In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mvm: fix driver-set TX rates on old devices On old devices such as 7265D, rates are still encoded in version 1 format, which doesn't use the CCK/OFDM rate index (0-3/0-7) but rather their PLCP value (e.g. 10 for 1 Mbps CCK rate.) While introducing v3 rates, I changed the driver from internally handling v1 rates and converting to v2, to internally handling v3 and converting to v1 or v2 according to the firmware. I accordingly changed the code in iwl_mvm_mac80211_idx_to_hwrate() to no longer have different values for different APIs. This was correct. However, I later reverted this part of the change, because it was reported that I had broken beacon rates, causing a FW assert/crash. This caused TX_CMD rates to be set incorrectly, potentially causing a warning when reported back from the device as having been used. Fix this (hopefully correctly now) by handling beacon rates in the TX_CMD that's embedded in the beacon template command separately. Restore iwl_mvm_mac80211_idx_to_hwrate() to return only the rate index, not PLCP value, fixing the real TX_CMD.

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:68570 advisory.

    * kernel: Linux kernel t7xx WWAN driver: Denial of Service via buffer overflow (CVE-2026-23172)

    * kernel: xfrm: hold dev ref until after transport_finish NF_HOOK (CVE-2026-31663)

    * kernel: RDMA/rxe: Fix race condition in QP timer handlers (CVE-2026-45910)

    * kernel: RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (CVE-2026-46043)

    * kernel: RDMA/rxe: Reject unknown opcodes before ICRC processing (CVE-2026-46133)

    * kernel: RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (CVE-2026-46114)

    * kernel: net: ena: PHC: Fix potential use-after-free in get_timestamp (CVE-2026-52971)

    * kernel: IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CVE-2026-53176)

    * kernel: ALSA: timer: Forcibly close timer instances at closing (CVE-2026-53193)

    * kernel: USB: serial: io_ti: fix heap overflow in get_manuf_info() (CVE-2026-53196)

    * kernel: xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (CVE-2026-53239)

    * kernel: ALSA: timer: Fix UAF at snd_timer_user_params() (CVE-2026-53192)

    * kernel: wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (CVE-2026-63869)

    * kernel: ALSA: seq: Serialize UMP output teardown with event_input (CVE-2026-64029)

    * kernel: ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate() (CVE-2026-63921)

    * kernel: xfrm: input: hold netns during deferred transport reinjection (CVE-2026-63919)

    * kernel: ip6: vti: Use ip6_tnl.net in vti6_changelink() (CVE-2026-63917)

    * kernel: netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check     (CVE-2026-63913)

    * kernel: wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (CVE-2026-64176)

    * kernel: wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (CVE-2026-64174)

    * kernel: wifi: iwlwifi: mld: stop TX during firmware restart (CVE-2026-64175)

    * kernel: RDMA/rxe: Fix a use-after-free problem in rxe_mmap (CVE-2026-64582)

    * kernel: Linux kernel: libceph stack out-of-bounds write via crafted OSDMap (CVE-2026-68159)

    * kernel: Linux kernel: ALSA timer use-after-free vulnerability allows privilege escalation     (CVE-2026-68200)

    * kernel: Linux kernel (ice): Denial of Service via out-of-range ptype in VIRTCHNL (CVE-2026-68128)

    * kernel: Linux kernel: ath9k Wi-Fi driver use-after-free vulnerability leading to system crash     (CVE-2026-68363)

    * kernel: xfrm: fix stale skb->prev after async crypto steals a GSO segment (CVE-2026-68426)

    * kernel: dm_early_create: fix freeing used table on dm_resume failure (CVE-2026-72102)

    * kernel: net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (CVE-2026-72298)

    * kernel: wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (CVE-2026-72003)

    * kernel: selinux: check connect-related permissions on TCP Fast Open (CVE-2026-72243)

    Bug Fix(es) and Enhancement(s):

    * gfs2: filesystem withdrawal rework [rhel-9.8.z] (JIRA:Rocky Linux-252540)

    * The slab cache entries for gfs2 and dlm grow very large for gfs2 filesystems [rhel-9.8.z] (JIRA:Rocky     Linux-252544)

    * gfs2: Get rid of sd_async_glock_wait [rhel-9.8.z] (JIRA:Rocky Linux-253986)

    * [Rocky Linux9.8z] watchdog: System panics during reboot when pretimeout is disabled (0) (JIRA:Rocky     Linux-255217)

    * [usb/xhci] kdump on Arrow Lake systems hangs system with dracut-initqueue Timed out errors [rhel-9.8.z]     (JIRA:Rocky Linux-256733)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:68507 advisory.

    * kernel: soc: qcom: socinfo: Avoid out of bounds read of serial number (CVE-2024-58007)

    * kernel: Linux kernel t7xx WWAN driver: Denial of Service via buffer overflow (CVE-2026-23172)

    * kernel: net: ena: PHC: Fix potential use-after-free in get_timestamp (CVE-2026-52971)

    * kernel: IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CVE-2026-53176)

    * kernel: ALSA: timer: Forcibly close timer instances at closing (CVE-2026-53193)

    * kernel: ALSA: timer: Fix UAF at snd_timer_user_params() (CVE-2026-53192)

    * kernel: wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (CVE-2026-63869)

    * kernel: ALSA: seq: Serialize UMP output teardown with event_input (CVE-2026-64029)

    * kernel: octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (CVE-2026-63923)

    * kernel: wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (CVE-2026-64176)

    * kernel: wifi: iwlwifi: mld: stop TX during firmware restart (CVE-2026-64175)

    * kernel: netfilter: handle unreadable frags (CVE-2026-64414)

    * kernel: hwrng: virtio: clamp device-reported used.len at copy_data() (CVE-2026-64456)

    * kernel: Linux kernel: ALSA timer use-after-free vulnerability allows privilege escalation     (CVE-2026-68200)

    * kernel: Linux kernel SLIP: Out-of-bounds write due to race condition during MTU change (CVE-2026-68143)

    * kernel: Linux kernel (ice): Denial of Service via out-of-range ptype in VIRTCHNL (CVE-2026-68128)

    * kernel: Linux kernel: ath9k Wi-Fi driver use-after-free vulnerability leading to system crash     (CVE-2026-68363)

    * kernel: net: qrtr: restrict socket creation to the initial network namespace (CVE-2026-68294)

    * kernel: dm_early_create: fix freeing used table on dm_resume failure (CVE-2026-72102)

    Bug Fix(es) and Enhancement(s):

    * nouveau vga_switcheroo binding holds Realtek ALC245 converter stream open ? analog output (device 0)     returns EBUSY [rhel-10.2.z] (JIRA:Rocky Linux-239776)

    * Rocky Linux 9.8: Multiuser Kerberized DFS shares fail to mount with UID mount option [rhel-10.2.z]     (JIRA:Rocky Linux-254105)

    * RHIVOS - [backport] S32G Fix STM driver linking failing modpost (JIRA:Rocky Linux-255225)

    * RHIVOS - [backport] S32G Driver Enablement - OCOTP (JIRA:Rocky Linux-255516)

    * RHIVOS - [backport] S32G Driver Enablement - INA231 (JIRA:Rocky Linux-255518)

    * RHIVOS - [backport] S32G Driver Enablement - PIT (JIRA:Rocky Linux-255519)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:68507 advisory.

    * kernel: soc: qcom: socinfo: Avoid out of bounds read of serial number (CVE-2024-58007)
      * kernel: Linux kernel t7xx WWAN driver: Denial of Service via buffer overflow (CVE-2026-23172)
      * kernel: net: ena: PHC: Fix potential use-after-free in get_timestamp (CVE-2026-52971)
      * kernel: IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CVE-2026-53176)
      * kernel: ALSA: timer: Forcibly close timer instances at closing (CVE-2026-53193)
      * kernel: ALSA: timer: Fix UAF at snd_timer_user_params() (CVE-2026-53192)
      * kernel: wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (CVE-2026-63869)
      * kernel: ALSA: seq: Serialize UMP output teardown with event_input (CVE-2026-64029)
      * kernel: octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (CVE-2026-63923)
      * kernel: wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (CVE-2026-64176)
      * kernel: wifi: iwlwifi: mld: stop TX during firmware restart (CVE-2026-64175)
      * kernel: netfilter: handle unreadable frags (CVE-2026-64414)
      * kernel: hwrng: virtio: clamp device-reported used.len at copy_data() (CVE-2026-64456)
      * kernel: Linux kernel: ALSA timer use-after-free vulnerability allows privilege escalation     (CVE-2026-68200)
      * kernel: Linux kernel SLIP: Out-of-bounds write due to race condition during MTU change     (CVE-2026-68143)
      * kernel: Linux kernel (ice): Denial of Service via out-of-range ptype in VIRTCHNL (CVE-2026-68128)
      * kernel: Linux kernel: ath9k Wi-Fi driver use-after-free vulnerability leading to system crash     (CVE-2026-68363)
      * kernel: net: qrtr: restrict socket creation to the initial network namespace (CVE-2026-68294)
      * kernel: dm_early_create: fix freeing used table on dm_resume failure (CVE-2026-72102)


    Bug Fix(es) and Enhancement(s):

      * nouveau vga_switcheroo binding holds Realtek ALC245 converter stream open ? analog output (device 0)     returns EBUSY [almalinux-10.2.z] (JIRA:AlmaLinux-239776)
      * AlmaLinux 9.8: Multiuser Kerberized DFS shares fail to mount with UID mount option [almalinux-10.2.z]     (JIRA:AlmaLinux-254105)
      * RHIVOS - [backport] S32G Fix STM driver linking failing modpost (JIRA:AlmaLinux-255225)
      * RHIVOS - [backport] S32G Driver Enablement - OCOTP (JIRA:AlmaLinux-255516)
      * RHIVOS - [backport] S32G Driver Enablement - INA231 (JIRA:AlmaLinux-255518)
      * RHIVOS - [backport] S32G Driver Enablement - PIT (JIRA:AlmaLinux-255519)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-68570 advisory.

    - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014]     {CVE-2026-72243}
    - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari)     [RHEL-246399] {CVE-2026-63869}
    - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350]     {CVE-2026-64174}
    - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723]     {CVE-2026-72003}
    - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100]     {CVE-2026-72298}
    - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari)     [RHEL-241012] {CVE-2026-68363}
    - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175}
    - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366]     {CVE-2026-64176}
    - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512]     {CVE-2026-23172}
    - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156]     {CVE-2026-68159}
    - libceph: Amend checking to fix make W=1 build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159}
    - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663}
    - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663}
    - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663}
    - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508]     {CVE-2026-63919}
    - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120]     {CVE-2026-68426}
    - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426}
    - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca)     [RHEL-228016] {CVE-2026-53239}
    - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917}
    - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921}
    - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932]     {CVE-2026-72102}
    - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028]     {CVE-2026-68200}
    - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325]     {CVE-2026-68128}
    - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582}
    - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133}
    - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910}
    - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182]     {CVE-2026-46043}
    - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114}
    - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627]     {CVE-2026-52971}
    - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192}
    - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713]     {CVE-2026-64029}
    - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087]     {CVE-2026-53193}
    - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193}
    - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport     Bot) [RHEL-226406] {CVE-2026-63913}
    - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605]     {CVE-2026-53176}
    - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035]     {CVE-2026-53195}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-68507 advisory.

    - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari)     [RHEL-241004] {CVE-2026-68363}
    - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243307] {CVE-2026-64175}
    - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243363]     {CVE-2026-64176}
    - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245528]     {CVE-2026-23172}
    - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari)     [RHEL-246405] {CVE-2026-63869}
    - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-231041]     {CVE-2026-72045}
    - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231041]     {CVE-2026-63923}
    - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244953]     {CVE-2026-72102}
    - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-241018]     {CVE-2026-68143}
    - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240243]     {CVE-2026-68294}
    - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-237211]     {CVE-2026-68128}
    - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-237201]     {CVE-2026-68200}
    - netfilter: handle unreadable frags (CKI Backport Bot) [RHEL-234265] {CVE-2026-64414}
    - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230631]     {CVE-2026-52971}
    - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228700] {CVE-2026-53192}
    - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227727]     {CVE-2026-64029}
    - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227086]     {CVE-2026-53193}
    - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193}
    - hwrng: virtio: clamp device-reported used.len at copy_data() (CKI Backport Bot) [RHEL-225748]     {CVE-2026-64456}
    - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191611]     {CVE-2026-53176}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:68507 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: soc: qcom: socinfo: Avoid out of bounds read of serial number (CVE-2024-58007)

    * kernel: Linux kernel t7xx WWAN driver: Denial of Service via buffer overflow (CVE-2026-23172)

    * kernel: net: ena: PHC: Fix potential use-after-free in get_timestamp (CVE-2026-52971)

    * kernel: IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CVE-2026-53176)

    * kernel: ALSA: timer: Forcibly close timer instances at closing (CVE-2026-53193)

    * kernel: ALSA: timer: Fix UAF at snd_timer_user_params() (CVE-2026-53192)

    * kernel: wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (CVE-2026-63869)

    * kernel: ALSA: seq: Serialize UMP output teardown with event_input (CVE-2026-64029)

    * kernel: octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (CVE-2026-63923)

    * kernel: wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (CVE-2026-64176)

    * kernel: wifi: iwlwifi: mld: stop TX during firmware restart (CVE-2026-64175)

    * kernel: netfilter: handle unreadable frags (CVE-2026-64414)

    * kernel: hwrng: virtio: clamp device-reported used.len at copy_data() (CVE-2026-64456)

    * kernel: Linux kernel: ALSA timer use-after-free vulnerability allows privilege escalation     (CVE-2026-68200)

    * kernel: Linux kernel SLIP: Out-of-bounds write due to race condition during MTU change (CVE-2026-68143)

    * kernel: Linux kernel (ice): Denial of Service via out-of-range ptype in VIRTCHNL (CVE-2026-68128)

    * kernel: Linux kernel: ath9k Wi-Fi driver use-after-free vulnerability leading to system crash     (CVE-2026-68363)

    * kernel: net: qrtr: restrict socket creation to the initial network namespace (CVE-2026-68294)

    * kernel: dm_early_create: fix freeing used table on dm_resume failure (CVE-2026-72102)

    Bug Fix(es) and Enhancement(s):

    * nouveau vga_switcheroo binding holds Realtek ALC245 converter stream open ? analog output (device 0)     returns EBUSY [rhel-10.2.z] (JIRA:RHEL-239776)

    * RHEL 9.8: Multiuser Kerberized DFS shares fail to mount with UID mount option [rhel-10.2.z]     (JIRA:RHEL-254105)

    * RHIVOS - [backport] S32G Fix STM driver linking failing modpost (JIRA:RHEL-255225)

    * RHIVOS - [backport] S32G Driver Enablement - OCOTP (JIRA:RHEL-255516)

    * RHIVOS - [backport] S32G Driver Enablement - INA231 (JIRA:RHEL-255518)

    * RHIVOS - [backport] S32G Driver Enablement - PIT (JIRA:RHEL-255519)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:68570 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: Linux kernel t7xx WWAN driver: Denial of Service via buffer overflow (CVE-2026-23172)

    * kernel: xfrm: hold dev ref until after transport_finish NF_HOOK (CVE-2026-31663)

    * kernel: RDMA/rxe: Fix race condition in QP timer handlers (CVE-2026-45910)

    * kernel: RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (CVE-2026-46043)

    * kernel: RDMA/rxe: Reject unknown opcodes before ICRC processing (CVE-2026-46133)

    * kernel: RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (CVE-2026-46114)

    * kernel: net: ena: PHC: Fix potential use-after-free in get_timestamp (CVE-2026-52971)

    * kernel: IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CVE-2026-53176)

    * kernel: ALSA: timer: Forcibly close timer instances at closing (CVE-2026-53193)

    * kernel: USB: serial: io_ti: fix heap overflow in get_manuf_info() (CVE-2026-53196)

    * kernel: xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (CVE-2026-53239)

    * kernel: ALSA: timer: Fix UAF at snd_timer_user_params() (CVE-2026-53192)

    * kernel: wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (CVE-2026-63869)

    * kernel: ALSA: seq: Serialize UMP output teardown with event_input (CVE-2026-64029)

    * kernel: ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate() (CVE-2026-63921)

    * kernel: xfrm: input: hold netns during deferred transport reinjection (CVE-2026-63919)

    * kernel: ip6: vti: Use ip6_tnl.net in vti6_changelink() (CVE-2026-63917)

    * kernel: netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check     (CVE-2026-63913)

    * kernel: wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (CVE-2026-64176)

    * kernel: wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (CVE-2026-64174)

    * kernel: wifi: iwlwifi: mld: stop TX during firmware restart (CVE-2026-64175)

    * kernel: RDMA/rxe: Fix a use-after-free problem in rxe_mmap (CVE-2026-64582)

    * kernel: Linux kernel: libceph stack out-of-bounds write via crafted OSDMap (CVE-2026-68159)

    * kernel: Linux kernel: ALSA timer use-after-free vulnerability allows privilege escalation     (CVE-2026-68200)

    * kernel: Linux kernel (ice): Denial of Service via out-of-range ptype in VIRTCHNL (CVE-2026-68128)

    * kernel: Linux kernel: ath9k Wi-Fi driver use-after-free vulnerability leading to system crash     (CVE-2026-68363)

    * kernel: xfrm: fix stale skb->prev after async crypto steals a GSO segment (CVE-2026-68426)

    * kernel: dm_early_create: fix freeing used table on dm_resume failure (CVE-2026-72102)

    * kernel: net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (CVE-2026-72298)

    * kernel: wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (CVE-2026-72003)

    * kernel: selinux: check connect-related permissions on TCP Fast Open (CVE-2026-72243)

    Bug Fix(es) and Enhancement(s):

    * gfs2: filesystem withdrawal rework [rhel-9.8.z] (JIRA:RHEL-252540)

    * The slab cache entries for gfs2 and dlm grow very large for gfs2 filesystems [rhel-9.8.z]     (JIRA:RHEL-252544)

    * gfs2: Get rid of sd_async_glock_wait [rhel-9.8.z] (JIRA:RHEL-253986)

    * [RHEL9.8z] watchdog: System panics during reboot when pretimeout is disabled (0) (JIRA:RHEL-255217)

    * [usb/xhci] kdump on Arrow Lake systems hangs system with dracut-initqueue Timed out errors [rhel-9.8.z]     (JIRA:RHEL-256733)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mvm: fix driver-set TX     rates on old devices On old devices such as 7265D, rates are still encoded in version 1 format, which     doesn't use the CCK/OFDM rate index (0-3/0-7) but rather their PLCP value (e.g. 10 for 1 Mbps CCK rate.)     While introducing v3 rates, I changed the driver from internally handling v1 rates and converting to v2,     to internally handling v3 and converting to v1 or v2 according to the firmware. I accordingly changed the     code in iwl_mvm_mac80211_idx_to_hwrate() to no longer have different values for different APIs. This was     correct. However, I later reverted this part of the change, because it was reported that I had broken     beacon rates, causing a FW assert/crash. This caused TX_CMD rates to be set incorrectly, potentially     causing a warning when reported back from the device as having been used. Fix this (hopefully correctly     now) by handling beacon rates in the TX_CMD that's embedded in the beacon template command separately.
    Restore iwl_mvm_mac80211_idx_to_hwrate() to return only the rate index, not PLCP value, fixing the real     TX_CMD. (CVE-2026-64176)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
348577	RockyLinux 9 : kernel (RLSA-2026:68570)	Nessus	Rocky Linux Local Security Checks	Local	medium
348576	RockyLinux 10 : kernel (RLSA-2026:68507)	Nessus	Rocky Linux Local Security Checks	Local	high
348288	AlmaLinux 10 : kernel (ALSA-2026:68507)	Nessus	Alma Linux Local Security Checks	Local	high
348237	Oracle Linux 9 : kernel (ELSA-2026-68570)	Nessus	Oracle Linux Local Security Checks	Local	medium
348157	Oracle Linux 10 : kernel (ELSA-2026-68507)	Nessus	Oracle Linux Local Security Checks	Local	high
346922	RHEL 10 : kernel (RHSA-2026:68507)	Nessus	Red Hat Local Security Checks	Local	high
346915	RHEL 9 : kernel (RHSA-2026:68570)	Nessus	Red Hat Local Security Checks	Local	medium
343532	Ubuntu 24.04 LTS / Pro Realtime 24.04 LTS : Linux kernel (GCP) vulnerabilities (USN-8728-1)	Nessus	Ubuntu Local Security Checks	Local	high
340681	Ubuntu 24.04 LTS / 26.04 LTS / Pro Realtime 24.04 LTS : Linux kernel (NVIDIA) vulnerabilities (USN-8663-1)	Nessus	Ubuntu Local Security Checks	Local	high
340045	Ubuntu 26.04 LTS : Linux kernel (NVIDIA BaseOS) vulnerabilities (USN-8664-1)	Nessus	Ubuntu Local Security Checks	Local	high
327936	Linux Distros Unpatched Vulnerability : CVE-2026-64176	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2026-64176

high

Tenable Plugins

medium

high

high

medium

high

high

medium

high

high

high

high