In the Linux kernel, the following vulnerability has been resolved: scsi: target: iscsi: Validate CHAP_R length before base64 decode chap_server_compute_hash() allocates client_digest as kzalloc(chap->digest_size) and then, for BASE64-encoded responses, passes chap_r directly to chap_base64_decode() without checking whether the input length could produce more than digest_size bytes of output. chap_base64_decode() writes to the destination unconditionally as long as there is input to consume. With MAX_RESPONSE_LENGTH set to 128 and the "0b" prefix stripped by extract_param(), up to 127 base64 characters can reach the decoder. 127 characters decode to 95 bytes. For SHA-256 (digest_size=32) this overflows client_digest by 63 bytes; for MD5 (digest_size=16) the overflow is 79 bytes. The length check at line 344 fires after the write has already happened. The HEX branch in the same switch statement already validates the length up front. Apply the same approach to the BASE64 branch: strip trailing base64 padding characters, then reject any input whose data length exceeds DIV_ROUND_UP(digest_size * 4, 3) before calling the decoder. Stripping trailing '=' before the comparison handles both padded and unpadded encodings. chap_base64_decode() already returns early on '=', so the full original string is still passed to the decoder unchanged. The mutual CHAP path decodes CHAP_C into initiatorchg_binhex, which is kzalloc(CHAP_CHALLENGE_STR_LEN). extract_param() caps initiatorchg at CHAP_CHALLENGE_STR_LEN characters, so at most CHAP_CHALLENGE_STR_LEN-1 base64 characters reach the decoder. The maximum decoded size, DIV_ROUND_UP((CHAP_CHALLENGE_STR_LEN-1) * 3, 4), is less than CHAP_CHALLENGE_STR_LEN, so no overflow is possible there. A comment is added at the call site to document this.

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:59737 advisory.

    * kernel: sctp: purge outqueue on stale COOKIE-ECHO handling (CVE-2026-52924)

    * kernel: scsi: target: iscsi: Validate CHAP_R length before base64 decode (CVE-2026-63886)

    * kernel: netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check     (CVE-2026-63913)

    * kernel: i2c: stub: Reject I2C block transfers with invalid length (CVE-2026-64191)

    * kernel: netfilter: ipset: fix race between dump and ip_set_list resize (CVE-2026-64189)

    * kernel: nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CVE-2026-64320)

    * kernel: Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CVE-2026-64277)

    * kernel: Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CVE-2026-64276)

    Bug Fix(es) and Enhancement(s):

    * [Rocky Linux-RT] usb_hub_wq items may run on isolated+nohz_full cores (JIRA:Rocky Linux-178088)

    * SELinux TCP/MPTCP connect check bypass via TCP Fast Open [rhel-8.10.z] (JIRA:Rocky Linux-222800)

    * ss core dumped when there is an SCTP session [rhel-8.10.z] (JIRA:Rocky Linux-212400)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-59821 advisory.

    - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (Maurizio Lombardi) [RHEL-219613]     {CVE-2026-64320}
    - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232120]     {CVE-2026-64191}
    - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231660] {CVE-2026-63886}
    - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231660]     {CVE-2026-63886}
    - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231447]     {CVE-2026-64277}
    - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230251]     {CVE-2026-64276}
    - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport     Bot) [RHEL-229797] {CVE-2026-63913}
    - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227676]     {CVE-2026-64189}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:59821 advisory.

    * kernel: sctp: purge outqueue on stale COOKIE-ECHO handling (CVE-2026-52924)

    * kernel: scsi: target: iscsi: Validate CHAP_R length before base64 decode (CVE-2026-63886)

    * kernel: netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check     (CVE-2026-63913)

    * kernel: i2c: stub: Reject I2C block transfers with invalid length (CVE-2026-64191)

    * kernel: netfilter: ipset: fix race between dump and ip_set_list resize (CVE-2026-64189)

    * kernel: nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CVE-2026-64320)

    * kernel: Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CVE-2026-64277)

    * kernel: Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CVE-2026-64276)

    Bug Fix(es) and Enhancement(s):

    * ss core dumped when there is an SCTP session [rhel-8.10.z] (JIRA:Rocky Linux-212400)

    * SELinux TCP/MPTCP connect check bypass via TCP Fast Open [rhel-8.10.z] (JIRA:Rocky Linux-222800)

    * [Rocky Linux-RT] usb_hub_wq items may run on isolated+nohz_full cores (JIRA:Rocky Linux-178088)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:59737 advisory.

    * kernel: sctp: purge outqueue on stale COOKIE-ECHO handling (CVE-2026-52924)
      * kernel: scsi: target: iscsi: Validate CHAP_R length before base64 decode (CVE-2026-63886)
      * kernel: netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check     (CVE-2026-63913)
      * kernel: i2c: stub: Reject I2C block transfers with invalid length (CVE-2026-64191)
      * kernel: netfilter: ipset: fix race between dump and ip_set_list resize (CVE-2026-64189)
      * kernel: nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CVE-2026-64320)
      * kernel: Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CVE-2026-64277)
      * kernel: Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CVE-2026-64276)


    Bug Fix(es) and Enhancement(s):

      * [AlmaLinux-RT] usb_hub_wq items may run on isolated+nohz_full cores (JIRA:AlmaLinux-178088)
      * SELinux TCP/MPTCP connect check bypass via TCP Fast Open [almalinux-8.10.z] (JIRA:AlmaLinux-222800)
      * ss core dumped when there is an SCTP session [almalinux-8.10.z] (JIRA:AlmaLinux-212400)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:59821 advisory.

    * kernel: sctp: purge outqueue on stale COOKIE-ECHO handling (CVE-2026-52924)
      * kernel: scsi: target: iscsi: Validate CHAP_R length before base64 decode (CVE-2026-63886)
      * kernel: netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check     (CVE-2026-63913)
      * kernel: i2c: stub: Reject I2C block transfers with invalid length (CVE-2026-64191)
      * kernel: netfilter: ipset: fix race between dump and ip_set_list resize (CVE-2026-64189)
      * kernel: nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CVE-2026-64320)
      * kernel: Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CVE-2026-64277)
      * kernel: Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CVE-2026-64276)


    Bug Fix(es) and Enhancement(s):

      * ss core dumped when there is an SCTP session [almalinux-8.10.z] (JIRA:AlmaLinux-212400)
      * SELinux TCP/MPTCP connect check bypass via TCP Fast Open [almalinux-8.10.z] (JIRA:AlmaLinux-222800)
      * [AlmaLinux-RT] usb_hub_wq items may run on isolated+nohz_full cores (JIRA:AlmaLinux-178088)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:59821 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: sctp: purge outqueue on stale COOKIE-ECHO handling (CVE-2026-52924)

    * kernel: scsi: target: iscsi: Validate CHAP_R length before base64 decode (CVE-2026-63886)

    * kernel: netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check     (CVE-2026-63913)

    * kernel: i2c: stub: Reject I2C block transfers with invalid length (CVE-2026-64191)

    * kernel: netfilter: ipset: fix race between dump and ip_set_list resize (CVE-2026-64189)

    * kernel: nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CVE-2026-64320)

    * kernel: Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CVE-2026-64277)

    * kernel: Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CVE-2026-64276)

    Bug Fix(es) and Enhancement(s):

    * ss core dumped when there is an SCTP session [rhel-8.10.z] (JIRA:RHEL-212400)

    * SELinux TCP/MPTCP connect check bypass via TCP Fast Open [rhel-8.10.z] (JIRA:RHEL-222800)

    * [RHEL-RT] usb_hub_wq items may run on isolated+nohz_full cores (JIRA:RHEL-178088)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:59737 advisory.

    The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with     extremely high determinism requirements.

    Security Fix(es):

    * kernel: sctp: purge outqueue on stale COOKIE-ECHO handling (CVE-2026-52924)

    * kernel: scsi: target: iscsi: Validate CHAP_R length before base64 decode (CVE-2026-63886)

    * kernel: netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check     (CVE-2026-63913)

    * kernel: i2c: stub: Reject I2C block transfers with invalid length (CVE-2026-64191)

    * kernel: netfilter: ipset: fix race between dump and ip_set_list resize (CVE-2026-64189)

    * kernel: nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CVE-2026-64320)

    * kernel: Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CVE-2026-64277)

    * kernel: Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CVE-2026-64276)

    Bug Fix(es) and Enhancement(s):

    * [RHEL-RT] usb_hub_wq items may run on isolated+nohz_full cores (JIRA:RHEL-178088)

    * SELinux TCP/MPTCP connect check bypass via TCP Fast Open [rhel-8.10.z] (JIRA:RHEL-222800)

    * ss core dumped when there is an SCTP session [rhel-8.10.z] (JIRA:RHEL-212400)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:57251 advisory.

    * kernel: drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CVE-2026-43206)
      * kernel: drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline     Management v4 (CVE-2026-43237)
      * kernel: crypto: pcrypt - Fix handling of MAY_BACKLOG requests (CVE-2026-43493)
      * kernel: udf: fix partition descriptor append bookkeeping (CVE-2026-45991)
      * kernel: drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CVE-2026-45878)
      * kernel: smb/client: fix out-of-bounds read in symlink_data() (CVE-2026-46185)
      * kernel: sched/psi: fix race between file release and pressure write (CVE-2026-52991)
      * kernel: drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CVE-2026-53143)
      * kernel: drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CVE-2026-53136)
      * kernel: drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CVE-2026-53329)
      * kernel: drm/i915/gem: Fix phys BO pread/pwrite with offset (CVE-2026-53356)
      * kernel: drm/amdgpu: zero-initialize GART table on allocation (CVE-2026-53374)
      * kernel: drm/i915: Fix potential UAF in TTM object purge (CVE-2026-63884)
      * kernel: scsi: target: iscsi: Validate CHAP_R length before base64 decode (CVE-2026-63886)
      * kernel: memfd: deny writeable mappings when implying SEAL_WRITE (CVE-2026-63952)
      * kernel: scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd()     (CVE-2026-63888)
      * kernel: blk-mq: pop cached request if it is usable (CVE-2026-64017)
      * kernel: drm/amdgpu: fix amdgpu_hmm_range_get_pages (CVE-2026-63879)
      * kernel: drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async     (CVE-2026-64219)
      * kernel: smb: client: fix double-free in SMB2_open() replay (CVE-2026-64382)
      * kernel: smb: client: mask server-provided mode to 07777 in modefromsid (CVE-2026-64379)
      * kernel: smb: client: fix query_info() replay double-free (CVE-2026-64386)
      * kernel: posix-cpu-timers: Prevent UAF caused by non-leader exec() race (CVE-2026-64560)
      * kernel: smb/client: handle overlapping allocated ranges in fallocate (CVE-2026-68388)


    Bug Fix(es) and Enhancement(s):

      * CLONE - AlmaLinux 10.2.z xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN     (JIRA:AlmaLinux-223954)
      * vhost: reset the vring metadata cache on vring reconfiguration [almalinux-10.2.z]     (JIRA:AlmaLinux-224545)
      * cifs: periodic IO errors when rename races with lease break [almalinux-10.2.z] (JIRA:AlmaLinux-235459)
      * cifs: smb1 directory listings from xp server returning EINVAL and EIO [almalinux-10.2.z]     (JIRA:AlmaLinux-235812)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:57251 advisory.

    * kernel: drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CVE-2026-43206)

    * kernel: drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management     v4 (CVE-2026-43237)

    * kernel: crypto: pcrypt - Fix handling of MAY_BACKLOG requests (CVE-2026-43493)

    * kernel: udf: fix partition descriptor append bookkeeping (CVE-2026-45991)

    * kernel: drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CVE-2026-45878)

    * kernel: smb/client: fix out-of-bounds read in symlink_data() (CVE-2026-46185)

    * kernel: sched/psi: fix race between file release and pressure write (CVE-2026-52991)

    * kernel: drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CVE-2026-53143)

    * kernel: drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CVE-2026-53136)

    * kernel: drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CVE-2026-53329)

    * kernel: drm/i915/gem: Fix phys BO pread/pwrite with offset (CVE-2026-53356)

    * kernel: drm/amdgpu: zero-initialize GART table on allocation (CVE-2026-53374)

    * kernel: drm/i915: Fix potential UAF in TTM object purge (CVE-2026-63884)

    * kernel: scsi: target: iscsi: Validate CHAP_R length before base64 decode (CVE-2026-63886)

    * kernel: memfd: deny writeable mappings when implying SEAL_WRITE (CVE-2026-63952)

    * kernel: scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd()     (CVE-2026-63888)

    * kernel: blk-mq: pop cached request if it is usable (CVE-2026-64017)

    * kernel: drm/amdgpu: fix amdgpu_hmm_range_get_pages (CVE-2026-63879)

    * kernel: drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async     (CVE-2026-64219)

    * kernel: smb: client: fix double-free in SMB2_open() replay (CVE-2026-64382)

    * kernel: smb: client: mask server-provided mode to 07777 in modefromsid (CVE-2026-64379)

    * kernel: smb: client: fix query_info() replay double-free (CVE-2026-64386)

    * kernel: posix-cpu-timers: Prevent UAF caused by non-leader exec() race (CVE-2026-64560)

    * kernel: smb/client: handle overlapping allocated ranges in fallocate (CVE-2026-68388)

    Bug Fix(es) and Enhancement(s):

    * CLONE - Rocky Linux 10.2.z xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN     (JIRA:Rocky Linux-223954)

    * vhost: reset the vring metadata cache on vring reconfiguration [rhel-10.2.z] (JIRA:Rocky Linux-224545)

    * cifs: periodic IO errors when rename races with lease break [rhel-10.2.z] (JIRA:Rocky Linux-235459)

    * cifs: smb1 directory listings from xp server returning EINVAL and EIO [rhel-10.2.z] (JIRA:Rocky     Linux-235812)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-57251 advisory.

    - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179570] {CVE-2026-45991}
    - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226717] {CVE-2026-43493}
    - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236210]     {CVE-2026-68388}
    - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227850]     {CVE-2026-64560}
    - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227850]     {CVE-2026-64370}
    - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234551] {CVE-2026-64382}
    - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234530]     {CVE-2026-64379}
    - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234129] {CVE-2026-64386}
    - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229066] {CVE-2026-46185}
    - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017}
    - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017}
    - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi)     [RHEL-213217] {CVE-2026-63888}
    - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222740] {CVE-2026-63884}
    - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI     Backport Bot) [RHEL-222567] {CVE-2026-64219}
    - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222667]     {CVE-2026-53329}
    - drm/amdgpu: fix amdgpu_hmm_range_get_pages (Mika Penttila) [RHEL-222625] {CVE-2026-63879}
    - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221336]     {CVE-2026-43206}
    - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222753] {CVE-2026-53356}
    - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222721]     {CVE-2026-45878}
    - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot)     [RHEL-222701] {CVE-2026-53143}
    - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222685]     {CVE-2026-53136}
    - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222646] {CVE-2026-53374}
    - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI     Backport Bot) [RHEL-221380] {CVE-2026-43237}
    - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI     Backport Bot) [RHEL-221380] {CVE-2026-43237}
    - sched/psi: Create the psimon kthread outside of cgroup_mutex (CKI Backport Bot) [RHEL-232560]     {CVE-2026-52991}
    - sched/psi: fix race between file release and pressure write (CKI Backport Bot) [RHEL-232560]     {CVE-2026-52991}
    - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886}
    - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231667]     {CVE-2026-63886}
    - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228531] {CVE-2026-63952}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:57251 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CVE-2026-43206)

    * kernel: drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management     v4 (CVE-2026-43237)

    * kernel: crypto: pcrypt - Fix handling of MAY_BACKLOG requests (CVE-2026-43493)

    * kernel: udf: fix partition descriptor append bookkeeping (CVE-2026-45991)

    * kernel: drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CVE-2026-45878)

    * kernel: smb/client: fix out-of-bounds read in symlink_data() (CVE-2026-46185)

    * kernel: sched/psi: fix race between file release and pressure write (CVE-2026-52991)

    * kernel: drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CVE-2026-53143)

    * kernel: drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CVE-2026-53136)

    * kernel: drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CVE-2026-53329)

    * kernel: drm/i915/gem: Fix phys BO pread/pwrite with offset (CVE-2026-53356)

    * kernel: drm/amdgpu: zero-initialize GART table on allocation (CVE-2026-53374)

    * kernel: drm/i915: Fix potential UAF in TTM object purge (CVE-2026-63884)

    * kernel: scsi: target: iscsi: Validate CHAP_R length before base64 decode (CVE-2026-63886)

    * kernel: memfd: deny writeable mappings when implying SEAL_WRITE (CVE-2026-63952)

    * kernel: scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd()     (CVE-2026-63888)

    * kernel: blk-mq: pop cached request if it is usable (CVE-2026-64017)

    * kernel: drm/amdgpu: fix amdgpu_hmm_range_get_pages (CVE-2026-63879)

    * kernel: drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async     (CVE-2026-64219)

    * kernel: smb: client: fix double-free in SMB2_open() replay (CVE-2026-64382)

    * kernel: smb: client: mask server-provided mode to 07777 in modefromsid (CVE-2026-64379)

    * kernel: smb: client: fix query_info() replay double-free (CVE-2026-64386)

    * kernel: posix-cpu-timers: Prevent UAF caused by non-leader exec() race (CVE-2026-64560)

    * kernel: smb/client: handle overlapping allocated ranges in fallocate (CVE-2026-68388)

    Bug Fix(es) and Enhancement(s):

    * CLONE - RHEL 10.2.z xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN     (JIRA:RHEL-223954)

    * vhost: reset the vring metadata cache on vring reconfiguration [rhel-10.2.z] (JIRA:RHEL-224545)

    * cifs: periodic IO errors when rename races with lease break [rhel-10.2.z] (JIRA:RHEL-235459)

    * cifs: smb1 directory listings from xp server returning EINVAL and EIO [rhel-10.2.z] (JIRA:RHEL-235812)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the linux package has been released.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - scsi: target: iscsi: Validate CHAP_R length before base64 decode chap_server_compute_hash() allocates     client_digest as kzalloc(chap->digest_size) and then, for BASE64-encoded responses, passes chap_r directly     to chap_base64_decode() without checking whether the input length could produce more than digest_size     bytes of output. chap_base64_decode() writes to the destination unconditionally as long as there is input     to consume. With MAX_RESPONSE_LENGTH set to 128 and the 0b prefix stripped by extract_param(), up to 127     base64 characters can reach the decoder. 127 characters decode to 95 bytes. For SHA-256 (digest_size=32)     this overflows client_digest by 63 bytes; for MD5 (digest_size=16) the overflow is 79 bytes. The length     check at line 344 fires after the write has already happened. The HEX branch in the same switch statement     already validates the length up front. Apply the same approach to the BASE64 branch: strip trailing base64     padding characters, then reject any input whose data length exceeds DIV_ROUND_UP(digest_size * 4, 3)     before calling the decoder. Stripping trailing '=' before the comparison handles both padded and unpadded     encodings. chap_base64_decode() already returns early on '=', so the full original string is still passed     to the decoder unchanged. The mutual CHAP path decodes CHAP_C into initiatorchg_binhex, which is     kzalloc(CHAP_CHALLENGE_STR_LEN). extract_param() caps initiatorchg at CHAP_CHALLENGE_STR_LEN characters,     so at most CHAP_CHALLENGE_STR_LEN-1 base64 characters reach the decoder. The maximum decoded size,     DIV_ROUND_UP((CHAP_CHALLENGE_STR_LEN-1) * 3, 4), is less than CHAP_CHALLENGE_STR_LEN, so no overflow is     possible there. A comment is added at the call site to document this. (CVE-2026-63886)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
341091	RockyLinux 8 : kernel-rt (RLSA-2026:59737)	Nessus	Rocky Linux Local Security Checks	Local	critical
341072	Oracle Linux 8 : kernel (ELSA-2026-59821)	Nessus	Oracle Linux Local Security Checks	Local	critical
341047	RockyLinux 8 : kernel (RLSA-2026:59821)	Nessus	Rocky Linux Local Security Checks	Local	critical
340744	AlmaLinux 8 : kernel-rt (ALSA-2026:59737)	Nessus	Alma Linux Local Security Checks	Local	critical
340718	AlmaLinux 8 : kernel (ALSA-2026:59821)	Nessus	Alma Linux Local Security Checks	Local	critical
340681	Ubuntu 24.04 LTS / 26.04 LTS / Pro Realtime 24.04 LTS : Linux kernel (NVIDIA) vulnerabilities (USN-8663-1)	Nessus	Ubuntu Local Security Checks	Local	high
340045	Ubuntu 26.04 LTS : Linux kernel (NVIDIA BaseOS) vulnerabilities (USN-8664-1)	Nessus	Ubuntu Local Security Checks	Local	high
339923	RHEL 8 : kernel (RHSA-2026:59821)	Nessus	Red Hat Local Security Checks	Local	critical
339689	RHEL 8 : kernel-rt (RHSA-2026:59737)	Nessus	Red Hat Local Security Checks	Local	critical
339386	AlmaLinux 10 : kernel (ALSA-2026:57251)	Nessus	Alma Linux Local Security Checks	Local	high
338772	RockyLinux 10 : kernel (RLSA-2026:57251)	Nessus	Rocky Linux Local Security Checks	Local	high
338720	Oracle Linux 10 : kernel (ELSA-2026-57251)	Nessus	Oracle Linux Local Security Checks	Local	high
338240	RHEL 10 : kernel (RHSA-2026:57251)	Nessus	Red Hat Local Security Checks	Local	high
335080	openSUSE 16: cluster-md-kmp-64kb / cluster-md-kmp-azure / cluster-md-kmp-default / etc (openSUSE-SU-2026:21555-1)	Nessus	SuSE Local Security Checks	Local	high
333941	Photon OS 5.0: Linux PHSA-2026-5.0-92-0926	Nessus	PhotonOS Local Security Checks	Local	high
333762	Photon OS 5.0: Linux PHSA-2026-5.0-92-0895	Nessus	PhotonOS Local Security Checks	Local	high
329326	Photon OS 5.0: Linux PHSA-2026-5.0-0926	Nessus	PhotonOS Local Security Checks	Local	high
328493	Amazon Linux 2023 : bpftool6.12, kernel6.12, kernel6.12-devel (ALAS2023-2026-1968)	Nessus	Amazon Linux Local Security Checks	Local	high
328102	Linux Distros Unpatched Vulnerability : CVE-2026-63886	Nessus	Misc.	Local	critical
327380	Amazon Linux 2023 : bpftool, kernel, kernel-devel (ALAS2023-2026-1924)	Nessus	Amazon Linux Local Security Checks	Local	high
322944	Photon OS 5.0: Linux PHSA-2026-5.0-0895	Nessus	PhotonOS Local Security Checks	Local	high
322087	Amazon Linux 2023 : bpftool6.18, kernel6.18, kernel6.18-devel (ALAS2023-2026-1881)	Nessus	Amazon Linux Local Security Checks	Local	high

Detections

Analytics

CVE-2026-63886

critical

Tenable Plugins

critical

critical

critical

critical

critical

high

high

critical

critical

high

high

high

high

high

high

high

high

high

critical

high

high

high