In the Linux kernel, the following vulnerability has been resolved: KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use As per the GHCB spec, when using GHCB v2+ require the software scratch area to reside in the GHCB's shared buffer. Note, things like Page State Change (PSC) requests _rely_ on this behavior, as the guest can't provide a length when making the request, i.e. the size of the guest payload is bounded by the size of the shared buffer. Failure to force usage of the GHCB, and a slew of other flaws, lets a malicious SNP guest corrupt host kernel heap memory, and leak host heap layout information. setup_vmgexit_scratch() allocates a buffer via kvzalloc(exit_info_2), where exit_info_2 is guest-controlled. With exit_info_2=24, this yields a 24-byte allocation in kmalloc-cg-32 (32-byte slab objects). The buffer holds an 8-byte psc_hdr followed by 8-byte psc_entry structs, so only entries[0] and entries[1] are in-bounds. snp_begin_psc() validates end_entry against VMGEXIT_PSC_MAX_COUNT (253) but NOT against the actual buffer size: idx_end = hdr->end_entry; if (idx_end >= VMGEXIT_PSC_MAX_COUNT) { // checks 253, not buffer snp_complete_psc(svm, ...); return 1; } for (idx = idx_start; idx <= idx_end; idx++) { entry_start = entries[idx]; // OOB when idx >= 2 The guest sets end_entry=10+, causing the host to iterate entries[2+] which are OOB into adjacent slab objects. For each OOB entry: - The host reads 8 bytes (OOB READ / info leak oracle) - If the data passes PSC validation, __snp_complete_one_psc() writes cur_page = 1 or 512 into the entry (OOB WRITE, sev.c:3806) - If validation fails, the error response reveals whether adjacent memory is zero vs non-zero (information disclosure to guest) The guest controls allocation size (exit_info_2), entry range (cur_entry/end_entry), and can fire unlimited VMGEXITs to repeatedly hit different slab positions. By exploiting the variety of bugs, a malicious SEV-SNP guest can: - OOB read adjacent kmalloc-cg-32 objects (heap layout disclosure) - OOB write cur_page bits into adjacent objects (heap corruption) - Trigger use-after-free conditions across VMGEXITs E.g. with KASAN enabled, a single insmod of the PoC guest module produces 73 KASAN reports: BUG: KASAN: slab-out-of-bounds in snp_begin_psc+0x126/0x890 Read of size 8 at addr ffff888219ffb5e0 by task qemu-system-x86/2199 BUG: KASAN: slab-out-of-bounds in snp_begin_psc+0x468/0x890 Write of size 8 at addr ffff888351566648 by task qemu-system-x86/2199 The buggy address belongs to the object at ffff888XXXXXXXXX which belongs to the cache kmalloc-cg-32 of size 32 The buggy address is located N bytes to the right of allocated 32-byte region [ffff888XXXXXXXXX, ffff888XXXXXXXXX) Breakdown: 62 slab-out-of-bounds (reads + writes past allocation) 7 slab-use-after-free 4 use-after-free All credit to Stan for the wonderful description and reproducer! [sean: write changelog]

The remote SUSE Linux SLES15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4359-1 advisory.

    This update for the SUSE Linux Enterprise Kernel 6.4.0-150700.53.66 fixes various security issues:

    The following security issues were fixed:

    - CVE-2026-53360: KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (bsc#1270303).
    - CVE-2026-64423: ipv4: igmp: remove multicast group from hash table on device destruction (bsc#1275458).
    - CVE-2026-64561: KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Zapscape)     (bsc#1273232).
    - CVE-2026-64564: sctp: don't free the ASCONF's own transport in DEL-IP processing (SCTPhantom)     (bsc#1274074).
    - CVE-2026-68138: net/sched: serialize qdisc_rtab_list against concurrent get/put (bsc#1274942).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4356-1 advisory.

    This update for the SUSE Linux Enterprise Kernel 6.4.0-150700.53.52 fixes various security issues:

    The following security issues were fixed:

    - CVE-2026-46150: fanotify: fix false positive on permission events (bsc#1267388).
    - CVE-2026-53360: KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (bsc#1270303).
    - CVE-2026-64423: ipv4: igmp: remove multicast group from hash table on device destruction (bsc#1275458).
    - CVE-2026-64561: KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Zapscape)     (bsc#1273232).
    - CVE-2026-64564: sctp: don't free the ASCONF's own transport in DEL-IP processing (SCTPhantom)     (bsc#1274074).
    - CVE-2026-68138: net/sched: serialize qdisc_rtab_list against concurrent get/put (bsc#1274942).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4258-1 advisory.

    This update for the SUSE Linux Enterprise Kernel 6.4.0-150700.53.45 fixes various security issues:

    The following security issues were fixed:

    - CVE-2026-46150: fanotify: fix false positive on permission events (bsc#1267388).
    - CVE-2026-53360: KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (bsc#1270303).
    - CVE-2026-64423: ipv4: igmp: remove multicast group from hash table on device destruction (bsc#1275458).
    - CVE-2026-64561: KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Zapscape)     (bsc#1273232).
    - CVE-2026-64564: sctp: don't free the ASCONF's own transport in DEL-IP processing (SCTPhantom)     (bsc#1274074).
    - CVE-2026-68138: net/sched: serialize qdisc_rtab_list against concurrent get/put (bsc#1274942).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4170-1 advisory.

    This update for the SUSE Linux Enterprise Kernel 6.4.0-150700.7.62 fixes various security issues:

    The following security issues were fixed:

    - CVE-2026-53360: KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (bsc#1270303).
    - CVE-2026-64423: ipv4: igmp: remove multicast group from hash table on device destruction (bsc#1275458).
    - CVE-2026-64561: KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Zapscape)     (bsc#1273232).
    - CVE-2026-64564: sctp: don't free the ASCONF's own transport in DEL-IP processing (SCTPhantom)     (bsc#1274074).
    - CVE-2026-68138: net/sched: serialize qdisc_rtab_list against concurrent get/put (bsc#1274942).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the linux package has been released.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use As per the GHCB spec, when using GHCB v2+     require the software scratch area to reside in the GHCB's shared buffer. Note, things like Page State     Change (PSC) requests _rely_ on this behavior, as the guest can't provide a length when making the     request, i.e. the size of the guest payload is bounded by the size of the shared buffer. Failure to force     usage of the GHCB, and a slew of other flaws, lets a malicious SNP guest corrupt host kernel heap memory,     and leak host heap layout information. setup_vmgexit_scratch() allocates a buffer via     kvzalloc(exit_info_2), where exit_info_2 is guest-controlled. With exit_info_2=24, this yields a 24-byte     allocation in kmalloc-cg-32 (32-byte slab objects). The buffer holds an 8-byte psc_hdr followed by 8-byte     psc_entry structs, so only entries[0] and entries[1] are in-bounds. snp_begin_psc() validates end_entry     against VMGEXIT_PSC_MAX_COUNT (253) but NOT against the actual buffer size: idx_end = hdr->end_entry; if     (idx_end >= VMGEXIT_PSC_MAX_COUNT) { // checks 253, not buffer snp_complete_psc(svm, ...); return 1; } for     (idx = idx_start; idx <= idx_end; idx++) { entry_start = entries[idx]; // OOB when idx >= 2 The guest sets     end_entry=10+, causing the host to iterate entries[2+] which are OOB into adjacent slab objects. For each     OOB entry: - The host reads 8 bytes (OOB READ / info leak oracle) - If the data passes PSC validation,
    __snp_complete_one_psc() writes cur_page = 1 or 512 into the entry (OOB WRITE, sev.c:3806) - If validation     fails, the error response reveals whether adjacent memory is zero vs non-zero (information disclosure to     guest) The guest controls allocation size (exit_info_2), entry range (cur_entry/end_entry), and can fire     unlimited VMGEXITs to repeatedly hit different slab positions. By exploiting the variety of bugs, a     malicious SEV-SNP guest can: - OOB read adjacent kmalloc-cg-32 objects (heap layout disclosure) - OOB     write cur_page bits into adjacent objects (heap corruption) - Trigger use-after-free conditions across     VMGEXITs E.g. with KASAN enabled, a single insmod of the PoC guest module produces 73 KASAN reports: BUG:
    KASAN: slab-out-of-bounds in snp_begin_psc+0x126/0x890 Read of size 8 at addr ffff888219ffb5e0 by task     qemu-system-x86/2199 BUG: KASAN: slab-out-of-bounds in snp_begin_psc+0x468/0x890 Write of size 8 at addr     ffff888351566648 by task qemu-system-x86/2199 The buggy address belongs to the object at ffff888XXXXXXXXX     which belongs to the cache kmalloc-cg-32 of size 32 The buggy address is located N bytes to the right of     allocated 32-byte region [ffff888XXXXXXXXX, ffff888XXXXXXXXX) Breakdown: 62 slab-out-of-bounds (reads +     writes past allocation) 7 slab-use-after-free 4 use-after-free All credit to Stan for the wonderful     description and reproducer! [sean: write changelog] (CVE-2026-53360)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
350984	SUSE SLES15 Security Update : kernel (Live Patch 18 for SUSE Linux Enterprise 15 SP7) (SUSE-SU-2026:4359-1)	Nessus	SuSE Local Security Checks	Local	critical
350979	SUSE SLES15 Security Update : kernel (Live Patch 14 for SUSE Linux Enterprise 15 SP7) (SUSE-SU-2026:4356-1)	Nessus	SuSE Local Security Checks	Local	critical
348279	SUSE SLES15 Security Update : kernel (Live Patch 13 for SUSE Linux Enterprise 15 SP7) (SUSE-SU-2026:4258-1)	Nessus	SuSE Local Security Checks	Local	critical
346208	SUSE SLES15 Security Update : kernel RT (Live Patch 17 for SUSE Linux Enterprise 15 SP7) (SUSE-SU-2026:4170-1)	Nessus	SuSE Local Security Checks	Local	critical
343532	Ubuntu 24.04 LTS / Pro Realtime 24.04 LTS : Linux kernel (GCP) vulnerabilities (USN-8728-1)	Nessus	Ubuntu Local Security Checks	Local	high
343049	Oracle Linux 10 / 9 : Unbreakable Enterprise kernel (ELSA-2026-500248)	Nessus	Oracle Linux Local Security Checks	Local	high
340681	Ubuntu 24.04 LTS / 26.04 LTS / Pro Realtime 24.04 LTS : Linux kernel (NVIDIA) vulnerabilities (USN-8663-1)	Nessus	Ubuntu Local Security Checks	Local	high
340045	Ubuntu 26.04 LTS : Linux kernel (NVIDIA BaseOS) vulnerabilities (USN-8664-1)	Nessus	Ubuntu Local Security Checks	Local	high
335080	openSUSE 16: cluster-md-kmp-64kb / cluster-md-kmp-azure / cluster-md-kmp-default / etc (openSUSE-SU-2026:21555-1)	Nessus	SuSE Local Security Checks	Local	high
333762	Photon OS 5.0: Linux PHSA-2026-5.0-92-0895	Nessus	PhotonOS Local Security Checks	Local	high
329149	SUSE SLED15 / SLES15 : Security update for the Linux Kernel (SUSE-SU-2026:3166-1)	Nessus	SuSE Local Security Checks	Local	medium
325341	Linux Distros Unpatched Vulnerability : CVE-2026-53360	Nessus	Misc.	Local	high
322944	Photon OS 5.0: Linux PHSA-2026-5.0-0895	Nessus	PhotonOS Local Security Checks	Local	high
322087	Amazon Linux 2023 : bpftool6.18, kernel6.18, kernel6.18-devel (ALAS2023-2026-1881)	Nessus	Amazon Linux Local Security Checks	Local	high

Detections

Analytics

CVE-2026-53360

high

Tenable Plugins

critical

critical

critical

critical

high

high

high

high

high

high

medium

high

high

high