In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers Three BA session handlers use ffs(ba_data->sta_mask) - 1 to derive a station ID without checking that sta_mask is non-zero. When sta_mask is zero, ffs() returns 0 and the subtraction wraps to 0xFFFFFFFF, causing an out-of-bounds access on fw_id_to_link_sta[]. Add WARN_ON_ONCE(!ba_data->sta_mask) guards before each ffs() call, consistent with the existing check in iwl_mld_ampdu_rx_start().

The remote Ubuntu 26.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-8800-1 advisory.

    Several security issues were discovered in the Linux kernel. An attacker could possibly use these to     compromise the system. This update corrects flaws in the following subsystems:

    - User-space API (UAPI);

    - Kernel build system;

    - ARM32 architecture;

    - ARM64 architecture;

    - RISC-V architecture;

    - S390 architecture;

    - x86 architecture;

    - Block layer subsystem;

    - Cryptographic API;

    - Compute Acceleration Framework;

    - Intel NPU Driver;

    - ACPI drivers;

    - Android drivers;

    - Drivers core;

    - Compressed RAM block device driver;

    - Bluetooth drivers;

    - Character device driver;

    - Hardware random number generator core;

    - CPU frequency scaling framework;

    - Hardware crypto device drivers;

    - Buffer Sharing and Synchronization framework;

    - Intel Stratix 10 firmware drivers;

    - FPGA Framework;

    - GPIO subsystem;

    - GPU drivers;

    - HID subsystem;

    - CoreSight HW tracing drivers;

    - I2C subsystem;

    - I3C subsystem;

    - IIO subsystem;

    - IIO ADC drivers;

    - InfiniBand drivers;

    - Input Device core drivers;

    - Input Device (Mouse) drivers;

    - IOMMU subsystem;

    - IRQ chip drivers;

    - Multiple devices driver;

    - Media drivers;

    - Multifunction device drivers;

    - Fastrpc Driver;

    - MMC subsystem;

    - Ethernet bonding driver;

    - Network drivers;

    - Mellanox network drivers;

    - MediaTek network drivers;

    - NTB driver;

    - NVME drivers;

    - NVMEM (Non Volatile Memory) drivers;

    - PCI subsystem;

    - Pin controllers subsystem;

    - x86 platform drivers;

    - System reset/shutdown drivers;

    - Power sequencing drivers;

    - PTP clock framework;

    - Voltage and Current Regulator drivers;

    - RPMSG subsystem;

    - SLIMbus drivers;

    - SPI subsystem;

    - Media staging drivers;

    - Realtek RTL8723BS SDIO drivers;

    - VME bus staging drivers;

    - Trusted Execution Environment drivers;

    - Thunderbolt and USB4 drivers;

    - TTY drivers;

    - Cadence USB3 driver;

    - ULPI bus;

    - DesignWare USB3 driver;

    - Faraday FOTG210 USB2 dual-role controller driver;

    - USB Gadget drivers;

    - USB Host Controller drivers;

    - USB ChaosKey driver;

    - Siemens ID Mouse USB driver;

    - IOWarrior USB driver;

    - LD Didactic USB driver;

    - LEGO USB Tower driver;

    - Intel USBIO USB I/O expander driver;

    - USS720 USB parallel port adapter driver;

    - MediaTek USB3 DRD driver;

    - USB Serial drivers;

    - USB Type-C Port Controller Manager driver;

    - USB Type-C Connector System Software Interface driver;

    - USB over IP driver;

    - VFIO drivers;

    - Framebuffer layer;

    - Virtio drivers;

    - BTRFS file system;

    - EROFS file system;

    - exFAT file system;

    - F2FS file system;

    - File systems infrastructure;

    - FUSE (File system in Userspace);

    - GFS2 file system;

    - HFS file system;

    - HFS+ file system;

    - Network file system (NFS) client;

    - Network file system (NFS) server daemon;

    - NILFS2 file system;

    - NTFS3 file system;

    - OCFS2 file system;

    - Proc file system;

    - SMB network file system;

    - UDF file system;

    - XFS file system;

    - Key management;

    - BPF subsystem;

    - Memory management;

    - Software nodes and device properties;

    - Glob pattern matching library;

    - Memory Management;

    - KVM subsystem;

    - Mellanox drivers;

    - Restartable sequences system call mechanism;

    - Socket messages infrastructure;

    - Network traffic control;

    - Bluetooth subsystem;

    - Netfilter;

    - Networking core;

    - Network sockets;

    - TCP network protocol;

    - io_uring subsystem;

    - IPC subsystem;

    - Audit subsystem;

    - Perf events;

    - Kernel fork() syscall;

    - Locking primitives;

    - Kernel module support;

    - Scheduler infrastructure;

    - Signal handling mechanism;

    - Timer subsystem;

    - Tracing infrastructure;

    - Debug objects infrastructure;

    - 6LoWPAN network protocol;

    - IEEE 802 network protocols;

    - 9P file system network protocol;

    - B.A.T.M.A.N. meshing protocol;

    - Ethernet bridge;

    - Devlink API;

    - HSR network protocol;

    - IEEE802154.4 network protocol;

    - IPv4 networking;

    - IPv6 networking;

    - XFRM subsystem;

    - L2TP protocol;

    - MAC80211 subsystem;

    - IEEE 802.15.4 subsystem;

    - Multipath TCP;

    - NetLabel subsystem;

    - Open vSwitch;

    - Phonet protocol;

    - Qualcomm IPC Router (QRTR);

    - RDS protocol;

    - SCTP protocol;

    - SMC sockets;

    - TIPC protocol;

    - TLS protocol;

    - Unix domain sockets;

    - VMware vSockets driver;

    - Wireless networking;

    - eXpress Data Path;

    - AppArmor security module;

    - Linux Security Modules (LSM) Framework;

    - Apple Onboard Audio ALSA driver;

    - ALSA framework;

    - FireWire sound drivers;

    - HD-audio driver;

    - Gravis UltraSound ALSA driver;

    - C-Media CMI8x38 ALSA driver;

    - ESS Solo-1 ALSA driver;

    - ICE1712/ICE1724 (Envy24) ALSA driver;

    - Yamaha YMFPCI ALSA driver;

    - Wolfson Microelectronics audio codecs;

    - SoundWire (SDCA) ASoC drivers;

    - USB sound devices;

    - Virtio sound driver; (CVE-2026-52908, CVE-2026-52909, CVE-2026-52910, CVE-2026-52917, CVE-2026-52929,     CVE-2026-52930, CVE-2026-52935, CVE-2026-52938, CVE-2026-52939, CVE-2026-52940, CVE-2026-52942,     CVE-2026-52947, CVE-2026-52948, CVE-2026-53132, CVE-2026-53133, CVE-2026-53134, CVE-2026-53135,     CVE-2026-53136, CVE-2026-53137, CVE-2026-53138, CVE-2026-53139, CVE-2026-53140, CVE-2026-53141,     CVE-2026-53142, CVE-2026-53143, CVE-2026-53144, CVE-2026-53145, CVE-2026-53146, CVE-2026-53147,     CVE-2026-53148, CVE-2026-53149, CVE-2026-53150, CVE-2026-53152, CVE-2026-53153, CVE-2026-53154,     CVE-2026-53155, CVE-2026-53156, CVE-2026-53157, CVE-2026-53158, CVE-2026-53159, CVE-2026-53160,     CVE-2026-53161, CVE-2026-53162, CVE-2026-53163, CVE-2026-53164, CVE-2026-53165, CVE-2026-53167,     CVE-2026-53168, CVE-2026-53169, CVE-2026-53170, CVE-2026-53171, CVE-2026-53172, CVE-2026-53173,     CVE-2026-53177, CVE-2026-53178, CVE-2026-53179, CVE-2026-53180, CVE-2026-53181, CVE-2026-53182,     CVE-2026-53183, CVE-2026-53184, CVE-2026-53185, CVE-2026-53187, CVE-2026-53188, CVE-2026-53189,     CVE-2026-53190, CVE-2026-53191, CVE-2026-53192, CVE-2026-53193, CVE-2026-53194, CVE-2026-53195,     CVE-2026-53196, CVE-2026-53197, CVE-2026-53198, CVE-2026-53199, CVE-2026-53200, CVE-2026-53201,     CVE-2026-53202, CVE-2026-53203, CVE-2026-53204, CVE-2026-53205, CVE-2026-53206, CVE-2026-53207,     CVE-2026-53208, CVE-2026-53209, CVE-2026-53210, CVE-2026-53211, CVE-2026-53213, CVE-2026-53214,     CVE-2026-53217, CVE-2026-53218, CVE-2026-53219, CVE-2026-53220, CVE-2026-53222, CVE-2026-53223,     CVE-2026-53226, CVE-2026-53227, CVE-2026-53229, CVE-2026-53230, CVE-2026-53231, CVE-2026-53232,     CVE-2026-53233, CVE-2026-53234, CVE-2026-53235, CVE-2026-53236, CVE-2026-53237, CVE-2026-53238,     CVE-2026-53239, CVE-2026-53240, CVE-2026-53241, CVE-2026-53242, CVE-2026-53243, CVE-2026-53244,     CVE-2026-53245, CVE-2026-53248, CVE-2026-53249, CVE-2026-53250, CVE-2026-53251, CVE-2026-53252,     CVE-2026-53253, CVE-2026-53254, CVE-2026-53255, CVE-2026-53256, CVE-2026-53257, CVE-2026-53258,     CVE-2026-53259, CVE-2026-53261, CVE-2026-53262, CVE-2026-53263, CVE-2026-53264, CVE-2026-53265,     CVE-2026-53266, CVE-2026-53267, CVE-2026-53268, CVE-2026-53269, CVE-2026-53270, CVE-2026-53271,     CVE-2026-53272, CVE-2026-53273, CVE-2026-53274, CVE-2026-53275, CVE-2026-53276, CVE-2026-53325,     CVE-2026-53326, CVE-2026-53327, CVE-2026-53328, CVE-2026-53329, CVE-2026-53330, CVE-2026-53331,     CVE-2026-53332, CVE-2026-53333, CVE-2026-53334, CVE-2026-53335, CVE-2026-53336, CVE-2026-53337,     CVE-2026-53338, CVE-2026-53339, CVE-2026-53340, CVE-2026-53341, CVE-2026-53342, CVE-2026-53343,     CVE-2026-53344, CVE-2026-53345, CVE-2026-53346, CVE-2026-53347, CVE-2026-53348, CVE-2026-53349,     CVE-2026-53350, CVE-2026-53351, CVE-2026-53352, CVE-2026-53353, CVE-2026-53355, CVE-2026-53356,     CVE-2026-53361, CVE-2026-53362, CVE-2026-53363, CVE-2026-53366, CVE-2026-53381, CVE-2026-53382,     CVE-2026-53383, CVE-2026-53384, CVE-2026-53385, CVE-2026-53386, CVE-2026-53387, CVE-2026-53388,     CVE-2026-53389, CVE-2026-53390, CVE-2026-53391, CVE-2026-53392, CVE-2026-53393, CVE-2026-53394,     CVE-2026-53395, CVE-2026-53396, CVE-2026-53397, CVE-2026-53398, CVE-2026-53399, CVE-2026-53400,     CVE-2026-53401, CVE-2026-53402, CVE-2026-53403, CVE-2026-63794, CVE-2026-63795, CVE-2026-63796,     CVE-2026-63797, CVE-2026-63798, CVE-2026-63799, CVE-2026-63800, CVE-2026-63801, CVE-2026-63802,     CVE-2026-63803, CVE-2026-63804, CVE-2026-63805, CVE-2026-63806, CVE-2026-63807, CVE-2026-63808,     CVE-2026-63809, CVE-2026-63810, CVE-2026-63811, CVE-2026-63812, CVE-2026-63813, CVE-2026-63814,     CVE-2026-63815, CVE-2026-63816, CVE-2026-63817, CVE-2026-63818, CVE-2026-63819, CVE-2026-63820,     CVE-2026-63821, CVE-2026-63822, CVE-2026-63823, CVE-2026-63824, CVE-2026-63825, CVE-2026-63826,     CVE-2026-63827, CVE-2026-63828, CVE-2026-63829, CVE-2026-63830, CVE-2026-63831, CVE-2026-63832,     CVE-2026-63833, CVE-2026-63834, CVE-2026-63835, CVE-2026-63836, CVE-2026-63867, CVE-2026-63868,     CVE-2026-63869, CVE-2026-63870, CVE-2026-63871, CVE-2026-63873, CVE-2026-63874, CVE-2026-64187,     CVE-2026-64188, CVE-2026-64189, CVE-2026-64191, CVE-2026-64192, CVE-2026-64205, CVE-2026-64206,     CVE-2026-64207, CVE-2026-64244, CVE-2026-64245, CVE-2026-64246, CVE-2026-64247, CVE-2026-64249,     CVE-2026-64251, CVE-2026-64253, CVE-2026-64254, CVE-2026-64255, CVE-2026-64256, CVE-2026-64258,     CVE-2026-64259, CVE-2026-64260, CVE-2026-64261, CVE-2026-64262, CVE-2026-64263, CVE-2026-64264,     CVE-2026-64265, CVE-2026-64266, CVE-2026-64267, CVE-2026-64268, CVE-2026-64269, CVE-2026-64270,     CVE-2026-64271, CVE-2026-64272, CVE-2026-64273, CVE-2026-64274, CVE-2026-64275, CVE-2026-64276,     CVE-2026-64277, CVE-2026-64278, CVE-2026-64279, CVE-2026-64280, CVE-2026-64282, CVE-2026-64283,     CVE-2026-64284, CVE-2026-64285, CVE-2026-64286, CVE-2026-64287, CVE-2026-64288, CVE-2026-64289,     CVE-2026-64290, CVE-2026-64291, CVE-2026-64292, CVE-2026-64293, CVE-2026-64294, CVE-2026-64295,     CVE-2026-64296, CVE-2026-64297, CVE-2026-64298, CVE-2026-64299, CVE-2026-64300, CVE-2026-64301,     CVE-2026-64302, CVE-2026-64303, CVE-2026-64304, CVE-2026-64305, CVE-2026-64306, CVE-2026-64307,     CVE-2026-64308, CVE-2026-64309, CVE-2026-64310, CVE-2026-64312, CVE-2026-64313, CVE-2026-64314,     CVE-2026-64315, CVE-2026-64316, CVE-2026-64317, CVE-2026-64318, CVE-2026-64319, CVE-2026-64320,     CVE-2026-64321, CVE-2026-64322, CVE-2026-64323, CVE-2026-64324, CVE-2026-64325, CVE-2026-64326,     CVE-2026-64327, CVE-2026-64328, CVE-2026-64329, CVE-2026-64330, CVE-2026-64331, CVE-2026-64332,     CVE-2026-64333, CVE-2026-64334, CVE-2026-64335, CVE-2026-64336, CVE-2026-64337, CVE-2026-64338,     CVE-2026-64339, CVE-2026-64340, CVE-2026-64341, CVE-2026-64342, CVE-2026-64343, CVE-2026-64344,     CVE-2026-64345, CVE-2026-64346, CVE-2026-64347, CVE-2026-64348, CVE-2026-64350, CVE-2026-64351,     CVE-2026-64352, CVE-2026-64353, CVE-2026-64354, CVE-2026-64355, CVE-2026-64356, CVE-2026-64357,     CVE-2026-64358, CVE-2026-64359, CVE-2026-64360, CVE-2026-64361, CVE-2026-64362, CVE-2026-64363,     CVE-2026-64364, CVE-2026-64365, CVE-2026-64366, CVE-2026-64367, CVE-2026-64368, CVE-2026-64369,     CVE-2026-64370, CVE-2026-64371, CVE-2026-64372, CVE-2026-64373, CVE-2026-64374, CVE-2026-64375,     CVE-2026-64376, CVE-2026-64377, CVE-2026-64378, CVE-2026-64379, CVE-2026-64380, CVE-2026-64381,     CVE-2026-64382, CVE-2026-64383, CVE-2026-64384, CVE-2026-64385, CVE-2026-64386, CVE-2026-64387,     CVE-2026-64388, CVE-2026-64389, CVE-2026-64390, CVE-2026-64391, CVE-2026-64392, CVE-2026-64393,     CVE-2026-64394, CVE-2026-64395, CVE-2026-64396, CVE-2026-64397, CVE-2026-64398, CVE-2026-64399,     CVE-2026-64400, CVE-2026-64401, CVE-2026-64402, CVE-2026-64403, CVE-2026-64404, CVE-2026-64405,     CVE-2026-64406, CVE-2026-64407, CVE-2026-64408, CVE-2026-64409, CVE-2026-64410, CVE-2026-64411,     CVE-2026-64412, CVE-2026-64413, CVE-2026-64414, CVE-2026-64415, CVE-2026-64416, CVE-2026-64417,     CVE-2026-64418, CVE-2026-64419, CVE-2026-64420, CVE-2026-64421, CVE-2026-64422, CVE-2026-64423,     CVE-2026-64424, CVE-2026-64425, CVE-2026-64426, CVE-2026-64428, CVE-2026-64429, CVE-2026-64430,     CVE-2026-64432, CVE-2026-64433, CVE-2026-64434, CVE-2026-64435, CVE-2026-64436, CVE-2026-64438,     CVE-2026-64439, CVE-2026-64440, CVE-2026-64441, CVE-2026-64442, CVE-2026-64443, CVE-2026-64444,     CVE-2026-64445, CVE-2026-64446, CVE-2026-64447, CVE-2026-64448, CVE-2026-64449, CVE-2026-64450,     CVE-2026-64451, CVE-2026-64452, CVE-2026-64453, CVE-2026-64454, CVE-2026-64455, CVE-2026-64456,     CVE-2026-64457, CVE-2026-64458, CVE-2026-64459, CVE-2026-64460, CVE-2026-64461, CVE-2026-64462,     CVE-2026-64463, CVE-2026-64464, CVE-2026-64465, CVE-2026-64466, CVE-2026-64467, CVE-2026-64468,     CVE-2026-64469, CVE-2026-64470, CVE-2026-64471, CVE-2026-64472, CVE-2026-64473, CVE-2026-64474,     CVE-2026-64475, CVE-2026-64476, CVE-2026-64477, CVE-2026-64478, CVE-2026-64479, CVE-2026-64480,     CVE-2026-64481, CVE-2026-64482, CVE-2026-64483, CVE-2026-64484, CVE-2026-64485, CVE-2026-64486,     CVE-2026-64487, CVE-2026-64488, CVE-2026-64489, CVE-2026-64490, CVE-2026-64491, CVE-2026-64492,     CVE-2026-64493, CVE-2026-64494, CVE-2026-64495, CVE-2026-64496, CVE-2026-64497, CVE-2026-64499,     CVE-2026-64500, CVE-2026-64501, CVE-2026-64502, CVE-2026-64503, CVE-2026-64504, CVE-2026-64505,     CVE-2026-64507, CVE-2026-64508, CVE-2026-64509, CVE-2026-64510, CVE-2026-64511, CVE-2026-64512,     CVE-2026-64513, CVE-2026-64514, CVE-2026-64529, CVE-2026-64531, CVE-2026-64536, CVE-2026-64556,     CVE-2026-64588, CVE-2026-64589, CVE-2026-64590, CVE-2026-64591, CVE-2026-64592, CVE-2026-64593,     CVE-2026-64594, CVE-2026-64596, CVE-2026-64597, CVE-2026-64598, CVE-2026-64599, CVE-2026-64600,     CVE-2026-64601, CVE-2026-64602, CVE-2026-64603, CVE-2026-64604, CVE-2026-68084, CVE-2026-68085,     CVE-2026-68087, CVE-2026-68088, CVE-2026-68089, CVE-2026-68090, CVE-2026-68091, CVE-2026-68092,     CVE-2026-68459, CVE-2026-68460, CVE-2026-68461, CVE-2026-74584, CVE-2026-80591, CVE-2026-80952,     CVE-2026-90386)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the kernel-5.14.0-749.el9 build changelog.

  - In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mld: validate sta_mask     before ffs() in BA session handlers Three BA session handlers use ffs(ba_data->sta_mask) - 1 to derive a     station ID without checking that sta_mask is non-zero. When sta_mask is zero, ffs() returns 0 and the     subtraction wraps to 0xFFFFFFFF, causing an out-of-bounds access on fw_id_to_link_sta[]. Add     WARN_ON_ONCE(!ba_data->sta_mask) guards before each ffs() call, consistent with the existing check in     iwl_mld_ampdu_rx_start(). (CVE-2026-64255)

  - In the Linux kernel, the following vulnerability has been resolved: mm/slab: do not limit zeroing to     orig_size when only red zoning is enabled When init (zeroing) on allocation is requested, for kmalloc() we     generally have to zero the full object size even if a smaller size is requested, in order to provide     krealloc()'s __GFP_ZERO guarantees. But if we track the requested size, krealloc() uses that information     to do the right thing, so we can zero only the requested size. With red zoning also enabled, any extra     size became part of the red zone, so it must not be zeroed and thus we must zero only the requested size.
    However the current check is imprecise, and will trigger also when only SLAB_RED_ZONE is enabled without     SLAB_STORE_USER (which enables tracking the requested size). This means enabling red zoning alone can     compromise krealloc()'s __GFP_ZERO contract. Fix this by using slub_debug_orig_size() instead, which is     the exact check for whether the requested size is tracked. We don't need to care if red zoning is also     enabled or not. Also update and expand the comment accordingly. (CVE-2026-64368)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:67150 advisory.

    * kernel: Linux kernel: Denial of Service in qla2xxx SCSI driver due to improper command handling after     chip reset (CVE-2025-68745)
      * kernel: drm/xe: Open-code GGTT MMIO access protection (CVE-2026-23466)
      * kernel: drm/xe: always keep track of remap prev/next (CVE-2026-31479)
      * kernel: drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CVE-2026-31566)
      * kernel: drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CVE-2026-31656)
      * kernel: rtnetlink: add missing netlink_ns_capable() check for peer netns (CVE-2026-31692)
      * kernel: Bluetooth: SMP: force responder MITM requirements before building the pairing response     (CVE-2026-43334)
      * kernel: drm/i915: Fix potential overflow of shmem scatterlist length (CVE-2026-43368)
      * kernel: drm/amdgpu: Fix use-after-free race in VM acquire (CVE-2026-43370)
      * kernel: Bluetooth: serialize accept_q access (CVE-2026-52918)
      * kernel: sctp: diag: reject stale associations in dump_one path (CVE-2026-52917)
      * kernel: net: pull headers in qdisc_pkt_len_segs_init() (CVE-2026-53091)
      * kernel: iommu/amd: Fix clone_alias() to use the original device's devid (CVE-2026-53053)
      * kernel: Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CVE-2026-53072)
      * kernel: net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (CVE-2026-52947)
      * kernel: Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CVE-2026-53256)
      * kernel: wifi: nl80211: reject oversized EMA RNR lists (CVE-2026-53182)
      * kernel: Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CVE-2026-53209)
      * kernel: sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (CVE-2026-53246)
      * kernel: Bluetooth: RFCOMM: validate skb length in MCC handlers (CVE-2026-53254)
      * kernel: tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (CVE-2026-63801)
      * kernel: scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CVE-2026-63889)
      * kernel: sctp: fix race between sctp_wait_for_connect and peeloff (CVE-2026-63971)
      * kernel: Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CVE-2026-63975)
      * kernel: Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CVE-2026-63947)
      * kernel: Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CVE-2026-63944)
      * kernel: Bluetooth: ISO: fix UAF in iso_recv_frame (CVE-2026-63946)
      * kernel: Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CVE-2026-63945)
      * kernel: wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (CVE-2026-64117)
      * kernel: wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (CVE-2026-64037)
      * kernel: ixgbevf: fix use-after-free in VEPA multicast source pruning (CVE-2026-64113)
      * kernel: wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (CVE-2026-64255)
      * kernel: wifi: mac80211: fix MLE defragmentation (CVE-2026-64515)
      * kernel: mm/khugepaged: write all dirty file folios when collapsing (CVE-2026-68086)
      * kernel: Linux kernel: Wi-Fi subsystem out-of-bounds read via crafted frames (CVE-2026-68402)
      * kernel: sctp: fix auth_hmacs array size in struct sctp_cookie (CVE-2026-68376)
      * kernel: wifi: cfg80211: validate PMSR FTM preamble range (CVE-2026-68406)
      * kernel: tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (CVE-2026-68117)
      * kernel: sctp: auth: verify auth requirement when auth_chunk is NULL (CVE-2026-68300)
      * kernel: drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (CVE-2026-68264)
      * kernel: sctp: validate stream count in sctp_process_strreset_inreq() (CVE-2026-68315)
      * kernel: dm-verity: fix buffer overflow in FEC calculation (CVE-2026-72098)


    Bug Fix(es) and Enhancement(s):

      * gfs2: Various xfstests fixes [almalinux-9.8.z] (JIRA:AlmaLinux-178219)
      * rtla-timerlat-top doesn't stop properly when threshold is reached on multiple CPUs at once     [almalinux-9.8.z] (JIRA:AlmaLinux-193025)
      * qede: build_skb failure causes off-by-one BD ring corruption and kernel panic [almalinux-9.8.z]     (JIRA:AlmaLinux-193050)
      * Customer needs netfilter: nfnetlink_queue: optimize verdict lookup with hash table patch     [almalinux-9.8.z] (JIRA:AlmaLinux-224489)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 24.04 LTS / Pro Realtime 24.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-8760-1 advisory.

    Several security issues were discovered in the Linux kernel. An attacker could possibly use these to     compromise the system. This update corrects flaws in the following subsystems:

    - User-space API (UAPI);

    - Kernel build system;

    - ARM32 architecture;

    - ARM64 architecture;

    - RISC-V architecture;

    - S390 architecture;

    - x86 architecture;

    - Block layer subsystem;

    - Cryptographic API;

    - Compute Acceleration Framework;

    - Intel NPU Driver;

    - ACPI drivers;

    - Android drivers;

    - Drivers core;

    - Compressed RAM block device driver;

    - Bluetooth drivers;

    - Character device driver;

    - Hardware random number generator core;

    - CPU frequency scaling framework;

    - Hardware crypto device drivers;

    - Buffer Sharing and Synchronization framework;

    - Intel Stratix 10 firmware drivers;

    - FPGA Framework;

    - GPIO subsystem;

    - GPU drivers;

    - HID subsystem;

    - CoreSight HW tracing drivers;

    - I2C subsystem;

    - IIO subsystem;

    - IIO ADC drivers;

    - InfiniBand drivers;

    - Input Device core drivers;

    - Input Device (Mouse) drivers;

    - IOMMU subsystem;

    - IRQ chip drivers;

    - Multiple devices driver;

    - Media drivers;

    - Multifunction device drivers;

    - Fastrpc Driver;

    - MMC subsystem;

    - Ethernet bonding driver;

    - Network drivers;

    - Mellanox network drivers;

    - MediaTek network drivers;

    - NTB driver;

    - NVME drivers;

    - NVMEM (Non Volatile Memory) drivers;

    - PCI subsystem;

    - Pin controllers subsystem;

    - x86 platform drivers;

    - System reset/shutdown drivers;

    - Power sequencing drivers;

    - PTP clock framework;

    - Voltage and Current Regulator drivers;

    - RPMSG subsystem;

    - SLIMbus drivers;

    - SPI subsystem;

    - Media staging drivers;

    - Realtek RTL8723BS SDIO drivers;

    - VME bus staging drivers;

    - Trusted Execution Environment drivers;

    - Thunderbolt and USB4 drivers;

    - TTY drivers;

    - Cadence USB3 driver;

    - ULPI bus;

    - DesignWare USB3 driver;

    - Faraday FOTG210 USB2 dual-role controller driver;

    - USB Gadget drivers;

    - USB Host Controller drivers;

    - USB ChaosKey driver;

    - Siemens ID Mouse USB driver;

    - IOWarrior USB driver;

    - LD Didactic USB driver;

    - LEGO USB Tower driver;

    - Intel USBIO USB I/O expander driver;

    - USS720 USB parallel port adapter driver;

    - MediaTek USB3 DRD driver;

    - USB Serial drivers;

    - USB Type-C Port Controller Manager driver;

    - USB Type-C Connector System Software Interface driver;

    - USB over IP driver;

    - VFIO drivers;

    - Framebuffer layer;

    - Virtio drivers;

    - BTRFS file system;

    - EROFS file system;

    - exFAT file system;

    - F2FS file system;

    - File systems infrastructure;

    - FUSE (File system in Userspace);

    - GFS2 file system;

    - HFS file system;

    - HFS+ file system;

    - Network file system (NFS) client;

    - Network file system (NFS) server daemon;

    - NILFS2 file system;

    - NTFS3 file system;

    - OCFS2 file system;

    - Proc file system;

    - SMB network file system;

    - UDF file system;

    - XFS file system;

    - Key management;

    - BPF subsystem;

    - Memory management;

    - Software nodes and device properties;

    - Glob pattern matching library;

    - Memory Management;

    - KVM subsystem;

    - Mellanox drivers;

    - Restartable sequences system call mechanism;

    - Socket messages infrastructure;

    - Network traffic control;

    - Bluetooth subsystem;

    - Netfilter;

    - Networking core;

    - Network sockets;

    - TCP network protocol;

    - io_uring subsystem;

    - IPC subsystem;

    - Audit subsystem;

    - Perf events;

    - Kernel fork() syscall;

    - Locking primitives;

    - Kernel module support;

    - Scheduler infrastructure;

    - Signal handling mechanism;

    - Timer subsystem;

    - Tracing infrastructure;

    - Debug objects infrastructure;

    - 6LoWPAN network protocol;

    - IEEE 802 network protocols;

    - 9P file system network protocol;

    - B.A.T.M.A.N. meshing protocol;

    - Ethernet bridge;

    - Devlink API;

    - HSR network protocol;

    - IEEE802154.4 network protocol;

    - IPv4 networking;

    - IPv6 networking;

    - XFRM subsystem;

    - L2TP protocol;

    - MAC80211 subsystem;

    - IEEE 802.15.4 subsystem;

    - Multipath TCP;

    - NetLabel subsystem;

    - Open vSwitch;

    - Phonet protocol;

    - Qualcomm IPC Router (QRTR);

    - RDS protocol;

    - SCTP protocol;

    - SMC sockets;

    - TIPC protocol;

    - TLS protocol;

    - Unix domain sockets;

    - VMware vSockets driver;

    - Wireless networking;

    - eXpress Data Path;

    - AppArmor security module;

    - Linux Security Modules (LSM) Framework;

    - Apple Onboard Audio ALSA driver;

    - ALSA framework;

    - FireWire sound drivers;

    - HD-audio driver;

    - Gravis UltraSound ALSA driver;

    - C-Media CMI8x38 ALSA driver;

    - ESS Solo-1 ALSA driver;

    - ICE1712/ICE1724 (Envy24) ALSA driver;

    - Yamaha YMFPCI ALSA driver;

    - Wolfson Microelectronics audio codecs;

    - SoundWire (SDCA) ASoC drivers;

    - USB sound devices;

    - Virtio sound driver; (CVE-2026-52908, CVE-2026-52909, CVE-2026-52910, CVE-2026-52917, CVE-2026-52929,     CVE-2026-52930, CVE-2026-52935, CVE-2026-52938, CVE-2026-52939, CVE-2026-52940, CVE-2026-52942,     CVE-2026-52947, CVE-2026-52948, CVE-2026-53132, CVE-2026-53133, CVE-2026-53134, CVE-2026-53135,     CVE-2026-53136, CVE-2026-53137, CVE-2026-53138, CVE-2026-53139, CVE-2026-53140, CVE-2026-53141,     CVE-2026-53142, CVE-2026-53143, CVE-2026-53144, CVE-2026-53145, CVE-2026-53146, CVE-2026-53147,     CVE-2026-53148, CVE-2026-53149, CVE-2026-53150, CVE-2026-53152, CVE-2026-53153, CVE-2026-53154,     CVE-2026-53155, CVE-2026-53156, CVE-2026-53157, CVE-2026-53158, CVE-2026-53159, CVE-2026-53160,     CVE-2026-53161, CVE-2026-53162, CVE-2026-53163, CVE-2026-53164, CVE-2026-53165, CVE-2026-53167,     CVE-2026-53168, CVE-2026-53169, CVE-2026-53170, CVE-2026-53171, CVE-2026-53172, CVE-2026-53173,     CVE-2026-53177, CVE-2026-53178, CVE-2026-53179, CVE-2026-53180, CVE-2026-53181, CVE-2026-53182,     CVE-2026-53183, CVE-2026-53184, CVE-2026-53185, CVE-2026-53187, CVE-2026-53188, CVE-2026-53189,     CVE-2026-53190, CVE-2026-53191, CVE-2026-53192, CVE-2026-53193, CVE-2026-53194, CVE-2026-53195,     CVE-2026-53196, CVE-2026-53197, CVE-2026-53198, CVE-2026-53199, CVE-2026-53200, CVE-2026-53201,     CVE-2026-53202, CVE-2026-53203, CVE-2026-53204, CVE-2026-53205, CVE-2026-53206, CVE-2026-53207,     CVE-2026-53208, CVE-2026-53209, CVE-2026-53210, CVE-2026-53211, CVE-2026-53213, CVE-2026-53214,     CVE-2026-53217, CVE-2026-53218, CVE-2026-53219, CVE-2026-53220, CVE-2026-53222, CVE-2026-53223,     CVE-2026-53226, CVE-2026-53227, CVE-2026-53229, CVE-2026-53230, CVE-2026-53231, CVE-2026-53232,     CVE-2026-53233, CVE-2026-53234, CVE-2026-53235, CVE-2026-53236, CVE-2026-53237, CVE-2026-53238,     CVE-2026-53239, CVE-2026-53240, CVE-2026-53241, CVE-2026-53242, CVE-2026-53243, CVE-2026-53244,     CVE-2026-53245, CVE-2026-53248, CVE-2026-53249, CVE-2026-53250, CVE-2026-53251, CVE-2026-53252,     CVE-2026-53253, CVE-2026-53254, CVE-2026-53255, CVE-2026-53256, CVE-2026-53257, CVE-2026-53258,     CVE-2026-53259, CVE-2026-53261, CVE-2026-53262, CVE-2026-53263, CVE-2026-53264, CVE-2026-53265,     CVE-2026-53266, CVE-2026-53267, CVE-2026-53268, CVE-2026-53269, CVE-2026-53270, CVE-2026-53271,     CVE-2026-53272, CVE-2026-53273, CVE-2026-53274, CVE-2026-53275, CVE-2026-53276, CVE-2026-53325,     CVE-2026-53326, CVE-2026-53327, CVE-2026-53328, CVE-2026-53329, CVE-2026-53330, CVE-2026-53331,     CVE-2026-53332, CVE-2026-53333, CVE-2026-53334, CVE-2026-53335, CVE-2026-53336, CVE-2026-53337,     CVE-2026-53338, CVE-2026-53339, CVE-2026-53340, CVE-2026-53341, CVE-2026-53342, CVE-2026-53343,     CVE-2026-53344, CVE-2026-53345, CVE-2026-53346, CVE-2026-53347, CVE-2026-53348, CVE-2026-53349,     CVE-2026-53350, CVE-2026-53351, CVE-2026-53352, CVE-2026-53353, CVE-2026-53355, CVE-2026-53356,     CVE-2026-53361, CVE-2026-53362, CVE-2026-53363, CVE-2026-53366, CVE-2026-53381, CVE-2026-53382,     CVE-2026-53383, CVE-2026-53384, CVE-2026-53385, CVE-2026-53386, CVE-2026-53387, CVE-2026-53388,     CVE-2026-53389, CVE-2026-53390, CVE-2026-53391, CVE-2026-53392, CVE-2026-53393, CVE-2026-53394,     CVE-2026-53395, CVE-2026-53396, CVE-2026-53397, CVE-2026-53398, CVE-2026-53399, CVE-2026-53400,     CVE-2026-53401, CVE-2026-53402, CVE-2026-53403, CVE-2026-63794, CVE-2026-63795, CVE-2026-63796,     CVE-2026-63797, CVE-2026-63798, CVE-2026-63799, CVE-2026-63800, CVE-2026-63801, CVE-2026-63802,     CVE-2026-63803, CVE-2026-63804, CVE-2026-63805, CVE-2026-63806, CVE-2026-63807, CVE-2026-63808,     CVE-2026-63809, CVE-2026-63810, CVE-2026-63811, CVE-2026-63812, CVE-2026-63813, CVE-2026-63814,     CVE-2026-63815, CVE-2026-63816, CVE-2026-63817, CVE-2026-63818, CVE-2026-63819, CVE-2026-63820,     CVE-2026-63821, CVE-2026-63822, CVE-2026-63823, CVE-2026-63824, CVE-2026-63825, CVE-2026-63826,     CVE-2026-63827, CVE-2026-63828, CVE-2026-63829, CVE-2026-63830, CVE-2026-63831, CVE-2026-63832,     CVE-2026-63833, CVE-2026-63834, CVE-2026-63835, CVE-2026-63836, CVE-2026-63867, CVE-2026-63868,     CVE-2026-63869, CVE-2026-63870, CVE-2026-63871, CVE-2026-63873, CVE-2026-63874, CVE-2026-64187,     CVE-2026-64188, CVE-2026-64189, CVE-2026-64191, CVE-2026-64192, CVE-2026-64205, CVE-2026-64206,     CVE-2026-64207, CVE-2026-64244, CVE-2026-64245, CVE-2026-64246, CVE-2026-64247, CVE-2026-64249,     CVE-2026-64251, CVE-2026-64253, CVE-2026-64254, CVE-2026-64255, CVE-2026-64256, CVE-2026-64258,     CVE-2026-64259, CVE-2026-64260, CVE-2026-64261, CVE-2026-64262, CVE-2026-64263, CVE-2026-64264,     CVE-2026-64265, CVE-2026-64266, CVE-2026-64267, CVE-2026-64268, CVE-2026-64269, CVE-2026-64270,     CVE-2026-64271, CVE-2026-64272, CVE-2026-64273, CVE-2026-64274, CVE-2026-64275, CVE-2026-64276,     CVE-2026-64277, CVE-2026-64278, CVE-2026-64279, CVE-2026-64280, CVE-2026-64282, CVE-2026-64283,     CVE-2026-64284, CVE-2026-64285, CVE-2026-64286, CVE-2026-64287, CVE-2026-64288, CVE-2026-64289,     CVE-2026-64290, CVE-2026-64291, CVE-2026-64292, CVE-2026-64293, CVE-2026-64294, CVE-2026-64295,     CVE-2026-64296, CVE-2026-64297, CVE-2026-64298, CVE-2026-64299, CVE-2026-64300, CVE-2026-64301,     CVE-2026-64302, CVE-2026-64303, CVE-2026-64304, CVE-2026-64305, CVE-2026-64306, CVE-2026-64307,     CVE-2026-64308, CVE-2026-64309, CVE-2026-64310, CVE-2026-64312, CVE-2026-64313, CVE-2026-64314,     CVE-2026-64315, CVE-2026-64316, CVE-2026-64317, CVE-2026-64318, CVE-2026-64319, CVE-2026-64320,     CVE-2026-64321, CVE-2026-64322, CVE-2026-64323, CVE-2026-64324, CVE-2026-64325, CVE-2026-64326,     CVE-2026-64327, CVE-2026-64328, CVE-2026-64329, CVE-2026-64330, CVE-2026-64331, CVE-2026-64332,     CVE-2026-64333, CVE-2026-64334, CVE-2026-64335, CVE-2026-64336, CVE-2026-64337, CVE-2026-64338,     CVE-2026-64339, CVE-2026-64340, CVE-2026-64341, CVE-2026-64342, CVE-2026-64343, CVE-2026-64344,     CVE-2026-64345, CVE-2026-64346, CVE-2026-64347, CVE-2026-64348, CVE-2026-64350, CVE-2026-64351,     CVE-2026-64352, CVE-2026-64353, CVE-2026-64354, CVE-2026-64355, CVE-2026-64356, CVE-2026-64357,     CVE-2026-64358, CVE-2026-64359, CVE-2026-64360, CVE-2026-64361, CVE-2026-64362, CVE-2026-64363,     CVE-2026-64364, CVE-2026-64365, CVE-2026-64366, CVE-2026-64367, CVE-2026-64368, CVE-2026-64369,     CVE-2026-64370, CVE-2026-64371, CVE-2026-64372, CVE-2026-64373, CVE-2026-64374, CVE-2026-64375,     CVE-2026-64376, CVE-2026-64377, CVE-2026-64378, CVE-2026-64379, CVE-2026-64380, CVE-2026-64381,     CVE-2026-64382, CVE-2026-64383, CVE-2026-64384, CVE-2026-64385, CVE-2026-64386, CVE-2026-64387,     CVE-2026-64388, CVE-2026-64389, CVE-2026-64390, CVE-2026-64391, CVE-2026-64392, CVE-2026-64393,     CVE-2026-64394, CVE-2026-64395, CVE-2026-64396, CVE-2026-64397, CVE-2026-64398, CVE-2026-64399,     CVE-2026-64400, CVE-2026-64401, CVE-2026-64402, CVE-2026-64403, CVE-2026-64404, CVE-2026-64405,     CVE-2026-64406, CVE-2026-64407, CVE-2026-64408, CVE-2026-64409, CVE-2026-64410, CVE-2026-64411,     CVE-2026-64412, CVE-2026-64413, CVE-2026-64414, CVE-2026-64415, CVE-2026-64416, CVE-2026-64417,     CVE-2026-64418, CVE-2026-64419, CVE-2026-64420, CVE-2026-64421, CVE-2026-64422, CVE-2026-64423,     CVE-2026-64424, CVE-2026-64425, CVE-2026-64426, CVE-2026-64428, CVE-2026-64429, CVE-2026-64430,     CVE-2026-64432, CVE-2026-64433, CVE-2026-64434, CVE-2026-64435, CVE-2026-64436, CVE-2026-64438,     CVE-2026-64439, CVE-2026-64440, CVE-2026-64441, CVE-2026-64442, CVE-2026-64443, CVE-2026-64444,     CVE-2026-64445, CVE-2026-64446, CVE-2026-64447, CVE-2026-64448, CVE-2026-64449, CVE-2026-64450,     CVE-2026-64451, CVE-2026-64452, CVE-2026-64453, CVE-2026-64454, CVE-2026-64455, CVE-2026-64456,     CVE-2026-64457, CVE-2026-64458, CVE-2026-64459, CVE-2026-64460, CVE-2026-64461, CVE-2026-64462,     CVE-2026-64463, CVE-2026-64464, CVE-2026-64465, CVE-2026-64466, CVE-2026-64467, CVE-2026-64468,     CVE-2026-64469, CVE-2026-64470, CVE-2026-64471, CVE-2026-64472, CVE-2026-64473, CVE-2026-64474,     CVE-2026-64475, CVE-2026-64476, CVE-2026-64477, CVE-2026-64478, CVE-2026-64479, CVE-2026-64480,     CVE-2026-64481, CVE-2026-64482, CVE-2026-64483, CVE-2026-64484, CVE-2026-64485, CVE-2026-64486,     CVE-2026-64487, CVE-2026-64488, CVE-2026-64489, CVE-2026-64490, CVE-2026-64491, CVE-2026-64492,     CVE-2026-64493, CVE-2026-64494, CVE-2026-64495, CVE-2026-64496, CVE-2026-64497, CVE-2026-64499,     CVE-2026-64500, CVE-2026-64501, CVE-2026-64502, CVE-2026-64503, CVE-2026-64504, CVE-2026-64505,     CVE-2026-64507, CVE-2026-64508, CVE-2026-64509, CVE-2026-64510, CVE-2026-64511, CVE-2026-64512,     CVE-2026-64513, CVE-2026-64514, CVE-2026-64529, CVE-2026-64531, CVE-2026-64536, CVE-2026-64556,     CVE-2026-64588, CVE-2026-64589, CVE-2026-64590, CVE-2026-64591, CVE-2026-64592, CVE-2026-64593,     CVE-2026-64594, CVE-2026-64596, CVE-2026-64597, CVE-2026-64598, CVE-2026-64599, CVE-2026-64600,     CVE-2026-64601, CVE-2026-64602, CVE-2026-64603, CVE-2026-64604, CVE-2026-68084, CVE-2026-68085,     CVE-2026-68087, CVE-2026-68088, CVE-2026-68089, CVE-2026-68090, CVE-2026-68091, CVE-2026-68092,     CVE-2026-68459, CVE-2026-68460, CVE-2026-68461, CVE-2026-74584, CVE-2026-80591)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:67150 advisory.

    * kernel: Linux kernel: Denial of Service in qla2xxx SCSI driver due to improper command handling after     chip reset (CVE-2025-68745)

    * kernel: drm/xe: Open-code GGTT MMIO access protection (CVE-2026-23466)

    * kernel: drm/xe: always keep track of remap prev/next (CVE-2026-31479)

    * kernel: drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CVE-2026-31566)

    * kernel: drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CVE-2026-31656)

    * kernel: rtnetlink: add missing netlink_ns_capable() check for peer netns (CVE-2026-31692)

    * kernel: Bluetooth: SMP: force responder MITM requirements before building the pairing response     (CVE-2026-43334)

    * kernel: drm/i915: Fix potential overflow of shmem scatterlist length (CVE-2026-43368)

    * kernel: drm/amdgpu: Fix use-after-free race in VM acquire (CVE-2026-43370)

    * kernel: Bluetooth: serialize accept_q access (CVE-2026-52918)

    * kernel: sctp: diag: reject stale associations in dump_one path (CVE-2026-52917)

    * kernel: net: pull headers in qdisc_pkt_len_segs_init() (CVE-2026-53091)

    * kernel: iommu/amd: Fix clone_alias() to use the original device's devid (CVE-2026-53053)

    * kernel: Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CVE-2026-53072)

    * kernel: net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (CVE-2026-52947)

    * kernel: Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CVE-2026-53256)

    * kernel: wifi: nl80211: reject oversized EMA RNR lists (CVE-2026-53182)

    * kernel: Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CVE-2026-53209)

    * kernel: sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (CVE-2026-53246)

    * kernel: Bluetooth: RFCOMM: validate skb length in MCC handlers (CVE-2026-53254)

    * kernel: tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (CVE-2026-63801)

    * kernel: scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CVE-2026-63889)

    * kernel: sctp: fix race between sctp_wait_for_connect and peeloff (CVE-2026-63971)

    * kernel: Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CVE-2026-63975)

    * kernel: Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CVE-2026-63947)

    * kernel: Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CVE-2026-63944)

    * kernel: Bluetooth: ISO: fix UAF in iso_recv_frame (CVE-2026-63946)

    * kernel: Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CVE-2026-63945)

    * kernel: wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (CVE-2026-64117)

    * kernel: wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (CVE-2026-64037)

    * kernel: ixgbevf: fix use-after-free in VEPA multicast source pruning (CVE-2026-64113)

    * kernel: wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (CVE-2026-64255)

    * kernel: wifi: mac80211: fix MLE defragmentation (CVE-2026-64515)

    * kernel: mm/khugepaged: write all dirty file folios when collapsing (CVE-2026-68086)

    * kernel: Linux kernel: Wi-Fi subsystem out-of-bounds read via crafted frames (CVE-2026-68402)

    * kernel: sctp: fix auth_hmacs array size in struct sctp_cookie (CVE-2026-68376)

    * kernel: wifi: cfg80211: validate PMSR FTM preamble range (CVE-2026-68406)

    * kernel: tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (CVE-2026-68117)

    * kernel: sctp: auth: verify auth requirement when auth_chunk is NULL (CVE-2026-68300)

    * kernel: drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (CVE-2026-68264)

    * kernel: sctp: validate stream count in sctp_process_strreset_inreq() (CVE-2026-68315)

    * kernel: dm-verity: fix buffer overflow in FEC calculation (CVE-2026-72098)

    Bug Fix(es) and Enhancement(s):

    *  gfs2: Various xfstests fixes [rhel-9.8.z] (JIRA:Rocky Linux-178219)

    * rtla-timerlat-top doesn't stop properly when threshold is reached on multiple CPUs at once [rhel-9.8.z]     (JIRA:Rocky Linux-193025)

    * qede: build_skb failure causes off-by-one BD ring corruption and kernel panic [rhel-9.8.z] (JIRA:Rocky     Linux-193050)

    * Customer needs netfilter: nfnetlink_queue: optimize verdict lookup with hash table patch [rhel-9.8.z]     (JIRA:Rocky Linux-224489)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-653340 advisory.

    - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244969] {CVE-2026-72098}
    - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244928] {CVE-2026-72129}
    - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-237706]     {CVE-2026-68409}
    - wifi: mt76: mt7925: drop TXRX_NOTIFY on non-mmio buses (Jose Ignacio Tornos Martinez) [RHEL-237681]     {CVE-2026-68193}
    - wifi: mt76: mt7925: fix crash in reset link replay (Jose Ignacio Tornos Martinez) [RHEL-237527]     {CVE-2026-68307}
    - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez)     [RHEL-232015] {CVE-2026-64255}
    - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez)     [RHEL-231685] {CVE-2026-64117}
    - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez)     [RHEL-231685] {CVE-2026-64117}
    - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez)     [RHEL-230977] {CVE-2026-64037}
    - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230604]     {CVE-2026-53182}
    - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez)     [RHEL-229725] {CVE-2026-52947}
    - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227617]     {CVE-2026-64515}
    - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515}
    - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232673]     {CVE-2026-53072}
    - accel/qaic: Add overflow check to remap_pfn_range during mmap (CKI Backport Bot) [RHEL-232178]     {CVE-2026-64051}
    - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231067]     {CVE-2026-63947}
    - Bluetooth: virtio_bt: validate rx pkt_type header length (CKI Backport Bot) [RHEL-230949]     {CVE-2026-46123}
    - Bluetooth: virtio_bt: clamp rx length before skb_put (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123}
    - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230076]     {CVE-2026-53209}
    - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230013] {CVE-2026-63944}
    - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228750]     {CVE-2026-63975}
    - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-227911]     {CVE-2026-63946}
    - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946}
    - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227889]     {CVE-2026-64113}
    - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport     Bot) [RHEL-227532] {CVE-2026-43334}
    - vfio/pci: Check BAR resources before exporting a DMABUF (CKI Backport Bot) [RHEL-227133]     {CVE-2026-64042}
    - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225690] {CVE-2026-64015}
    - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225653] {CVE-2026-53254}
    - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225574]     {CVE-2026-53256}
    - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225552] {CVE-2026-52918}
    - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188232] {CVE-2026-53091}
    - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091}
    - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188232] {CVE-2026-53091}
    - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232]     {CVE-2026-53091}
    - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091}
    - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188232] {CVE-2026-53091}
    - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188232] {CVE-2026-53091}
    - vfio/pci: Clean up DMABUFs before disabling function (CKI Backport Bot) [RHEL-189549] {CVE-2026-53322}
    - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189468]     {CVE-2026-43133}
    - fuse: fix race between interrupt and resend (Miklos Szeredi) [RHEL-218495] {CVE-2026-64265}
    - fuse: clear intr_entry in fuse_resend and fuse_remove_pending_req (Miklos Szeredi) [RHEL-218495]     {CVE-2026-64265}
    - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248457] {CVE-2026-64563}
    - udp: Fix wildcard bind conflict check when using hash2 (Felix Maurer) [RHEL-218016] {CVE-2026-31503}
    - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232246] {CVE-2026-46015}
    - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232629] {CVE-2026-46306}
    - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226125]     {CVE-2026-46266}
    - ipv6: anycast: insert aca into global hash under idev->lock (Felix Maurer) [RHEL-230763]     {CVE-2026-53259}
    - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226073]     {CVE-2026-53275}
    - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225606] {CVE-2026-43339}
    - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225864] {CVE-2026-53223}
    - net: add pskb_may_pull() to skb_gro_receive_list() (Felix Maurer) [RHEL-229309] {CVE-2026-53235}
    - can: bcm: extend bcm_tx_lock usage for data and timer updates (Abhishek Rawal) [RHEL-216700]     {CVE-2025-38004}
    - can: bcm: add locking when updating filter and timer values (Abhishek Rawal) [RHEL-216700]     {CVE-2025-38004}
    - can: bcm: fix locking for bcm_op runtime updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004}
    - can: bcm: add locking for bcm_op runtime updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004}
    - smb: client: fix double-free in SMB2_close() replay (Paulo Alcantara) [RHEL-240056] {CVE-2026-64597}
    - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-132852] {CVE-2026-43084}
    - ppp: require CAP_NET_ADMIN in target netns for unattached ioctls (Abhishek Rawal) [RHEL-228009]     {CVE-2026-53075}
    - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231711]     {CVE-2026-63993}
    - ipv6: sit: reload inner IPv6 header after GSO offloads (Abhishek Rawal) [RHEL-225920] {CVE-2026-53228}
    - ipv6: add NULL checks for idev in SRv6 paths (Abhishek Rawal) [RHEL-218012] {CVE-2026-23442}
    - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot)     [RHEL-234153] {CVE-2026-64319}
    - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (CKI Backport Bot) [RHEL-234204]     {CVE-2026-64287}
    - KVM: arm64: Take the SRCU lock for page table walks in fault injection and AT emulation (CKI Backport     Bot) [RHEL-229347] {CVE-2026-53277}
    - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot)     [RHEL-227269] {CVE-2026-64002}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-671500 advisory.

    - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098}
    - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332]     {CVE-2026-68086}
    - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370}
    - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481]     {CVE-2026-43368}
    - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417]     {CVE-2026-31656}
    - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275]     {CVE-2026-31566}
    - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479}
    - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466}
    - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (Jose Exposito) [RHEL-236583] {CVE-2026-68264}
    - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801}
    - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037]     {CVE-2026-68117}
    - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971}
    - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917}
    - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315}
    - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376}
    - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300}
    - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084}
    - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745}
    - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206]     {CVE-2026-53246}
    - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652]     {CVE-2026-68406}
    - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez)     [RHEL-237652] {CVE-2026-68406}
    - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652]     {CVE-2026-68406}
    - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652]     {CVE-2026-68406}
    - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez)     [RHEL-236961] {CVE-2026-68402}
    - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez)     [RHEL-232010] {CVE-2026-64255}
    - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez)     [RHEL-231682] {CVE-2026-64117}
    - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez)     [RHEL-231682] {CVE-2026-64117}
    - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez)     [RHEL-230975] {CVE-2026-64037}
    - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587]     {CVE-2026-53182}
    - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez)     [RHEL-229728] {CVE-2026-52947}
    - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619]     {CVE-2026-64515}
    - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515}
    - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670]     {CVE-2026-53072}
    - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059]     {CVE-2026-63947}
    - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073]     {CVE-2026-53209}
    - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944}
    - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756]     {CVE-2026-63975}
    - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721]     {CVE-2026-63889}
    - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946}
    - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882]     {CVE-2026-64113}
    - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport     Bot) [RHEL-227536] {CVE-2026-43334}
    - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454]     {CVE-2026-53053}
    - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431]     {CVE-2026-63945}
    - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646]     {CVE-2026-53254}
    - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254}
    - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576]     {CVE-2026-53256}
    - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918}
    - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091}
    - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091}
    - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091}
    - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228]     {CVE-2026-53091}
    - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091}
    - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091}
    - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091}
    - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532]     {CVE-2026-31692}
    - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532]     {CVE-2026-31692}
    - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692}
    - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692}
    - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692}
    - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:67150 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: Linux kernel: Denial of Service in qla2xxx SCSI driver due to improper command handling after     chip reset (CVE-2025-68745)

    * kernel: drm/xe: Open-code GGTT MMIO access protection (CVE-2026-23466)

    * kernel: drm/xe: always keep track of remap prev/next (CVE-2026-31479)

    * kernel: drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CVE-2026-31566)

    * kernel: drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CVE-2026-31656)

    * kernel: rtnetlink: add missing netlink_ns_capable() check for peer netns (CVE-2026-31692)

    * kernel: Bluetooth: SMP: force responder MITM requirements before building the pairing response     (CVE-2026-43334)

    * kernel: drm/i915: Fix potential overflow of shmem scatterlist length (CVE-2026-43368)

    * kernel: drm/amdgpu: Fix use-after-free race in VM acquire (CVE-2026-43370)

    * kernel: Bluetooth: serialize accept_q access (CVE-2026-52918)

    * kernel: sctp: diag: reject stale associations in dump_one path (CVE-2026-52917)

    * kernel: net: pull headers in qdisc_pkt_len_segs_init() (CVE-2026-53091)

    * kernel: iommu/amd: Fix clone_alias() to use the original device's devid (CVE-2026-53053)

    * kernel: Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CVE-2026-53072)

    * kernel: net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (CVE-2026-52947)

    * kernel: Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CVE-2026-53256)

    * kernel: wifi: nl80211: reject oversized EMA RNR lists (CVE-2026-53182)

    * kernel: Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CVE-2026-53209)

    * kernel: sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (CVE-2026-53246)

    * kernel: Bluetooth: RFCOMM: validate skb length in MCC handlers (CVE-2026-53254)

    * kernel: tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (CVE-2026-63801)

    * kernel: scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CVE-2026-63889)

    * kernel: sctp: fix race between sctp_wait_for_connect and peeloff (CVE-2026-63971)

    * kernel: Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CVE-2026-63975)

    * kernel: Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CVE-2026-63947)

    * kernel: Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CVE-2026-63944)

    * kernel: Bluetooth: ISO: fix UAF in iso_recv_frame (CVE-2026-63946)

    * kernel: Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CVE-2026-63945)

    * kernel: wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (CVE-2026-64117)

    * kernel: wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (CVE-2026-64037)

    * kernel: ixgbevf: fix use-after-free in VEPA multicast source pruning (CVE-2026-64113)

    * kernel: wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (CVE-2026-64255)

    * kernel: wifi: mac80211: fix MLE defragmentation (CVE-2026-64515)

    * kernel: mm/khugepaged: write all dirty file folios when collapsing (CVE-2026-68086)

    * kernel: Linux kernel: Wi-Fi subsystem out-of-bounds read via crafted frames (CVE-2026-68402)

    * kernel: sctp: fix auth_hmacs array size in struct sctp_cookie (CVE-2026-68376)

    * kernel: wifi: cfg80211: validate PMSR FTM preamble range (CVE-2026-68406)

    * kernel: tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (CVE-2026-68117)

    * kernel: sctp: auth: verify auth requirement when auth_chunk is NULL (CVE-2026-68300)

    * kernel: drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (CVE-2026-68264)

    * kernel: sctp: validate stream count in sctp_process_strreset_inreq() (CVE-2026-68315)

    * kernel: dm-verity: fix buffer overflow in FEC calculation (CVE-2026-72098)

    Bug Fix(es) and Enhancement(s):

    *  gfs2: Various xfstests fixes [rhel-9.8.z] (JIRA:RHEL-178219)

    * rtla-timerlat-top doesn't stop properly when threshold is reached on multiple CPUs at once [rhel-9.8.z]     (JIRA:RHEL-193025)

    * qede: build_skb failure causes off-by-one BD ring corruption and kernel panic [rhel-9.8.z]     (JIRA:RHEL-193050)

    * Customer needs netfilter: nfnetlink_queue: optimize verdict lookup with hash table patch [rhel-9.8.z]     (JIRA:RHEL-224489)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:65334 advisory.

    * kernel: KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CVE-2026-43133)
      * kernel: Bluetooth: SMP: force responder MITM requirements before building the pairing response     (CVE-2026-43334)
      * kernel: Bluetooth: virtio_bt: clamp rx length before skb_put (CVE-2026-46123)
      * kernel: Bluetooth: serialize accept_q access (CVE-2026-52918)
      * kernel: net: pull headers in qdisc_pkt_len_segs_init() (CVE-2026-53091)
      * kernel: Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CVE-2026-53072)
      * kernel: net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (CVE-2026-52947)
      * kernel: Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CVE-2026-53256)
      * kernel: wifi: nl80211: reject oversized EMA RNR lists (CVE-2026-53182)
      * kernel: Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CVE-2026-53209)
      * kernel: Bluetooth: RFCOMM: validate skb length in MCC handlers (CVE-2026-53254)
      * kernel: vfio/pci: Clean up DMABUFs before disabling function (CVE-2026-53322)
      * kernel: Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CVE-2026-63975)
      * kernel: security/keys: fix missed RCU read section on lookup (CVE-2026-64015)
      * kernel: Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CVE-2026-63947)
      * kernel: Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CVE-2026-63944)
      * kernel: Bluetooth: ISO: fix UAF in iso_recv_frame (CVE-2026-63946)
      * kernel: wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (CVE-2026-64117)
      * kernel: wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (CVE-2026-64037)
      * kernel: ixgbevf: fix use-after-free in VEPA multicast source pruning (CVE-2026-64113)
      * kernel: vfio/pci: Check BAR resources before exporting a DMABUF (CVE-2026-64042)
      * kernel: accel/qaic: Add overflow check to remap_pfn_range during mmap (CVE-2026-64051)
      * kernel: wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (CVE-2026-64255)
      * kernel: wifi: mac80211: fix MLE defragmentation (CVE-2026-64515)
      * kernel: wifi: mac80211: defer link RX stats percpu free to RCU (CVE-2026-68409)
      * kernel: wifi: mt76: mt7925: fix crash in reset link replay (CVE-2026-68307)
      * kernel: wifi: mt76: mt7925: drop TXRX_NOTIFY on non-mmio buses (CVE-2026-68193)
      * kernel: dm-verity: fix buffer overflow in FEC calculation (CVE-2026-72098)
      * kernel: nvmet-rdma: handle inline data with a nonzero offset (CVE-2026-72129)


    Bug Fix(es) and Enhancement(s):

      * rtla-timerlat-top doesn't stop properly when threshold is reached on multiple CPUs at once     [almalinux-10.2.z] (JIRA:AlmaLinux-193027)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:65334 advisory.

    * kernel: KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CVE-2026-43133)

    * kernel: Bluetooth: SMP: force responder MITM requirements before building the pairing response     (CVE-2026-43334)

    * kernel: Bluetooth: virtio_bt: clamp rx length before skb_put (CVE-2026-46123)

    * kernel: Bluetooth: serialize accept_q access (CVE-2026-52918)

    * kernel: net: pull headers in qdisc_pkt_len_segs_init() (CVE-2026-53091)

    * kernel: Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CVE-2026-53072)

    * kernel: net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (CVE-2026-52947)

    * kernel: Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CVE-2026-53256)

    * kernel: wifi: nl80211: reject oversized EMA RNR lists (CVE-2026-53182)

    * kernel: Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CVE-2026-53209)

    * kernel: Bluetooth: RFCOMM: validate skb length in MCC handlers (CVE-2026-53254)

    * kernel: vfio/pci: Clean up DMABUFs before disabling function (CVE-2026-53322)

    * kernel: Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CVE-2026-63975)

    * kernel: security/keys: fix missed RCU read section on lookup (CVE-2026-64015)

    * kernel: Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CVE-2026-63947)

    * kernel: Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CVE-2026-63944)

    * kernel: Bluetooth: ISO: fix UAF in iso_recv_frame (CVE-2026-63946)

    * kernel: wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (CVE-2026-64117)

    * kernel: wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (CVE-2026-64037)

    * kernel: ixgbevf: fix use-after-free in VEPA multicast source pruning (CVE-2026-64113)

    * kernel: vfio/pci: Check BAR resources before exporting a DMABUF (CVE-2026-64042)

    * kernel: accel/qaic: Add overflow check to remap_pfn_range during mmap (CVE-2026-64051)

    * kernel: wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (CVE-2026-64255)

    * kernel: wifi: mac80211: fix MLE defragmentation (CVE-2026-64515)

    * kernel: wifi: mac80211: defer link RX stats percpu free to RCU (CVE-2026-68409)

    * kernel: wifi: mt76: mt7925: fix crash in reset link replay (CVE-2026-68307)

    * kernel: wifi: mt76: mt7925: drop TXRX_NOTIFY on non-mmio buses (CVE-2026-68193)

    * kernel: dm-verity: fix buffer overflow in FEC calculation (CVE-2026-72098)

    * kernel: nvmet-rdma: handle inline data with a nonzero offset (CVE-2026-72129)

    Bug Fix(es) and Enhancement(s):

    * rtla-timerlat-top doesn't stop properly when threshold is reached on multiple CPUs at once [rhel-10.2.z]     (JIRA:Rocky Linux-193027)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:65334 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CVE-2026-43133)

    * kernel: Bluetooth: SMP: force responder MITM requirements before building the pairing response     (CVE-2026-43334)

    * kernel: Bluetooth: virtio_bt: clamp rx length before skb_put (CVE-2026-46123)

    * kernel: Bluetooth: serialize accept_q access (CVE-2026-52918)

    * kernel: net: pull headers in qdisc_pkt_len_segs_init() (CVE-2026-53091)

    * kernel: Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CVE-2026-53072)

    * kernel: net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (CVE-2026-52947)

    * kernel: Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CVE-2026-53256)

    * kernel: wifi: nl80211: reject oversized EMA RNR lists (CVE-2026-53182)

    * kernel: Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CVE-2026-53209)

    * kernel: Bluetooth: RFCOMM: validate skb length in MCC handlers (CVE-2026-53254)

    * kernel: vfio/pci: Clean up DMABUFs before disabling function (CVE-2026-53322)

    * kernel: Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CVE-2026-63975)

    * kernel: security/keys: fix missed RCU read section on lookup (CVE-2026-64015)

    * kernel: Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CVE-2026-63947)

    * kernel: Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CVE-2026-63944)

    * kernel: Bluetooth: ISO: fix UAF in iso_recv_frame (CVE-2026-63946)

    * kernel: wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (CVE-2026-64117)

    * kernel: wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (CVE-2026-64037)

    * kernel: ixgbevf: fix use-after-free in VEPA multicast source pruning (CVE-2026-64113)

    * kernel: vfio/pci: Check BAR resources before exporting a DMABUF (CVE-2026-64042)

    * kernel: accel/qaic: Add overflow check to remap_pfn_range during mmap (CVE-2026-64051)

    * kernel: wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (CVE-2026-64255)

    * kernel: wifi: mac80211: fix MLE defragmentation (CVE-2026-64515)

    * kernel: wifi: mac80211: defer link RX stats percpu free to RCU (CVE-2026-68409)

    * kernel: wifi: mt76: mt7925: fix crash in reset link replay (CVE-2026-68307)

    * kernel: wifi: mt76: mt7925: drop TXRX_NOTIFY on non-mmio buses (CVE-2026-68193)

    * kernel: dm-verity: fix buffer overflow in FEC calculation (CVE-2026-72098)

    * kernel: nvmet-rdma: handle inline data with a nonzero offset (CVE-2026-72129)

    Bug Fix(es) and Enhancement(s):

    * rtla-timerlat-top doesn't stop properly when threshold is reached on multiple CPUs at once [rhel-10.2.z]     (JIRA:RHEL-193027)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 26.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-8727-1 advisory.

    It was discovered that some Arm processors could complete a broadcast translation lookaside buffer (TLB)     invalidation before memory writes made through the invalidated translation were globally observed. A local     attacker could possibly use this to write to memory after permission to do so had been revoked, bypassing     memory protections or escalating privileges. (CVE-2025-10263)

    Several security issues were discovered in the Linux kernel. An attacker could possibly use these to     compromise the system. This update corrects flaws in the following subsystems:

    - ARM64 architecture;

    - User-space API (UAPI);

    - Kernel build system;

    - ARM32 architecture;

    - RISC-V architecture;

    - S390 architecture;

    - x86 architecture;

    - Block layer subsystem;

    - Cryptographic API;

    - Compute Acceleration Framework;

    - Intel NPU Driver;

    - ACPI drivers;

    - Android drivers;

    - Drivers core;

    - Compressed RAM block device driver;

    - Bluetooth drivers;

    - Character device driver;

    - Hardware random number generator core;

    - CPU frequency scaling framework;

    - Hardware crypto device drivers;

    - Buffer Sharing and Synchronization framework;

    - Intel Stratix 10 firmware drivers;

    - FPGA Framework;

    - GPIO subsystem;

    - GPU drivers;

    - HID subsystem;

    - CoreSight HW tracing drivers;

    - I2C subsystem;

    - IIO subsystem;

    - IIO ADC drivers;

    - InfiniBand drivers;

    - Input Device core drivers;

    - Input Device (Mouse) drivers;

    - IOMMU subsystem;

    - IRQ chip drivers;

    - Multiple devices driver;

    - Media drivers;

    - Multifunction device drivers;

    - Fastrpc Driver;

    - MMC subsystem;

    - Ethernet bonding driver;

    - Network drivers;

    - Mellanox network drivers;

    - MediaTek network drivers;

    - NTB driver;

    - NVME drivers;

    - NVMEM (Non Volatile Memory) drivers;

    - PCI subsystem;

    - Pin controllers subsystem;

    - x86 platform drivers;

    - System reset/shutdown drivers;

    - Power sequencing drivers;

    - PTP clock framework;

    - Voltage and Current Regulator drivers;

    - RPMSG subsystem;

    - SLIMbus drivers;

    - SPI subsystem;

    - Media staging drivers;

    - Realtek RTL8723BS SDIO drivers;

    - VME bus staging drivers;

    - Trusted Execution Environment drivers;

    - TTY drivers;

    - Cadence USB3 driver;

    - ULPI bus;

    - USB core drivers;

    - DesignWare USB3 driver;

    - Faraday FOTG210 USB2 dual-role controller driver;

    - USB Gadget drivers;

    - USB Host Controller drivers;

    - USB ChaosKey driver;

    - Siemens ID Mouse USB driver;

    - IOWarrior USB driver;

    - LD Didactic USB driver;

    - LEGO USB Tower driver;

    - Intel USBIO USB I/O expander driver;

    - USS720 USB parallel port adapter driver;

    - MediaTek USB3 DRD driver;

    - USB Serial drivers;

    - USB Type-C Port Controller Manager driver;

    - USB Type-C Connector System Software Interface driver;

    - USB over IP driver;

    - VFIO drivers;

    - Framebuffer layer;

    - Virtio drivers;

    - BTRFS file system;

    - EROFS file system;

    - exFAT file system;

    - F2FS file system;

    - File systems infrastructure;

    - FUSE (File system in Userspace);

    - GFS2 file system;

    - HFS file system;

    - HFS+ file system;

    - Network file system (NFS) client;

    - Network file system (NFS) server daemon;

    - NILFS2 file system;

    - NTFS3 file system;

    - OCFS2 file system;

    - Proc file system;

    - SMB network file system;

    - UDF file system;

    - XFS file system;

    - Key management;

    - BPF subsystem;

    - Memory management;

    - Software nodes and device properties;

    - Glob pattern matching library;

    - Memory Management;

    - KVM subsystem;

    - Mellanox drivers;

    - Restartable sequences system call mechanism;

    - Socket messages infrastructure;

    - Network traffic control;

    - Bluetooth subsystem;

    - Netfilter;

    - Networking core;

    - Network sockets;

    - TCP network protocol;

    - io_uring subsystem;

    - IPC subsystem;

    - Audit subsystem;

    - Perf events;

    - Kernel fork() syscall;

    - Locking primitives;

    - Kernel module support;

    - Scheduler infrastructure;

    - Signal handling mechanism;

    - Timer subsystem;

    - Tracing infrastructure;

    - Debug objects infrastructure;

    - 6LoWPAN network protocol;

    - IEEE 802 network protocols;

    - 9P file system network protocol;

    - B.A.T.M.A.N. meshing protocol;

    - Ethernet bridge;

    - Devlink API;

    - HSR network protocol;

    - IEEE802154.4 network protocol;

    - IPv4 networking;

    - IPv6 networking;

    - XFRM subsystem;

    - L2TP protocol;

    - MAC80211 subsystem;

    - IEEE 802.15.4 subsystem;

    - Multipath TCP;

    - NetLabel subsystem;

    - Open vSwitch;

    - Phonet protocol;

    - Qualcomm IPC Router (QRTR);

    - RDS protocol;

    - SCTP protocol;

    - SMC sockets;

    - TIPC protocol;

    - TLS protocol;

    - Unix domain sockets;

    - VMware vSockets driver;

    - Wireless networking;

    - eXpress Data Path;

    - AppArmor security module;

    - Linux Security Modules (LSM) Framework;

    - Apple Onboard Audio ALSA driver;

    - ALSA framework;

    - FireWire sound drivers;

    - HD-audio driver;

    - Gravis UltraSound ALSA driver;

    - C-Media CMI8x38 ALSA driver;

    - ESS Solo-1 ALSA driver;

    - ICE1712/ICE1724 (Envy24) ALSA driver;

    - Yamaha YMFPCI ALSA driver;

    - Wolfson Microelectronics audio codecs;

    - SoundWire (SDCA) ASoC drivers;

    - USB sound devices;

    - Virtio sound driver; (CVE-2026-52908, CVE-2026-52909, CVE-2026-52910, CVE-2026-52917, CVE-2026-52929,     CVE-2026-52930, CVE-2026-52935, CVE-2026-52938, CVE-2026-52939, CVE-2026-52940, CVE-2026-52942,     CVE-2026-52947, CVE-2026-52948, CVE-2026-53132, CVE-2026-53133, CVE-2026-53134, CVE-2026-53135,     CVE-2026-53136, CVE-2026-53137, CVE-2026-53138, CVE-2026-53139, CVE-2026-53140, CVE-2026-53141,     CVE-2026-53142, CVE-2026-53143, CVE-2026-53144, CVE-2026-53145, CVE-2026-53152, CVE-2026-53153,     CVE-2026-53154, CVE-2026-53155, CVE-2026-53156, CVE-2026-53157, CVE-2026-53158, CVE-2026-53159,     CVE-2026-53160, CVE-2026-53161, CVE-2026-53162, CVE-2026-53163, CVE-2026-53164, CVE-2026-53165,     CVE-2026-53167, CVE-2026-53168, CVE-2026-53169, CVE-2026-53170, CVE-2026-53171, CVE-2026-53172,     CVE-2026-53173, CVE-2026-53177, CVE-2026-53178, CVE-2026-53179, CVE-2026-53180, CVE-2026-53181,     CVE-2026-53182, CVE-2026-53183, CVE-2026-53184, CVE-2026-53185, CVE-2026-53187, CVE-2026-53188,     CVE-2026-53189, CVE-2026-53190, CVE-2026-53191, CVE-2026-53192, CVE-2026-53193, CVE-2026-53194,     CVE-2026-53195, CVE-2026-53196, CVE-2026-53197, CVE-2026-53198, CVE-2026-53199, CVE-2026-53200,     CVE-2026-53201, CVE-2026-53202, CVE-2026-53203, CVE-2026-53204, CVE-2026-53205, CVE-2026-53206,     CVE-2026-53207, CVE-2026-53208, CVE-2026-53209, CVE-2026-53210, CVE-2026-53211, CVE-2026-53213,     CVE-2026-53214, CVE-2026-53217, CVE-2026-53218, CVE-2026-53219, CVE-2026-53220, CVE-2026-53222,     CVE-2026-53223, CVE-2026-53226, CVE-2026-53227, CVE-2026-53229, CVE-2026-53230, CVE-2026-53231,     CVE-2026-53232, CVE-2026-53233, CVE-2026-53234, CVE-2026-53235, CVE-2026-53236, CVE-2026-53237,     CVE-2026-53238, CVE-2026-53239, CVE-2026-53240, CVE-2026-53241, CVE-2026-53242, CVE-2026-53243,     CVE-2026-53244, CVE-2026-53245, CVE-2026-53248, CVE-2026-53249, CVE-2026-53250, CVE-2026-53251,     CVE-2026-53252, CVE-2026-53253, CVE-2026-53254, CVE-2026-53255, CVE-2026-53256, CVE-2026-53257,     CVE-2026-53258, CVE-2026-53259, CVE-2026-53261, CVE-2026-53262, CVE-2026-53263, CVE-2026-53264,     CVE-2026-53265, CVE-2026-53266, CVE-2026-53267, CVE-2026-53268, CVE-2026-53269, CVE-2026-53270,     CVE-2026-53271, CVE-2026-53272, CVE-2026-53273, CVE-2026-53274, CVE-2026-53275, CVE-2026-53276,     CVE-2026-53325, CVE-2026-53326, CVE-2026-53327, CVE-2026-53328, CVE-2026-53329, CVE-2026-53330,     CVE-2026-53331, CVE-2026-53332, CVE-2026-53333, CVE-2026-53334, CVE-2026-53335, CVE-2026-53336,     CVE-2026-53337, CVE-2026-53338, CVE-2026-53339, CVE-2026-53340, CVE-2026-53341, CVE-2026-53342,     CVE-2026-53343, CVE-2026-53344, CVE-2026-53345, CVE-2026-53346, CVE-2026-53347, CVE-2026-53348,     CVE-2026-53349, CVE-2026-53350, CVE-2026-53351, CVE-2026-53352, CVE-2026-53353, CVE-2026-53354,     CVE-2026-53355, CVE-2026-53356, CVE-2026-53361, CVE-2026-53362, CVE-2026-53363, CVE-2026-53366,     CVE-2026-53381, CVE-2026-53382, CVE-2026-53383, CVE-2026-53384, CVE-2026-53385, CVE-2026-53386,     CVE-2026-53387, CVE-2026-53388, CVE-2026-53389, CVE-2026-53390, CVE-2026-53391, CVE-2026-53392,     CVE-2026-53393, CVE-2026-53394, CVE-2026-53395, CVE-2026-53396, CVE-2026-53397, CVE-2026-53398,     CVE-2026-53399, CVE-2026-53400, CVE-2026-53401, CVE-2026-53402, CVE-2026-53403, CVE-2026-63794,     CVE-2026-63795, CVE-2026-63796, CVE-2026-63797, CVE-2026-63798, CVE-2026-63799, CVE-2026-63800,     CVE-2026-63801, CVE-2026-63802, CVE-2026-63803, CVE-2026-63804, CVE-2026-63805, CVE-2026-63806,     CVE-2026-63807, CVE-2026-63808, CVE-2026-63809, CVE-2026-63810, CVE-2026-63811, CVE-2026-63812,     CVE-2026-63813, CVE-2026-63814, CVE-2026-63815, CVE-2026-63816, CVE-2026-63817, CVE-2026-63818,     CVE-2026-63819, CVE-2026-63820, CVE-2026-63821, CVE-2026-63822, CVE-2026-63823, CVE-2026-63824,     CVE-2026-63825, CVE-2026-63826, CVE-2026-63827, CVE-2026-63828, CVE-2026-63829, CVE-2026-63830,     CVE-2026-63831, CVE-2026-63832, CVE-2026-63833, CVE-2026-63834, CVE-2026-63835, CVE-2026-63836,     CVE-2026-63867, CVE-2026-63868, CVE-2026-63869, CVE-2026-63870, CVE-2026-63871, CVE-2026-63873,     CVE-2026-63874, CVE-2026-64187, CVE-2026-64188, CVE-2026-64189, CVE-2026-64191, CVE-2026-64192,     CVE-2026-64205, CVE-2026-64206, CVE-2026-64207, CVE-2026-64244, CVE-2026-64245, CVE-2026-64246,     CVE-2026-64247, CVE-2026-64249, CVE-2026-64251, CVE-2026-64253, CVE-2026-64254, CVE-2026-64255,     CVE-2026-64256, CVE-2026-64258, CVE-2026-64259, CVE-2026-64260, CVE-2026-64261, CVE-2026-64262,     CVE-2026-64263, CVE-2026-64264, CVE-2026-64265, CVE-2026-64266, CVE-2026-64267, CVE-2026-64268,     CVE-2026-64269, CVE-2026-64270, CVE-2026-64271, CVE-2026-64272, CVE-2026-64273, CVE-2026-64274,     CVE-2026-64275, CVE-2026-64276, CVE-2026-64277, CVE-2026-64278, CVE-2026-64279, CVE-2026-64280,     CVE-2026-64282, CVE-2026-64283, CVE-2026-64284, CVE-2026-64285, CVE-2026-64286, CVE-2026-64287,     CVE-2026-64288, CVE-2026-64289, CVE-2026-64290, CVE-2026-64291, CVE-2026-64292, CVE-2026-64293,     CVE-2026-64294, CVE-2026-64295, CVE-2026-64296, CVE-2026-64297, CVE-2026-64298, CVE-2026-64299,     CVE-2026-64300, CVE-2026-64301, CVE-2026-64302, CVE-2026-64303, CVE-2026-64304, CVE-2026-64305,     CVE-2026-64306, CVE-2026-64307, CVE-2026-64308, CVE-2026-64309, CVE-2026-64310, CVE-2026-64312,     CVE-2026-64313, CVE-2026-64314, CVE-2026-64315, CVE-2026-64316, CVE-2026-64317, CVE-2026-64318,     CVE-2026-64319, CVE-2026-64320, CVE-2026-64321, CVE-2026-64322, CVE-2026-64323, CVE-2026-64324,     CVE-2026-64325, CVE-2026-64326, CVE-2026-64327, CVE-2026-64328, CVE-2026-64329, CVE-2026-64330,     CVE-2026-64331, CVE-2026-64332, CVE-2026-64333, CVE-2026-64334, CVE-2026-64335, CVE-2026-64336,     CVE-2026-64337, CVE-2026-64338, CVE-2026-64339, CVE-2026-64340, CVE-2026-64341, CVE-2026-64342,     CVE-2026-64343, CVE-2026-64344, CVE-2026-64345, CVE-2026-64346, CVE-2026-64347, CVE-2026-64348,     CVE-2026-64350, CVE-2026-64351, CVE-2026-64352, CVE-2026-64353, CVE-2026-64354, CVE-2026-64355,     CVE-2026-64356, CVE-2026-64357, CVE-2026-64358, CVE-2026-64359, CVE-2026-64360, CVE-2026-64361,     CVE-2026-64362, CVE-2026-64363, CVE-2026-64364, CVE-2026-64365, CVE-2026-64366, CVE-2026-64367,     CVE-2026-64368, CVE-2026-64369, CVE-2026-64370, CVE-2026-64371, CVE-2026-64372, CVE-2026-64373,     CVE-2026-64374, CVE-2026-64375, CVE-2026-64376, CVE-2026-64377, CVE-2026-64378, CVE-2026-64379,     CVE-2026-64380, CVE-2026-64381, CVE-2026-64382, CVE-2026-64383, CVE-2026-64384, CVE-2026-64385,     CVE-2026-64386, CVE-2026-64387, CVE-2026-64388, CVE-2026-64389, CVE-2026-64390, CVE-2026-64391,     CVE-2026-64392, CVE-2026-64393, CVE-2026-64394, CVE-2026-64395, CVE-2026-64396, CVE-2026-64397,     CVE-2026-64398, CVE-2026-64399, CVE-2026-64400, CVE-2026-64401, CVE-2026-64402, CVE-2026-64403,     CVE-2026-64404, CVE-2026-64405, CVE-2026-64406, CVE-2026-64407, CVE-2026-64408, CVE-2026-64409,     CVE-2026-64410, CVE-2026-64411, CVE-2026-64412, CVE-2026-64413, CVE-2026-64414, CVE-2026-64415,     CVE-2026-64416, CVE-2026-64417, CVE-2026-64418, CVE-2026-64419, CVE-2026-64420, CVE-2026-64421,     CVE-2026-64422, CVE-2026-64423, CVE-2026-64424, CVE-2026-64425, CVE-2026-64426, CVE-2026-64428,     CVE-2026-64429, CVE-2026-64430, CVE-2026-64432, CVE-2026-64433, CVE-2026-64434, CVE-2026-64435,     CVE-2026-64436, CVE-2026-64438, CVE-2026-64439, CVE-2026-64440, CVE-2026-64441, CVE-2026-64442,     CVE-2026-64443, CVE-2026-64444, CVE-2026-64445, CVE-2026-64446, CVE-2026-64447, CVE-2026-64448,     CVE-2026-64449, CVE-2026-64450, CVE-2026-64451, CVE-2026-64452, CVE-2026-64453, CVE-2026-64454,     CVE-2026-64455, CVE-2026-64456, CVE-2026-64457, CVE-2026-64458, CVE-2026-64459, CVE-2026-64460,     CVE-2026-64461, CVE-2026-64462, CVE-2026-64463, CVE-2026-64464, CVE-2026-64465, CVE-2026-64466,     CVE-2026-64467, CVE-2026-64468, CVE-2026-64469, CVE-2026-64470, CVE-2026-64471, CVE-2026-64472,     CVE-2026-64473, CVE-2026-64474, CVE-2026-64475, CVE-2026-64476, CVE-2026-64477, CVE-2026-64478,     CVE-2026-64479, CVE-2026-64480, CVE-2026-64481, CVE-2026-64482, CVE-2026-64483, CVE-2026-64484,     CVE-2026-64485, CVE-2026-64486, CVE-2026-64487, CVE-2026-64488, CVE-2026-64489, CVE-2026-64490,     CVE-2026-64491, CVE-2026-64492, CVE-2026-64493, CVE-2026-64494, CVE-2026-64495, CVE-2026-64496,     CVE-2026-64497, CVE-2026-64499, CVE-2026-64500, CVE-2026-64501, CVE-2026-64502, CVE-2026-64503,     CVE-2026-64504, CVE-2026-64505, CVE-2026-64507, CVE-2026-64508, CVE-2026-64509, CVE-2026-64510,     CVE-2026-64511, CVE-2026-64512, CVE-2026-64513, CVE-2026-64514, CVE-2026-64529, CVE-2026-64536,     CVE-2026-64556, CVE-2026-64588, CVE-2026-64589, CVE-2026-64590, CVE-2026-64591, CVE-2026-64592,     CVE-2026-64593, CVE-2026-64594, CVE-2026-64596, CVE-2026-64597, CVE-2026-64598, CVE-2026-64599,     CVE-2026-64600, CVE-2026-64601, CVE-2026-64602, CVE-2026-64603, CVE-2026-64604, CVE-2026-68084,     CVE-2026-68085, CVE-2026-68087, CVE-2026-68088, CVE-2026-68089, CVE-2026-68090, CVE-2026-68091,     CVE-2026-68092, CVE-2026-68372, CVE-2026-68459, CVE-2026-68460, CVE-2026-68461, CVE-2026-74584,     CVE-2026-80591)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 24.04 LTS / 26.04 LTS / Pro Realtime 24.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-8726-1 advisory.

    It was discovered that some Arm processors could complete a broadcast translation lookaside buffer (TLB)     invalidation before memory writes made through the invalidated translation were globally observed. A local     attacker could possibly use this to write to memory after permission to do so had been revoked, bypassing     memory protections or escalating privileges. (CVE-2025-10263)

    Several security issues were discovered in the Linux kernel. An attacker could possibly use these to     compromise the system. This update corrects flaws in the following subsystems:

    - ARM64 architecture;

    - User-space API (UAPI);

    - Kernel build system;

    - ARM32 architecture;

    - RISC-V architecture;

    - S390 architecture;

    - x86 architecture;

    - Block layer subsystem;

    - Cryptographic API;

    - Compute Acceleration Framework;

    - Intel NPU Driver;

    - ACPI drivers;

    - Android drivers;

    - Drivers core;

    - Compressed RAM block device driver;

    - Bluetooth drivers;

    - Character device driver;

    - Hardware random number generator core;

    - CPU frequency scaling framework;

    - Hardware crypto device drivers;

    - Buffer Sharing and Synchronization framework;

    - Intel Stratix 10 firmware drivers;

    - FPGA Framework;

    - GPIO subsystem;

    - GPU drivers;

    - HID subsystem;

    - CoreSight HW tracing drivers;

    - I2C subsystem;

    - IIO subsystem;

    - IIO ADC drivers;

    - InfiniBand drivers;

    - Input Device core drivers;

    - Input Device (Mouse) drivers;

    - IOMMU subsystem;

    - IRQ chip drivers;

    - Multiple devices driver;

    - Media drivers;

    - Multifunction device drivers;

    - Fastrpc Driver;

    - MMC subsystem;

    - Ethernet bonding driver;

    - Network drivers;

    - Mellanox network drivers;

    - MediaTek network drivers;

    - NTB driver;

    - NVME drivers;

    - NVMEM (Non Volatile Memory) drivers;

    - PCI subsystem;

    - Pin controllers subsystem;

    - x86 platform drivers;

    - System reset/shutdown drivers;

    - Power sequencing drivers;

    - PTP clock framework;

    - Voltage and Current Regulator drivers;

    - RPMSG subsystem;

    - SLIMbus drivers;

    - SPI subsystem;

    - Media staging drivers;

    - Realtek RTL8723BS SDIO drivers;

    - VME bus staging drivers;

    - Trusted Execution Environment drivers;

    - Thunderbolt and USB4 drivers;

    - TTY drivers;

    - Cadence USB3 driver;

    - ULPI bus;

    - DesignWare USB3 driver;

    - Faraday FOTG210 USB2 dual-role controller driver;

    - USB Gadget drivers;

    - USB Host Controller drivers;

    - USB ChaosKey driver;

    - Siemens ID Mouse USB driver;

    - IOWarrior USB driver;

    - LD Didactic USB driver;

    - LEGO USB Tower driver;

    - Intel USBIO USB I/O expander driver;

    - USS720 USB parallel port adapter driver;

    - MediaTek USB3 DRD driver;

    - USB Serial drivers;

    - USB Type-C Port Controller Manager driver;

    - USB Type-C Connector System Software Interface driver;

    - USB over IP driver;

    - VFIO drivers;

    - Framebuffer layer;

    - Virtio drivers;

    - BTRFS file system;

    - EROFS file system;

    - exFAT file system;

    - F2FS file system;

    - File systems infrastructure;

    - FUSE (File system in Userspace);

    - GFS2 file system;

    - HFS file system;

    - HFS+ file system;

    - Network file system (NFS) client;

    - Network file system (NFS) server daemon;

    - NILFS2 file system;

    - NTFS3 file system;

    - OCFS2 file system;

    - Proc file system;

    - SMB network file system;

    - UDF file system;

    - XFS file system;

    - Key management;

    - BPF subsystem;

    - Memory management;

    - Software nodes and device properties;

    - Glob pattern matching library;

    - Memory Management;

    - KVM subsystem;

    - Mellanox drivers;

    - Restartable sequences system call mechanism;

    - Socket messages infrastructure;

    - Network traffic control;

    - Bluetooth subsystem;

    - Netfilter;

    - Networking core;

    - Network sockets;

    - TCP network protocol;

    - io_uring subsystem;

    - IPC subsystem;

    - Audit subsystem;

    - Perf events;

    - Kernel fork() syscall;

    - Locking primitives;

    - Kernel module support;

    - Scheduler infrastructure;

    - Signal handling mechanism;

    - Timer subsystem;

    - Tracing infrastructure;

    - Debug objects infrastructure;

    - 6LoWPAN network protocol;

    - IEEE 802 network protocols;

    - 9P file system network protocol;

    - B.A.T.M.A.N. meshing protocol;

    - Ethernet bridge;

    - Devlink API;

    - HSR network protocol;

    - IEEE802154.4 network protocol;

    - IPv4 networking;

    - IPv6 networking;

    - XFRM subsystem;

    - L2TP protocol;

    - MAC80211 subsystem;

    - IEEE 802.15.4 subsystem;

    - Multipath TCP;

    - NetLabel subsystem;

    - Open vSwitch;

    - Phonet protocol;

    - Qualcomm IPC Router (QRTR);

    - RDS protocol;

    - SCTP protocol;

    - SMC sockets;

    - TIPC protocol;

    - TLS protocol;

    - Unix domain sockets;

    - VMware vSockets driver;

    - Wireless networking;

    - eXpress Data Path;

    - AppArmor security module;

    - Linux Security Modules (LSM) Framework;

    - Apple Onboard Audio ALSA driver;

    - ALSA framework;

    - FireWire sound drivers;

    - HD-audio driver;

    - Gravis UltraSound ALSA driver;

    - C-Media CMI8x38 ALSA driver;

    - ESS Solo-1 ALSA driver;

    - ICE1712/ICE1724 (Envy24) ALSA driver;

    - Yamaha YMFPCI ALSA driver;

    - Wolfson Microelectronics audio codecs;

    - SoundWire (SDCA) ASoC drivers;

    - USB sound devices;

    - Virtio sound driver; (CVE-2026-52908, CVE-2026-52909, CVE-2026-52910, CVE-2026-52917, CVE-2026-52929,     CVE-2026-52930, CVE-2026-52935, CVE-2026-52938, CVE-2026-52939, CVE-2026-52940, CVE-2026-52942,     CVE-2026-52947, CVE-2026-52948, CVE-2026-53132, CVE-2026-53133, CVE-2026-53134, CVE-2026-53135,     CVE-2026-53136, CVE-2026-53137, CVE-2026-53138, CVE-2026-53139, CVE-2026-53140, CVE-2026-53141,     CVE-2026-53142, CVE-2026-53143, CVE-2026-53144, CVE-2026-53145, CVE-2026-53146, CVE-2026-53147,     CVE-2026-53148, CVE-2026-53149, CVE-2026-53150, CVE-2026-53152, CVE-2026-53153, CVE-2026-53154,     CVE-2026-53155, CVE-2026-53156, CVE-2026-53157, CVE-2026-53158, CVE-2026-53159, CVE-2026-53160,     CVE-2026-53161, CVE-2026-53162, CVE-2026-53163, CVE-2026-53164, CVE-2026-53165, CVE-2026-53167,     CVE-2026-53168, CVE-2026-53169, CVE-2026-53170, CVE-2026-53171, CVE-2026-53172, CVE-2026-53173,     CVE-2026-53177, CVE-2026-53178, CVE-2026-53179, CVE-2026-53180, CVE-2026-53181, CVE-2026-53182,     CVE-2026-53183, CVE-2026-53184, CVE-2026-53185, CVE-2026-53187, CVE-2026-53188, CVE-2026-53189,     CVE-2026-53190, CVE-2026-53191, CVE-2026-53192, CVE-2026-53193, CVE-2026-53194, CVE-2026-53195,     CVE-2026-53196, CVE-2026-53197, CVE-2026-53198, CVE-2026-53199, CVE-2026-53200, CVE-2026-53201,     CVE-2026-53202, CVE-2026-53203, CVE-2026-53204, CVE-2026-53205, CVE-2026-53206, CVE-2026-53207,     CVE-2026-53208, CVE-2026-53209, CVE-2026-53210, CVE-2026-53211, CVE-2026-53213, CVE-2026-53214,     CVE-2026-53217, CVE-2026-53218, CVE-2026-53219, CVE-2026-53220, CVE-2026-53222, CVE-2026-53223,     CVE-2026-53226, CVE-2026-53227, CVE-2026-53229, CVE-2026-53230, CVE-2026-53231, CVE-2026-53232,     CVE-2026-53233, CVE-2026-53234, CVE-2026-53235, CVE-2026-53236, CVE-2026-53237, CVE-2026-53238,     CVE-2026-53239, CVE-2026-53240, CVE-2026-53241, CVE-2026-53242, CVE-2026-53243, CVE-2026-53244,     CVE-2026-53245, CVE-2026-53248, CVE-2026-53249, CVE-2026-53250, CVE-2026-53251, CVE-2026-53252,     CVE-2026-53253, CVE-2026-53254, CVE-2026-53255, CVE-2026-53256, CVE-2026-53257, CVE-2026-53258,     CVE-2026-53259, CVE-2026-53261, CVE-2026-53262, CVE-2026-53263, CVE-2026-53264, CVE-2026-53265,     CVE-2026-53266, CVE-2026-53267, CVE-2026-53268, CVE-2026-53269, CVE-2026-53270, CVE-2026-53271,     CVE-2026-53272, CVE-2026-53273, CVE-2026-53274, CVE-2026-53275, CVE-2026-53276, CVE-2026-53325,     CVE-2026-53326, CVE-2026-53327, CVE-2026-53328, CVE-2026-53329, CVE-2026-53330, CVE-2026-53331,     CVE-2026-53332, CVE-2026-53333, CVE-2026-53334, CVE-2026-53335, CVE-2026-53336, CVE-2026-53337,     CVE-2026-53338, CVE-2026-53339, CVE-2026-53340, CVE-2026-53341, CVE-2026-53342, CVE-2026-53343,     CVE-2026-53344, CVE-2026-53345, CVE-2026-53346, CVE-2026-53347, CVE-2026-53348, CVE-2026-53349,     CVE-2026-53350, CVE-2026-53351, CVE-2026-53352, CVE-2026-53353, CVE-2026-53354, CVE-2026-53355,     CVE-2026-53356, CVE-2026-53361, CVE-2026-53362, CVE-2026-53363, CVE-2026-53366, CVE-2026-53381,     CVE-2026-53382, CVE-2026-53383, CVE-2026-53384, CVE-2026-53385, CVE-2026-53386, CVE-2026-53387,     CVE-2026-53388, CVE-2026-53389, CVE-2026-53390, CVE-2026-53391, CVE-2026-53392, CVE-2026-53393,     CVE-2026-53394, CVE-2026-53395, CVE-2026-53396, CVE-2026-53397, CVE-2026-53398, CVE-2026-53399,     CVE-2026-53400, CVE-2026-53401, CVE-2026-53402, CVE-2026-53403, CVE-2026-63794, CVE-2026-63795,     CVE-2026-63796, CVE-2026-63797, CVE-2026-63798, CVE-2026-63799, CVE-2026-63800, CVE-2026-63801,     CVE-2026-63802, CVE-2026-63803, CVE-2026-63804, CVE-2026-63805, CVE-2026-63806, CVE-2026-63807,     CVE-2026-63808, CVE-2026-63809, CVE-2026-63810, CVE-2026-63811, CVE-2026-63812, CVE-2026-63813,     CVE-2026-63814, CVE-2026-63815, CVE-2026-63816, CVE-2026-63817, CVE-2026-63818, CVE-2026-63819,     CVE-2026-63820, CVE-2026-63821, CVE-2026-63822, CVE-2026-63823, CVE-2026-63824, CVE-2026-63825,     CVE-2026-63826, CVE-2026-63827, CVE-2026-63828, CVE-2026-63829, CVE-2026-63830, CVE-2026-63831,     CVE-2026-63832, CVE-2026-63833, CVE-2026-63834, CVE-2026-63835, CVE-2026-63836, CVE-2026-63867,     CVE-2026-63868, CVE-2026-63869, CVE-2026-63870, CVE-2026-63871, CVE-2026-63873, CVE-2026-63874,     CVE-2026-64187, CVE-2026-64188, CVE-2026-64189, CVE-2026-64191, CVE-2026-64192, CVE-2026-64205,     CVE-2026-64206, CVE-2026-64207, CVE-2026-64244, CVE-2026-64245, CVE-2026-64246, CVE-2026-64247,     CVE-2026-64249, CVE-2026-64251, CVE-2026-64253, CVE-2026-64254, CVE-2026-64255, CVE-2026-64256,     CVE-2026-64258, CVE-2026-64259, CVE-2026-64260, CVE-2026-64261, CVE-2026-64262, CVE-2026-64263,     CVE-2026-64264, CVE-2026-64265, CVE-2026-64266, CVE-2026-64267, CVE-2026-64268, CVE-2026-64269,     CVE-2026-64270, CVE-2026-64271, CVE-2026-64272, CVE-2026-64273, CVE-2026-64274, CVE-2026-64275,     CVE-2026-64276, CVE-2026-64277, CVE-2026-64278, CVE-2026-64279, CVE-2026-64280, CVE-2026-64282,     CVE-2026-64283, CVE-2026-64284, CVE-2026-64285, CVE-2026-64286, CVE-2026-64287, CVE-2026-64288,     CVE-2026-64289, CVE-2026-64290, CVE-2026-64291, CVE-2026-64292, CVE-2026-64293, CVE-2026-64294,     CVE-2026-64295, CVE-2026-64296, CVE-2026-64297, CVE-2026-64298, CVE-2026-64299, CVE-2026-64300,     CVE-2026-64301, CVE-2026-64302, CVE-2026-64303, CVE-2026-64304, CVE-2026-64305, CVE-2026-64306,     CVE-2026-64307, CVE-2026-64308, CVE-2026-64309, CVE-2026-64310, CVE-2026-64312, CVE-2026-64313,     CVE-2026-64314, CVE-2026-64315, CVE-2026-64316, CVE-2026-64317, CVE-2026-64318, CVE-2026-64319,     CVE-2026-64320, CVE-2026-64321, CVE-2026-64322, CVE-2026-64323, CVE-2026-64324, CVE-2026-64325,     CVE-2026-64326, CVE-2026-64327, CVE-2026-64328, CVE-2026-64329, CVE-2026-64330, CVE-2026-64331,     CVE-2026-64332, CVE-2026-64333, CVE-2026-64334, CVE-2026-64335, CVE-2026-64336, CVE-2026-64337,     CVE-2026-64338, CVE-2026-64339, CVE-2026-64340, CVE-2026-64341, CVE-2026-64342, CVE-2026-64343,     CVE-2026-64344, CVE-2026-64345, CVE-2026-64346, CVE-2026-64347, CVE-2026-64348, CVE-2026-64350,     CVE-2026-64351, CVE-2026-64352, CVE-2026-64353, CVE-2026-64354, CVE-2026-64355, CVE-2026-64356,     CVE-2026-64357, CVE-2026-64358, CVE-2026-64359, CVE-2026-64360, CVE-2026-64361, CVE-2026-64362,     CVE-2026-64363, CVE-2026-64364, CVE-2026-64365, CVE-2026-64366, CVE-2026-64367, CVE-2026-64368,     CVE-2026-64369, CVE-2026-64370, CVE-2026-64371, CVE-2026-64372, CVE-2026-64373, CVE-2026-64374,     CVE-2026-64375, CVE-2026-64376, CVE-2026-64377, CVE-2026-64378, CVE-2026-64379, CVE-2026-64380,     CVE-2026-64381, CVE-2026-64382, CVE-2026-64383, CVE-2026-64384, CVE-2026-64385, CVE-2026-64386,     CVE-2026-64387, CVE-2026-64388, CVE-2026-64389, CVE-2026-64390, CVE-2026-64391, CVE-2026-64392,     CVE-2026-64393, CVE-2026-64394, CVE-2026-64395, CVE-2026-64396, CVE-2026-64397, CVE-2026-64398,     CVE-2026-64399, CVE-2026-64400, CVE-2026-64401, CVE-2026-64402, CVE-2026-64403, CVE-2026-64404,     CVE-2026-64405, CVE-2026-64406, CVE-2026-64407, CVE-2026-64408, CVE-2026-64409, CVE-2026-64410,     CVE-2026-64411, CVE-2026-64412, CVE-2026-64413, CVE-2026-64414, CVE-2026-64415, CVE-2026-64416,     CVE-2026-64417, CVE-2026-64418, CVE-2026-64419, CVE-2026-64420, CVE-2026-64421, CVE-2026-64422,     CVE-2026-64423, CVE-2026-64424, CVE-2026-64425, CVE-2026-64426, CVE-2026-64428, CVE-2026-64429,     CVE-2026-64430, CVE-2026-64432, CVE-2026-64433, CVE-2026-64434, CVE-2026-64435, CVE-2026-64436,     CVE-2026-64438, CVE-2026-64439, CVE-2026-64440, CVE-2026-64441, CVE-2026-64442, CVE-2026-64443,     CVE-2026-64444, CVE-2026-64445, CVE-2026-64446, CVE-2026-64447, CVE-2026-64448, CVE-2026-64449,     CVE-2026-64450, CVE-2026-64451, CVE-2026-64452, CVE-2026-64453, CVE-2026-64454, CVE-2026-64455,     CVE-2026-64456, CVE-2026-64457, CVE-2026-64458, CVE-2026-64459, CVE-2026-64460, CVE-2026-64461,     CVE-2026-64462, CVE-2026-64463, CVE-2026-64464, CVE-2026-64465, CVE-2026-64466, CVE-2026-64467,     CVE-2026-64468, CVE-2026-64469, CVE-2026-64470, CVE-2026-64471, CVE-2026-64472, CVE-2026-64473,     CVE-2026-64474, CVE-2026-64475, CVE-2026-64476, CVE-2026-64477, CVE-2026-64478, CVE-2026-64479,     CVE-2026-64480, CVE-2026-64481, CVE-2026-64482, CVE-2026-64483, CVE-2026-64484, CVE-2026-64485,     CVE-2026-64486, CVE-2026-64487, CVE-2026-64488, CVE-2026-64489, CVE-2026-64490, CVE-2026-64491,     CVE-2026-64492, CVE-2026-64493, CVE-2026-64494, CVE-2026-64495, CVE-2026-64496, CVE-2026-64497,     CVE-2026-64499, CVE-2026-64500, CVE-2026-64501, CVE-2026-64502, CVE-2026-64503, CVE-2026-64504,     CVE-2026-64505, CVE-2026-64507, CVE-2026-64508, CVE-2026-64509, CVE-2026-64510, CVE-2026-64511,     CVE-2026-64512, CVE-2026-64513, CVE-2026-64514, CVE-2026-64529, CVE-2026-64536, CVE-2026-64556,     CVE-2026-64588, CVE-2026-64589, CVE-2026-64590, CVE-2026-64591, CVE-2026-64592, CVE-2026-64593,     CVE-2026-64594, CVE-2026-64596, CVE-2026-64597, CVE-2026-64598, CVE-2026-64599, CVE-2026-64600,     CVE-2026-64601, CVE-2026-64602, CVE-2026-64603, CVE-2026-64604, CVE-2026-68084, CVE-2026-68085,     CVE-2026-68087, CVE-2026-68088, CVE-2026-68089, CVE-2026-68090, CVE-2026-68091, CVE-2026-68092,     CVE-2026-68459, CVE-2026-68460, CVE-2026-68461, CVE-2026-74584, CVE-2026-80591)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers Three BA session handlers use     ffs(ba_data->sta_mask) - 1 to derive a station ID without checking that sta_mask is non-zero. When     sta_mask is zero, ffs() returns 0 and the subtraction wraps to 0xFFFFFFFF, causing an out-of-bounds access     on fw_id_to_link_sta[]. Add WARN_ON_ONCE(!ba_data->sta_mask) guards before each ffs() call, consistent     with the existing check in iwl_mld_ampdu_rx_start(). (CVE-2026-64255)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
349106	Ubuntu 26.04 LTS : Linux kernel (NVIDIA BaseOS) vulnerabilities (USN-8800-1)	Nessus	Ubuntu Local Security Checks	Local	high
348808	CentOS 9 : kernel-5.14.0-749.el9	Nessus	CentOS Local Security Checks	Local	high
346870	AlmaLinux 9 : kernel (ALSA-2026:67150)	Nessus	Alma Linux Local Security Checks	Local	high
346233	Ubuntu 24.04 LTS / Pro Realtime 24.04 LTS : Linux kernel (NVIDIA) vulnerabilities (USN-8760-1)	Nessus	Ubuntu Local Security Checks	Local	high
346033	RockyLinux 9 : kernel (RLSA-2026:67150)	Nessus	Rocky Linux Local Security Checks	Local	high
345898	Oracle Linux 10 : ELSA-2026-65334-0: / kernel (ELSA-2026-653340)	Nessus	Oracle Linux Local Security Checks	Local	critical
345896	Oracle Linux 9 : ELSA-2026-67150-0: / kernel (ELSA-2026-671500)	Nessus	Oracle Linux Local Security Checks	Local	high
345600	RHEL 9 : kernel (RHSA-2026:67150)	Nessus	Red Hat Local Security Checks	Local	high
344851	AlmaLinux 10 : kernel (ALSA-2026:65334)	Nessus	Alma Linux Local Security Checks	Local	critical
344461	RockyLinux 10 : kernel (RLSA-2026:65334)	Nessus	Rocky Linux Local Security Checks	Local	critical
343886	RHEL 10 : kernel (RHSA-2026:65334)	Nessus	Red Hat Local Security Checks	Local	critical
343532	Ubuntu 24.04 LTS / Pro Realtime 24.04 LTS : Linux kernel (GCP) vulnerabilities (USN-8728-1)	Nessus	Ubuntu Local Security Checks	Local	high
343531	Ubuntu 26.04 LTS : Linux kernel (OEM) vulnerabilities (USN-8727-1)	Nessus	Ubuntu Local Security Checks	Local	high
343527	Ubuntu 24.04 LTS / 26.04 LTS / Pro Realtime 24.04 LTS : Linux kernel vulnerabilities (USN-8726-1)	Nessus	Ubuntu Local Security Checks	Local	high
329628	Linux Distros Unpatched Vulnerability : CVE-2026-64255	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2026-64255

high

Tenable Plugins

high

high

high

high

high

critical

high

high

critical

critical

critical

high

high

high

high