In the Linux kernel, the following vulnerability has been resolved: vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() skb_tunnel_check_pmtu() can change skb->head. Reusing old_iph afer skb_tunnel_check_pmtu() can cause an UAF. Use instead ip_hdr(skb) as done in drivers/net/bareudp.c and drivers/net/geneve.c. Found by Sashiko.

The remote Ubuntu 24.04 LTS / Pro Realtime 24.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-8781-1 advisory.

    It was discovered that some Arm processors could complete a broadcast translation lookaside buffer (TLB)     invalidation before memory writes made through the invalidated translation were globally observed. A local     attacker could possibly use this to write to memory after permission to do so had been revoked, bypassing     memory protections or escalating privileges. (CVE-2025-10263)

    Several security issues were discovered in the Linux kernel. An attacker could possibly use these to     compromise the system. This update corrects flaws in the following subsystems:

    - ARM64 architecture;

    - User-space API (UAPI);

    - Kernel build system;

    - ARM32 architecture;

    - PowerPC architecture;

    - RISC-V architecture;

    - S390 architecture;

    - User-Mode Linux (UML);

    - x86 architecture;

    - Cryptographic API;

    - Intel NPU Driver;

    - Compute Acceleration Framework;

    - ACPI drivers;

    - Drivers core;

    - DRBD Distributed Replicated Block Device drivers;

    - Rados block device (RBD) driver;

    - Ublk userspace block driver;

    - Compressed RAM block device driver;

    - Bluetooth drivers;

    - Hardware crypto device drivers;

    - CXL (Compute Express Link) drivers;

    - Arm Firmware Framework for ARMv8-A(FFA);

    - EFI core;

    - FPGA Framework;

    - GPU drivers;

    - HID subsystem;

    - Hardware monitoring drivers;

    - I2C subsystem;

    - I3C subsystem;

    - InfiniBand drivers;

    - Input Device core drivers;

    - Input Device (Mouse) drivers;

    - IOMMU subsystem;

    - Multiple devices driver;

    - Media drivers;

    - Fastrpc Driver;

    - Network drivers;

    - Mellanox network drivers;

    - Microsoft Azure Network Adapter (MANA) driver;

    - MediaTek network drivers;

    - NVME drivers;

    - Operating Performance Points (OPP) driver;

    - PCI subsystem;

    - PTP clock framework;

    - RPMSG subsystem;

    - SCSI subsystem;

    - SoundWire subsystem;

    - SPI subsystem;

    - Greybus lights staging drivers;

    - Media staging drivers;

    - NVIDIA Tegra embedded controller (NVEC) staging driver;

    - Realtek RTL8723BS SDIO drivers;

    - TCM subsystem;

    - Trusted Execution Environment drivers;

    - Thunderbolt and USB4 drivers;

    - TTY drivers;

    - USB Gadget drivers;

    - USB Dual Role (OTG-ready) Controller drivers;

    - USB Serial drivers;

    - vDPA drivers;

    - VFIO drivers;

    - Virtio Host (VHOST) subsystem;

    - Virtio drivers;

    - Xen hypervisor drivers;

    - 9P distributed file system;

    - AFS file system;

    - File systems infrastructure;

    - BTRFS file system;

    - Ceph distributed file system;

    - exFAT file system;

    - F2FS file system;

    - GFS2 file system;

    - HFS file system;

    - HFS+ file system;

    - JFS file system;

    - Network file systems library;

    - Network file system (NFS) client;

    - Network file system (NFS) server daemon;

    - NTFS3 file system;

    - OCFS2 file system;

    - OrangeFS file system;

    - SMB network file system;

    - BPF subsystem;

    - File system encryption (fscrypt);

    - Software nodes and device properties;

    - IPv4 networking;

    - KVM subsystem;

    - Mellanox drivers;

    - Memory management;

    - Networking core;

    - Netfilter;

    - Socket messages infrastructure;

    - MediaTek SoC drivers;

    - Sun RPC protocol;

    - Network traffic control;

    - IPv6 networking;

    - Amateur Radio drivers;

    - Bluetooth subsystem;

    - IP tunnels definitions;

    - KCM (Kernel Connection Multiplexor) sockets driver;

    - MultiProtocol Label Switching driver;

    - TCP network protocol;

    - XFRM subsystem;

    - Tracing infrastructure;

    - io_uring subsystem;

    - Control group (cgroup);

    - Perf events;

    - IRQ subsystem;

    - Locking primitives;

    - KProbes tracing;

    - 9P file system network protocol;

    - B.A.T.M.A.N. meshing protocol;

    - Ethernet bridge;

    - CAN network layer;

    - Ceph Core library;

    - Handshake API;

    - HSR network protocol;

    - IFE protocol;

    - L2TP protocol;

    - MAC80211 subsystem;

    - IEEE 802.15.4 subsystem;

    - Multipath TCP;

    - NFC subsystem;

    - Open vSwitch;

    - Phonet protocol;

    - RDS protocol;

    - RxRPC session sockets;

    - SCTP protocol;

    - SMC sockets;

    - TIPC protocol;

    - TLS protocol;

    - Unix domain sockets;

    - VMware vSockets driver;

    - Wireless networking;

    - X.25 network layer;

    - eXpress Data Path;

    - Rust bindings mechanism;

    - AppArmor security module;

    - Key management;

    - Linux Security Modules (LSM) Framework;

    - SELinux security module;

    - ALSA framework;

    - AudioScience HPI driver;

    - Intel ASoC drivers;

    - USB sound devices; (CVE-2024-14040, CVE-2024-35948, CVE-2024-41008, CVE-2024-43872, CVE-2024-44932,     CVE-2024-44964, CVE-2024-49932, CVE-2024-49940, CVE-2024-50106, CVE-2024-50217, CVE-2024-52560,     CVE-2024-53098, CVE-2024-56552, CVE-2024-56591, CVE-2024-57857, CVE-2024-58089, CVE-2024-58094,     CVE-2024-58098, CVE-2024-58100, CVE-2024-58241, CVE-2025-21687, CVE-2025-21693, CVE-2025-21984,     CVE-2025-21985, CVE-2025-22104, CVE-2025-22108, CVE-2025-22109, CVE-2025-23132, CVE-2025-37776,     CVE-2025-37876, CVE-2025-37906, CVE-2025-38064, CVE-2025-38069, CVE-2025-38187, CVE-2025-38204,     CVE-2025-38206, CVE-2025-38242, CVE-2025-38498, CVE-2025-38563, CVE-2025-38565, CVE-2025-38636,     CVE-2025-38717, CVE-2025-39677, CVE-2025-39789, CVE-2025-39859, CVE-2025-39862, CVE-2025-39896,     CVE-2025-39933, CVE-2025-39958, CVE-2025-39990, CVE-2025-40025, CVE-2025-40040, CVE-2025-40054,     CVE-2025-40064, CVE-2025-40074, CVE-2025-40075, CVE-2025-40139, CVE-2025-40158, CVE-2025-40168,     CVE-2025-40170, CVE-2025-40203, CVE-2025-40274, CVE-2025-40344, CVE-2025-40354, CVE-2025-68174,     CVE-2025-68304, CVE-2025-68360, CVE-2025-68745, CVE-2025-68822, CVE-2025-71073, CVE-2025-71074,     CVE-2025-71202, CVE-2025-71289, CVE-2026-23208, CVE-2026-23239, CVE-2026-23240, CVE-2026-23327,     CVE-2026-23393, CVE-2026-23469, CVE-2026-31420, CVE-2026-31479, CVE-2026-31486, CVE-2026-31493,     CVE-2026-31560, CVE-2026-31568, CVE-2026-31630, CVE-2026-31663, CVE-2026-31771, CVE-2026-43009,     CVE-2026-43029, CVE-2026-43042, CVE-2026-43048, CVE-2026-43101, CVE-2026-43116, CVE-2026-43126,     CVE-2026-43172, CVE-2026-43213, CVE-2026-43263, CVE-2026-43303, CVE-2026-43352, CVE-2026-43353,     CVE-2026-43464, CVE-2026-45850, CVE-2026-45894, CVE-2026-45932, CVE-2026-45944, CVE-2026-46054,     CVE-2026-46130, CVE-2026-46158, CVE-2026-46170, CVE-2026-46175, CVE-2026-46181, CVE-2026-46203,     CVE-2026-46275, CVE-2026-46315, CVE-2026-46320, CVE-2026-46324, CVE-2026-46330, CVE-2026-52908,     CVE-2026-52909, CVE-2026-52910, CVE-2026-52912, CVE-2026-52915, CVE-2026-52916, CVE-2026-52918,     CVE-2026-52919, CVE-2026-52921, CVE-2026-52922, CVE-2026-52926, CVE-2026-52934, CVE-2026-52941,     CVE-2026-52956, CVE-2026-52988, CVE-2026-52991, CVE-2026-53000, CVE-2026-53005, CVE-2026-53009,     CVE-2026-53024, CVE-2026-53025, CVE-2026-53053, CVE-2026-53070, CVE-2026-53078, CVE-2026-53089,     CVE-2026-53090, CVE-2026-53091, CVE-2026-53109, CVE-2026-53118, CVE-2026-53120, CVE-2026-53129,     CVE-2026-53131, CVE-2026-53132, CVE-2026-53133, CVE-2026-53148, CVE-2026-53159, CVE-2026-53182,     CVE-2026-53183, CVE-2026-53185, CVE-2026-53186, CVE-2026-53196, CVE-2026-53198, CVE-2026-53216,     CVE-2026-53217, CVE-2026-53221, CVE-2026-53230, CVE-2026-53232, CVE-2026-53239, CVE-2026-53250,     CVE-2026-53254, CVE-2026-53256, CVE-2026-53262, CVE-2026-53264, CVE-2026-53266, CVE-2026-53269,     CVE-2026-53270, CVE-2026-53273, CVE-2026-53275, CVE-2026-53281, CVE-2026-53284, CVE-2026-53354,     CVE-2026-53355, CVE-2026-53357, CVE-2026-53358, CVE-2026-53361, CVE-2026-53368, CVE-2026-53384,     CVE-2026-53398, CVE-2026-53399, CVE-2026-63795, CVE-2026-63796, CVE-2026-63797, CVE-2026-63800,     CVE-2026-63801, CVE-2026-63804, CVE-2026-63807, CVE-2026-63808, CVE-2026-63815, CVE-2026-63818,     CVE-2026-63825, CVE-2026-63828, CVE-2026-63829, CVE-2026-63830, CVE-2026-63831, CVE-2026-63853,     CVE-2026-63858, CVE-2026-63886, CVE-2026-63887, CVE-2026-63888, CVE-2026-63893, CVE-2026-63906,     CVE-2026-63912, CVE-2026-63914, CVE-2026-63915, CVE-2026-63916, CVE-2026-63917, CVE-2026-63919,     CVE-2026-63921, CVE-2026-63922, CVE-2026-63924, CVE-2026-63926, CVE-2026-63940, CVE-2026-63944,     CVE-2026-63945, CVE-2026-63946, CVE-2026-63947, CVE-2026-63948, CVE-2026-63952, CVE-2026-63974,     CVE-2026-63975, CVE-2026-63976, CVE-2026-63978, CVE-2026-63979, CVE-2026-63980, CVE-2026-63984,     CVE-2026-63992, CVE-2026-63993, CVE-2026-63994, CVE-2026-64000, CVE-2026-64007, CVE-2026-64010,     CVE-2026-64011, CVE-2026-64015, CVE-2026-64018, CVE-2026-64025, CVE-2026-64029, CVE-2026-64032,     CVE-2026-64033, CVE-2026-64034, CVE-2026-64039, CVE-2026-64046, CVE-2026-64047, CVE-2026-64048,     CVE-2026-64051, CVE-2026-64055, CVE-2026-64056, CVE-2026-64064, CVE-2026-64073, CVE-2026-64076,     CVE-2026-64077, CVE-2026-64082, CVE-2026-64083, CVE-2026-64084, CVE-2026-64085, CVE-2026-64086,     CVE-2026-64087, CVE-2026-64088, CVE-2026-64089, CVE-2026-64091, CVE-2026-64092, CVE-2026-64093,     CVE-2026-64096, CVE-2026-64097, CVE-2026-64098, CVE-2026-64099, CVE-2026-64102, CVE-2026-64103,     CVE-2026-64106, CVE-2026-64108, CVE-2026-64109, CVE-2026-64111, CVE-2026-64112, CVE-2026-64113,     CVE-2026-64114, CVE-2026-64115, CVE-2026-64116, CVE-2026-64117, CVE-2026-64118, CVE-2026-64121,     CVE-2026-64125, CVE-2026-64126, CVE-2026-64127, CVE-2026-64128, CVE-2026-64133, CVE-2026-64134,     CVE-2026-64135, CVE-2026-64136, CVE-2026-64137, CVE-2026-64138, CVE-2026-64144, CVE-2026-64147,     CVE-2026-64148, CVE-2026-64153, CVE-2026-64155, CVE-2026-64160, CVE-2026-64163, CVE-2026-64165,     CVE-2026-64166, CVE-2026-64168, CVE-2026-64170, CVE-2026-64173, CVE-2026-64174, CVE-2026-64177,     CVE-2026-64178, CVE-2026-64179, CVE-2026-64180, CVE-2026-64182, CVE-2026-64183, CVE-2026-64184,     CVE-2026-64185, CVE-2026-64191, CVE-2026-64206, CVE-2026-64214, CVE-2026-64217, CVE-2026-64218,     CVE-2026-64219, CVE-2026-64220, CVE-2026-64221, CVE-2026-64225, CVE-2026-64231, CVE-2026-64237,     CVE-2026-64247, CVE-2026-64249, CVE-2026-64268, CVE-2026-64269, CVE-2026-64280, CVE-2026-64303,     CVE-2026-64313, CVE-2026-64315, CVE-2026-64319, CVE-2026-64320, CVE-2026-64355, CVE-2026-64361,     CVE-2026-64364, CVE-2026-64382, CVE-2026-64383, CVE-2026-64384, CVE-2026-64385, CVE-2026-64386,     CVE-2026-64387, CVE-2026-64390, CVE-2026-64391, CVE-2026-64392, CVE-2026-64393, CVE-2026-64394,     CVE-2026-64396, CVE-2026-64397, CVE-2026-64399, CVE-2026-64400, CVE-2026-64408, CVE-2026-64438,     CVE-2026-64441, CVE-2026-64445, CVE-2026-64450, CVE-2026-64475, CVE-2026-64510, CVE-2026-64518,     CVE-2026-64523, CVE-2026-64529, CVE-2026-64530, CVE-2026-64534, CVE-2026-64535, CVE-2026-64541,     CVE-2026-64548, CVE-2026-64551, CVE-2026-64552, CVE-2026-64554, CVE-2026-64555, CVE-2026-64557,     CVE-2026-64561, CVE-2026-64562, CVE-2026-64564, CVE-2026-64586, CVE-2026-64597, CVE-2026-64598,     CVE-2026-68082, CVE-2026-68083, CVE-2026-68117, CVE-2026-68123, CVE-2026-68124, CVE-2026-68127,     CVE-2026-68136, CVE-2026-68137, CVE-2026-68138, CVE-2026-68144, CVE-2026-68147, CVE-2026-68152,     CVE-2026-68154, CVE-2026-68156, CVE-2026-68158, CVE-2026-68159, CVE-2026-68160, CVE-2026-68161,     CVE-2026-68162, CVE-2026-68198, CVE-2026-68206, CVE-2026-68209, CVE-2026-68210, CVE-2026-68213,     CVE-2026-68228, CVE-2026-68229, CVE-2026-68300, CVE-2026-68302, CVE-2026-68343, CVE-2026-68381,     CVE-2026-68388, CVE-2026-68426, CVE-2026-68431, CVE-2026-68457, CVE-2026-68461, CVE-2026-68470,     CVE-2026-68476, CVE-2026-68477, CVE-2026-72014, CVE-2026-72020, CVE-2026-72033, CVE-2026-72041,     CVE-2026-72065, CVE-2026-72069, CVE-2026-72071, CVE-2026-72083, CVE-2026-72084, CVE-2026-72085,     CVE-2026-72098, CVE-2026-72111, CVE-2026-72124, CVE-2026-72125, CVE-2026-72126, CVE-2026-72129,     CVE-2026-72130, CVE-2026-72191, CVE-2026-72192, CVE-2026-72194, CVE-2026-72200, CVE-2026-72217,     CVE-2026-72221, CVE-2026-72222, CVE-2026-72226, CVE-2026-72234, CVE-2026-72251, CVE-2026-72255,     CVE-2026-72288, CVE-2026-72289, CVE-2026-72296, CVE-2026-72299, CVE-2026-72317, CVE-2026-72318,     CVE-2026-72319, CVE-2026-72320, CVE-2026-72322, CVE-2026-72323, CVE-2026-72329, CVE-2026-72339,     CVE-2026-72348, CVE-2026-72351, CVE-2026-72380, CVE-2026-72383, CVE-2026-72398, CVE-2026-72399,     CVE-2026-72421, CVE-2026-72422, CVE-2026-72434, CVE-2026-72436, CVE-2026-72451, CVE-2026-72454,     CVE-2026-72466, CVE-2026-72472, CVE-2026-72473, CVE-2026-72487, CVE-2026-72488, CVE-2026-72489,     CVE-2026-72491, CVE-2026-72494, CVE-2026-72495, CVE-2026-72496, CVE-2026-72499, CVE-2026-74255,     CVE-2026-74264, CVE-2026-74267, CVE-2026-74268, CVE-2026-74269, CVE-2026-74279, CVE-2026-74280,     CVE-2026-74287, CVE-2026-74302, CVE-2026-74305, CVE-2026-74310, CVE-2026-74345, CVE-2026-74350,     CVE-2026-74376, CVE-2026-74384, CVE-2026-74394, CVE-2026-74398, CVE-2026-74401, CVE-2026-74405,     CVE-2026-74406, CVE-2026-74407, CVE-2026-74408, CVE-2026-74410, CVE-2026-74411, CVE-2026-74417,     CVE-2026-74427, CVE-2026-74436, CVE-2026-74439, CVE-2026-74440, CVE-2026-74473, CVE-2026-74474,     CVE-2026-74475, CVE-2026-74476, CVE-2026-74478, CVE-2026-74480, CVE-2026-74493, CVE-2026-74495,     CVE-2026-74521, CVE-2026-74538, CVE-2026-74541, CVE-2026-74556, CVE-2026-74569)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-647750 advisory.

    - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244969] {CVE-2026-72098}
    - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244928] {CVE-2026-72129}
    - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-237706]     {CVE-2026-68409}
    - wifi: mt76: mt7925: drop TXRX_NOTIFY on non-mmio buses (Jose Ignacio Tornos Martinez) [RHEL-237681]     {CVE-2026-68193}
    - wifi: mt76: mt7925: fix crash in reset link replay (Jose Ignacio Tornos Martinez) [RHEL-237527]     {CVE-2026-68307}
    - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez)     [RHEL-232015] {CVE-2026-64255}
    - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez)     [RHEL-231685] {CVE-2026-64117}
    - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez)     [RHEL-231685] {CVE-2026-64117}
    - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez)     [RHEL-230977] {CVE-2026-64037}
    - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230604]     {CVE-2026-53182}
    - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez)     [RHEL-229725] {CVE-2026-52947}
    - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227617]     {CVE-2026-64515}
    - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515}
    - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232673]     {CVE-2026-53072}
    - accel/qaic: Add overflow check to remap_pfn_range during mmap (CKI Backport Bot) [RHEL-232178]     {CVE-2026-64051}
    - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231067]     {CVE-2026-63947}
    - Bluetooth: virtio_bt: validate rx pkt_type header length (CKI Backport Bot) [RHEL-230949]     {CVE-2026-46123}
    - Bluetooth: virtio_bt: clamp rx length before skb_put (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123}
    - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230076]     {CVE-2026-53209}
    - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230013] {CVE-2026-63944}
    - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228750]     {CVE-2026-63975}
    - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-227911]     {CVE-2026-63946}
    - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946}
    - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227889]     {CVE-2026-64113}
    - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport     Bot) [RHEL-227532] {CVE-2026-43334}
    - vfio/pci: Check BAR resources before exporting a DMABUF (CKI Backport Bot) [RHEL-227133]     {CVE-2026-64042}
    - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225690] {CVE-2026-64015}
    - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225653] {CVE-2026-53254}
    - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225574]     {CVE-2026-53256}
    - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225552] {CVE-2026-52918}
    - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188232] {CVE-2026-53091}
    - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091}
    - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188232] {CVE-2026-53091}
    - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232]     {CVE-2026-53091}
    - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091}
    - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188232] {CVE-2026-53091}
    - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188232] {CVE-2026-53091}
    - vfio/pci: Clean up DMABUFs before disabling function (CKI Backport Bot) [RHEL-189549] {CVE-2026-53322}
    - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189468]     {CVE-2026-43133}
    - fuse: fix race between interrupt and resend (Miklos Szeredi) [RHEL-218495] {CVE-2026-64265}
    - fuse: clear intr_entry in fuse_resend and fuse_remove_pending_req (Miklos Szeredi) [RHEL-218495]     {CVE-2026-64265}
    - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248457] {CVE-2026-64563}
    - udp: Fix wildcard bind conflict check when using hash2 (Felix Maurer) [RHEL-218016] {CVE-2026-31503}
    - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232246] {CVE-2026-46015}
    - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232629] {CVE-2026-46306}
    - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226125]     {CVE-2026-46266}
    - ipv6: anycast: insert aca into global hash under idev->lock (Felix Maurer) [RHEL-230763]     {CVE-2026-53259}
    - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226073]     {CVE-2026-53275}
    - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225606] {CVE-2026-43339}
    - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225864] {CVE-2026-53223}
    - net: add pskb_may_pull() to skb_gro_receive_list() (Felix Maurer) [RHEL-229309] {CVE-2026-53235}
    - can: bcm: extend bcm_tx_lock usage for data and timer updates (Abhishek Rawal) [RHEL-216700]     {CVE-2025-38004}
    - can: bcm: add locking when updating filter and timer values (Abhishek Rawal) [RHEL-216700]     {CVE-2025-38004}
    - can: bcm: fix locking for bcm_op runtime updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004}
    - can: bcm: add locking for bcm_op runtime updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004}
    - smb: client: fix double-free in SMB2_close() replay (Paulo Alcantara) [RHEL-240056] {CVE-2026-64597}
    - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-132852] {CVE-2026-43084}
    - ppp: require CAP_NET_ADMIN in target netns for unattached ioctls (Abhishek Rawal) [RHEL-228009]     {CVE-2026-53075}
    - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231711]     {CVE-2026-63993}
    - ipv6: sit: reload inner IPv6 header after GSO offloads (Abhishek Rawal) [RHEL-225920] {CVE-2026-53228}
    - ipv6: add NULL checks for idev in SRv6 paths (Abhishek Rawal) [RHEL-218012] {CVE-2026-23442}
    - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot)     [RHEL-234153] {CVE-2026-64319}
    - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (CKI Backport Bot) [RHEL-234204]     {CVE-2026-64287}
    - KVM: arm64: Take the SRCU lock for page table walks in fault injection and AT emulation (CKI Backport     Bot) [RHEL-229347] {CVE-2026-53277}
    - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot)     [RHEL-227269] {CVE-2026-64002}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:64775 advisory.

    * kernel: can: bcm: add locking for bcm_op runtime updates (CVE-2025-38004)

    * kernel: ipv6: add NULL checks for idev in SRv6 paths (CVE-2026-23442)

    * kernel: udp: Fix wildcard bind conflict check when using hash2 (CVE-2026-31503)

    * kernel: ipv6: prevent possible UaF in addrconf_permanent_addr() (CVE-2026-43339)

    * kernel: tcp: call sk_data_ready() after listener migration (CVE-2026-46015)

    * kernel: inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (CVE-2026-46266)

    * kernel: flow_dissector: do not dissect PPPoE PFC frames (CVE-2026-46306)

    * kernel: io_uring/poll: fix signed comparison in io_poll_get_ownership() (CVE-2026-52933)

    * kernel: ppp: require CAP_NET_ADMIN in target netns for unattached ioctls (CVE-2026-53075)

    * kernel: KVM: arm64: Take the SRCU lock for page table walks in fault injection and AT emulation     (CVE-2026-53277)

    * kernel: ipv6: sit: reload inner IPv6 header after GSO offloads (CVE-2026-53228)

    * kernel: net: add pskb_may_pull() to skb_gro_receive_list() (CVE-2026-53235)

    * kernel: net: guard timestamp cmsgs to real error queue skbs (CVE-2026-53223)

    * kernel: ipv6: mcast: Fix use-after-free when processing MLD queries (CVE-2026-53275)

    * kernel: ipv6: anycast: insert aca into global hash under idev->lock (CVE-2026-53259)

    * kernel: ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table()     (CVE-2026-64002)

    * kernel: vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (CVE-2026-63993)

    * kernel: fuse: clear intr_entry in fuse_resend and fuse_remove_pending_req (CVE-2026-64265)

    * kernel: nvmet-auth: validate reply message payload bounds against transfer length (CVE-2026-64319)

    * kernel: KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (CVE-2026-64287)

    * kernel: rhashtable: clear stale iter->p on table restart (CVE-2026-64563)

    * kernel: smb: client: fix double-free in SMB2_close() replay (CVE-2026-64597)

    Bug Fix(es) and Enhancement(s):

    * Customer needs netfilter: nfnetlink_queue: optimize verdict lookup with hash table patch [Rocky Linux     10.2] (JIRA:Rocky Linux-132852)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:64775 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: can: bcm: add locking for bcm_op runtime updates (CVE-2025-38004)

    * kernel: ipv6: add NULL checks for idev in SRv6 paths (CVE-2026-23442)

    * kernel: udp: Fix wildcard bind conflict check when using hash2 (CVE-2026-31503)

    * kernel: ipv6: prevent possible UaF in addrconf_permanent_addr() (CVE-2026-43339)

    * kernel: tcp: call sk_data_ready() after listener migration (CVE-2026-46015)

    * kernel: inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (CVE-2026-46266)

    * kernel: flow_dissector: do not dissect PPPoE PFC frames (CVE-2026-46306)

    * kernel: io_uring/poll: fix signed comparison in io_poll_get_ownership() (CVE-2026-52933)

    * kernel: ppp: require CAP_NET_ADMIN in target netns for unattached ioctls (CVE-2026-53075)

    * kernel: KVM: arm64: Take the SRCU lock for page table walks in fault injection and AT emulation     (CVE-2026-53277)

    * kernel: ipv6: sit: reload inner IPv6 header after GSO offloads (CVE-2026-53228)

    * kernel: net: add pskb_may_pull() to skb_gro_receive_list() (CVE-2026-53235)

    * kernel: net: guard timestamp cmsgs to real error queue skbs (CVE-2026-53223)

    * kernel: ipv6: mcast: Fix use-after-free when processing MLD queries (CVE-2026-53275)

    * kernel: ipv6: anycast: insert aca into global hash under idev->lock (CVE-2026-53259)

    * kernel: ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table()     (CVE-2026-64002)

    * kernel: vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (CVE-2026-63993)

    * kernel: fuse: clear intr_entry in fuse_resend and fuse_remove_pending_req (CVE-2026-64265)

    * kernel: nvmet-auth: validate reply message payload bounds against transfer length (CVE-2026-64319)

    * kernel: KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (CVE-2026-64287)

    * kernel: rhashtable: clear stale iter->p on table restart (CVE-2026-64563)

    * kernel: smb: client: fix double-free in SMB2_close() replay (CVE-2026-64597)

    Bug Fix(es) and Enhancement(s):

    * Customer needs netfilter: nfnetlink_queue: optimize verdict lookup with hash table patch [RHEL 10.2]     (JIRA:RHEL-132852)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-099727 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu()

    skb_tunnel_check_pmtu() can change skb->head.

    Reusing old_iph afer skb_tunnel_check_pmtu() can cause an UAF.

    Use instead ip_hdr(skb) as done in drivers/net/bareudp.c     and drivers/net/geneve.c.

    Found by Sashiko.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

An update of the linux package has been released.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() skb_tunnel_check_pmtu() can change     skb->head. Reusing old_iph afer skb_tunnel_check_pmtu() can cause an UAF. Use instead ip_hdr(skb) as done     in drivers/net/bareudp.c and drivers/net/geneve.c. Found by Sashiko. (CVE-2026-63993)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
348386	Ubuntu 24.04 LTS / Pro Realtime 24.04 LTS : Linux kernel (NVIDIA Tegra) vulnerabilities (USN-8781-1)	Nessus	Ubuntu Local Security Checks	Local	high
344653	Oracle Linux 10 : ELSA-2026-64775-0: / kernel (ELSA-2026-647750)	Nessus	Oracle Linux Local Security Checks	Local	high
344050	RockyLinux 10 : kernel (RLSA-2026:64775)	Nessus	Rocky Linux Local Security Checks	Local	high
343877	RHEL 10 : kernel (RHSA-2026:64775)	Nessus	Red Hat Local Security Checks	Local	high
343532	Ubuntu 24.04 LTS / Pro Realtime 24.04 LTS : Linux kernel (GCP) vulnerabilities (USN-8728-1)	Nessus	Ubuntu Local Security Checks	Local	high
343049	Oracle Linux 10 / 9 : Unbreakable Enterprise kernel (ELSA-2026-500248)	Nessus	Oracle Linux Local Security Checks	Local	high
340681	Ubuntu 24.04 LTS / 26.04 LTS / Pro Realtime 24.04 LTS : Linux kernel (NVIDIA) vulnerabilities (USN-8663-1)	Nessus	Ubuntu Local Security Checks	Local	high
340045	Ubuntu 26.04 LTS : Linux kernel (NVIDIA BaseOS) vulnerabilities (USN-8664-1)	Nessus	Ubuntu Local Security Checks	Local	high
336732	Unity Linux 20.1050e Security Update: kernel (UTSA-2026-099727)	Nessus	Unity Linux Local Security Checks	Local	critical
333941	Photon OS 5.0: Linux PHSA-2026-5.0-92-0926	Nessus	PhotonOS Local Security Checks	Local	high
333762	Photon OS 5.0: Linux PHSA-2026-5.0-92-0895	Nessus	PhotonOS Local Security Checks	Local	high
329326	Photon OS 5.0: Linux PHSA-2026-5.0-0926	Nessus	PhotonOS Local Security Checks	Local	high
328499	Amazon Linux 2 : kernel, --advisory ALAS2KERNEL-5.15-2026-110 (ALASKERNEL-5.15-2026-110)	Nessus	Amazon Linux Local Security Checks	Local	medium
328493	Amazon Linux 2023 : bpftool6.12, kernel6.12, kernel6.12-devel (ALAS2023-2026-1968)	Nessus	Amazon Linux Local Security Checks	Local	high
328267	Linux Distros Unpatched Vulnerability : CVE-2026-63993	Nessus	Misc.	Local	critical
327380	Amazon Linux 2023 : bpftool, kernel, kernel-devel (ALAS2023-2026-1924)	Nessus	Amazon Linux Local Security Checks	Local	high
325574	Amazon Linux 2 : kernel, --advisory ALAS2KERNEL-5.10-2026-124 (ALASKERNEL-5.10-2026-124)	Nessus	Amazon Linux Local Security Checks	Local	high
322944	Photon OS 5.0: Linux PHSA-2026-5.0-0895	Nessus	PhotonOS Local Security Checks	Local	high
322087	Amazon Linux 2023 : bpftool6.18, kernel6.18, kernel6.18-devel (ALAS2023-2026-1881)	Nessus	Amazon Linux Local Security Checks	Local	high

Detections

Analytics

CVE-2026-63993

critical

Tenable Plugins

high

high

high

high

high

high

high

high

critical

high

high

high

medium

high

critical

high

high

high

high