64546 CVE-2026-64547                      CVE-2026-64548 CVE-2026-64549 CVE-2026-64550 CVE-2026-64551                      CVE-2026-64552 CVE-2026-64553 CVE-2026-64554 CVE-2026-64555                      CVE-2026-64557 CVE-2026-64558 CVE-2026-64559 CVE-2026-64560     Debian Bug     : 1130336

    Several vulnerabilities have been discovered in the Linux kernel that     may lead to a privilege escalation, denial of service or information     leaks.

    For the stable distribution (trixie), these problems have been fixed in     version 6.12.100-1.

    We recommend that you upgrade your linux packages.

    For the detailed security status of linux please refer to its security     tracker page at:
    https://security-tracker.debian.org/tracker/linux

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - tcp: Add preempt_{disable,enable}_nested() in reqsk_queue_hash_req(). syzbot reported a weird     reqsk->rsk_refcnt underflow in __inet_csk_reqsk_queue_drop(). The captured reqsk_put() in
    __inet_csk_reqsk_queue_drop() is called only when it successfully removes reqsk from ehash. Moreover,     reqsk_timer_handler() calls another reqsk_put() after that. This indicates that the reqsk was missing both     refcnts for ehash and the timer itself. Since all the syzbot reports had PREEMPT_RT enabled, the only     possible scenario is that reqsk_queue_hash_req() is preempted after mod_timer() and before refcount_set(),     and then the timer triggered after 1s aborts the reqsk due to its listener's close(). Let's wrap     mod_timer() and refcount_set() with preempt_disable_nested() and preempt_enable_nested(). Note that     inet_ehash_insert() holds the normal spin_lock() (mutex in PREEMPT_RT), so it must be called outside of     preempt_disable_nested(), but this is fine. The lookup path just ignores 0 sk_refcnt entries in ehash and     tries to create another reqsk, but this will fail at inet_ehash_insert(). [0]: refcount_t: underflow; use-     after-free. WARNING: lib/refcount.c:28 at refcount_warn_saturate+0xb2/0x110 lib/refcount.c:28, CPU#0:
    ktimers/0/16 Modules linked in: CPU: 0 UID: 0 PID: 16 Comm: ktimers/0 Tainted: G L syzkaller #0     PREEMPT_{RT,(full)} Tainted: [L]=SOFTLOCKUP Hardware name: Google Google Compute Engine/Google Compute     Engine, BIOS Google 04/18/2026 RIP: 0010:refcount_warn_saturate+0xb2/0x110 lib/refcount.c:28 Code: e4 7d     d1 0a 67 48 0f b9 3a eb 4a e8 38 3d 23 fd 48 8d 3d e1 7d d1 0a 67 48 0f b9 3a eb 37 e8 25 3d 23 fd 48 8d     3d de 7d d1 0a <67> 48 0f b9 3a eb 24 e8 12 3d 23 fd 48 8d 3d db 7d d1 0a 67 48 0f RSP:
    0000:ffffc90000157948 EFLAGS: 00010246 RAX: ffffffff84a1301b RBX: 0000000000000003 RCX: ffff88801ca98000     RDX: 0000000000000100 RSI: 0000000000000000 RDI: ffffffff8f72ae00 RBP: ffffffff99ae3b01 R08:
    ffff88801ca98000 R09: 0000000000000005 R10: 0000000000000100 R11: 0000000000000004 R12: ffff8880425ef568     R13: ffff8880425ef4f8 R14: ffff8880425ef578 R15: 0000000000000000 FS: 0000000000000000(0000)     GS:ffff888126386000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2:
    00007f7b46710e9c CR3: 000000000dbb6000 CR4: 00000000003526f0 Call Trace: <TASK> __refcount_sub_and_test     include/linux/refcount.h:400 [inline] __refcount_dec_and_test include/linux/refcount.h:432 [inline]     refcount_dec_and_test include/linux/refcount.h:450 [inline] reqsk_put include/net/request_sock.h:136     [inline] __inet_csk_reqsk_queue_drop+0x3ce/0x440 net/ipv4/inet_connection_sock.c:1007     reqsk_timer_handler+0x651/0xdf0 net/ipv4/inet_connection_sock.c:1137 call_timer_fn+0x192/0x5e0     kernel/time/timer.c:1748 expire_timers kernel/time/timer.c:1799 [inline] __run_timers     kernel/time/timer.c:2374 [inline] __run_timer_base+0x6a3/0x9f0 kernel/time/timer.c:2386 run_timer_base     kernel/time/timer.c:2395 [inline] run_timer_softirq+0x67/0x170 kernel/time/timer.c:2403     handle_softirqs+0x1de/0x6d0 kernel/softirq.c:622 __do_softirq kernel/softirq.c:656 [inline]     run_ktimerd+0x69/0x100 kernel/softirq.c:1151 smpboot_thread_fn+0x541/0xa50 kernel/smpboot.c:160     kthread+0x388/0x470 kernel/kthread.c:436 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158     ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 </TASK> (CVE-2026-53260)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
340681	Ubuntu 24.04 LTS / 26.04 LTS / Pro Realtime 24.04 LTS : Linux kernel (NVIDIA) vulnerabilities (USN-8663-1)	Nessus	Ubuntu Local Security Checks	Local	high
340045	Ubuntu 26.04 LTS : Linux kernel (NVIDIA BaseOS) vulnerabilities (USN-8664-1)	Nessus	Ubuntu Local Security Checks	Local	high
340044	Ubuntu 26.04 LTS : Linux kernel vulnerabilities (USN-8660-1)	Nessus	Ubuntu Local Security Checks	Local	critical
335101	SUSE SLES15: cluster-md-kmp-default / dlm-kmp-default / gfs2-kmp-default / etc (SUSE-SU-2026:3595-1)	Nessus	SuSE Local Security Checks	Local	high
335098	SUSE SLES15: cluster-md-kmp-default / dlm-kmp-default / gfs2-kmp-default / etc (SUSE-SU-2026:3593-1)	Nessus	SuSE Local Security Checks	Local	high
335080	openSUSE 16: cluster-md-kmp-64kb / cluster-md-kmp-azure / cluster-md-kmp-default / etc (openSUSE-SU-2026:21555-1)	Nessus	SuSE Local Security Checks	Local	high
334784	Photon OS 5.0: Linux PHSA-2026-5.0-92-0952	Nessus	PhotonOS Local Security Checks	Local	medium
333521	Debian dla-4724 : ata-modules-6.12.100+deb12-armmp-di - security update	Nessus	Debian Local Security Checks	Local	high
331409	Debian dsa-6405 : ata-modules-6.12.100+deb13-armmp-di - security update	Nessus	Debian Local Security Checks	Local	medium
323415	Linux Distros Unpatched Vulnerability : CVE-2026-53260	Nessus	Misc.	Local	critical

Detections

Analytics

CVE-2026-53260

critical

Tenable Plugins

high

high

critical

high

high

high

medium

high

medium

critical