In the Linux kernel, the following vulnerability has been resolved: net: shaper: rework the VALID marking (again) Recent commit changed the semantics from NOT_VALID to VALID. I didn't realize that the flags are not stored atomically with the entry in XArray. There's still a race of reader observing a VALID mark for a slot, getting interrupted, writer replacing the entry with a different one, reader continuing, fetching the entry which is now a different pointer than the pointer for which VALID was meant. The biggest consequence of this is that we may see a UAF since net_shaper_rollback() assumed that entries without VALID can be freed without observing RCU. Looks like the XArray marks are buying us nothing at this point. Let's convert the code to an explicit valid field. The smp_load_acquire() / smp_store_release() barriers are marginally cleaner.

The Rocky Linux 10.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-2026_91565 advisory.

    * kernel: tcp: restrict SO_ATTACH_FILTER to priv users (CVE-2026-53236)

    * kernel: fuse: re-lock request before replacing page cache folio (CVE-2026-53388)

    * kernel: net: shaper: rework the VALID marking (again) (CVE-2026-64027)

    * kernel: net/handshake: hand off the pinned file reference to accept_doit (CVE-2026-63979)

    * kernel: net/handshake: Drain pending requests at net namespace exit (CVE-2026-63978)

    * kernel: af_unix: Fix UAF read of tail->len in unix_stream_data_wait() (CVE-2026-64109)

    * kernel: net/handshake: Take a long-lived file reference at submit (CVE-2026-64523)

    * kernel: net: gro: fix double aggregation of flush-marked skbs (CVE-2026-68136)

    * kernel: net/packet: avoid fanout hook re-registration after unregister (CVE-2026-68338)

    * kernel: scsi: target: core: Fix iSCSI ISID use-after-free in REGISTER AND MOVE (CVE-2026-72083)

    * kernel: KVM: s390: pci: Reject adapter interrupt forwarding if already enabled (CVE-2026-74515)

    * kernel: net: smc: fix splice entry lifetime imbalance in smc_rx_splice (CVE-2026-74631)

    * kernel: usb: usbfs: fix use-after-free of usb_device in usbdev_release() (CVE-2026-80824)

    * kernel: smb: client: clear setuid/setgid bit on write with cifsacl/modefromsid/posix extensions     (CVE-2026-89638)

    * kernel: vfio/pci: clear vdev->msi_perm after freeing it on init failure (CVE-2026-89777)

    * kernel: md/raid5-ppl: fix use-after-free in ppl_do_flush() (CVE-2026-93262)

    Bug Fix(es) and Enhancement(s):

    * x86/microcode: Add platform mask to Intel microcode old list [Rocky Linux-10] [rhel-10.2.z]     (JIRA:Rocky Linux-212778)

    * net: NULL pointer deref kernel panic in fib6_walk_continue under heavy VRF churn [rhel-10.2.z]     (JIRA:Rocky Linux-245489)

    * backport fixes for lockdep issues reported with rt-debug [rhel-10.2.z] (JIRA:Rocky Linux-259937)

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:91565 advisory.

    * kernel: tcp: restrict SO_ATTACH_FILTER to priv users (CVE-2026-53236)

    * kernel: fuse: re-lock request before replacing page cache folio (CVE-2026-53388)

    * kernel: net: shaper: rework the VALID marking (again) (CVE-2026-64027)

    * kernel: net/handshake: hand off the pinned file reference to accept_doit (CVE-2026-63979)

    * kernel: net/handshake: Drain pending requests at net namespace exit (CVE-2026-63978)

    * kernel: af_unix: Fix UAF read of tail->len in unix_stream_data_wait() (CVE-2026-64109)

    * kernel: net/handshake: Take a long-lived file reference at submit (CVE-2026-64523)

    * kernel: net: gro: fix double aggregation of flush-marked skbs (CVE-2026-68136)

    * kernel: net/packet: avoid fanout hook re-registration after unregister (CVE-2026-68338)

    * kernel: scsi: target: core: Fix iSCSI ISID use-after-free in REGISTER AND MOVE (CVE-2026-72083)

    * kernel: KVM: s390: pci: Reject adapter interrupt forwarding if already enabled (CVE-2026-74515)

    * kernel: net: smc: fix splice entry lifetime imbalance in smc_rx_splice (CVE-2026-74631)

    * kernel: usb: usbfs: fix use-after-free of usb_device in usbdev_release() (CVE-2026-80824)

    * kernel: smb: client: clear setuid/setgid bit on write with cifsacl/modefromsid/posix extensions     (CVE-2026-89638)

    * kernel: vfio/pci: clear vdev->msi_perm after freeing it on init failure (CVE-2026-89777)

    * kernel: md/raid5-ppl: fix use-after-free in ppl_do_flush() (CVE-2026-93262)

    Bug Fix(es) and Enhancement(s):

    * x86/microcode: Add platform mask to Intel microcode old list [Rocky Linux-10] [rhel-10.2.z]     (JIRA:Rocky Linux-212778)

    * net: NULL pointer deref kernel panic in fib6_walk_continue under heavy VRF churn [rhel-10.2.z]     (JIRA:Rocky Linux-245489)

    * backport fixes for lockdep issues reported with rt-debug [rhel-10.2.z] (JIRA:Rocky Linux-259937)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-91565 advisory.

    - scsi: target: core: Fix iSCSI ISID use-after-free in REGISTER AND MOVE (CKI Backport Bot) [RHEL-283521]     {CVE-2026-72083}
    - md/raid5-ppl: fix use-after-free in ppl_do_flush() (Nigel Croxon) [RHEL-278085] {CVE-2026-93262}
    - KVM: s390: pci: Reject adapter interrupt forwarding if already enabled (CKI Backport Bot) [RHEL-277647]     {CVE-2026-74515}
    - vfio/pci: clear vdev->msi_perm after freeing it on init failure (Rodolfo Vick) [RHEL-270937]     {CVE-2026-89777}
    - smb: client: clear setuid/setgid bit on write with cifsacl/modefromsid/posix extensions (Jorge San     Emeterio Villalain) [RHEL-271266] {CVE-2026-89638}
    - net/handshake: Drain pending requests at net namespace exit (Xin Long) [RHEL-232133] {CVE-2026-63978}
    - net/handshake: hand off the pinned file reference to accept_doit (Xin Long) [RHEL-230367]     {CVE-2026-63979}
    - net/handshake: Take a long-lived file reference at submit (Xin Long) [RHEL-234161] {CVE-2026-64523}
    - fuse: re-lock request before replacing page cache folio (Miklos Szeredi) [RHEL-226096] {CVE-2026-53388}
    - net: shaper: rework the VALID marking (again) (Jamie Bainbridge) [RHEL-231705] {CVE-2026-64027}
    - net/packet: avoid fanout hook re-registration after unregister (Jamie Bainbridge) [RHEL-246967]     {CVE-2026-68338}
    - af_unix: Fix UAF read of tail->len in unix_stream_data_wait() (Jamie Bainbridge) [RHEL-225883]     {CVE-2026-64109}
    - net: gro: fix double aggregation of flush-marked skbs (Jamie Bainbridge) [RHEL-242620] {CVE-2026-68136}
    - tcp: restrict SO_ATTACH_FILTER to priv users (Jamie Bainbridge) [RHEL-257741] {CVE-2026-53236}
    - usb: usbfs: fix use-after-free of usb_device in usbdev_release() (CKI Backport Bot) [RHEL-258583]     {CVE-2026-80824}
    - net: smc: fix splice entry lifetime imbalance in smc_rx_splice (CKI Backport Bot) [RHEL-253457]     {CVE-2026-74631}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:91565 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: tcp: restrict SO_ATTACH_FILTER to priv users (CVE-2026-53236)

    * kernel: fuse: re-lock request before replacing page cache folio (CVE-2026-53388)

    * kernel: net: shaper: rework the VALID marking (again) (CVE-2026-64027)

    * kernel: net/handshake: hand off the pinned file reference to accept_doit (CVE-2026-63979)

    * kernel: net/handshake: Drain pending requests at net namespace exit (CVE-2026-63978)

    * kernel: af_unix: Fix UAF read of tail->len in unix_stream_data_wait() (CVE-2026-64109)

    * kernel: net/handshake: Take a long-lived file reference at submit (CVE-2026-64523)

    * kernel: net: gro: fix double aggregation of flush-marked skbs (CVE-2026-68136)

    * kernel: net/packet: avoid fanout hook re-registration after unregister (CVE-2026-68338)

    * kernel: scsi: target: core: Fix iSCSI ISID use-after-free in REGISTER AND MOVE (CVE-2026-72083)

    * kernel: KVM: s390: pci: Reject adapter interrupt forwarding if already enabled (CVE-2026-74515)

    * kernel: net: smc: fix splice entry lifetime imbalance in smc_rx_splice (CVE-2026-74631)

    * kernel: usb: usbfs: fix use-after-free of usb_device in usbdev_release() (CVE-2026-80824)

    * kernel: smb: client: clear setuid/setgid bit on write with cifsacl/modefromsid/posix extensions     (CVE-2026-89638)

    * kernel: vfio/pci: clear vdev->msi_perm after freeing it on init failure (CVE-2026-89777)

    * kernel: md/raid5-ppl: fix use-after-free in ppl_do_flush() (CVE-2026-93262)

    Bug Fix(es) and Enhancement(s):

    * x86/microcode: Add platform mask to Intel microcode old list [RHEL-10] [rhel-10.2.z]     (JIRA:RHEL-212778)

    * net: NULL pointer deref kernel panic in fib6_walk_continue under heavy VRF churn [rhel-10.2.z]     (JIRA:RHEL-245489)

    * backport fixes for lockdep issues reported with rt-debug [rhel-10.2.z] (JIRA:RHEL-259937)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:91565 advisory.

    * kernel: tcp: restrict SO_ATTACH_FILTER to priv users (CVE-2026-53236)
      * kernel: fuse: re-lock request before replacing page cache folio (CVE-2026-53388)
      * kernel: net: shaper: rework the VALID marking (again) (CVE-2026-64027)
      * kernel: net/handshake: hand off the pinned file reference to accept_doit (CVE-2026-63979)
      * kernel: net/handshake: Drain pending requests at net namespace exit (CVE-2026-63978)
      * kernel: af_unix: Fix UAF read of tail->len in unix_stream_data_wait() (CVE-2026-64109)
      * kernel: net/handshake: Take a long-lived file reference at submit (CVE-2026-64523)
      * kernel: net: gro: fix double aggregation of flush-marked skbs (CVE-2026-68136)
      * kernel: net/packet: avoid fanout hook re-registration after unregister (CVE-2026-68338)
      * kernel: scsi: target: core: Fix iSCSI ISID use-after-free in REGISTER AND MOVE (CVE-2026-72083)
      * kernel: KVM: s390: pci: Reject adapter interrupt forwarding if already enabled (CVE-2026-74515)
      * kernel: net: smc: fix splice entry lifetime imbalance in smc_rx_splice (CVE-2026-74631)
      * kernel: usb: usbfs: fix use-after-free of usb_device in usbdev_release() (CVE-2026-80824)
      * kernel: smb: client: clear setuid/setgid bit on write with cifsacl/modefromsid/posix extensions     (CVE-2026-89638)
      * kernel: vfio/pci: clear vdev->msi_perm after freeing it on init failure (CVE-2026-89777)
      * kernel: md/raid5-ppl: fix use-after-free in ppl_do_flush() (CVE-2026-93262)


    Bug Fix(es) and Enhancement(s):

      * x86/microcode: Add platform mask to Intel microcode old list [AlmaLinux-10] [almalinux-10.2.z]     (JIRA:AlmaLinux-212778)
      * net: NULL pointer deref kernel panic in fib6_walk_continue under heavy VRF churn [almalinux-10.2.z]     (JIRA:AlmaLinux-245489)
      * backport fixes for lockdep issues reported with rt-debug [almalinux-10.2.z] (JIRA:AlmaLinux-259937)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - In the Linux kernel, the following vulnerability has been resolved: net: shaper: rework the VALID marking     (again) Recent commit changed the semantics from NOT_VALID to VALID. I didn't realize that the flags are     not stored atomically with the entry in XArray. There's still a race of reader observing a VALID mark for     a slot, getting interrupted, writer replacing the entry with a different one, reader continuing, fetching     the entry which is now a different pointer than the pointer for which VALID was meant. The biggest     consequence of this is that we may see a UAF since net_shaper_rollback() assumed that entries without     VALID can be freed without observing RCU. Looks like the XArray marks are buying us nothing at this point.
    Let's convert the code to an explicit valid field. The smp_load_acquire() / smp_store_release() barriers     are marginally cleaner. (CVE-2026-64027)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
374071	Rocky Linux 10.2 [CIQ] Security Update: kernel / kernel-64k / kernel-64k-core / kernel-64k-debug / etc Multiple Vulnerabilities (crlsa-2026_91565)	Nessus	Rocky Linux Local Security Checks	Local	medium
373667	RockyLinux 10 : kernel (RLSA-2026:91565)	Nessus	Rocky Linux Local Security Checks	Local	medium
373633	Oracle Linux 10 : kernel (ELSA-2026-91565)	Nessus	Oracle Linux Local Security Checks	Local	medium
373588	RHEL 10 : kernel (RHSA-2026:91565)	Nessus	Red Hat Local Security Checks	Local	medium
373226	AlmaLinux 10 : kernel (ALSA-2026:91565)	Nessus	Alma Linux Local Security Checks	Local	medium
343532	Ubuntu 24.04 LTS / Pro Realtime 24.04 LTS : Linux kernel (GCP) vulnerabilities (USN-8728-1)	Nessus	Ubuntu Local Security Checks	Local	high
340681	Ubuntu 24.04 LTS / 26.04 LTS : Linux kernel (NVIDIA) vulnerabilities (USN-8663-1)	Nessus	Ubuntu Local Security Checks	Local	high
340045	Ubuntu 26.04 LTS : Linux kernel (NVIDIA BaseOS) vulnerabilities (USN-8664-1)	Nessus	Ubuntu Local Security Checks	Local	high
328128	Linux Distros Unpatched Vulnerability : CVE-2026-64027	Nessus	Misc.	Local	high
322087	Amazon Linux 2023 : bpftool6.18, kernel6.18, kernel6.18-devel (ALAS2023-2026-1881)	Nessus	Amazon Linux Local Security Checks	Local	high

Detections

Analytics

CVE-2026-64027

high

Tenable Plugins

medium

medium

medium

medium

medium

high

high

high

high

high