In the Linux kernel, the following vulnerability has been resolved: blk-cgroup: fix UAF in __blkcg_rstat_flush() When multiple blkgs in the same blkcg are released concurrently, a use-after-free can occur. The race happens when one blkg's __blkcg_rstat_flush() removes another blkg's iostat entries via llist_del_all(). The second blkg sees an empty list and proceeds to free itself while the first is still iterating over its entries. Move the flush from __blkg_release() (RCU callback) to blkg_release() (before call_rcu). This ensures the RCU grace period waits for any concurrent flush's rcu_read_lock() section to complete before freeing.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3602-1 advisory.

    The SUSE Linux Enterprise 15 SP6 kernel was updated to fix various security issues:

    The following security issues were fixed:

    - CVE-2026-46056: Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (bsc#1267435).
    - CVE-2026-46193: xfrm: ah: account for ESN high bits in async callbacks (bsc#1267656).
    - CVE-2026-46324: netfilter: nf_tables: Introduce functions freeing nft_hook objects (bsc#1267995).
    - CVE-2026-52967: smb/client: fix possible infinite loop and oob read in symlink_data() (bsc#1269181).
    - CVE-2026-52986: netfilter: nf_conntrack_sip: don't use simple_strtoul (bsc#1269289).
    - CVE-2026-53050: quota: Fix race of dquot_scan_active() with quota deactivation (bsc#1269188).
    - CVE-2026-53129: fs/mbcache: cancel shrink work before destroying the cache (bsc#1269633).
    - CVE-2026-53131: netfilter: require Ethernet MAC header before using eth_hdr() (bsc#1269773).
    - CVE-2026-53224: sctp: validate embedded INIT chunk and address list lengths in cookie (bsc#1269997).
    - CVE-2026-53246: sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (bsc#1269988).
    - CVE-2026-53250: xsk: cache csum_start/csum_offset to fix TOCTOU in xsk_skb_metadata() (bsc#1269808).
    - CVE-2026-53262: l2tp: pppol2tp: hold reference to session in pppol2tp_ioctl() (bsc#1270000).
    - CVE-2026-53267: netfilter: nft_ct: bail out on template ct in get eval (bsc#1269577).
    - CVE-2026-53354: arm64: errata: Mitigate TLBI errata on various Arm CPUs (bsc#1270230).
    - CVE-2026-53375: drm/amdgpu/vce: Prevent partial address patches (bsc#1271899).
    - CVE-2026-53388: fuse: re-lock request before replacing page cache folio (bsc#1271825).
    - CVE-2026-53391: NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (bsc#1271904).
    - CVE-2026-53402: fbdev: fbcon: fix out-of-bounds read in err_out of (bsc#1271908).
    - CVE-2026-63794: KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (bsc#1271964).
    - CVE-2026-63802: blk-cgroup: fix UAF in __blkcg_rstat_flush() (bsc#1272282).
    - CVE-2026-63806: KVM: Replace guest-triggerable BUG_ON() in ioeventfd datamatch with get_unaligned()     (bsc#1272268).
    - CVE-2026-63807: KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level     (bsc#1272263).
    - CVE-2026-63824: KEYS: fix overflow in keyctl_pkey_params_get_2() (bsc#1272180).
    - CVE-2026-63826: fbdev: fix use-after-free in store_modes() (bsc#1272183).
    - CVE-2026-63829: net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (bsc#1272176).
    - CVE-2026-63884: drm/i915: Fix potential UAF in TTM object purge (bsc#1272573).
    - CVE-2026-63893: thunderbolt: property: Reject u32 wrap in tb_property_entry_valid() (bsc#1272607).
    - CVE-2026-63912: xfrm: esp: restore combined single-frag length gate (bsc#1272836).
    - CVE-2026-63917: ip6: vti: Use ip6_tnl.net in vti6_changelink() (bsc#1272904).
    - CVE-2026-63919: xfrm: input: hold netns during deferred transport reinjection (bsc#1272907).
    - CVE-2026-63921: ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate() (bsc#1272918).
    - CVE-2026-63922,CVE-2026-63924: ipv6: exthdrs: refresh nh after handling HAO option (bsc#1272855).
    - CVE-2026-63946: Bluetooth: ISO: fix UAF in iso_recv_frame (bsc#1272665).
    - CVE-2026-63952: memfd: deny writeable mappings when implying SEAL_WRITE (bsc#1272468).
    - CVE-2026-63968: ipv6: fix possible infinite loop in fib6_select_path() (bsc#1272466).
    - CVE-2026-63971: sctp: fix race between sctp_wait_for_connect and peeloff (bsc#1272678).
    - CVE-2026-63975: Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (bsc#1272694).
    - CVE-2026-63984: ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (bsc#1272865).
    - CVE-2026-63994: tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp()     (bsc#1273035).
    - CVE-2026-64106: KVM: arm64: vgic-its: Reject restored DTE with out-of-range num_eventid_bits     (bsc#1272242).
    - CVE-2026-64189: netfilter: ipset: fix race between dump and ip_set_list resize (bsc#1272207).
    - CVE-2026-64560: posix-cpu-timers: Prevent UAF caused by non-leader exec() race (bsc#1273004).
    - CVE-2026-64561: KVM: x86: Check for invalid/obsolete root *after* making MMU pages available     (bsc#1273231).
    - CVE-2026-64564: sctp: don't free the ASCONF's own transport in DEL-IP processing (bsc#1274072).
    - CVE-2026-64600: xfs: resample the data fork mapping after cycling ILOCK (bsc#1271526).

    The following non security issues were fixed:

    - Drivers: hv: vmbus: Set DMA coherent mask for VMBus devices (git-fixes).
    - hrtimers: Introduce hrtimer_setup() to replace hrtimer_init() (bsc#1271912).
    - ice: don't check has_ready_bitmap in E810 functions (bsc#1269981).
    - ice: factor out ice_ptp_rebuild_owner() (bsc#1269981).
    - ice: fix PTP Call Trace during PTP release (bsc#1269981).
    - ice: Fix PTP NULL pointer dereference during VSI rebuild (bsc#1269981).
    - ice: introduce PTP state machine (bsc#1269981).
    - ice: pass reset type to PTP reset functions (bsc#1269981).
    - ice: rename ice_ptp_tx_cfg_intr (bsc#1269981).
    - ice: rename verify_cached to has_ready_bitmap (bsc#1269981).
    - ice: stop destroying and reinitalizing Tx tracker during reset (bsc#1269981).
    - KVM: SVM: Mark VMCB_NPT as dirty on nested VMRUN (git-fixes).
    - KVM: SVM: Mark VMCB_PERM_MAP as dirty on nested VMRUN (git-fixes).
    - KVM: x86/mmu: Fix use-after-free on vendor module reload (git-fixes).
    - KVM: x86/mmu: Preserve nested TDP shadow page tables if they are used as roots (git-fixes).
    - KVM: x86/xen: Fix cleanup logic in emulation of Xen schedop poll hypercalls (git-fixes).
    - KVM: x86: Fix SRCU list traversal in kvm_fire_mask_notifiers() (git-fixes).
    - KVM: x86: Fix VM hard lockup after prolonged inactivity with periodic HV timer (git-fixes).
    - KVM: x86: hyper-v: Bound the bank index when querying sparse banks (git-fixes).
    - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (git-fixes).
    - mkspec-dtb: Skip missing DTBs.
    - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (bsc#1271866).
    - net: mana: Add Interrupt Moderation support (bsc#1271368).
    - net: mana: Return error code from mana_create_rxq() (git-fixes).
    - net: mana: Validate the packet length reported by the NIC (git-fixes).
    - pkspec-dtb: Fix dtb-al rename.
    - posix-cpu-timers: Cleanup the firing logic (bsc#1271912).
    - posix-cpu-timers: Correctly update timer status in posix_cpu_timer_del() (bsc#1271912).
    - posix-cpu-timers: Do not arm SIGEV_NONE timers (bsc#1271912).
    - posix-cpu-timers: Handle interval timers correctly in timer_get() (bsc#1271912).
    - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (bsc#1271912).
    - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (bsc#1271912).
    - posix-cpu-timers: Make k_itimer::it_active consistent (bsc#1271912).
    - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (bsc#1271912).
    - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (bsc#1271912).
    - posix-cpu-timers: Simplify posix_cpu_timer_set() (bsc#1271912).
    - posix-cpu-timers: Split up posix_cpu_timer_get() (bsc#1271912).
    - posix-cpu-timers: Use @now instead of @val for clarity (bsc#1271912).
    - posix-timers: Add proper state tracking (bsc#1271912).
    - posix-timers: Avoid direct access to hrtimer clockbase (bsc#1271912).
    - posix-timers: Clarify posix_timer_fn() comments (bsc#1271912).
    - posix-timers: Clear overrun in common_timer_set() (bsc#1271912).
    - posix-timers: Consolidate signal queueing (bsc#1271912).
    - posix-timers: Consolidate timer setup (bsc#1271912).
    - posix-timers: Cure si_sys_private race (bsc#1271912).
    - posix-timers: Document common_clock_get() correctly (bsc#1271912).
    - posix-timers: Expand timer_arm() callbacks with a boolean return value (bsc#1271912).
    - posix-timers: Polish coding style in a few places (bsc#1271912).
    - posix-timers: Retrieve interval in common timer_settime() code (bsc#1271912).
    - RDMA/mana_ib: initialize err for empty send WR lists (git-fixes).
    - sctp: validate embedded address parameter length (git-fixes).
    - time: Switch to hrtimer_setup() (bsc#1271912).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the linux package has been released.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2014 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    ipv6: use RCU in ip6_output() (CVE-2025-40158)

    In the Linux kernel, the following vulnerability has been resolved:

    gpio: Fix resource leaks on errors in gpiochip_add_data_with_key() (CVE-2026-31732)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf: Reject sleepable kprobe_multi programs at attach time (CVE-2026-43010)

    In the Linux kernel, the following vulnerability has been resolved:

    net: Drop the lock in skb_may_tx_timestamp() (CVE-2026-43216)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf: Fix tcx/netkit detach permissions when prog fd isn't given (CVE-2026-45932)

    In the Linux kernel, the following vulnerability has been resolved:

    ip6_vti: set netns_immutable on the fallback device. (CVE-2026-52909)

    In the Linux kernel, the following vulnerability has been resolved:

    bonding: 3ad: implement proper RCU rules for port->aggregator (CVE-2026-52975)

    In the Linux kernel, the following vulnerability has been resolved:

    sched/psi: fix race between file release and pressure write (CVE-2026-52991)

    In the Linux kernel, the following vulnerability has been resolved:

    sctp: disable BH before calling udp_tunnel_xmit_skb() (CVE-2026-53070)

    In the Linux kernel, the following vulnerability has been resolved:

    fuse: limit FUSE_NOTIFY_RETRIEVE to uptodate folios (CVE-2026-53167)

    In the Linux kernel, the following vulnerability has been resolved:

    sctp: validate embedded INIT chunk and address list lengths in cookie (CVE-2026-53224)

    In the Linux kernel, the following vulnerability has been resolved:

    sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (CVE-2026-53246)

    In the Linux kernel, the following vulnerability has been resolved:

    fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (CVE-2026-53341)

    In the Linux kernel, the following vulnerability has been resolved:

    af_unix: Set gc_in_progress to true in unix_gc(). (CVE-2026-53361)

    In the Linux kernel, the following vulnerability has been resolved:

    virtiofs: fix UAF on submount umount

    iput() called from fuse_release_end() can Oops if the super block hasalready been destroyed.  Normally     this is prevented by waiting fornum_waiting to go down to zero before commencing with super block     shutdown.

    This only works, however, for the last submount instance, as the waitcounter is per connection, not per     superblock.

    Revert to using synchronous release requests for the auto_submounts case,which is virtiofs only at this     time. (CVE-2026-53381)

    In the Linux kernel, the following vulnerability has been resolved:

    vc_screen: fix null-ptr-deref in vcs_notifier() during concurrent vcs_write

    A KASAN null-ptr-deref was observed in vcs_notifier():

    BUG: KASAN: null-ptr-deref in vcs_notifier+0x98/0x130Read of size 2 at addr qmp_cmd_name:
    qmp_capabilities, arguments: {}

    The issue is a race condition in vcs_write(). When the console_lock istemporarily dropped (to copy data     from userspace), the vc_data pointerobtained from vcs_vc() may become stale. After re-acquiring the     lock,vcs_vc() is called again to re-validate the pointer. If the vc has beendeallocated in the meantime,     vcs_vc() returns NULL, and the while loopbreaks (with written > 0). However, after the loop,     vcs_scr_updated(vc)is still called with the now-NULL vc pointer, leading to a null pointerdereference in     the notifier chain (vcs_notifier dereferences param->vc).

    Fix this by adding a NULL check for vc before calling vcs_scr_updated(). (CVE-2026-53385)

    In the Linux kernel, the following vulnerability has been resolved:

    fuse: re-lock request before replacing page cache folio

    fuse_try_move_folio() unlocks the request on entry but does notre-lock it on the success path. This means     fuse_chan_abort() can end therequest and free the fuse_io_args (eg fuse_readpages_end()) while     thesubsequent copy chain logic after fuse_try_move_folio() accesses thefuse_io_args, leading to use-after-     free issues.

    Fix this by calling lock_request() before replace_page_cache_folio().This ensures the request is locked on     the success path which willprevent the fuse_io_args from being freed while the later copying logicruns,     and also ensures that the ap->folios[i]->mapping is never nullsince ap->folios[i] will always point to the     newfolio afterreplace_page_cache_folio(). (CVE-2026-53388)

    In the Linux kernel, the following vulnerability has been resolved:

    NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CVE-2026-53391)

    In the Linux kernel, the following vulnerability has been resolved:

    nfsd: reset write verifier on deferred writeback errors (CVE-2026-53393)

    In the Linux kernel, the following vulnerability has been resolved:

    nfsd: avoid leaking pre-allocated openowner on unconfirmed retry race (CVE-2026-53394)

    In the Linux kernel, the following vulnerability has been resolved:

    nfsd: fix posix_acl leak on SETACL decode failure (CVE-2026-53397)

    In the Linux kernel, the following vulnerability has been resolved:

    NFSD: Fix SECINFO_NO_NAME decode error cleanup (CVE-2026-53398)

    In the Linux kernel, the following vulnerability has been resolved:

    i2c: core: fix adapter registration race

    Adapters can be looked up based on their id using i2c_get_adapter()which takes a reference to the embedded     struct device.

    Make sure that the adapter (including its struct device) has beeninitialised before adding it to the IDR     to avoid accessing uninitialiseddata which could, for example, lead to NULL-pointer dereferences oruse-     after-free.

    Note that the i2c-dev chardev, which is registered from a bus notifier,currently uses i2c_get_adapter() so     the adapter needs to be added to theIDR before registration. (CVE-2026-53400)

    In the Linux kernel, the following vulnerability has been resolved:

    fbdev: Fix fb_new_modelist to prevent null-ptr-deref in fb_videomode_to_var

    info->var, a framebuffer's current mode, is expected to have a matchingentry in info->modelist.
    var_to_display() relies on this and treats afailed fb_match_mode() as This should not happen.
    fb_set_var() keeps ittrue by adding the mode to the list on every change, anddo_register_framebuffer()     does the same at registration.

    store_modes() replaces the modelist from userspace. fb_new_modelist()validates the new modes but does not     check that info->var still has amatch. It relies on fbcon_new_modelist() to re-point consoles, but     thatonly handles consoles mapped to the framebuffer. With fbcon unbound thereare none, so info->var is     left describing a mode that is no longer in thelist.

    A later console takeover runs var_to_display(), where fb_match_mode()returns NULL and leaves     fb_display[i].mode NULL. fbcon_switch() passes itto display_to_var(), and fb_videomode_to_var()     dereferences the NULL mode.

    Keep the current mode in the list in fb_new_modelist(), the same wayfb_set_var() does. (CVE-2026-53403)

    In the Linux kernel, the following vulnerability has been resolved:

    pNFS: Fix use-after-free in pnfs_update_layout() (CVE-2026-63800)

    In the Linux kernel, the following vulnerability has been resolved:

    tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (CVE-2026-63801)

    In the Linux kernel, the following vulnerability has been resolved:

    blk-cgroup: fix UAF in __blkcg_rstat_flush() (CVE-2026-63802)

    In the Linux kernel, the following vulnerability has been resolved:

    KVM: Replace guest-triggerable BUG_ON() in ioeventfd datamatch with get_unaligned() (CVE-2026-63806)

    In the Linux kernel, the following vulnerability has been resolved:

    KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (CVE-2026-63807)

    In the Linux kernel, the following vulnerability has been resolved:

    exfat: fix potential use-after-free in exfat_find_dir_entry() (CVE-2026-63808)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf: use kvfree() for replaced sysctl write buffer (CVE-2026-63809)

    In the Linux kernel, the following vulnerability has been resolved:

    block: Avoid mounting the bdev pseudo-filesystem in userspace (CVE-2026-63810)

    In the Linux kernel, the following vulnerability has been resolved:

    keys: Pin request_key_auth payload in instantiate paths (CVE-2026-63823)

    In the Linux kernel, the following vulnerability has been resolved:

    KEYS: fix overflow in keyctl_pkey_params_get_2() (CVE-2026-63824)

    In the Linux kernel, the following vulnerability has been resolved:

    fbdev: fix use-after-free in store_modes() (CVE-2026-63826)

    In the Linux kernel, the following vulnerability has been resolved:

    net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (CVE-2026-63829)

    In the Linux kernel, the following vulnerability has been resolved:

    net: skmsg: preserve sg.copy across SG transforms (CVE-2026-63830)

    In the Linux kernel, the following vulnerability has been resolved:

    ntfs3: reject direct userspace writes to reserved $LX* xattrs

    NTFS3 uses $LXUID, $LXGID, $LXMOD and $LXDEV as internal WSLpermission metadata and reloads them into     i_uid, i_gid and i_modefrom ntfs_get_wsl_perm().

    Because the empty-prefix xattr handler also lets file owners callsetxattr() on these names directly, an     unprivileged writer on awritable ntfs3 mount can plant root ownership and S_ISUID on their ownfile and     gain euid 0 after inode reload.

    Reject direct userspace writes to the reserved $LX* names. Internalntfs3 metadata updates are unchanged     because ntfs_save_wsl_perm()writes them via ntfs_set_ea() directly.

    [almaz.alexandrovich@paragon-software.com: added an additional check for non privileged users]     (CVE-2026-63833)

    In the Linux kernel, the following vulnerability has been resolved:

    drivers/base/memory: set mem->altmap after successful device registration (CVE-2026-64244)

    In the Linux kernel, the following vulnerability has been resolved:

    fbdev: modedb: fix a possible UAF in fb_find_mode() (CVE-2026-64245)

    In the Linux kernel, the following vulnerability has been resolved:

    KVM: x86: hyper-v: Bound the bank index when querying sparse banks (CVE-2026-64247)

    In the Linux kernel, the following vulnerability has been resolved:

    MIPS: smp: report dying CPU to RCU in stop_this_cpu() (CVE-2026-64248)

    In the Linux kernel, the following vulnerability has been resolved:

    LoongArch: Report dying CPU to RCU in stop_this_cpu() (CVE-2026-64250)

    In the Linux kernel, the following vulnerability has been resolved:

    kernel/fork: clear PF_BLOCK_TS in copy_process() (CVE-2026-64253)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1969 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    sctp: disable BH before calling udp_tunnel_xmit_skb() (CVE-2026-53070)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf: Fix same-register dst/src OOB read and pointer leak in sock_ops (CVE-2026-53078)

    In the Linux kernel, the following vulnerability has been resolved:

    KVM: x86: Fix shadow paging use-after-free due to unexpected role (CVE-2026-53359)

    In the Linux kernel, the following vulnerability has been resolved:

    af_unix: Set gc_in_progress to true in unix_gc(). (CVE-2026-53361)

    In the Linux kernel, the following vulnerability has been resolved:

    virtiofs: fix UAF on submount umount

    iput() called from fuse_release_end() can Oops if the super block hasalready been destroyed.  Normally     this is prevented by waiting fornum_waiting to go down to zero before commencing with super block     shutdown.

    This only works, however, for the last submount instance, as the waitcounter is per connection, not per     superblock.

    Revert to using synchronous release requests for the auto_submounts case,which is virtiofs only at this     time. (CVE-2026-53381)

    In the Linux kernel, the following vulnerability has been resolved:

    vc_screen: fix null-ptr-deref in vcs_notifier() during concurrent vcs_write

    A KASAN null-ptr-deref was observed in vcs_notifier():

    BUG: KASAN: null-ptr-deref in vcs_notifier+0x98/0x130Read of size 2 at addr qmp_cmd_name:
    qmp_capabilities, arguments: {}

    The issue is a race condition in vcs_write(). When the console_lock istemporarily dropped (to copy data     from userspace), the vc_data pointerobtained from vcs_vc() may become stale. After re-acquiring the     lock,vcs_vc() is called again to re-validate the pointer. If the vc has beendeallocated in the meantime,     vcs_vc() returns NULL, and the while loopbreaks (with written > 0). However, after the loop,     vcs_scr_updated(vc)is still called with the now-NULL vc pointer, leading to a null pointerdereference in     the notifier chain (vcs_notifier dereferences param->vc).

    Fix this by adding a NULL check for vc before calling vcs_scr_updated(). (CVE-2026-53385)

    In the Linux kernel, the following vulnerability has been resolved:

    fuse: re-lock request before replacing page cache folio

    fuse_try_move_folio() unlocks the request on entry but does notre-lock it on the success path. This means     fuse_chan_abort() can end therequest and free the fuse_io_args (eg fuse_readpages_end()) while     thesubsequent copy chain logic after fuse_try_move_folio() accesses thefuse_io_args, leading to use-after-     free issues.

    Fix this by calling lock_request() before replace_page_cache_folio().This ensures the request is locked on     the success path which willprevent the fuse_io_args from being freed while the later copying logicruns,     and also ensures that the ap->folios[i]->mapping is never nullsince ap->folios[i] will always point to the     newfolio afterreplace_page_cache_folio(). (CVE-2026-53388)

    In the Linux kernel, the following vulnerability has been resolved:

    net/tcp-ao: fix use-after-free of key in del_async path (CVE-2026-53389)

    In the Linux kernel, the following vulnerability has been resolved:

    NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CVE-2026-53391)

    In the Linux kernel, the following vulnerability has been resolved:

    NFSv4/flexfiles: reject zero filehandle version count (CVE-2026-53392)

    In the Linux kernel, the following vulnerability has been resolved:

    nfsd: reset write verifier on deferred writeback errors (CVE-2026-53393)

    In the Linux kernel, the following vulnerability has been resolved:

    nfsd: avoid leaking pre-allocated openowner on unconfirmed retry race (CVE-2026-53394)

    In the Linux kernel, the following vulnerability has been resolved:

    nfsd: fix posix_acl leak on SETACL decode failure (CVE-2026-53397)

    In the Linux kernel, the following vulnerability has been resolved:

    NFSD: Fix SECINFO_NO_NAME decode error cleanup (CVE-2026-53398)

    In the Linux kernel, the following vulnerability has been resolved:

    i2c: core: fix adapter registration race

    Adapters can be looked up based on their id using i2c_get_adapter()which takes a reference to the embedded     struct device.

    Make sure that the adapter (including its struct device) has beeninitialised before adding it to the IDR     to avoid accessing uninitialiseddata which could, for example, lead to NULL-pointer dereferences oruse-     after-free.

    Note that the i2c-dev chardev, which is registered from a bus notifier,currently uses i2c_get_adapter() so     the adapter needs to be added to theIDR before registration. (CVE-2026-53400)

    In the Linux kernel, the following vulnerability has been resolved:

    fbdev: Fix fb_new_modelist to prevent null-ptr-deref in fb_videomode_to_var

    info->var, a framebuffer's current mode, is expected to have a matchingentry in info->modelist.
    var_to_display() relies on this and treats afailed fb_match_mode() as This should not happen.
    fb_set_var() keeps ittrue by adding the mode to the list on every change, anddo_register_framebuffer()     does the same at registration.

    store_modes() replaces the modelist from userspace. fb_new_modelist()validates the new modes but does not     check that info->var still has amatch. It relies on fbcon_new_modelist() to re-point consoles, but     thatonly handles consoles mapped to the framebuffer. With fbcon unbound thereare none, so info->var is     left describing a mode that is no longer in thelist.

    A later console takeover runs var_to_display(), where fb_match_mode()returns NULL and leaves     fb_display[i].mode NULL. fbcon_switch() passes itto display_to_var(), and fb_videomode_to_var()     dereferences the NULL mode.

    Keep the current mode in the list in fb_new_modelist(), the same wayfb_set_var() does. (CVE-2026-53403)

    In the Linux kernel, the following vulnerability has been resolved:

    pNFS: Fix use-after-free in pnfs_update_layout() (CVE-2026-63800)

    In the Linux kernel, the following vulnerability has been resolved:

    tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (CVE-2026-63801)

    In the Linux kernel, the following vulnerability has been resolved:

    blk-cgroup: fix UAF in __blkcg_rstat_flush() (CVE-2026-63802)

    In the Linux kernel, the following vulnerability has been resolved:

    KVM: Replace guest-triggerable BUG_ON() in ioeventfd datamatch with get_unaligned() (CVE-2026-63806)

    In the Linux kernel, the following vulnerability has been resolved:

    KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (CVE-2026-63807)

    In the Linux kernel, the following vulnerability has been resolved:

    exfat: fix potential use-after-free in exfat_find_dir_entry() (CVE-2026-63808)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf: use kvfree() for replaced sysctl write buffer (CVE-2026-63809)

    In the Linux kernel, the following vulnerability has been resolved:

    block: Avoid mounting the bdev pseudo-filesystem in userspace (CVE-2026-63810)

    In the Linux kernel, the following vulnerability has been resolved:

    keys: Pin request_key_auth payload in instantiate paths (CVE-2026-63823)

    In the Linux kernel, the following vulnerability has been resolved:

    KEYS: fix overflow in keyctl_pkey_params_get_2() (CVE-2026-63824)

    In the Linux kernel, the following vulnerability has been resolved:

    fbdev: fix use-after-free in store_modes() (CVE-2026-63826)

    In the Linux kernel, the following vulnerability has been resolved:

    apparmor: mediate the implicit connect of TCP fast open sendmsg (CVE-2026-63828)

    In the Linux kernel, the following vulnerability has been resolved:

    net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (CVE-2026-63829)

    In the Linux kernel, the following vulnerability has been resolved:

    net: skmsg: preserve sg.copy across SG transforms (CVE-2026-63830)

    In the Linux kernel, the following vulnerability has been resolved:

    ntfs3: reject direct userspace writes to reserved $LX* xattrs

    NTFS3 uses $LXUID, $LXGID, $LXMOD and $LXDEV as internal WSLpermission metadata and reloads them into     i_uid, i_gid and i_modefrom ntfs_get_wsl_perm().

    Because the empty-prefix xattr handler also lets file owners callsetxattr() on these names directly, an     unprivileged writer on awritable ntfs3 mount can plant root ownership and S_ISUID on their ownfile and     gain euid 0 after inode reload.

    Reject direct userspace writes to the reserved $LX* names. Internalntfs3 metadata updates are unchanged     because ntfs_save_wsl_perm()writes them via ntfs_set_ea() directly.

    [almaz.alexandrovich@paragon-software.com: added an additional check for non privileged users]     (CVE-2026-63833)

    In the Linux kernel, the following vulnerability has been resolved:

    drivers/base/memory: set mem->altmap after successful device registration (CVE-2026-64244)

    In the Linux kernel, the following vulnerability has been resolved:

    fbdev: modedb: fix a possible UAF in fb_find_mode() (CVE-2026-64245)

    In the Linux kernel, the following vulnerability has been resolved:

    KVM: x86: hyper-v: Bound the bank index when querying sparse banks (CVE-2026-64247)

    In the Linux kernel, the following vulnerability has been resolved:

    MIPS: smp: report dying CPU to RCU in stop_this_cpu() (CVE-2026-64248)

    In the Linux kernel, the following vulnerability has been resolved:

    LoongArch: Report dying CPU to RCU in stop_this_cpu() (CVE-2026-64250)

    In the Linux kernel, the following vulnerability has been resolved:

    kernel/fork: clear PF_BLOCK_TS in copy_process() (CVE-2026-64253)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - blk-cgroup: fix UAF in __blkcg_rstat_flush() When multiple blkgs in the same blkcg are released     concurrently, a use-after-free can occur. The race happens when one blkg's __blkcg_rstat_flush() removes     another blkg's iostat entries via llist_del_all(). The second blkg sees an empty list and proceeds to free     itself while the first is still iterating over its entries. Move the flush from __blkg_release() (RCU     callback) to blkg_release() (before call_rcu). This ensures the RCU grace period waits for any concurrent     flush's rcu_read_lock() section to complete before freeing. (CVE-2026-63802)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
341024	SUSE SLED15: cluster-md-kmp-default / dlm-kmp-default / gfs2-kmp-default / etc (SUSE-SU-2026:3790-1)	Nessus	SuSE Local Security Checks	Local	high
335327	SUSE SLES15: cluster-md-kmp-default / dlm-kmp-default / gfs2-kmp-default / etc (SUSE-SU-2026:3602-1)	Nessus	SuSE Local Security Checks	Local	high
335080	openSUSE 16: cluster-md-kmp-64kb / cluster-md-kmp-azure / cluster-md-kmp-default / etc (openSUSE-SU-2026:21555-1)	Nessus	SuSE Local Security Checks	Local	high
333954	Photon OS 5.0: Linux PHSA-2026-5.0-92-0916	Nessus	PhotonOS Local Security Checks	Local	high
332042	Amazon Linux 2023 : bpftool6.12, kernel6.12, kernel6.12-devel (ALAS2023-2026-2014)	Nessus	Amazon Linux Local Security Checks	Local	high
328468	Amazon Linux 2023 : bpftool6.18, kernel6.18, kernel6.18-devel (ALAS2023-2026-1969)	Nessus	Amazon Linux Local Security Checks	Local	high
328064	Linux Distros Unpatched Vulnerability : CVE-2026-63802	Nessus	Misc.	Local	high
326038	Photon OS 5.0: Linux PHSA-2026-5.0-0916	Nessus	PhotonOS Local Security Checks	Local	high

Detections

Analytics

CVE-2026-63802

high

Tenable Plugins

high

high

high

high

high

high

high

high