In the Linux kernel, the following vulnerability has been resolved: l2tp: pppol2tp: hold reference to session in pppol2tp_ioctl() pppol2tp_ioctl() read sock->sk->sk_user_data directly without any locks or reference counting. If a controllable sleep was induced during copy_from_user() (e.g. via a userfaultfd page fault sleep), a concurrent socket close could trigger pppol2tp_session_close() asynchronously. This frees the l2tp_session structure via the l2tp_session_del_work workqueue. Upon resuming, the ioctl thread dereferences the stale session pointer, resulting in a Use-After-Free (UAF). Fix this by securely fetching the session reference using the RCU-safe, refcounted helper pppol2tp_sock_to_session(sk) on entry. This locks the session's refcount across the sleep. We structured the function to exit via standard err breaks, guaranteeing that l2tp_session_put() is cleanly called on all return paths to drop the reference. To preserve existing behavior we validate the session and its magic signature only for the specific L2TP commands that require it. This ensures that generic/unknown ioctls called on an unconnected socket still return -ENOIOCTLCMD and correctly fall back to generic handlers (e.g. in sock_do_ioctl()).

The version of kernel installed on the remote host is prior to 5.10.260-259.1053. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.10-2026-126 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: replace BUG_ON with proper error handling in ext4_read_inline_folio (CVE-2026-31451)

    In the Linux kernel, the following vulnerability has been resolved:

    usb: cdns3: gadget: fix NULL pointer dereference in ep_queue (CVE-2026-31755)

    In the Linux kernel, the following vulnerability has been resolved:

    xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (CVE-2026-46116)

    In the Linux kernel, the following vulnerability has been resolved:

    regulator: core: fix locking in regulator_resolve_supply() error path (CVE-2026-46252)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: nf_tables: use list_del_rcu for netlink hooks (CVE-2026-46324)

    In the Linux kernel, the following vulnerability has been resolved:

    net/sched: fix pedit partial COW leading to page cache corruption (CVE-2026-46331)

    In the Linux kernel, the following vulnerability has been resolved:

    ip6_vti: set netns_immutable on the fallback device. (CVE-2026-52909)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf: Fix same-register dst/src OOB read and pointer leak in sock_ops (CVE-2026-53078)

    In the Linux kernel, the following vulnerability has been resolved:

    fuse: limit FUSE_NOTIFY_RETRIEVE to uptodate folios (CVE-2026-53167)

    In the Linux kernel, the following vulnerability has been resolved:

    bnxt_en: Fix NULL pointer dereference (CVE-2026-53177)

    In the Linux kernel, the following vulnerability has been resolved:

    l2tp: pppol2tp: hold reference to session in pppol2tp_ioctl() (CVE-2026-53262)

    In the Linux kernel, the following vulnerability has been resolved:

    KVM: x86: Fix shadow paging use-after-free due to unexpected role (CVE-2026-53359)

    In the Linux kernel, the following vulnerability has been resolved:

    virtiofs: fix UAF on submount umount

    iput() called from fuse_release_end() can Oops if the super block hasalready been destroyed.  Normally     this is prevented by waiting fornum_waiting to go down to zero before commencing with super block     shutdown.

    This only works, however, for the last submount instance, as the waitcounter is per connection, not per     superblock.

    Revert to using synchronous release requests for the auto_submounts case,which is virtiofs only at this     time. (CVE-2026-53381)

    In the Linux kernel, the following vulnerability has been resolved:

    vc_screen: fix null-ptr-deref in vcs_notifier() during concurrent vcs_write

    A KASAN null-ptr-deref was observed in vcs_notifier():

    BUG: KASAN: null-ptr-deref in vcs_notifier+0x98/0x130Read of size 2 at addr qmp_cmd_name:
    qmp_capabilities, arguments: {}

    The issue is a race condition in vcs_write(). When the console_lock istemporarily dropped (to copy data     from userspace), the vc_data pointerobtained from vcs_vc() may become stale. After re-acquiring the     lock,vcs_vc() is called again to re-validate the pointer. If the vc has beendeallocated in the meantime,     vcs_vc() returns NULL, and the while loopbreaks (with written > 0). However, after the loop,     vcs_scr_updated(vc)is still called with the now-NULL vc pointer, leading to a null pointerdereference in     the notifier chain (vcs_notifier dereferences param->vc).

    Fix this by adding a NULL check for vc before calling vcs_scr_updated(). (CVE-2026-53385)

    In the Linux kernel, the following vulnerability has been resolved:

    nfsd: fix posix_acl leak on SETACL decode failure (CVE-2026-53397)

    In the Linux kernel, the following vulnerability has been resolved:

    NFSD: Fix SECINFO_NO_NAME decode error cleanup (CVE-2026-53398)

    In the Linux kernel, the following vulnerability has been resolved:

    fbdev: Fix fb_new_modelist to prevent null-ptr-deref in fb_videomode_to_var

    info->var, a framebuffer's current mode, is expected to have a matchingentry in info->modelist.
    var_to_display() relies on this and treats afailed fb_match_mode() as This should not happen.
    fb_set_var() keeps ittrue by adding the mode to the list on every change, anddo_register_framebuffer()     does the same at registration.

    store_modes() replaces the modelist from userspace. fb_new_modelist()validates the new modes but does not     check that info->var still has amatch. It relies on fbcon_new_modelist() to re-point consoles, but     thatonly handles consoles mapped to the framebuffer. With fbcon unbound thereare none, so info->var is     left describing a mode that is no longer in thelist.

    A later console takeover runs var_to_display(), where fb_match_mode()returns NULL and leaves     fb_display[i].mode NULL. fbcon_switch() passes itto display_to_var(), and fb_videomode_to_var()     dereferences the NULL mode.

    Keep the current mode in the list in fb_new_modelist(), the same wayfb_set_var() does. (CVE-2026-53403)

    In the Linux kernel, the following vulnerability has been resolved:

    KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CVE-2026-63794)

    In the Linux kernel, the following vulnerability has been resolved:

    pNFS: Fix use-after-free in pnfs_update_layout() (CVE-2026-63800)

    In the Linux kernel, the following vulnerability has been resolved:

    tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (CVE-2026-63801)

    In the Linux kernel, the following vulnerability has been resolved:

    exfat: fix potential use-after-free in exfat_find_dir_entry() (CVE-2026-63808)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf: use kvfree() for replaced sysctl write buffer (CVE-2026-63809)

    In the Linux kernel, the following vulnerability has been resolved:

    keys: Pin request_key_auth payload in instantiate paths (CVE-2026-63823)

    In the Linux kernel, the following vulnerability has been resolved:

    KEYS: fix overflow in keyctl_pkey_params_get_2() (CVE-2026-63824)

    In the Linux kernel, the following vulnerability has been resolved:

    i2c: stub: Reject I2C block transfers with invalid length

    The I2C_SMBUS_I2C_BLOCK_DATA case in stub_xfer() uses data->block[0]as the transfer length. The existing     check only clamps it to avoidoverrunning the chip->words[256] register array, but does not validateit     against I2C_SMBUS_BLOCK_MAX (32), which is the limit of the unioni2c_smbus_data.block buffer (34 bytes     total). The driver is adevelopment/test tool (CONFIG_I2C_STUB=m, not built by default)that must be loaded     with a chip_addr= parameter.

    A local user with access to /dev/i2c-* can issue an I2C_SMBUS ioctlwith I2C_SMBUS_I2C_BLOCK_DATA and     data->block[0] > 32, causingstub_xfer() to read or write past the end of the unioni2c_smbus_data.block     buffer:

    BUG: KASAN: stack-out-of-bounds in stub_xfer (drivers/i2c/i2c-stub.c:223)Read of size 1 at addr     ffff88800abcfd92 by task exploit/81Call Trace:<TASK>stub_xfer (drivers/i2c/i2c-stub.c:223)__i2c_smbus_xfer     (drivers/i2c/i2c-core-smbus.c:593)i2c_smbus_xfer (drivers/i2c/i2c-core-smbus.c:536)i2cdev_ioctl_smbus     (drivers/i2c/i2c-dev.c:391)i2cdev_ioctl (drivers/i2c/i2c-dev.c:478)__x64_sys_ioctl     (fs/ioctl.c:583)do_syscall_64 (arch/x86/entry/syscall_64.c:94)entry_SYSCALL_64_after_hwframe     (arch/x86/entry/entry_64.S:130)</TASK>

    The bug exists because i2c-stub implements .smbus_xfer directly,bypassing the I2C_SMBUS_BLOCK_MAX     validation ini2c_smbus_xfer_emulated(). The I2C_SMBUS_BLOCK_DATA case in the samefunction correctly     validates against I2C_SMBUS_BLOCK_MAX, but theI2C_SMBUS_I2C_BLOCK_DATA case does not.

    Fix by rejecting transfers with data->block[0] == 0 ordata->block[0] > I2C_SMBUS_BLOCK_MAX with -EINVAL,     consistent withboth the I2C_SMBUS_BLOCK_DATA case in the same function and theI2C_SMBUS_I2C_BLOCK_DATA     validation in i2c_smbus_xfer_emulated(). (CVE-2026-64191)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - l2tp: pppol2tp: hold reference to session in pppol2tp_ioctl() pppol2tp_ioctl() read sock->sk->sk_user_data     directly without any locks or reference counting. If a controllable sleep was induced during     copy_from_user() (e.g. via a userfaultfd page fault sleep), a concurrent socket close could trigger     pppol2tp_session_close() asynchronously. This frees the l2tp_session structure via the     l2tp_session_del_work workqueue. Upon resuming, the ioctl thread dereferences the stale session pointer,     resulting in a Use-After-Free (UAF). Fix this by securely fetching the session reference using the RCU-     safe, refcounted helper pppol2tp_sock_to_session(sk) on entry. This locks the session's refcount across     the sleep. We structured the function to exit via standard err breaks, guaranteeing that     l2tp_session_put() is cleanly called on all return paths to drop the reference. To preserve existing     behavior we validate the session and its magic signature only for the specific L2TP commands that require     it. This ensures that generic/unknown ioctls called on an unconnected socket still return -ENOIOCTLCMD and     correctly fall back to generic handlers (e.g. in sock_do_ioctl()). (CVE-2026-53262)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
329305	openSUSE 16: cluster-md-kmp-64kb / cluster-md-kmp-azure / cluster-md-kmp-default / etc (openSUSE-SU-2026:21388-1)	Nessus	SuSE Local Security Checks	high
328495	Amazon Linux 2 : kernel, --advisory ALAS2KERNEL-5.10-2026-126 (ALASKERNEL-5.10-2026-126)	Nessus	Amazon Linux Local Security Checks	high
323405	Linux Distros Unpatched Vulnerability : CVE-2026-53262	Nessus	Misc.	high

Detections

Analytics

CVE-2026-53262

high

Tenable Plugins

high

high

high