In the Linux kernel, the following vulnerability has been resolved: idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() In idpf_ptp_init(), read_dev_clk_lock is initialized after ptp_schedule_worker() had already been called (and after idpf_ptp_settime64() could reach the lock). The PTP aux worker fires immediately upon scheduling and can call into idpf_ptp_read_src_clk_reg_direct(), which takes spin_lock(&ptp->read_dev_clk_lock) on an uninitialized lock, triggering the lockdep "non-static key" warning: [12973.796587] idpf 0000:83:00.0: Device HW Reset initiated [12974.094507] INFO: trying to register non-static key. ... [12974.097208] Call Trace: [12974.097213] <TASK> [12974.097218] dump_stack_lvl+0x93/0xe0 [12974.097234] register_lock_class+0x4c4/0x4e0 [12974.097249] ? __lock_acquire+0x427/0x2290 [12974.097259] __lock_acquire+0x98/0x2290 [12974.097272] lock_acquire+0xc6/0x310 [12974.097281] ? idpf_ptp_read_src_clk_reg+0xb7/0x150 [idpf] [12974.097311] ? lockdep_hardirqs_on_prepare+0xde/0x190 [12974.097318] ? finish_task_switch.isra.0+0xd2/0x350 [12974.097330] ? __pfx_ptp_aux_kworker+0x10/0x10 [ptp] [12974.097343] _raw_spin_lock+0x30/0x40 [12974.097353] ? idpf_ptp_read_src_clk_reg+0xb7/0x150 [idpf] [12974.097373] idpf_ptp_read_src_clk_reg+0xb7/0x150 [idpf] [12974.097391] ? kthread_worker_fn+0x88/0x3d0 [12974.097404] ? kthread_worker_fn+0x4e/0x3d0 [12974.097411] idpf_ptp_update_cached_phctime+0x26/0x120 [idpf] [12974.097428] ? _raw_spin_unlock_irq+0x28/0x50 [12974.097436] idpf_ptp_do_aux_work+0x15/0x20 [idpf] [12974.097454] ptp_aux_kworker+0x20/0x40 [ptp] [12974.097464] kthread_worker_fn+0xd5/0x3d0 [12974.097474] ? __pfx_kthread_worker_fn+0x10/0x10 [12974.097482] kthread+0xf4/0x130 [12974.097489] ? __pfx_kthread+0x10/0x10 [12974.097498] ret_from_fork+0x32c/0x410 [12974.097512] ? __pfx_kthread+0x10/0x10 [12974.097519] ret_from_fork_asm+0x1a/0x30 [12974.097540] </TASK> Move the call to spin_lock_init() up a bit to make sure read_dev_clk_lock is not touched before it's been initialized.

redhat RHSA-2026:77689: RHSA-2026:77689: kernel security, bug fix, and enhancement update (Important)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-2026_77689 advisory.

    * kernel: ipvlan: Make the addrs_lock be per port (CVE-2026-23103)

    * kernel: KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (CVE-2026-53360)

    * kernel: vsock/virtio: fix zerocopy completion for multi-skb sends (CVE-2026-53365)

    * kernel: NFSD: Fix SECINFO_NO_NAME decode error cleanup (CVE-2026-53398)

    * kernel: vsock/virtio: bind uarg before filling zerocopy skb (CVE-2026-63970)

    * kernel: igc: set tx buffer type for SMD frames (CVE-2026-64035)

    * kernel: idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (CVE-2026-64162)

    * kernel: vsock/vmci: fix UAF when peer resets connection during handshake (CVE-2026-64115)

    * kernel: SUNRPC: pin upper rpc_clnt across the TLS connect_worker (CVE-2026-72317)

    * kernel: ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (CVE-2026-74744)

    * kernel: nfsd: defer vfree of compound ops to fix rpc_status UAF (CVE-2026-89690)

    * kernel: nfsd: initialize copy-notify stateid before publishing it (CVE-2026-89669)

    * kernel: svcrdma: Reject inline replies that overflow the pull-up buffer (CVE-2026-89530)

    * kernel: nfsd: revoke copy-notify stateids before dropping their reference (CVE-2026-89663)

    Bug Fix(es) and Enhancement(s):

    * iavf: refactor iavf_clean_rx_irq to support legacy and flex descriptors broke rx-vlan-offload on     rhel-9.7 [rhel-9.8.z] (JIRA:Rocky Linux-169480)

    * [GNR-D] missing interfaces tspll_cfg (JIRA:Rocky Linux-183201)

    * Rocky Linux9.8z KVM guest panicked in vmmouse driver (JIRA:Rocky Linux-186577)

    * Add Epson RX8111 support to Rocky Linux9.9 [rhel-9.8.z] (JIRA:Rocky Linux-212014)

    * RT scheduler livelock: migrate-disabled task at pushable-list head causes repeated RT push/stopper     retries, starving a critical RT task (remaining issue after CVE-2026-45919 fix in 94894c9c477e)     [rhel-9.8.z] (JIRA:Rocky Linux-256279)

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:77689 advisory.

    * kernel: ipvlan: Make the addrs_lock be per port (CVE-2026-23103)

    * kernel: KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (CVE-2026-53360)

    * kernel: vsock/virtio: fix zerocopy completion for multi-skb sends (CVE-2026-53365)

    * kernel: NFSD: Fix SECINFO_NO_NAME decode error cleanup (CVE-2026-53398)

    * kernel: vsock/virtio: bind uarg before filling zerocopy skb (CVE-2026-63970)

    * kernel: igc: set tx buffer type for SMD frames (CVE-2026-64035)

    * kernel: idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (CVE-2026-64162)

    * kernel: vsock/vmci: fix UAF when peer resets connection during handshake (CVE-2026-64115)

    * kernel: SUNRPC: pin upper rpc_clnt across the TLS connect_worker (CVE-2026-72317)

    * kernel: ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (CVE-2026-74744)

    * kernel: nfsd: defer vfree of compound ops to fix rpc_status UAF (CVE-2026-89690)

    * kernel: nfsd: initialize copy-notify stateid before publishing it (CVE-2026-89669)

    * kernel: svcrdma: Reject inline replies that overflow the pull-up buffer (CVE-2026-89530)

    * kernel: nfsd: revoke copy-notify stateids before dropping their reference (CVE-2026-89663)

    Bug Fix(es) and Enhancement(s):

    * iavf: refactor iavf_clean_rx_irq to support legacy and flex descriptors broke rx-vlan-offload on     rhel-9.7 [rhel-9.8.z] (JIRA:Rocky Linux-169480)

    * [GNR-D] missing interfaces tspll_cfg (JIRA:Rocky Linux-183201)

    * Rocky Linux9.8z KVM guest panicked in vmmouse driver (JIRA:Rocky Linux-186577)

    * Add Epson RX8111 support to Rocky Linux9.9 [rhel-9.8.z] (JIRA:Rocky Linux-212014)

    * RT scheduler livelock: migrate-disabled task at pushable-list head causes repeated RT push/stopper     retries, starving a critical RT task (remaining issue after CVE-2026-45919 fix in 94894c9c477e)     [rhel-9.8.z] (JIRA:Rocky Linux-256279)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - In the Linux kernel, the following vulnerability has been resolved: idpf: fix read_dev_clk_lock spinlock
    init in idpf_ptp_init() In idpf_ptp_init(), read_dev_clk_lock is initialized after ptp_schedule_worker()
    had already been called (and after idpf_ptp_settime64() could reach the lock). The PTP aux worker fires
    immediately upon scheduling and can call into idpf_ptp_read_src_clk_reg_direct(), which takes
    spin_lock(&ptp->read_dev_clk_lock) on an uninitialized lock, triggering the lockdep "non-static key"
    warning: [12973.796587] idpf 0000:83:00.0: Device HW Reset initiated [12974.094507] INFO: trying to
    register non-static key. ... [12974.097208] Call Trace: [12974.097213] <TASK> [12974.097218]
    dump_stack_lvl+0x93/0xe0 [12974.097234] register_lock_class+0x4c4/0x4e0 [12974.097249] ?
    __lock_acquire+0x427/0x2290 [12974.097259] __lock_acquire+0x98/0x2290 [12974.097272]
    lock_acquire+0xc6/0x310 [12974.097281] ? idpf_ptp_read_src_clk_reg+0xb7/0x150 [idpf] [12974.097311] ?
    lockdep_hardirqs_on_prepare+0xde/0x190 [12974.097318] ? finish_task_switch.isra.0+0xd2/0x350
    [12974.097330] ? __pfx_ptp_aux_kworker+0x10/0x10 [ptp] [12974.097343] _raw_spin_lock+0x30/0x40
    [12974.097353] ? idpf_ptp_read_src_clk_reg+0xb7/0x150 [idpf] [12974.097373]
    idpf_ptp_read_src_clk_reg+0xb7/0x150 [idpf] [12974.097391] ? kthread_worker_fn+0x88/0x3d0 [12974.097404] ?
    kthread_worker_fn+0x4e/0x3d0 [12974.097411] idpf_ptp_update_cached_phctime+0x26/0x120 [idpf]
    [12974.097428] ? _raw_spin_unlock_irq+0x28/0x50 [12974.097436] idpf_ptp_do_aux_work+0x15/0x20 [idpf]
    [12974.097454] ptp_aux_kworker+0x20/0x40 [ptp] [12974.097464] kthread_worker_fn+0xd5/0x3d0 [12974.097474]
    ? __pfx_kthread_worker_fn+0x10/0x10 [12974.097482] kthread+0xf4/0x130 [12974.097489] ?
    __pfx_kthread+0x10/0x10 [12974.097498] ret_from_fork+0x32c/0x410 [12974.097512] ? __pfx_kthread+0x10/0x10
    [12974.097519] ret_from_fork_asm+0x1a/0x30 [12974.097540] </TASK> Move the call to spin_lock_init() up a
    bit to make sure read_dev_clk_lock is not touched before it's been initialized. (CVE-2026-64162)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - In the Linux kernel, the following vulnerability has been resolved: idpf: fix read_dev_clk_lock spinlock     init in idpf_ptp_init() In idpf_ptp_init(), read_dev_clk_lock is initialized after ptp_schedule_worker()     had already been called (and after idpf_ptp_settime64() could reach the lock). The PTP aux worker fires     immediately upon scheduling and can call into idpf_ptp_read_src_clk_reg_direct(), which takes     spin_lock(&ptp->read_dev_clk_lock) on an uninitialized lock, triggering the lockdep non-static key     warning: [12973.796587] idpf 0000:83:00.0: Device HW Reset initiated [12974.094507] INFO: trying to     register non-static key. ... [12974.097208] Call Trace: [12974.097213] <TASK> [12974.097218]     dump_stack_lvl+0x93/0xe0 [12974.097234] register_lock_class+0x4c4/0x4e0 [12974.097249] ?
    __lock_acquire+0x427/0x2290 [12974.097259] __lock_acquire+0x98/0x2290 [12974.097272]     lock_acquire+0xc6/0x310 [12974.097281] ? idpf_ptp_read_src_clk_reg+0xb7/0x150 [idpf] [12974.097311] ?     lockdep_hardirqs_on_prepare+0xde/0x190 [12974.097318] ? finish_task_switch.isra.0+0xd2/0x350     [12974.097330] ? __pfx_ptp_aux_kworker+0x10/0x10 [ptp] [12974.097343] _raw_spin_lock+0x30/0x40     [12974.097353] ? idpf_ptp_read_src_clk_reg+0xb7/0x150 [idpf] [12974.097373]     idpf_ptp_read_src_clk_reg+0xb7/0x150 [idpf] [12974.097391] ? kthread_worker_fn+0x88/0x3d0 [12974.097404] ?     kthread_worker_fn+0x4e/0x3d0 [12974.097411] idpf_ptp_update_cached_phctime+0x26/0x120 [idpf]     [12974.097428] ? _raw_spin_unlock_irq+0x28/0x50 [12974.097436] idpf_ptp_do_aux_work+0x15/0x20 [idpf]     [12974.097454] ptp_aux_kworker+0x20/0x40 [ptp] [12974.097464] kthread_worker_fn+0xd5/0x3d0 [12974.097474]     ? __pfx_kthread_worker_fn+0x10/0x10 [12974.097482] kthread+0xf4/0x130 [12974.097489] ?
    __pfx_kthread+0x10/0x10 [12974.097498] ret_from_fork+0x32c/0x410 [12974.097512] ? __pfx_kthread+0x10/0x10     [12974.097519] ret_from_fork_asm+0x1a/0x30 [12974.097540] </TASK> Move the call to spin_lock_init() up a     bit to make sure read_dev_clk_lock is not touched before it's been initialized. (CVE-2026-64162)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
364635	Rocky Linux 9 [CIQ] Security Update: kernel / kernel-64k / kernel-64k-core / kernel-64k-debug / etc Multiple Vulnerabilities (crlsa-2026_77689)	Nessus	Rocky Linux Local Security Checks	Local	medium
364451	RockyLinux 9 : kernel (RLSA-2026:77689)	Nessus	Rocky Linux Local Security Checks	Local	medium
470570	Google: sys-kernel/cchost-kernel-6_18, sys-kernel/csql-kernel-6_18, sys-kernel/lakitu-kernel-6_18, sys-kernel/lakitu-nc-kernel-6_18: security update to 19862.0.0	Tenable Cloud Security	Google COS Security Checks	Local	critical
470570	Google: sys-kernel/cchost-kernel-6_18, sys-kernel/csql-kernel-6_18, sys-kernel/lakitu-kernel-6_18, sys-kernel/lakitu-nc-kernel-6_18: security update to 19862.0.0	Tenable Self-Hosted Container Security	Google COS Security Checks	Local	critical
350138	openSUSE 16: cluster-md-kmp-64kb / cluster-md-kmp-azure / cluster-md-kmp-default / etc (openSUSE-SU-2026:21910-1)	Nessus	SuSE Local Security Checks	Local	high
343532	Ubuntu 24.04 LTS / Pro Realtime 24.04 LTS : Linux kernel (GCP) vulnerabilities (USN-8728-1)	Nessus	Ubuntu Local Security Checks	Local	high
340681	Ubuntu 24.04 LTS / 26.04 LTS / Pro Realtime 24.04 LTS : Linux kernel (NVIDIA) vulnerabilities (USN-8663-1)	Nessus	Ubuntu Local Security Checks	Local	high
340045	Ubuntu 26.04 LTS : Linux kernel (NVIDIA BaseOS) vulnerabilities (USN-8664-1)	Nessus	Ubuntu Local Security Checks	Local	high
328070	Linux Distros Unpatched Vulnerability : CVE-2026-64162	Nessus	Misc.	Local	critical

Detections

Analytics

CVE-2026-64162

critical

Tenable Plugins

Coming Soon

medium

medium

critical

critical

high

high

high

high

critical