In the Linux kernel, the following vulnerability has been resolved: blk-mq: pop cached request if it is usable When submitting a bio to blk-mq, if the task should sleep after peeking a cached request, but before it pops it, the plug flushes and calls blk_mq_free_plug_rqs, freeing the cached_rqs. This creates a use-after-free bug. Fix this by popping the cached request before any possible blocking calls if it is suitable for use. Popping this request first holds a queue reference, so avoid any serialization races with queue freezes and can safely proceed with dispatching that request to the driver. This potentially increases a timing window from when a driver wants to freeze its queue to when requests stop being dispatched. That scenario is off the fast path though, and drivers need to appropriately handle requests during a freeze request anyway. The downside is the popped element needs to be individually freed when we performed a bio plug merge. The cached request would have had to be freed later anyway, but this patch does it inline with building the plug list instead of after flushing it.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2107 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    blk-mq: pop cached request if it is usable (CVE-2026-64017)

    In the Linux kernel, the following vulnerability has been resolved:

    sctp: don't free the ASCONF's own transport in DEL-IP processing (CVE-2026-64564)

    In the Linux kernel, the following vulnerability has been resolved:

    xfrm: fix sk_dst_cache double-free in xfrm_user_policy() (CVE-2026-64581)

    In the Linux kernel, the following vulnerability has been resolved:

    rbd: Reset positive result codes to zero in object map update path (CVE-2026-68131)

    In the Linux kernel, the following vulnerability has been resolved:

    net/sched: serialize qdisc_rtab_list against concurrent get/put (CVE-2026-68138)

    In the Linux kernel, the following vulnerability has been resolved:

    libceph: Reject monmaps advertising zero monitors (CVE-2026-68155)

    In the Linux kernel, the following vulnerability has been resolved:

    ceph: fix pre-auth out-of-bounds read on snaptrace in ceph_handle_caps() (CVE-2026-68160)

    In the Linux kernel, the following vulnerability has been resolved:

    vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CVE-2026-68299)

    In the Linux kernel, the following vulnerability has been resolved:

    rds: drop incoming messages that cross network namespace boundaries (CVE-2026-68335)

    In the Linux kernel, the following vulnerability has been resolved:

    net/packet: avoid fanout hook re-registration after unregister (CVE-2026-68338)

    In the Linux kernel, the following vulnerability has been resolved:

    x86/bugs: Make Safe-RET robust against interrupt injection (CVE-2026-68480)

    In the Linux kernel, the following vulnerability has been resolved:

    net: ip6_tunnel: require CAP_NET_ADMIN in the device netns for changelink (CVE-2026-72051)

    In the Linux kernel, the following vulnerability has been resolved:

    scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CVE-2026-74556)

    In the Linux kernel, the following vulnerability has been resolved:

    vhost: reset the vring metadata cache on vring reconfiguration (CVE-2026-74580)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6466 advisory.

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-6466-1                   security@debian.org     https://www.debian.org/security/                     Salvatore Bonaccorso     August 25, 2026                       https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : linux     CVE ID         : CVE-2025-38525 CVE-2025-40054 CVE-2026-43197 CVE-2026-53092                      CVE-2026-64017 CVE-2026-64586 CVE-2026-68082 CVE-2026-68118                      CVE-2026-68132 CVE-2026-68138 CVE-2026-68159 CVE-2026-68166                      CVE-2026-68169 CVE-2026-68198 CVE-2026-68253 CVE-2026-68254                      CVE-2026-68264 CVE-2026-68266 CVE-2026-68267 CVE-2026-68273                      CVE-2026-68276 CVE-2026-68322 CVE-2026-68367 CVE-2026-68431                      CVE-2026-68451 CVE-2026-68452 CVE-2026-68480 CVE-2026-72111                      CVE-2026-74440 CVE-2026-74441 CVE-2026-74442 CVE-2026-74443                      CVE-2026-74444 CVE-2026-74445 CVE-2026-74446 CVE-2026-74447                      CVE-2026-74448 CVE-2026-74450 CVE-2026-74451 CVE-2026-74452                      CVE-2026-74453 CVE-2026-74454 CVE-2026-74455 CVE-2026-74456                      CVE-2026-74457 CVE-2026-74458 CVE-2026-74459 CVE-2026-74460                      CVE-2026-74461 CVE-2026-74463 CVE-2026-74464 CVE-2026-74465                      CVE-2026-74467 CVE-2026-74468 CVE-2026-74469 CVE-2026-74470                      CVE-2026-74471 CVE-2026-74472 CVE-2026-74473 CVE-2026-74474                      CVE-2026-74475 CVE-2026-74476 CVE-2026-74478 CVE-2026-74479                      CVE-2026-74480 CVE-2026-74481 CVE-2026-74482 CVE-2026-74483                      CVE-2026-74484 CVE-2026-74485 CVE-2026-74487 CVE-2026-74488                      CVE-2026-74490 CVE-2026-74492 CVE-2026-74493 CVE-2026-74494                      CVE-2026-74495 CVE-2026-74497 CVE-2026-74498 CVE-2026-74499                      CVE-2026-74500 CVE-2026-74501 CVE-2026-74502 CVE-2026-74503                      CVE-2026-74504 CVE-2026-74505 CVE-2026-74507 CVE-2026-74508                      CVE-2026-74509 CVE-2026-74510 CVE-2026-74512 CVE-2026-74514                      CVE-2026-74515 CVE-2026-74516 CVE-2026-74517 CVE-2026-74518                      CVE-2026-74519 CVE-2026-74522 CVE-2026-74523 CVE-2026-74524                      CVE-2026-74525 CVE-2026-74531 CVE-2026-74532 CVE-2026-74535                      CVE-2026-74536 CVE-2026-74540 CVE-2026-74541 CVE-2026-74543                      CVE-2026-74545 CVE-2026-74546 CVE-2026-74547 CVE-2026-74548                      CVE-2026-74549 CVE-2026-74550 CVE-2026-74551 CVE-2026-74552                      CVE-2026-74553 CVE-2026-74555 CVE-2026-74556 CVE-2026-74557                      CVE-2026-74563 CVE-2026-74564 CVE-2026-74565 CVE-2026-74566                      CVE-2026-74567 CVE-2026-74569 CVE-2026-74572 CVE-2026-74574                      CVE-2026-74575 CVE-2026-74576 CVE-2026-74577 CVE-2026-74579                      CVE-2026-74580 CVE-2026-74581 CVE-2026-74582 CVE-2026-74583                      CVE-2026-74585 CVE-2026-74586 CVE-2026-74587 CVE-2026-74588                      CVE-2026-74589 CVE-2026-74590 CVE-2026-74592 CVE-2026-74594                      CVE-2026-74595 CVE-2026-74597 CVE-2026-74598 CVE-2026-74599                      CVE-2026-74601 CVE-2026-74602 CVE-2026-74603 CVE-2026-74604                      CVE-2026-74606 CVE-2026-74607 CVE-2026-74608 CVE-2026-74609                      CVE-2026-74610 CVE-2026-74612 CVE-2026-74613 CVE-2026-74614                      CVE-2026-74615 CVE-2026-74616 CVE-2026-74618 CVE-2026-74619                      CVE-2026-74620 CVE-2026-74621 CVE-2026-74622 CVE-2026-74623                      CVE-2026-74624 CVE-2026-74625 CVE-2026-74628 CVE-2026-74630                      CVE-2026-74631 CVE-2026-74632 CVE-2026-74634 CVE-2026-74635                      CVE-2026-74636 CVE-2026-74637 CVE-2026-74641 CVE-2026-74644                      CVE-2026-74646 CVE-2026-74647 CVE-2026-74648 CVE-2026-74649                      CVE-2026-74650 CVE-2026-74651 CVE-2026-74654 CVE-2026-74655                      CVE-2026-74656 CVE-2026-74657 CVE-2026-74658 CVE-2026-74659                      CVE-2026-74660 CVE-2026-74661 CVE-2026-74663 CVE-2026-74664                      CVE-2026-74665 CVE-2026-74666 CVE-2026-74667 CVE-2026-74668                      CVE-2026-74669 CVE-2026-74670 CVE-2026-74671 CVE-2026-74672                      CVE-2026-74673 CVE-2026-74675 CVE-2026-74676 CVE-2026-74677                      CVE-2026-74678 CVE-2026-74679 CVE-2026-74680 CVE-2026-74682                      CVE-2026-74683 CVE-2026-74684 CVE-2026-74685 CVE-2026-74688                      CVE-2026-74689 CVE-2026-74691 CVE-2026-74692 CVE-2026-74693                      CVE-2026-74694 CVE-2026-74696 CVE-2026-74700 CVE-2026-74701                      CVE-2026-74704 CVE-2026-74705 CVE-2026-74710 CVE-2026-74712                      CVE-2026-74714 CVE-2026-74717 CVE-2026-74718 CVE-2026-74719                      CVE-2026-74720 CVE-2026-74722 CVE-2026-74724 CVE-2026-74725                      CVE-2026-74726 CVE-2026-74730 CVE-2026-74732     Debian Bug     : 1142912 1143545

    Several vulnerabilities have been discovered in the Linux kernel that     may lead to a privilege escalation, denial of service or information     leaks.

    For the stable distribution (trixie), these problems have been fixed in     version 6.12.105-1.

    We recommend that you upgrade your linux packages.

    For the detailed security status of linux please refer to its security     tracker page at:
    https://security-tracker.debian.org/tracker/linux

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:57251 advisory.

    * kernel: drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CVE-2026-43206)
      * kernel: drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline     Management v4 (CVE-2026-43237)
      * kernel: crypto: pcrypt - Fix handling of MAY_BACKLOG requests (CVE-2026-43493)
      * kernel: udf: fix partition descriptor append bookkeeping (CVE-2026-45991)
      * kernel: drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CVE-2026-45878)
      * kernel: smb/client: fix out-of-bounds read in symlink_data() (CVE-2026-46185)
      * kernel: sched/psi: fix race between file release and pressure write (CVE-2026-52991)
      * kernel: drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CVE-2026-53143)
      * kernel: drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CVE-2026-53136)
      * kernel: drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CVE-2026-53329)
      * kernel: drm/i915/gem: Fix phys BO pread/pwrite with offset (CVE-2026-53356)
      * kernel: drm/amdgpu: zero-initialize GART table on allocation (CVE-2026-53374)
      * kernel: drm/i915: Fix potential UAF in TTM object purge (CVE-2026-63884)
      * kernel: scsi: target: iscsi: Validate CHAP_R length before base64 decode (CVE-2026-63886)
      * kernel: memfd: deny writeable mappings when implying SEAL_WRITE (CVE-2026-63952)
      * kernel: scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd()     (CVE-2026-63888)
      * kernel: blk-mq: pop cached request if it is usable (CVE-2026-64017)
      * kernel: drm/amdgpu: fix amdgpu_hmm_range_get_pages (CVE-2026-63879)
      * kernel: drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async     (CVE-2026-64219)
      * kernel: smb: client: fix double-free in SMB2_open() replay (CVE-2026-64382)
      * kernel: smb: client: mask server-provided mode to 07777 in modefromsid (CVE-2026-64379)
      * kernel: smb: client: fix query_info() replay double-free (CVE-2026-64386)
      * kernel: posix-cpu-timers: Prevent UAF caused by non-leader exec() race (CVE-2026-64560)
      * kernel: smb/client: handle overlapping allocated ranges in fallocate (CVE-2026-68388)


    Bug Fix(es) and Enhancement(s):

      * CLONE - AlmaLinux 10.2.z xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN     (JIRA:AlmaLinux-223954)
      * vhost: reset the vring metadata cache on vring reconfiguration [almalinux-10.2.z]     (JIRA:AlmaLinux-224545)
      * cifs: periodic IO errors when rename races with lease break [almalinux-10.2.z] (JIRA:AlmaLinux-235459)
      * cifs: smb1 directory listings from xp server returning EINVAL and EIO [almalinux-10.2.z]     (JIRA:AlmaLinux-235812)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:57251 advisory.

    * kernel: drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CVE-2026-43206)

    * kernel: drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management     v4 (CVE-2026-43237)

    * kernel: crypto: pcrypt - Fix handling of MAY_BACKLOG requests (CVE-2026-43493)

    * kernel: udf: fix partition descriptor append bookkeeping (CVE-2026-45991)

    * kernel: drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CVE-2026-45878)

    * kernel: smb/client: fix out-of-bounds read in symlink_data() (CVE-2026-46185)

    * kernel: sched/psi: fix race between file release and pressure write (CVE-2026-52991)

    * kernel: drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CVE-2026-53143)

    * kernel: drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CVE-2026-53136)

    * kernel: drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CVE-2026-53329)

    * kernel: drm/i915/gem: Fix phys BO pread/pwrite with offset (CVE-2026-53356)

    * kernel: drm/amdgpu: zero-initialize GART table on allocation (CVE-2026-53374)

    * kernel: drm/i915: Fix potential UAF in TTM object purge (CVE-2026-63884)

    * kernel: scsi: target: iscsi: Validate CHAP_R length before base64 decode (CVE-2026-63886)

    * kernel: memfd: deny writeable mappings when implying SEAL_WRITE (CVE-2026-63952)

    * kernel: scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd()     (CVE-2026-63888)

    * kernel: blk-mq: pop cached request if it is usable (CVE-2026-64017)

    * kernel: drm/amdgpu: fix amdgpu_hmm_range_get_pages (CVE-2026-63879)

    * kernel: drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async     (CVE-2026-64219)

    * kernel: smb: client: fix double-free in SMB2_open() replay (CVE-2026-64382)

    * kernel: smb: client: mask server-provided mode to 07777 in modefromsid (CVE-2026-64379)

    * kernel: smb: client: fix query_info() replay double-free (CVE-2026-64386)

    * kernel: posix-cpu-timers: Prevent UAF caused by non-leader exec() race (CVE-2026-64560)

    * kernel: smb/client: handle overlapping allocated ranges in fallocate (CVE-2026-68388)

    Bug Fix(es) and Enhancement(s):

    * CLONE - Rocky Linux 10.2.z xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN     (JIRA:Rocky Linux-223954)

    * vhost: reset the vring metadata cache on vring reconfiguration [rhel-10.2.z] (JIRA:Rocky Linux-224545)

    * cifs: periodic IO errors when rename races with lease break [rhel-10.2.z] (JIRA:Rocky Linux-235459)

    * cifs: smb1 directory listings from xp server returning EINVAL and EIO [rhel-10.2.z] (JIRA:Rocky     Linux-235812)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-57251 advisory.

    - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179570] {CVE-2026-45991}
    - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226717] {CVE-2026-43493}
    - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236210]     {CVE-2026-68388}
    - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227850]     {CVE-2026-64560}
    - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227850]     {CVE-2026-64370}
    - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234551] {CVE-2026-64382}
    - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234530]     {CVE-2026-64379}
    - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234129] {CVE-2026-64386}
    - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229066] {CVE-2026-46185}
    - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017}
    - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017}
    - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi)     [RHEL-213217] {CVE-2026-63888}
    - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222740] {CVE-2026-63884}
    - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI     Backport Bot) [RHEL-222567] {CVE-2026-64219}
    - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222667]     {CVE-2026-53329}
    - drm/amdgpu: fix amdgpu_hmm_range_get_pages (Mika Penttila) [RHEL-222625] {CVE-2026-63879}
    - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221336]     {CVE-2026-43206}
    - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222753] {CVE-2026-53356}
    - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222721]     {CVE-2026-45878}
    - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot)     [RHEL-222701] {CVE-2026-53143}
    - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222685]     {CVE-2026-53136}
    - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222646] {CVE-2026-53374}
    - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI     Backport Bot) [RHEL-221380] {CVE-2026-43237}
    - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI     Backport Bot) [RHEL-221380] {CVE-2026-43237}
    - sched/psi: Create the psimon kthread outside of cgroup_mutex (CKI Backport Bot) [RHEL-232560]     {CVE-2026-52991}
    - sched/psi: fix race between file release and pressure write (CKI Backport Bot) [RHEL-232560]     {CVE-2026-52991}
    - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886}
    - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231667]     {CVE-2026-63886}
    - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228531] {CVE-2026-63952}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:57251 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CVE-2026-43206)

    * kernel: drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management     v4 (CVE-2026-43237)

    * kernel: crypto: pcrypt - Fix handling of MAY_BACKLOG requests (CVE-2026-43493)

    * kernel: udf: fix partition descriptor append bookkeeping (CVE-2026-45991)

    * kernel: drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CVE-2026-45878)

    * kernel: smb/client: fix out-of-bounds read in symlink_data() (CVE-2026-46185)

    * kernel: sched/psi: fix race between file release and pressure write (CVE-2026-52991)

    * kernel: drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CVE-2026-53143)

    * kernel: drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CVE-2026-53136)

    * kernel: drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CVE-2026-53329)

    * kernel: drm/i915/gem: Fix phys BO pread/pwrite with offset (CVE-2026-53356)

    * kernel: drm/amdgpu: zero-initialize GART table on allocation (CVE-2026-53374)

    * kernel: drm/i915: Fix potential UAF in TTM object purge (CVE-2026-63884)

    * kernel: scsi: target: iscsi: Validate CHAP_R length before base64 decode (CVE-2026-63886)

    * kernel: memfd: deny writeable mappings when implying SEAL_WRITE (CVE-2026-63952)

    * kernel: scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd()     (CVE-2026-63888)

    * kernel: blk-mq: pop cached request if it is usable (CVE-2026-64017)

    * kernel: drm/amdgpu: fix amdgpu_hmm_range_get_pages (CVE-2026-63879)

    * kernel: drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async     (CVE-2026-64219)

    * kernel: smb: client: fix double-free in SMB2_open() replay (CVE-2026-64382)

    * kernel: smb: client: mask server-provided mode to 07777 in modefromsid (CVE-2026-64379)

    * kernel: smb: client: fix query_info() replay double-free (CVE-2026-64386)

    * kernel: posix-cpu-timers: Prevent UAF caused by non-leader exec() race (CVE-2026-64560)

    * kernel: smb/client: handle overlapping allocated ranges in fallocate (CVE-2026-68388)

    Bug Fix(es) and Enhancement(s):

    * CLONE - RHEL 10.2.z xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN     (JIRA:RHEL-223954)

    * vhost: reset the vring metadata cache on vring reconfiguration [rhel-10.2.z] (JIRA:RHEL-224545)

    * cifs: periodic IO errors when rename races with lease break [rhel-10.2.z] (JIRA:RHEL-235459)

    * cifs: smb1 directory listings from xp server returning EINVAL and EIO [rhel-10.2.z] (JIRA:RHEL-235812)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:47040 advisory.

    * kernel: xfrm: Duplicate SPI Handling (CVE-2025-39797)
      * kernel: lib/buildid: use __kernel_read() for sleepable context (CVE-2026-23002)
      * kernel: futex: Drop CLONE_THREAD requirement for private default hash alloc (CVE-2026-52973)
      * kernel: iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (CVE-2026-53281)
      * kernel: blk-mq: pop cached request if it is usable (CVE-2026-64017)


    Bug Fix(es) and Enhancement(s):

      * general protection fault during exportfs / nfsd4_revoke_states [almalinux-9.8.z]     (JIRA:AlmaLinux-188257)
      * Enable Pretimeout Watchdog Panic Functionality on x86 [almalinux-9.8.z] (JIRA:AlmaLinux-193729)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-47040 advisory.

    - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017}
    - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017}
    - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517]     {CVE-2026-52973}
    - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797}
    - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797}
    - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342]     {CVE-2026-53281}
    - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:47040 advisory.

    * kernel: xfrm: Duplicate SPI Handling (CVE-2025-39797)

    * kernel: lib/buildid: use __kernel_read() for sleepable context (CVE-2026-23002)

    * kernel: futex: Drop CLONE_THREAD requirement for private default hash alloc (CVE-2026-52973)

    * kernel: iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (CVE-2026-53281)

    * kernel: blk-mq: pop cached request if it is usable (CVE-2026-64017)

    Bug Fix(es) and Enhancement(s):

    * general protection fault during exportfs / nfsd4_revoke_states [rhel-9.8.z] (JIRA:Rocky Linux-188257)

    * Enable Pretimeout Watchdog Panic Functionality on x86 [rhel-9.8.z] (JIRA:Rocky Linux-193729)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:47040 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: xfrm: Duplicate SPI Handling (CVE-2025-39797)

    * kernel: lib/buildid: use __kernel_read() for sleepable context (CVE-2026-23002)

    * kernel: futex: Drop CLONE_THREAD requirement for private default hash alloc (CVE-2026-52973)

    * kernel: iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (CVE-2026-53281)

    * kernel: blk-mq: pop cached request if it is usable (CVE-2026-64017)

    Bug Fix(es) and Enhancement(s):

    * general protection fault during exportfs / nfsd4_revoke_states [rhel-9.8.z] (JIRA:RHEL-188257)

    * Enable Pretimeout Watchdog Panic Functionality on x86 [rhel-9.8.z] (JIRA:RHEL-193729)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - blk-mq: pop cached request if it is usable When submitting a bio to blk-mq, if the task should sleep after     peeking a cached request, but before it pops it, the plug flushes and calls blk_mq_free_plug_rqs, freeing     the cached_rqs. This creates a use-after-free bug. Fix this by popping the cached request before any     possible blocking calls if it is suitable for use. Popping this request first holds a queue reference, so     avoid any serialization races with queue freezes and can safely proceed with dispatching that request to     the driver. This potentially increases a timing window from when a driver wants to freeze its queue to     when requests stop being dispatched. That scenario is off the fast path though, and drivers need to     appropriately handle requests during a freeze request anyway. The downside is the popped element needs to     be individually freed when we performed a bio plug merge. The cached request would have had to be freed     later anyway, but this patch does it inline with building the plug list instead of after flushing it.
    (CVE-2026-64017)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
342043	Amazon Linux 2023 : bpftool, kernel, kernel-devel (ALAS2023-2026-2107)	Nessus	Amazon Linux Local Security Checks	Local	critical
341899	Amazon Linux 2023 : bpftool6.12, kernel6.12, kernel6.12-devel (ALAS2023-2026-2110)	Nessus	Amazon Linux Local Security Checks	Local	medium
341888	Amazon Linux 2023 : bpftool6.18, kernel6.18, kernel6.18-devel (ALAS2023-2026-2106)	Nessus	Amazon Linux Local Security Checks	Local	high
340681	Ubuntu 24.04 LTS / 26.04 LTS / Pro Realtime 24.04 LTS : Linux kernel (NVIDIA) vulnerabilities (USN-8663-1)	Nessus	Ubuntu Local Security Checks	Local	high
340045	Ubuntu 26.04 LTS : Linux kernel (NVIDIA BaseOS) vulnerabilities (USN-8664-1)	Nessus	Ubuntu Local Security Checks	Local	high
339550	Debian dsa-6466 : ata-modules-6.12.101+deb13-armmp-di - security update	Nessus	Debian Local Security Checks	Local	medium
339386	AlmaLinux 10 : kernel (ALSA-2026:57251)	Nessus	Alma Linux Local Security Checks	Local	high
338772	RockyLinux 10 : kernel (RLSA-2026:57251)	Nessus	Rocky Linux Local Security Checks	Local	high
338720	Oracle Linux 10 : kernel (ELSA-2026-57251)	Nessus	Oracle Linux Local Security Checks	Local	high
338240	RHEL 10 : kernel (RHSA-2026:57251)	Nessus	Red Hat Local Security Checks	Local	high
331609	AlmaLinux 9 : kernel (ALSA-2026:47040)	Nessus	Alma Linux Local Security Checks	Local	high
331544	Oracle Linux 9 : kernel (ELSA-2026-47040)	Nessus	Oracle Linux Local Security Checks	Local	high
331314	RockyLinux 9 : kernel (RLSA-2026:47040)	Nessus	Rocky Linux Local Security Checks	Local	high
330427	RHEL 9 : kernel (RHSA-2026:47040)	Nessus	Red Hat Local Security Checks	Local	high
327910	Linux Distros Unpatched Vulnerability : CVE-2026-64017	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2026-64017

high

Tenable Plugins

critical

medium

high

high

high

medium

high

high

high

high

high

high

high

high

high