In the Linux kernel, the following vulnerability has been resolved: netfilter: x_tables: add and use xtables_unregister_table_exit Previous change added xtables_unregister_table_pre_exit to detach the table from the packetpath and to unlink it from the active table list. In case of rmmod, userspace that is doing set/getsockopt for this table will not be able to re-instantiate the table: 1. The larval table has been removed already 2. existing instantiated table is no longer on the xt pernet table list. This adds the second stage helper: unlink the table from the dying list, free the hook ops (if any) and do the audit notification. It replaces xt_unregister_table().

oracle_linux ELSA-2026-76738: ELSA-2026-76738:  kernel security, bug fix, and enhancement update (IMPORTANT)

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-76738 advisory.

    - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot)     [RHEL-271653] {CVE-2026-93288}
    - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Davide Caratti) [RHEL-231698]     {CVE-2026-64024}
    - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232645]     {CVE-2026-46275}
    - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot)     [RHEL-232645] {CVE-2026-46275}
    - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269475] {CVE-2026-90227}
    - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270934] {CVE-2026-89972}
    - ipv6: ioam: refresh hdr pointer before ioam6_event() (Prasenjit Mukherjee) [RHEL-259773]     {CVE-2026-64132}
    - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270657]     {CVE-2026-97417}
    - crypto: af_alg - Cap AEAD AD length to 0x80000000 (Pablo Alessandro Santos Hugen) [RHEL-259063]     {CVE-2026-52972}
    - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263469] {CVE-2026-90003}
    - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263469]     {CVE-2026-80775}
    - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263469] {CVE-2026-80778}
    - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263469] {CVE-2026-80758}
    - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263469]     {CVE-2026-80776}
    - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263469] {CVE-2026-74658}
    - ipvs: reload ip header after head reallocation (CKI Backport Bot) [RHEL-263870] {CVE-2026-68476}
    - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258672] {CVE-2026-80792}
    - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259369] {CVE-2026-63924}
    - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259404] {CVE-2026-63922}
    - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231288]     {CVE-2026-63984}
    - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225393]     {CVE-2026-63920}
    - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359]     {CVE-2026-64557}
    - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359]     {CVE-2026-64557}
    - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231359]     {CVE-2026-64557}
    - l2tp: use refcount_inc_not_zero in l2tp_session_get_by_ifname (Abhishek Rawal) [RHEL-227466]     {CVE-2026-63918}
    - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230778]     {CVE-2026-63992}
    - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal)     [RHEL-259564] {CVE-2026-63994}
    - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-239729]     {CVE-2026-68432}
    - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247005]     {CVE-2026-72052}
    - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247054]     {CVE-2026-63829}
    - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357}
    - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229761]     {CVE-2026-53357}
    - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot)     [RHEL-261255] {CVE-2026-72320}
    - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258155] {CVE-2026-80921}
    - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (CKI Backport Bot)     [RHEL-254525] {CVE-2026-74516}
    - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (CKI Backport Bot) [RHEL-254525]     {CVE-2026-74516}
    - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (CKI Backport Bot) [RHEL-254525]     {CVE-2026-74516}
    - KVM: SVM: Add a helper to look up the max physical ID for AVIC (CKI Backport Bot) [RHEL-254525]     {CVE-2026-74516}
    - KVM: SVM: Limit AVIC physical max index based on configured max_vcpu_ids (CKI Backport Bot)     [RHEL-254525] {CVE-2026-74516}
    - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254392]     {CVE-2026-74669}
    - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254392]     {CVE-2026-74669}
    - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669}
    - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252430]     {CVE-2026-72255}
    - netfilter: x_tables: add and use xtables_unregister_table_exit (Phil Sutter) [RHEL-243394]     {CVE-2026-64078}
    - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250538] {CVE-2026-74746}
    - packet: use consistent hard_header_len in non-ring send paths (Toke Hoiland-Jorgensen) [RHEL-244537]     {CVE-2026-74582}
    - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232598]     {CVE-2026-45856}
    - netfilter: nf_conncount: increase the connection clean up limit to 64 (CKI Backport Bot) [RHEL-232220]     {CVE-2026-45860}
    - ipvs: clear the svc scheduler ptr early on edit (CKI Backport Bot) [RHEL-225996] {CVE-2026-53270}
    - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214949]     {CVE-2026-63794}
    - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257773] {CVE-2026-72099}
    - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230992]     {CVE-2026-64034}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:76738 advisory.

    * kernel: netfilter: nf_conncount: increase the connection clean up limit to 64 (CVE-2026-45860)
      * kernel: RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CVE-2026-45856)
      * kernel: Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CVE-2026-46275)
      * kernel: crypto: af_alg - Cap AEAD AD length to 0x80000000 (CVE-2026-52972)
      * kernel: ipvs: clear the svc scheduler ptr early on edit (CVE-2026-53270)
      * kernel: Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CVE-2026-53357)
      * kernel: net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (CVE-2026-63829)
      * kernel: KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CVE-2026-63794)
      * kernel: ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (CVE-2026-63924)
      * kernel: ipv6: exthdrs: refresh nh after handling HAO option (CVE-2026-63922)
      * kernel: ipv6: validate extension header length before copying to cmsg (CVE-2026-63920)
      * kernel: tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (CVE-2026-64024)
      * kernel: l2tp: use refcount_inc_not_zero in l2tp_session_get_by_ifname (CVE-2026-63918)
      * kernel: ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (CVE-2026-63984)
      * kernel: tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (CVE-2026-63992)
      * kernel: tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]()     (CVE-2026-63994)
      * kernel: netfilter: x_tables: add and use xtables_unregister_table_exit (CVE-2026-64078)
      * kernel: ipv6: ioam: refresh hdr pointer before ioam6_event() (CVE-2026-64132)
      * kernel: Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CVE-2026-64557)
      * kernel: vxlan: require CAP_NET_ADMIN in the device netns for changelink (CVE-2026-68432)
      * kernel: ipvs: reload ip header after head reallocation (CVE-2026-68476)
      * kernel: net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (CVE-2026-72052)
      * kernel: netfilter: nft_lookup: fix catchall element handling with inverted lookups (CVE-2026-72320)
      * kernel: netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CVE-2026-72255)
      * kernel: KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active     (CVE-2026-74516)
      * kernel: packet: use consistent hard_header_len in non-ring send paths ()
      * kernel: packet: use consistent hard_header_len in non-ring send paths (CVE-2026-74582)
      * kernel: ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CVE-2026-74669)
      * kernel: netfilter: flowtable: publish GC-visible tuple last (CVE-2026-74746)
      * kernel: ipv6: fix use-after-free in ip6_finish_output2() (CVE-2026-80792)
      * kernel: futex: Fix race on the initial mm->futex.phash.ref allocation (CVE-2026-80775)
      * kernel: KVM: s390: vsie: zero stale crypto bits (CVE-2026-80921)
      * kernel: nvme: add missing SRCU grace period in error path (CVE-2026-89972)
      * kernel: nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CVE-2026-90227)
      * kernel: netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CVE-2026-97417)
      * kernel: netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state     (CVE-2026-93288)


    Bug Fix(es) and Enhancement(s):

      * wifi card breaks using FIPS (JIRA:AlmaLinux-257457)
      * AlmaLinux10.0 - kernel: CPU hotplug unsupported by CPUMF [almalinux-10.2.z] (JIRA:AlmaLinux-270888)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - In the Linux kernel, the following vulnerability has been resolved: netfilter: x_tables: add and use
    xtables_unregister_table_exit Previous change added xtables_unregister_table_pre_exit to detach the table
    from the packetpath and to unlink it from the active table list. In case of rmmod, userspace that is doing
    set/getsockopt for this table will not be able to re-instantiate the table: 1. The larval table has been
    removed already 2. existing instantiated table is no longer on the xt pernet table list. This adds the
    second stage helper: unlink the table from the dying list, free the hook ops (if any) and do the audit
    notification. It replaces xt_unregister_table(). (CVE-2026-64078)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - netfilter: x_tables: add and use xtables_unregister_table_exit Previous change added     xtables_unregister_table_pre_exit to detach the table from the packetpath and to unlink it from the active     table list. In case of rmmod, userspace that is doing set/getsockopt for this table will not be able to     re-instantiate the table: 1. The larval table has been removed already 2. existing instantiated table is     no longer on the xt pernet table list. This adds the second stage helper: unlink the table from the dying     list, free the hook ops (if any) and do the audit notification. It replaces xt_unregister_table().
    (CVE-2026-64078)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
368019	Oracle Linux 10 : kernel (ELSA-2026-76738)	Nessus	Oracle Linux Local Security Checks	Local	high
367954	AlmaLinux 10 : kernel (ALSA-2026:76738)	Nessus	Alma Linux Local Security Checks	Local	high
365279	Amazon Linux 2023 : bpftool6.12, kernel6.12, kernel6.12-devel (ALAS2023-2026-3196)	Nessus	Amazon Linux Local Security Checks	Local	medium
365220	Amazon Linux 2023 : bpftool, kernel, kernel-devel (ALAS2023-2026-3197)	Nessus	Amazon Linux Local Security Checks	Local	medium
470858	Google: sys-kernel/cchost-kernel-6_12, sys-kernel/cchost-kernel-6_18, sys-kernel/csql-kernel-6_12, sys-kernel/csql-kernel-6_18, sys-kernel/lakitu-kernel-6_12, sys-kernel/lakitu-kernel-6_18, sys-kernel/lakitu-nc-kernel-6_12, sys-kernel/lakitu-nc-kernel-6_18: security update to 19862.0.0	Tenable Cloud Security	Google COS Security Checks	Local	high
470858	Google: sys-kernel/cchost-kernel-6_12, sys-kernel/cchost-kernel-6_18, sys-kernel/csql-kernel-6_12, sys-kernel/csql-kernel-6_18, sys-kernel/lakitu-kernel-6_12, sys-kernel/lakitu-kernel-6_18, sys-kernel/lakitu-nc-kernel-6_12, sys-kernel/lakitu-nc-kernel-6_18: security update to 19862.0.0	Tenable Self-Hosted Container Security	Google COS Security Checks	Local	high
343532	Ubuntu 24.04 LTS / Pro Realtime 24.04 LTS : Linux kernel (GCP) vulnerabilities (USN-8728-1)	Nessus	Ubuntu Local Security Checks	Local	high
340681	Ubuntu 24.04 LTS / 26.04 LTS : Linux kernel (NVIDIA) vulnerabilities (USN-8663-1)	Nessus	Ubuntu Local Security Checks	Local	high
340045	Ubuntu 26.04 LTS : Linux kernel (NVIDIA BaseOS) vulnerabilities (USN-8664-1)	Nessus	Ubuntu Local Security Checks	Local	high
327915	Linux Distros Unpatched Vulnerability : CVE-2026-64078	Nessus	Misc.	Local	high
322087	Amazon Linux 2023 : bpftool6.18, kernel6.18, kernel6.18-devel (ALAS2023-2026-1881)	Nessus	Amazon Linux Local Security Checks	Local	high

Detections

Analytics

CVE-2026-64078

high

Tenable Plugins

Coming Soon

high

high

medium

medium

high

high

high

high

high

high

high