In the Linux kernel, the following vulnerability has been resolved: sctp: don't free the ASCONF's own transport in DEL-IP processing sctp_process_asconf() caches the transport the ASCONF chunk is processed against in asconf->transport (== chunk->transport, set once in sctp_rcv()). For an ASCONF located through its Address Parameter by __sctp_rcv_asconf_lookup(), that cached transport corresponds to the Address Parameter, which need not be the packet's source address. sctp_process_asconf_param() rejects a DEL-IP for the packet source address (ADDIP D8, SCTP_ERROR_DEL_SRC_IP), but nothing protects asconf->transport. A single ASCONF can therefore carry, in order: [Address Parameter L] [DEL-IP L] [DEL-IP 0.0.0.0] where L differs from the source. The DEL-IP for L passes the D8 check and calls sctp_assoc_rm_peer() on the transport that asconf->transport still points at, freeing it (RCU-deferred). The following wildcard DEL-IP then reuses the now-dangling asconf->transport in sctp_assoc_set_primary() and sctp_assoc_del_nonprimary_peers(): set_primary() dereferences the freed transport (->ipaddr, ->state) and plants the dangling pointer into asoc->peer.primary_path / active_path, and del_nonprimary_peers(), keeping only the pointer that is no longer on the list, removes every real transport, leaving the association with a transport_count of 0 and primary_path/active_path pointing at freed memory. Reject a DEL-IP that targets the transport the ASCONF is being processed against, mirroring the existing source-address guard, so the wildcard branch can never reuse a freed transport.

The remote CentOS Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the kernel-5.14.0-741.el9 build changelog.

  - In the Linux kernel, the following vulnerability has been resolved: sctp: don't free the ASCONF's own     transport in DEL-IP processing sctp_process_asconf() caches the transport the ASCONF chunk is processed     against in asconf->transport (== chunk->transport, set once in sctp_rcv()). For an ASCONF located through     its Address Parameter by __sctp_rcv_asconf_lookup(), that cached transport corresponds to the Address     Parameter, which need not be the packet's source address. sctp_process_asconf_param() rejects a DEL-IP for     the packet source address (ADDIP D8, SCTP_ERROR_DEL_SRC_IP), but nothing protects asconf->transport. A     single ASCONF can therefore carry, in order: [Address Parameter L] [DEL-IP L] [DEL-IP 0.0.0.0] where L     differs from the source. The DEL-IP for L passes the D8 check and calls sctp_assoc_rm_peer() on the     transport that asconf->transport still points at, freeing it (RCU-deferred). The following wildcard DEL-IP     then reuses the now-dangling asconf->transport in sctp_assoc_set_primary() and     sctp_assoc_del_nonprimary_peers(): set_primary() dereferences the freed transport (->ipaddr, ->state) and     plants the dangling pointer into asoc->peer.primary_path / active_path, and del_nonprimary_peers(),     keeping only the pointer that is no longer on the list, removes every real transport, leaving the     association with a transport_count of 0 and primary_path/active_path pointing at freed memory. Reject a     DEL-IP that targets the transport the ASCONF is being processed against, mirroring the existing source-     address guard, so the wildcard branch can never reuse a freed transport. (CVE-2026-64564)

  - In the Linux kernel, the following vulnerability has been resolved: sctp: purge outqueue on stale COOKIE-     ECHO handling sctp_stream_update() is only invoked when the association is moved into COOKIE_WAIT during     association setup/reconfiguration. In this path, the outbound stream scheduler state (stream->out_curr) is     expected to be clean, since no user data should have been transmitted yet unless the state machine has     already partially progressed. However, a corner case exists in sctp_sf_do_5_2_6_stale(): when a Stale     Cookie ERROR is received, the association is rolled back from COOKIE_ECHOED to COOKIE_WAIT. In this     scenario, user data may already have been queued and even bundled with the COOKIE-ECHO chunk. During the     rollback, sctp_stream_update() frees the old stream table and installs a new one, but it does not     invalidate stream->out_curr. As a result, out_curr may still point to a freed sctp_stream_out entry from     the previous stream state. Later, SCTP scheduler dequeue paths (FCFS, RR, PRIO, etc.) rely on     stream->out_curr->ext, which can lead to use-after-free once the old stream state has been released via     sctp_stream_free(). This results in crashes such as (reported by Yuqi): BUG: KASAN: slab-use-after-free in     sctp_sched_fcfs_dequeue+0x13a/0x140 Read of size 8 at addr ff1100004d4d3208 by task mini_poc/9312 CPU: 1     UID: 1001 PID: 9312 Comm: mini_poc Not tainted 7.1.0-rc1-00305-gbd3a4795d574 #5 PREEMPT(full)     sctp_sched_fcfs_dequeue+0x13a/0x140 sctp_outq_flush+0x1603/0x33e0 sctp_do_sm+0x31c9/0x5d30     sctp_assoc_bh_rcv+0x392/0x6f0 sctp_inq_push+0x1db/0x270 sctp_rcv+0x138d/0x3c10 Fix this by fully purging     the association outqueue when handling the Stale Cookie case. This ensures all pending transmit and     retransmit state is dropped, and any scheduler cached pointers are invalidated, making it safe to rebuild     stream state during COOKIE_WAIT restart. Updating only stream->out_curr would be insufficient, since     queued and retransmittable data would still reference the old stream state and trigger later use-after-     free in dequeue paths. (CVE-2026-52924)

  - In the Linux kernel, the following vulnerability has been resolved: dm cache policy smq: fix missing locks     in invalidating cache blocks In passthrough mode, the policy invalidate_mapping operation is called     simultaneously from multiple workers, thus it should be protected by a lock. Otherwise, we might end up     with data races on the allocated blocks counter, or even use-after-free issues with internal data     structures when doing concurrent writes. Note that the existing FIXME in smq_invalidate_mapping() doesn't     affect passthrough mode since migration tasks don't exist there, but would need attention if supporting     fast device shrinking via suspend/resume without target reloading. Reproduce steps: 1. Create a cache     device consisting of 1024 cache entries dmsetup create cmeta --table 0 8192 linear /dev/sdc 0 dmsetup     create cdata --table 0 131072 linear /dev/sdc 8192 dmsetup create corig --table 0 262144 linear     /dev/sdc 262144 dd if=/dev/zero of=/dev/mapper/cmeta bs=4k count=1 oflag=direct dmsetup create cache
    --table 0 262144 cache /dev/mapper/cmeta \ /dev/mapper/cdata /dev/mapper/corig 128 2 metadata2     writethrough smq 0 2. Populate the cache, and record the number of cached blocks fio --name=populate
    --filename=/dev/mapper/cache --rw=randwrite --bs=4k \ --size=64m --direct=1 nr_cached=$(dmsetup status     cache | awk '{split($7, a, /); print a[1]}') 3. Reload the cache into passthrough mode dmsetup suspend     cache dmsetup reload cache --table 0 262144 cache /dev/mapper/cmeta \ /dev/mapper/cdata /dev/mapper/corig     128 2 metadata2 passthrough smq 0 dmsetup resume cache 4. Write to the passthrough cache. By setting     multiple jobs with I/O size equal to the cache block size, cache blocks are invalidated concurrently from     different workers. fio --filename=/dev/mapper/cache --name=test --rw=randwrite --bs=64k \ --direct=1
    --numjobs=2 --randrepeat=0 --size=64m 5. Check if demoted matches cached block count. These numbers should     match but may differ due to the data race. nr_demoted=$(dmsetup status cache | awk '{print $12}') echo     $nr_cached, $nr_demoted (CVE-2026-53062)

  - In the Linux kernel, the following vulnerability has been resolved: sctp: validate cached peer INIT chunk     length in COOKIE_ECHO processing When a listening SCTP server processes a COOKIE_ECHO chunk, the cached     peer INIT chunk embedded after the cookie is parsed and its parameters are later walked by     sctp_process_init() using sctp_walk_params(). However, the chunk header length of this cached INIT chunk     was not validated against the remaining buffer in the COOKIE_ECHO payload. If the length field is     inflated, the parameter walk can run beyond the actual received data, leading to out-of-bounds reads and     potential memory corruption during later parameter handling (e.g. STATE_COOKIE processing and kmemdup()     copies). Add a bounds check in sctp_unpack_cookie() to ensure the cached INIT chunk length does not exceed     the available data in the COOKIE_ECHO buffer before it is used. (CVE-2026-53246)

  - In the Linux kernel, the following vulnerability has been resolved: netfilter: bridge: make ebt_snat ARP     rewrite writable The ebtables SNAT target keeps the Ethernet source address rewrite behind     skb_ensure_writable(skb, 0). This is intentional: at the bridge ebtables hooks the Ethernet header is     addressed through skb_mac_header()/eth_hdr(), while skb->data points at the Ethernet payload. Asking     skb_ensure_writable() for ETH_HLEN bytes would check the payload, not the Ethernet header, and would     reintroduce the small packet regression fixed by commit 63137bc5882a. However, the optional ARP sender     hardware address rewrite is different. It writes through skb_store_bits() at an offset relative to     skb->data: skb_store_bits(skb, sizeof(struct arphdr), info->mac, ETH_ALEN) skb_header_pointer() only     safely reads the ARP header; it does not make the later sender hardware address range writable. If that     range is still held in a nonlinear skb fragment backed by a splice-imported file page, skb_store_bits()     maps the frag page and copies the new MAC address directly into it. Ensure the ARP SHA range is writable     before reading the ARP header and before calling skb_store_bits(). (CVE-2026-53266)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4745 advisory.

    -------------------------------------------------------------------------     Debian LTS Advisory DLA-4745-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                        Ben Hutchings     August 18, 2026                               https://wiki.debian.org/LTS
    -------------------------------------------------------------------------

    Package        : linux-6.12     Version        : 6.12.101-1~deb12u1     CVE ID         : CVE-2025-40098 CVE-2026-45897 CVE-2026-45901 CVE-2026-53078                      CVE-2026-53090 CVE-2026-64205 CVE-2026-64280 CVE-2026-64290                      CVE-2026-64561 CVE-2026-64562 CVE-2026-64563 CVE-2026-64564                      CVE-2026-64565 CVE-2026-64567 CVE-2026-64568 CVE-2026-64569                      CVE-2026-64570 CVE-2026-64571 CVE-2026-64572 CVE-2026-64573                      CVE-2026-64574 CVE-2026-64576 CVE-2026-64577 CVE-2026-64578                      CVE-2026-64579 CVE-2026-64580 CVE-2026-64583 CVE-2026-64584                      CVE-2026-68093 CVE-2026-68096 CVE-2026-68097 CVE-2026-68098                      CVE-2026-68099 CVE-2026-68100 CVE-2026-68102 CVE-2026-68104                      CVE-2026-68106 CVE-2026-68107 CVE-2026-68108 CVE-2026-68110                      CVE-2026-68111 CVE-2026-68112 CVE-2026-68113 CVE-2026-68115                      CVE-2026-68116 CVE-2026-68117 CVE-2026-68119 CVE-2026-68120                      CVE-2026-68121 CVE-2026-68123 CVE-2026-68124 CVE-2026-68125                      CVE-2026-68126 CVE-2026-68127 CVE-2026-68128 CVE-2026-68129                      CVE-2026-68130 CVE-2026-68131 CVE-2026-68133 CVE-2026-68135                      CVE-2026-68136 CVE-2026-68137 CVE-2026-68139 CVE-2026-68140                      CVE-2026-68141 CVE-2026-68142 CVE-2026-68143 CVE-2026-68144                      CVE-2026-68145 CVE-2026-68146 CVE-2026-68147 CVE-2026-68148                      CVE-2026-68149 CVE-2026-68151 CVE-2026-68152 CVE-2026-68153                      CVE-2026-68154 CVE-2026-68155 CVE-2026-68156 CVE-2026-68157                      CVE-2026-68158 CVE-2026-68160 CVE-2026-68161 CVE-2026-68162                      CVE-2026-68164 CVE-2026-68165 CVE-2026-68175 CVE-2026-68176                      CVE-2026-68178 CVE-2026-68179 CVE-2026-68180 CVE-2026-68181                      CVE-2026-68182 CVE-2026-68183 CVE-2026-68184 CVE-2026-68185                      CVE-2026-68186 CVE-2026-68187 CVE-2026-68188 CVE-2026-68189                      CVE-2026-68190 CVE-2026-68192 CVE-2026-68193 CVE-2026-68194                      CVE-2026-68195 CVE-2026-68196 CVE-2026-68197 CVE-2026-68199                      CVE-2026-68200 CVE-2026-68201 CVE-2026-68202 CVE-2026-68203                      CVE-2026-68204 CVE-2026-68205 CVE-2026-68206 CVE-2026-68207                      CVE-2026-68209 CVE-2026-68210 CVE-2026-68212 CVE-2026-68213                      CVE-2026-68214 CVE-2026-68215 CVE-2026-68216 CVE-2026-68217                      CVE-2026-68218 CVE-2026-68219 CVE-2026-68220 CVE-2026-68221                      CVE-2026-68222 CVE-2026-68223 CVE-2026-68225 CVE-2026-68226                      CVE-2026-68227 CVE-2026-68228 CVE-2026-68229 CVE-2026-68231                      CVE-2026-68234 CVE-2026-68235 CVE-2026-68236 CVE-2026-68243                      CVE-2026-68244 CVE-2026-68245 CVE-2026-68246 CVE-2026-68247                      CVE-2026-68248 CVE-2026-68249 CVE-2026-68250 CVE-2026-68251                      CVE-2026-68252 CVE-2026-68255 CVE-2026-68256 CVE-2026-68257                      CVE-2026-68259 CVE-2026-68260 CVE-2026-68261 CVE-2026-68262                      CVE-2026-68263 CVE-2026-68269 CVE-2026-68271 CVE-2026-68272                      CVE-2026-68277 CVE-2026-68278 CVE-2026-68279 CVE-2026-68280                      CVE-2026-68281 CVE-2026-68284 CVE-2026-68290 CVE-2026-68293                      CVE-2026-68294 CVE-2026-68296 CVE-2026-68297 CVE-2026-68299                      CVE-2026-68300 CVE-2026-68301 CVE-2026-68302 CVE-2026-68304                      CVE-2026-68306 CVE-2026-68307 CVE-2026-68308 CVE-2026-68309                      CVE-2026-68310 CVE-2026-68311 CVE-2026-68313 CVE-2026-68314                      CVE-2026-68315 CVE-2026-68317 CVE-2026-68318 CVE-2026-68319                      CVE-2026-68320 CVE-2026-68321 CVE-2026-68324 CVE-2026-68325                      CVE-2026-68326 CVE-2026-68327 CVE-2026-68328 CVE-2026-68329                      CVE-2026-68331 CVE-2026-68333 CVE-2026-68335 CVE-2026-68336                      CVE-2026-68338 CVE-2026-68339 CVE-2026-68340 CVE-2026-68343                      CVE-2026-68344 CVE-2026-68346 CVE-2026-68348 CVE-2026-68349                      CVE-2026-68350 CVE-2026-68351 CVE-2026-68352 CVE-2026-68353                      CVE-2026-68354 CVE-2026-68355 CVE-2026-68357 CVE-2026-68358                      CVE-2026-68359 CVE-2026-68360 CVE-2026-68361 CVE-2026-68362                      CVE-2026-68363 CVE-2026-68365 CVE-2026-68366 CVE-2026-68368                      CVE-2026-68369 CVE-2026-68370 CVE-2026-68371 CVE-2026-68372                      CVE-2026-68373 CVE-2026-68374 CVE-2026-68376 CVE-2026-68377                      CVE-2026-68381 CVE-2026-68385 CVE-2026-68386 CVE-2026-68388                      CVE-2026-68389 CVE-2026-68391 CVE-2026-68392 CVE-2026-68394                      CVE-2026-68395 CVE-2026-68396 CVE-2026-68397 CVE-2026-68398                      CVE-2026-68402 CVE-2026-68403 CVE-2026-68405 CVE-2026-68406                      CVE-2026-68407 CVE-2026-68408 CVE-2026-68410 CVE-2026-68411                      CVE-2026-68413 CVE-2026-68414 CVE-2026-68416 CVE-2026-68417                      CVE-2026-68419 CVE-2026-68422 CVE-2026-68425 CVE-2026-68427                      CVE-2026-68428 CVE-2026-68429 CVE-2026-68430 CVE-2026-68432                      CVE-2026-68433 CVE-2026-68434 CVE-2026-68437 CVE-2026-68439                      CVE-2026-68442 CVE-2026-68443 CVE-2026-68444 CVE-2026-68445                      CVE-2026-68446 CVE-2026-68449 CVE-2026-68450 CVE-2026-72015                      CVE-2026-72017 CVE-2026-72023 CVE-2026-72030 CVE-2026-72032                      CVE-2026-72040 CVE-2026-72045 CVE-2026-72046 CVE-2026-72051                      CVE-2026-72062 CVE-2026-72065 CVE-2026-72069 CVE-2026-72070                      CVE-2026-72101 CVE-2026-72103 CVE-2026-72113 CVE-2026-72114                      CVE-2026-72115 CVE-2026-72116 CVE-2026-72117 CVE-2026-72118                      CVE-2026-72119 CVE-2026-72121 CVE-2026-72124 CVE-2026-72125                      CVE-2026-72130 CVE-2026-72137 CVE-2026-72142 CVE-2026-72146                      CVE-2026-72147 CVE-2026-72168 CVE-2026-72175 CVE-2026-72183                      CVE-2026-72213 CVE-2026-72244 CVE-2026-72253 CVE-2026-72254                      CVE-2026-72260 CVE-2026-72299 CVE-2026-72305 CVE-2026-72372                      CVE-2026-74436     Debian Bug     : 1143721

    Several vulnerabilities have been discovered in the Linux kernel that     may lead to a privilege escalation, denial of service or information     leaks.  This update additionally includes many more bug fixes from     stable update 6.12.101.

    For Debian 12 bookworm, these problems have been fixed in version     6.12.101-1~deb12u1.

    We recommend that you upgrade your linux-6.12 packages.

    For the detailed security status of linux-6.12 please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/linux-6.12

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS     Attachment:
    signature.asc     Description: PGP signature

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-099242 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    sctp: don't free the ASCONF's own transport in DEL-IP processing

    sctp_process_asconf() caches the transport the ASCONF chunk is processed     against in asconf->transport (== chunk->transport, set once in sctp_rcv()).
    For an ASCONF located through its Address Parameter by
    __sctp_rcv_asconf_lookup(), that cached transport corresponds to the     Address Parameter, which need not be the packet's source address.

    sctp_process_asconf_param() rejects a DEL-IP for the packet source address     (ADDIP D8, SCTP_ERROR_DEL_SRC_IP), but nothing protects asconf->transport.
    A single ASCONF can therefore carry, in order:

        [Address Parameter L] [DEL-IP L] [DEL-IP 0.0.0.0]

    where L differs from the source. The DEL-IP for L passes the D8 check and     calls sctp_assoc_rm_peer() on the transport that asconf->transport still     points at, freeing it (RCU-deferred). The following wildcard DEL-IP then     reuses the now-dangling asconf->transport in sctp_assoc_set_primary() and     sctp_assoc_del_nonprimary_peers(): set_primary() dereferences the freed     transport (->ipaddr, ->state) and plants the dangling pointer into     asoc->peer.primary_path / active_path, and del_nonprimary_peers(), keeping     only the pointer that is no longer on the list, removes every real     transport, leaving the association with a transport_count of 0 and     primary_path/active_path pointing at freed memory.

    Reject a DEL-IP that targets the transport the ASCONF is being processed     against, mirroring the existing source-address guard, so the wildcard     branch can never reuse a freed transport.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3602-1 advisory.

    The SUSE Linux Enterprise 15 SP6 kernel was updated to fix various security issues:

    The following security issues were fixed:

    - CVE-2026-46056: Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (bsc#1267435).
    - CVE-2026-46193: xfrm: ah: account for ESN high bits in async callbacks (bsc#1267656).
    - CVE-2026-46324: netfilter: nf_tables: Introduce functions freeing nft_hook objects (bsc#1267995).
    - CVE-2026-52967: smb/client: fix possible infinite loop and oob read in symlink_data() (bsc#1269181).
    - CVE-2026-52986: netfilter: nf_conntrack_sip: don't use simple_strtoul (bsc#1269289).
    - CVE-2026-53050: quota: Fix race of dquot_scan_active() with quota deactivation (bsc#1269188).
    - CVE-2026-53129: fs/mbcache: cancel shrink work before destroying the cache (bsc#1269633).
    - CVE-2026-53131: netfilter: require Ethernet MAC header before using eth_hdr() (bsc#1269773).
    - CVE-2026-53224: sctp: validate embedded INIT chunk and address list lengths in cookie (bsc#1269997).
    - CVE-2026-53246: sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (bsc#1269988).
    - CVE-2026-53250: xsk: cache csum_start/csum_offset to fix TOCTOU in xsk_skb_metadata() (bsc#1269808).
    - CVE-2026-53262: l2tp: pppol2tp: hold reference to session in pppol2tp_ioctl() (bsc#1270000).
    - CVE-2026-53267: netfilter: nft_ct: bail out on template ct in get eval (bsc#1269577).
    - CVE-2026-53354: arm64: errata: Mitigate TLBI errata on various Arm CPUs (bsc#1270230).
    - CVE-2026-53375: drm/amdgpu/vce: Prevent partial address patches (bsc#1271899).
    - CVE-2026-53388: fuse: re-lock request before replacing page cache folio (bsc#1271825).
    - CVE-2026-53391: NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (bsc#1271904).
    - CVE-2026-53402: fbdev: fbcon: fix out-of-bounds read in err_out of (bsc#1271908).
    - CVE-2026-63794: KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (bsc#1271964).
    - CVE-2026-63802: blk-cgroup: fix UAF in __blkcg_rstat_flush() (bsc#1272282).
    - CVE-2026-63806: KVM: Replace guest-triggerable BUG_ON() in ioeventfd datamatch with get_unaligned()     (bsc#1272268).
    - CVE-2026-63807: KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level     (bsc#1272263).
    - CVE-2026-63824: KEYS: fix overflow in keyctl_pkey_params_get_2() (bsc#1272180).
    - CVE-2026-63826: fbdev: fix use-after-free in store_modes() (bsc#1272183).
    - CVE-2026-63829: net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (bsc#1272176).
    - CVE-2026-63884: drm/i915: Fix potential UAF in TTM object purge (bsc#1272573).
    - CVE-2026-63893: thunderbolt: property: Reject u32 wrap in tb_property_entry_valid() (bsc#1272607).
    - CVE-2026-63912: xfrm: esp: restore combined single-frag length gate (bsc#1272836).
    - CVE-2026-63917: ip6: vti: Use ip6_tnl.net in vti6_changelink() (bsc#1272904).
    - CVE-2026-63919: xfrm: input: hold netns during deferred transport reinjection (bsc#1272907).
    - CVE-2026-63921: ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate() (bsc#1272918).
    - CVE-2026-63922,CVE-2026-63924: ipv6: exthdrs: refresh nh after handling HAO option (bsc#1272855).
    - CVE-2026-63946: Bluetooth: ISO: fix UAF in iso_recv_frame (bsc#1272665).
    - CVE-2026-63952: memfd: deny writeable mappings when implying SEAL_WRITE (bsc#1272468).
    - CVE-2026-63968: ipv6: fix possible infinite loop in fib6_select_path() (bsc#1272466).
    - CVE-2026-63971: sctp: fix race between sctp_wait_for_connect and peeloff (bsc#1272678).
    - CVE-2026-63975: Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (bsc#1272694).
    - CVE-2026-63984: ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (bsc#1272865).
    - CVE-2026-63994: tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp()     (bsc#1273035).
    - CVE-2026-64106: KVM: arm64: vgic-its: Reject restored DTE with out-of-range num_eventid_bits     (bsc#1272242).
    - CVE-2026-64189: netfilter: ipset: fix race between dump and ip_set_list resize (bsc#1272207).
    - CVE-2026-64560: posix-cpu-timers: Prevent UAF caused by non-leader exec() race (bsc#1273004).
    - CVE-2026-64561: KVM: x86: Check for invalid/obsolete root *after* making MMU pages available     (bsc#1273231).
    - CVE-2026-64564: sctp: don't free the ASCONF's own transport in DEL-IP processing (bsc#1274072).
    - CVE-2026-64600: xfs: resample the data fork mapping after cycling ILOCK (bsc#1271526).

    The following non security issues were fixed:

    - Drivers: hv: vmbus: Set DMA coherent mask for VMBus devices (git-fixes).
    - hrtimers: Introduce hrtimer_setup() to replace hrtimer_init() (bsc#1271912).
    - ice: don't check has_ready_bitmap in E810 functions (bsc#1269981).
    - ice: factor out ice_ptp_rebuild_owner() (bsc#1269981).
    - ice: fix PTP Call Trace during PTP release (bsc#1269981).
    - ice: Fix PTP NULL pointer dereference during VSI rebuild (bsc#1269981).
    - ice: introduce PTP state machine (bsc#1269981).
    - ice: pass reset type to PTP reset functions (bsc#1269981).
    - ice: rename ice_ptp_tx_cfg_intr (bsc#1269981).
    - ice: rename verify_cached to has_ready_bitmap (bsc#1269981).
    - ice: stop destroying and reinitalizing Tx tracker during reset (bsc#1269981).
    - KVM: SVM: Mark VMCB_NPT as dirty on nested VMRUN (git-fixes).
    - KVM: SVM: Mark VMCB_PERM_MAP as dirty on nested VMRUN (git-fixes).
    - KVM: x86/mmu: Fix use-after-free on vendor module reload (git-fixes).
    - KVM: x86/mmu: Preserve nested TDP shadow page tables if they are used as roots (git-fixes).
    - KVM: x86/xen: Fix cleanup logic in emulation of Xen schedop poll hypercalls (git-fixes).
    - KVM: x86: Fix SRCU list traversal in kvm_fire_mask_notifiers() (git-fixes).
    - KVM: x86: Fix VM hard lockup after prolonged inactivity with periodic HV timer (git-fixes).
    - KVM: x86: hyper-v: Bound the bank index when querying sparse banks (git-fixes).
    - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (git-fixes).
    - mkspec-dtb: Skip missing DTBs.
    - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (bsc#1271866).
    - net: mana: Add Interrupt Moderation support (bsc#1271368).
    - net: mana: Return error code from mana_create_rxq() (git-fixes).
    - net: mana: Validate the packet length reported by the NIC (git-fixes).
    - pkspec-dtb: Fix dtb-al rename.
    - posix-cpu-timers: Cleanup the firing logic (bsc#1271912).
    - posix-cpu-timers: Correctly update timer status in posix_cpu_timer_del() (bsc#1271912).
    - posix-cpu-timers: Do not arm SIGEV_NONE timers (bsc#1271912).
    - posix-cpu-timers: Handle interval timers correctly in timer_get() (bsc#1271912).
    - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (bsc#1271912).
    - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (bsc#1271912).
    - posix-cpu-timers: Make k_itimer::it_active consistent (bsc#1271912).
    - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (bsc#1271912).
    - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (bsc#1271912).
    - posix-cpu-timers: Simplify posix_cpu_timer_set() (bsc#1271912).
    - posix-cpu-timers: Split up posix_cpu_timer_get() (bsc#1271912).
    - posix-cpu-timers: Use @now instead of @val for clarity (bsc#1271912).
    - posix-timers: Add proper state tracking (bsc#1271912).
    - posix-timers: Avoid direct access to hrtimer clockbase (bsc#1271912).
    - posix-timers: Clarify posix_timer_fn() comments (bsc#1271912).
    - posix-timers: Clear overrun in common_timer_set() (bsc#1271912).
    - posix-timers: Consolidate signal queueing (bsc#1271912).
    - posix-timers: Consolidate timer setup (bsc#1271912).
    - posix-timers: Cure si_sys_private race (bsc#1271912).
    - posix-timers: Document common_clock_get() correctly (bsc#1271912).
    - posix-timers: Expand timer_arm() callbacks with a boolean return value (bsc#1271912).
    - posix-timers: Polish coding style in a few places (bsc#1271912).
    - posix-timers: Retrieve interval in common timer_settime() code (bsc#1271912).
    - RDMA/mana_ib: initialize err for empty send WR lists (git-fixes).
    - sctp: validate embedded address parameter length (git-fixes).
    - time: Switch to hrtimer_setup() (bsc#1271912).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3593-1 advisory.

    The SUSE Linux Enterprise 15 SP4 kernel was updated to fix various security issues:

    The following security issues were fixed:

    - CVE-2022-4994: KVM: x86: wean fast IN from emulator_pio_in (bsc#1273097).
    - CVE-2023-53995: net: ipv4: fix one memleak in __inet_del_ifa() (bsc#1255616).
    - CVE-2026-46052: ceph: only d_add() negative dentries when they are unhashed (bsc#1267494).
    - CVE-2026-46056: Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (bsc#1267435).
    - CVE-2026-46145: RDMA/mana: Validate rx_hash_key_len (bsc#1267715).
    - CVE-2026-46193: xfrm: ah: account for ESN high bits in async callbacks (bsc#1267656).
    - CVE-2026-52956: libceph: Fix potential out-of-bounds access in __ceph_x_decrypt() (bsc#1269172).
    - CVE-2026-52958: libceph: Fix potential out-of-bounds access in osdmap_decode() (bsc#1269174).
    - CVE-2026-52967: smb/client: fix possible infinite loop and oob read in symlink_data() (bsc#1269181).
    - CVE-2026-52986: netfilter: nf_conntrack_sip: don't use simple_strtoul (bsc#1269289).
    - CVE-2026-53050: quota: Fix race of dquot_scan_active() with quota deactivation (bsc#1269188).
    - CVE-2026-53131: netfilter: require Ethernet MAC header before using eth_hdr() (bsc#1269773).
    - CVE-2026-53196: USB: serial: io_ti: fix heap overflow in get_manuf_info() (bsc#1269986).
    - CVE-2026-53224: sctp: validate embedded INIT chunk and address list lengths in cookie (bsc#1269997).
    - CVE-2026-53246: sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (bsc#1269988).
    - CVE-2026-53256: Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (bsc#1269993).
    - CVE-2026-53260: preempt: Provide preempt_[dis|en]able_nested() (bsc#1269731).
    - CVE-2026-53267: netfilter: nft_ct: bail out on template ct in get eval (bsc#1269577).
    - CVE-2026-53354: arm64: errata: Mitigate TLBI errata on various Arm CPUs (bsc#1270230).
    - CVE-2026-53357: Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (bsc#1270257).
    - CVE-2026-53375: drm/amdgpu/vce: Prevent partial address patches (bsc#1271899).
    - CVE-2026-53388: fuse: re-lock request before replacing page cache folio (bsc#1271825).
    - CVE-2026-53391: NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (bsc#1271904).
    - CVE-2026-53402: fbdev: fbcon: fix out-of-bounds read in err_out of (bsc#1271908).
    - CVE-2026-63794: KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (bsc#1271964).
    - CVE-2026-63806: KVM: Replace guest-triggerable BUG_ON() in ioeventfd datamatch with get_unaligned()     (bsc#1272268).
    - CVE-2026-63807: KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level     (bsc#1272263).
    - CVE-2026-63824: KEYS: fix overflow in keyctl_pkey_params_get_2() (bsc#1272180).
    - CVE-2026-63829: net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (bsc#1272176).
    - CVE-2026-63893: thunderbolt: property: Reject u32 wrap in tb_property_entry_valid() (bsc#1272607).
    - CVE-2026-63917: ip6: vti: Use ip6_tnl.net in vti6_changelink() (bsc#1272904).
    - CVE-2026-63919: xfrm: input: hold netns during deferred transport reinjection (bsc#1272907).
    - CVE-2026-63921: ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate() (bsc#1272918).
    - CVE-2026-63922,CVE-2026-63924: ipv6: exthdrs: recompute network header pointer once (bsc#1272855).
    - CVE-2026-63971: sctp: fix race between sctp_wait_for_connect and peeloff (bsc#1272678).
    - CVE-2026-63975: Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (bsc#1272694).
    - CVE-2026-63984: ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (bsc#1272865).
    - CVE-2026-63994: tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp()     (bsc#1273035).
    - CVE-2026-64106: KVM: arm64: vgic-its: Reject restored DTE with out-of-range num_eventid_bits     (bsc#1272242).
    - CVE-2026-64189: netfilter: ipset: fix race between dump and ip_set_list resize (bsc#1272207).
    - CVE-2026-64561: KVM: x86: Check for invalid/obsolete root *after* making MMU pages available     (bsc#1273231).
    - CVE-2026-64560: posix-cpu-timers: Prevent UAF caused by non-leader exec() race (bsc#1273004).
    - CVE-2026-64564: sctp: don't free the ASCONF's own transport in DEL-IP processing (bsc#1274072).
    - CVE-2026-64600: xfs: resample the data fork mapping after cycling ILOCK (bsc#1271526).

    The following non security issues were fixed:

    - hrtimers: Introduce hrtimer_setup() to replace hrtimer_init() (bsc#1271912).
    - mkspec-dtb: Skip missing DTBs.
    - pkspec-dtb: Fix dtb-al rename.
    - posix-cpu-timers: Cleanup the firing logic (bsc#1271912).
    - posix-cpu-timers: Correctly update timer status in posix_cpu_timer_del() (bsc#1271912).
    - posix-cpu-timers: Do not arm SIGEV_NONE timers (bsc#1271912).
    - posix-cpu-timers: Handle interval timers correctly in timer_get() (bsc#1271912).
    - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (bsc#1271912).
    - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (bsc#1271912).
    - posix-cpu-timers: Make k_itimer::it_active consistent (bsc#1271912).
    - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (bsc#1271912).
    - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (bsc#1271912).
    - posix-cpu-timers: Simplify posix_cpu_timer_set() (bsc#1271912).
    - posix-cpu-timers: Split up posix_cpu_timer_get() (bsc#1271912).
    - posix-cpu-timers: Use @now instead of @val for clarity (bsc#1271912).
    - posix-timers: Add proper state tracking (bsc#1271912).
    - posix-timers: Avoid direct access to hrtimer clockbase (bsc#1271912).
    - posix-timers: Clarify posix_timer_fn() comments (bsc#1271912).
    - posix-timers: Clear overrun in common_timer_set() (bsc#1271912).
    - posix-timers: Consolidate signal queueing (bsc#1271912).
    - posix-timers: Consolidate timer setup (bsc#1271912).
    - posix-timers: Cure si_sys_private race (bsc#1271912).
    - posix-timers: Document common_clock_get() correctly (bsc#1271912).
    - posix-timers: Expand timer_arm() callbacks with a boolean return value (bsc#1271912).
    - posix-timers: Polish coding style in a few places (bsc#1271912).
    - posix-timers: Retrieve interval in common timer_settime() code (bsc#1271912).
    - sctp: validate embedded address parameter length (git-fixes).
    - time: Switch to hrtimer_setup() (bsc#1271912).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3594-1 advisory.

    The SUSE Linux Enterprise 12 SP5 kernel was updated to fix various security issues:

    The following security issues were fixed:

    - CVE-2026-31450: ext4: publish jinode after initialization (bsc#1262618).
    - CVE-2026-31510: Bluetooth: L2CAP: Fix null-ptr-deref on l2cap_sock_ready_cb (bsc#1262603).
    - CVE-2026-31624: HID: core: clamp report_size in s32ton() to avoid undefined shift (bsc#1263657).
    - CVE-2026-43068: ext4: avoid allocate block from corrupted group in ext4_mb_find_by_goal() (bsc#1264255).
    - CVE-2026-43069: Bluetooth: hci_ll: Fix firmware leak on error path (bsc#1264190).
    - CVE-2026-43123: fbcon: check return value of con2fb_acquire_newinfo() (bsc#1264598).
    - CVE-2026-43124: pstore: ram_core: fix incorrect success return when vmap() fails (bsc#1264545).
    - CVE-2026-43156: net: usb: pegasus: enable basic endpoint checking (bsc#1265092).
    - CVE-2026-43168: ocfs2: fix reflink preserve cleanup issue (bsc#1264537).
    - CVE-2026-43180: net: usb: kaweth: remove TX queue manipulation in kaweth_set_rx_mode (bsc#1265093).
    - CVE-2026-43211: PCI: Fix pci_slot_trylock() error handling (bsc#1264387).
    - CVE-2026-43216: net: Drop the lock in skb_may_tx_timestamp() (bsc#1264319).
    - CVE-2026-43226: net/rds: No shortcut out of RDS_CONN_ERROR (bsc#1264544).
    - CVE-2026-43230: net/rds: Clear reconnect pending bit (bsc#1264539).
    - CVE-2026-43244: kcm: fix zero-frag skb in frag_list on partial sendmsg error (bsc#1264321).
    - CVE-2026-43253: iommu/amd: move wait_on_sem() out of spinlock (bsc#1264419).
    - CVE-2026-43266: EFI/CPER: don't go past the ARM processor CPER record buffer (bsc#1264418).
    - CVE-2026-43268: hfsplus: pretend special inodes as regular files (bsc#1265083).
    - CVE-2026-43273: ceph: supply snapshot context in ceph_zero_partial_object() (bsc#1264446).
    - CVE-2026-43281: mailbox: Prevent out-of-bounds access in fw_mbox_index_xlate() (bsc#1264534).
    - CVE-2026-43287: drm: Account property blob allocations to memcg (bsc#1265037).
    - CVE-2026-43308: btrfs: don't BUG() on unexpected delayed ref type in run_one_delayed_ref()     (bsc#1264712).
    - CVE-2026-43309: md raid: fix hang when stopping arrays with metadata through dm-raid (bsc#1264827).
    - CVE-2026-43313: ACPI: processor: Fix NULL-pointer dereference in acpi_processor_errata_piix4()     (bsc#1264821).
    - CVE-2026-43370: drm/amdgpu: Fix use-after-free race in VM acquire (bsc#1264782).
    - CVE-2026-43373: net: ncsi: fix skb leak in error paths (bsc#1265079).
    - CVE-2026-43383: net/tcp-md5: Fix MAC comparison to be constant-time (bsc#1264744).
    - CVE-2026-43425: usb: image: mdc800: kill download URB on timeout (bsc#1265133).
    - CVE-2026-43427: usb: class: cdc-wdm: fix reordering issue in read code path (bsc#1264746).
    - CVE-2026-43445: e1000/e1000e: Fix leak in DMA error cleanup (bsc#1265041).
    - CVE-2026-43449: nvme-pci: Fix slab-out-of-bounds in nvme_dbbuf_set (bsc#1265023).
    - CVE-2026-43450: netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (bsc#1264794).
    - CVE-2026-43451: netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (bsc#1265009).
    - CVE-2026-43452: netfilter: x_tables: guard option walkers against 1-byte tail reads (bsc#1265142).
    - CVE-2026-43466: net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (bsc#1264790).
    - CVE-2026-43493: crypto: pcrypt - Fix handling of MAY_BACKLOG requests (bsc#1265627).
    - CVE-2026-43496: net/sched: sch_red: Replace direct dequeue call with peek and qdisc_dequeue_peeked     (bsc#1266000).
    - CVE-2026-45857: scsi: csiostor: Fix dereference of null pointer rn (bsc#1266458).
    - CVE-2026-45858: ext4: subdivide EXT4_EXT_DATA_VALID1 (bsc#1266773).
    - CVE-2026-45871: tpm: st33zp24: Fix missing cleanup on get_burstcount() error (bsc#1266755).
    - CVE-2026-45877: HID: intel-ish-hid: fix NULL-ptr-deref in ishtp_bus_remove_all_clients (bsc#1266468).
    - CVE-2026-45899: ext4: drop extent cache when splitting extent fails (bsc#1266883).
    - CVE-2026-45905: xfrm: fix ip_rt_bug race in icmp_route_lookup reverse path (bsc#1266685).
    - CVE-2026-45915: fat: avoid parent link count underflow in rmdir (bsc#1266896).
    - CVE-2026-45917: ipvs: do not keep dest_dst if dev is going down (bsc#1266900).
    - CVE-2026-45920: ext4: fix dirtyclusters double decrement on fs shutdown (bsc#1266893).
    - CVE-2026-45923: net: usb: catc: enable basic endpoint checking (bsc#1266894).
    - CVE-2026-45981: s390/cio: Fix device lifecycle handling in css_alloc_subchannel() (bsc#1267204).
    - CVE-2026-45985: ext4: don't set EXT4_GET_BLOCKS_CONVERT when splitting before submitting I/O     (bsc#1266700).
    - CVE-2026-45994: ibmasm: fix OOB reads in command_file_write due to missing size checks (bsc#1267432).
    - CVE-2026-45997: scsi: sd: fix missing put_disk() when device_add(&disk_dev) fails (bsc#1266740).
    - CVE-2026-46018: ALSA: usb-audio: stop parsing UAC2 rates at MAX_NR_RATES (bsc#1266751).
    - CVE-2026-46023: dm mirror: fix integer overflow in create_dirty_log() (bsc#1267449).
    - CVE-2026-46027: net/smc: avoid early lgr access in smc_clc_wait_msg (bsc#1266744).
    - CVE-2026-46033: crypto: authencesn - reject short ahash digests during instance creation (bsc#1266692).
    - CVE-2026-46040: inotify: fix watch count leak when fsnotify_add_inode_mark_locked() fails (bsc#1267472).
    - CVE-2026-46049: ALSA: ctxfi: Add fallback to default RSR for S/PDIF (bsc#1267448).
    - CVE-2026-46051: md/raid5: fix soft lockup in retry_aligned_read() (bsc#1267360).
    - CVE-2026-46056: Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (bsc#1267435).
    - CVE-2026-46064: ibmasm: fix heap over-read in ibmasm_send_i2o_message() (bsc#1267497).
    - CVE-2026-46068: crypto: nx - fix bounce buffer leaks in nx842_crypto_{alloc,free}_ctx (bsc#1267592).
    - CVE-2026-46086: net: bridge: use a stable FDB dst snapshot in RCU readers (bsc#1267524).
    - CVE-2026-46088: ALSA: control: Validate buf_len before strnlen() in snd_ctl_elem_init_enum_names()     (bsc#1267226).
    - CVE-2026-46102: net: strparser: fix skb_head leak in strp_abort_strp() (bsc#1267502).
    - CVE-2026-46146: ALSA: usb-audio: Avoid potential endless loop in convert_chmap_v3() (bsc#1267571).
    - CVE-2026-46149: scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show()     (bsc#1267648).
    - CVE-2026-46161: md/raid10: fix divide-by-zero in setup_geo() with zero far_copies (bsc#1266838).
    - CVE-2026-46167: usb: usblp: fix uninitialized heap leak via LPGETSTATUS ioctl (bsc#1266832).
    - CVE-2026-46177: ipmi: Add limits to event and receive message requests (bsc#1267725).
    - CVE-2026-46178: RDMA/mlx4: Fix resource leak on error in mlx4_ib_create_srq() (bsc#1267493).
    - CVE-2026-46180: wifi: brcmfmac: Fix potential use-after-free issue when stopping watchdog task     (bsc#1266813).
    - CVE-2026-46184: sound: ua101: fix division by zero at probe (bsc#1266864).
    - CVE-2026-46189: RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (bsc#1266918).
    - CVE-2026-46191: fbcon: Avoid OOB font access if console rotation fails (bsc#1267690).
    - CVE-2026-46193: xfrm: ah: account for ESN high bits in async callbacks (bsc#1267656).
    - CVE-2026-46220: drm/amdgpu/sdma4: replace BUG_ON with WARN_ON in fence emission (bsc#1267704).
    - CVE-2026-46245: drm/amd/display: Fix dc_link NULL handling in HPD init (bsc#1267678).
    - CVE-2026-46252: regulator: core: fix locking in regulator_resolve_supply() error path (bsc#1267676).
    - CVE-2026-46294: dm: fix a buffer overflow in ioctl processing (bsc#1267939).
    - CVE-2026-46307: wifi: ath5k: do not access array OOB (bsc#1267987).
    - CVE-2026-46321: tun: free page on short-frame rejection in tun_xdp_one() (bsc#1268024).
    - CVE-2026-46322: tun: free page on build_skb failure in tun_xdp_one() (bsc#1267994).
    - CVE-2026-52910: bpf: Free reuseport cBPF prog after RCU grace period (bsc#1268659).
    - CVE-2026-52915: netfilter: ip6t_hbh: reject oversized option lists (bsc#1269001).
    - CVE-2026-52927: netfilter: ebtables: fix OOB read in compat_mtw_from_user (bsc#1269027).
    - CVE-2026-52930: ipc/shm: serialize orphan cleanup with shm_nattch updates (bsc#1269003).
    - CVE-2026-52942: netfilter: nf_log: validate MAC header was set before dumping it (bsc#1268967).
    - CVE-2026-52948: i2c: dev: prevent integer overflow in I2C_TIMEOUT ioctl (bsc#1269116).
    - CVE-2026-52956: libceph: Fix potential out-of-bounds access in __ceph_x_decrypt() (bsc#1269172).
    - CVE-2026-52958: libceph: Fix potential out-of-bounds access in osdmap_decode() (bsc#1269174).
    - CVE-2026-52981: neigh: let neigh_xmit take skb ownership (bsc#1269254).
    - CVE-2026-52982: net: usb: rtl8150: fix use-after-free in rtl8150_start_xmit() (bsc#1269258).
    - CVE-2026-52984: net/sched: netem: fix queue limit check to include reordered packets (bsc#1269272).
    - CVE-2026-52986: netfilter: nf_conntrack_sip: don't use simple_strtoul (bsc#1269289).
    - CVE-2026-52995: net/rds: zero per-item info buffer before handing it to visitors (bsc#1269124).
    - CVE-2026-52998: netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (bsc#1269118).
    - CVE-2026-53002: netfilter: conntrack: remove sprintf usage (bsc#1269112).
    - CVE-2026-53004: sctp: fix OOB write to userspace in sctp_getsockopt_peer_auth_chunks (bsc#1269106).
    - CVE-2026-53006: ipv6: fix possible UAF in icmpv6_rcv() (bsc#1269104).
    - CVE-2026-53016: crypto: ccp - copy IV using skcipher ivsize (bsc#1269090).
    - CVE-2026-53021: scsi: target: core: Fix integer overflow in UNMAP bounds check (bsc#1269151).
    - CVE-2026-53036: bpf, arm64: Reject out-of-range B.cond targets (bsc#1269389).
    - CVE-2026-53039: ocfs2: validate group add input before caching (bsc#1269392).
    - CVE-2026-53060: dm cache metadata: fix memory leak on metadata abort retry (bsc#1269164).
    - CVE-2026-53062: dm cache policy smq: fix missing locks in invalidating cache blocks (bsc#1269658).
    - CVE-2026-53063: dm cache: fix write hang in passthrough mode (bsc#1269659).
    - CVE-2026-53064: dm cache: fix null-deref with concurrent writes in passthrough mode (bsc#1269132).
    - CVE-2026-53093: wifi: brcmfmac: Fix error pointer dereference (bsc#1269414).
    - CVE-2026-53129: fs/mbcache: cancel shrink work before destroying the cache (bsc#1269633).
    - CVE-2026-53131: netfilter: require Ethernet MAC header before using eth_hdr() (bsc#1269773).
    - CVE-2026-53134: netfilter: nft_fib: fix stale stack leak via the OIFNAME register (bsc#1269819).
    - CVE-2026-53146: thunderbolt: Limit XDomain response copy to actual frame size (bsc#1269826).
    - CVE-2026-53147: thunderbolt: Validate XDomain request packet size before type cast (bsc#1269709).
    - CVE-2026-53149: thunderbolt: Bound root directory content to block size (bsc#1269733).
    - CVE-2026-53167: fuse: limit FUSE_NOTIFY_RETRIEVE to uptodate folios (bsc#1269768).
    - CVE-2026-53176: IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (bsc#1269710).
    - CVE-2026-53181: vsock/vmci: fix sk_ack_backlog leak on failed handshake (bsc#1269886).
    - CVE-2026-53186: RDMA/srp: bound SRP_RSP sense copy by the received length (bsc#1269663).
    - CVE-2026-53196: USB: serial: io_ti: fix heap overflow in get_manuf_info() (bsc#1269986).
    - CVE-2026-53208: Bluetooth: L2CAP: reject BR/EDR signaling packets over MTUsig (bsc#1269899).
    - CVE-2026-53213: drm/vc4: fix krealloc() memory leak (bsc#1269283).
    - CVE-2026-53218: netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (bsc#1269273).
    - CVE-2026-53224: sctp: validate embedded INIT chunk and address list lengths in cookie (bsc#1269997).
    - CVE-2026-53225: sctp: fix uninit-value in __sctp_rcv_asconf_lookup() (bsc#1269711).
    - CVE-2026-53227: net: openvswitch: fix possible kfree_skb of ERR_PTR (bsc#1269877).
    - CVE-2026-53236: tcp: restrict SO_ATTACH_FILTER to priv users (bsc#1269994).
    - CVE-2026-53242: ALSA: PCM: Fix wait queue list corruption in snd_pcm_drain() on linked streams     (bsc#1269236).
    - CVE-2026-53245: net/802/mrp: fix vector attribute parsing in mrp_pdu_parse_vecattr (bsc#1269675).
    - CVE-2026-53246: sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (bsc#1269988).
    - CVE-2026-53249: ipv4: restrict IPOPT_SSRR and IPOPT_LSRR options (bsc#1269992).
    - CVE-2026-53252: adaption to srcu change of hci_dev in hci_sysfs (bsc#1269307).
    - CVE-2026-53254: Bluetooth: RFCOMM: validate skb length in MCC handlers (bsc#1269996).
    - CVE-2026-53255: Bluetooth: MGMT: validate advertising TLV before type checks (bsc#1269378).
    - CVE-2026-53256: Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (bsc#1269993).
    - CVE-2026-53262: l2tp: remove pppol2tp_session_close() (bsc#1270000).
    - CVE-2026-53267: netfilter: nft_ct: bail out on template ct in get eval (bsc#1269577).
    - CVE-2026-53268: netfilter: conntrack_irc: fix possible out-of-bounds read (bsc#1269257).
    - CVE-2026-53270: ipvs: clear the svc scheduler ptr early on edit (bsc#1269240).
    - CVE-2026-53273: tee: optee: prevent use-after-free when the client exits before the supplicant     (bsc#1269713).
    - CVE-2026-53275: ipv6: mcast: Fix use-after-free when processing MLD queries (bsc#1269810).
    - CVE-2026-53306: tty: hvc_iucv: fix off-by-one in number of supported devices (bsc#1269814).
    - CVE-2026-53325: agp/amd64: Fix broken error propagation in agp_amd64_probe() (bsc#1269726).
    - CVE-2026-53354: arm64: errata: Mitigate TLBI errata on various Arm CPUs (bsc#1270230).
    - CVE-2026-53355: net: rds: clear i_sends on setup unwind (bsc#1270249).
    - CVE-2026-53369: udf: reject descriptors with oversized CRC length (bsc#1271818).
    - CVE-2026-53374: drm/amdgpu: zero-initialize GART table on allocation (bsc#1271827).
    - CVE-2026-53375: drm/amdgpu/vce: Prevent partial address patches (bsc#1271899).
    - CVE-2026-53376: drm/amdkfd: Add upper bound check for num_of_nodes (bsc#1271831).
    - CVE-2026-53388: fuse: re-lock request before replacing page cache folio (bsc#1271825).
    - CVE-2026-53391: NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (bsc#1271904).
    - CVE-2026-53392: NFSv4/flexfiles: reject zero filehandle version count (bsc#1271826).
    - CVE-2026-53397: nfsd: fix posix_acl leak on SETACL decode failure (bsc#1271869).
    - CVE-2026-53399: nfsd: release layout stid on setlease failure (bsc#1271832).
    - CVE-2026-63794: KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (bsc#1271964).
    - CVE-2026-63806: KVM: Replace guest-triggerable BUG_ON() in ioeventfd datamatch with get_unaligned()     (bsc#1272268).
    - CVE-2026-63826: fbdev: fix use-after-free in store_modes() (bsc#1272183).
    - CVE-2026-63829: net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (bsc#1272176).
    - CVE-2026-63893: thunderbolt: property: Reject u32 wrap in tb_property_entry_valid() (bsc#1272607).
    - CVE-2026-63899: USB: serial: mxuport: fix memory corruption with small endpoint (bsc#1272494).
    - CVE-2026-63901: USB: serial: digi_acceleport: fix memory corruption with small endpoints (bsc#1272501).
    - CVE-2026-63915: nfc: hci: fix out-of-bounds read in HCP header parsing (bsc#1272897).
    - CVE-2026-63922,CVE-2026-63924: ipv6: exthdrs: recompute network header pointer once (bsc#1272855).
    - CVE-2026-63927: usb: dwc2: Fix use after free in debug code (bsc#1272892).
    - CVE-2026-63928: USB: serial: omninet: fix memory corruption with small endpoint (bsc#1272891).
    - CVE-2026-63958: usb: typec: ucsi: validate connector number in ucsi_connector_change() (bsc#1272467).
    - CVE-2026-64298: NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (bsc#1273550).
    - CVE-2026-64330: usb: typec: tcpm: Validate SVID index in svdm_consume_modes() (bsc#1272681).
    - CVE-2026-64465: usb: xhci: Fix sleep in atomic context in xhci_free_streams() (bsc#1272843).
    - CVE-2026-64564: sctp: don't free the ASCONF's own transport in DEL-IP processing (bsc#1274072).
    - CVE-2026-64600: xfs: resample the data fork mapping after cycling ILOCK (bsc#1271526).

    The following non security issues were fixed:

    - ACPI: processor: Fix previous acpi_processor_errata_piix4() fix (bsc#1264821).
    - dm cache policy smq: check allocation under invalidate lock (git-fixes).
    - dm cache: fix missing return in invalidate_committed's error path (git-fixes).
    - HID: Intel-ish-hid: Ishtp: Fix sensor reads after ACPI S3 suspend (bsc#1266468).
    - KVM: nVMX: use vm_exit_controls_init() to write exit controls for vmcs02 (bsc#1249414).
    - kvm: vmx: Fix entry number check for add_atomic_switch_msr() (git-fixes).
    - mkspec-dtb: Skip missing DTBs.
    - pkspec-dtb: Fix dtb-al rename.
    - sctp: validate embedded address parameter length (git-fixes).
    - tee: fix possible error pointer ctx dereferencing (git-fixes).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the linux package has been released.

The version of Tencent Linux installed on the remote TencentOS Server 2 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:0797 advisory.

    Package updates are available for TencentOS Server 2 that fix the following vulnerabilities:

    CVE-2026-31502:
    In the Linux kernel, the following vulnerability has been resolved: xfs: resample the data fork mapping     after cycling ILOCK. xfs_reflink_fill_{cow_hole,delalloc} are both presented with an inode, a data fork     mapping, and a cow fork mapping. Unfortunately, these two helpers cycle the ILOCK to grab a transaction,     which means that the mappings are stale as soon as we reacquire the ILOCK. Currently we refresh the cow     fork mapping by re-calling xfs_find_trim_cow_extent, but we don't refresh the data fork mapping     beforehand, which means that the xfs_bmap_trim_cow in that function queries the refcount btree about the     wrong physical blocks and returns an inaccurate value in *shared. If *shared is now false, the directio     write proceeds with a stale data fork mapping. Fix this by querying the data fork mapping if the sequence     counter changes across the ILOCK cycle.

    CVE-2026-43456:
    In the Linux kernel, the following vulnerability has been resolved:

    bonding: fix type confusion in bond_setup_by_slave()

    kernel BUG at net/core/skbuff.c:2306!     Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI     RIP: 0010:pskb_expand_head+0xa08/0xfe0 net/core/skbuff.c:2306     RSP: 0018:ffffc90004aff760 EFLAGS: 00010293     RAX: 0000000000000000 RBX: ffff88807e3c8780 RCX: ffffffff89593e0e     RDX: ffff88807b7c4900 RSI: ffffffff89594747 RDI: ffff88807b7c4900     RBP: 0000000000000820 R08: 0000000000000005 R09: 0000000000000000     R10: 00000000961a63e0 R11: 0000000000000000 R12: ffff88807e3c8780     R13: 00000000961a6560 R14: dffffc0000000000 R15: 00000000961a63e0     CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033     CR2: 00007fe1a0ed8df0 CR3: 000000002d816000 CR4: 00000000003526f0     Call Trace:
     <TASK>      ipgre_header+0xdd/0x540 net/ipv4/ip_gre.c:900      dev_hard_header include/linux/netdevice.h:3439 [inline]      packet_snd net/packet/af_packet.c:3028 [inline]      packet_sendmsg+0x3ae5/0x53c0 net/packet/af_packet.c:3108      sock_sendmsg_nosec net/socket.c:727 [inline]
     __sock_sendmsg net/socket.c:742 [inline]
     ____sys_sendmsg+0xa54/0xc30 net/socket.c:2592
     ___sys_sendmsg+0x190/0x1e0 net/socket.c:2646
     __sys_sendmsg+0x170/0x220 net/socket.c:2678      do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]      do_syscall_64+0x106/0xf80 arch/x86/entry/syscall_64.c:94      entry_SYSCALL_64_after_hwframe+0x77/0x7f     RIP: 0033:0x7fe1a0e6c1a9

    When a non-Ethernet device (e.g. GRE tunnel) is enslaved to a bond,     bond_setup_by_slave() directly copies the slave's header_ops to the     bond device:

      bond_dev->header_ops = slave_dev->header_ops;

    This causes a type confusion when dev_hard_header() is later called     on the bond device. Functions like ipgre_header(), ip6gre_header(),all use     netdev_priv(dev) to access their device-specific private data. When     called with the bond device, netdev_priv() returns the bond's private     data (struct bonding) instead of the expected type (e.g. struct     ip_tunnel), leading to garbage values being read and kernel crashes.

    Fix this by introducing bond_header_ops with wrapper functions that     delegate to the active slave's header_ops using the slave's own     device. This ensures netdev_priv() in the slave's header functions     always receives the correct device.

    The fix is placed in the bonding driver rather than individual device     drivers, as the root cause is bond blindly inheriting header_ops from     the slave without considering that these callbacks expect a specific     netdev_priv() layout.

    The type confusion can be observed by adding a printk in     ipgre_header() and running the following commands:

      ip link add dummy0 type dummy       ip addr add 10.0.0.1/24 dev dummy0       ip link set dummy0 up       ip link add gre1 type gre local 10.0.0.1       ip link add bond1 type bond mode active-backup       ip link set gre1 master bond1       ip link set gre1 up       ip link set bond1 up       ip addr add fe80::1/64 dev bond1

    CVE-2026-23451:
    In the Linux kernel, the following vulnerability has been resolved:

    team: fix header_ops type confusion with non-Ethernet ports

    Similar to commit 950803f72547 (bonding: fix type confusion in     bond_setup_by_slave()) team has the same class of header_ops type     confusion.

    For non-Ethernet ports, team_setup_by_port() copies port_dev->header_ops     directly. When the team device later calls dev_hard_header() or     dev_parse_header(), these callbacks can run with the team net_device     instead of the real lower device, so netdev_priv(dev) is interpreted as     the wrong private type and can crash.

    The syzbot report shows a crash in bond_header_create(), but the root     cause is in team: the topology is gre -> bond -> team, and team calls     the inherited header_ops with its own net_device instead of the lower     device, so bond_header_create() receives a team device and interprets     netdev_priv() as bonding private data, causing a type confusion crash.

    Fix this by introducing team header_ops wrappers for create/parse,     selecting a team port under RCU, and calling the lower device callbacks     with port->dev, so each callback always sees the correct net_device     context.

    Also pass the selected lower device to the lower parse callback, so     recursion is bounded in stacked non-Ethernet topologies and parse     callbacks always run with the correct device context.

    CVE-2026-64600:
    In the Linux kernel, the following vulnerability has been resolved:

    bonding: prevent potential infinite loop in bond_header_parse()

    bond_header_parse() can loop if a stack of two bonding devices is setup,     because skb->dev always points to the hierarchy top.

    Add new const struct net_device *dev parameter to     (struct header_ops)->parse() method to make sure the recursion     is bounded, and that the final leaf parse method is called.

    CVE-2026-64564:
    In the Linux kernel, the following vulnerability has been resolved: sctp: don't free the ASCONF's own     transport in DEL-IP processing. sctp_process_asconf() caches the transport the ASCONF chunk is processed     against in asconf->transport. For an ASCONF located through its Address Parameter, that cached transport     corresponds to the Address Parameter, which need not be the packet's source address. A single ASCONF can     carry DEL-IP for the cached transport followed by a wildcard DEL-IP, causing use-after-free of the freed     transport.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:0793 advisory.

    Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:

    CVE-2026-31502:
    In the Linux kernel, the following vulnerability has been resolved: xfs: resample the data fork mapping     after cycling ILOCK. xfs_reflink_fill_{cow_hole,delalloc} are both presented with an inode, a data fork     mapping, and a cow fork mapping. Unfortunately, these two helpers cycle the ILOCK to grab a transaction,     which means that the mappings are stale as soon as we reacquire the ILOCK. Currently we refresh the cow     fork mapping by re-calling xfs_find_trim_cow_extent, but we don't refresh the data fork mapping     beforehand, which means that the xfs_bmap_trim_cow in that function queries the refcount btree about the     wrong physical blocks and returns an inaccurate value in *shared. If *shared is now false, the directio     write proceeds with a stale data fork mapping. Fix this by querying the data fork mapping if the sequence     counter changes across the ILOCK cycle.

    CVE-2026-43456:
    In the Linux kernel, the following vulnerability has been resolved:

    bonding: fix type confusion in bond_setup_by_slave()

    kernel BUG at net/core/skbuff.c:2306!     Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI     RIP: 0010:pskb_expand_head+0xa08/0xfe0 net/core/skbuff.c:2306     RSP: 0018:ffffc90004aff760 EFLAGS: 00010293     RAX: 0000000000000000 RBX: ffff88807e3c8780 RCX: ffffffff89593e0e     RDX: ffff88807b7c4900 RSI: ffffffff89594747 RDI: ffff88807b7c4900     RBP: 0000000000000820 R08: 0000000000000005 R09: 0000000000000000     R10: 00000000961a63e0 R11: 0000000000000000 R12: ffff88807e3c8780     R13: 00000000961a6560 R14: dffffc0000000000 R15: 00000000961a63e0     CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033     CR2: 00007fe1a0ed8df0 CR3: 000000002d816000 CR4: 00000000003526f0     Call Trace:
     <TASK>      ipgre_header+0xdd/0x540 net/ipv4/ip_gre.c:900      dev_hard_header include/linux/netdevice.h:3439 [inline]      packet_snd net/packet/af_packet.c:3028 [inline]      packet_sendmsg+0x3ae5/0x53c0 net/packet/af_packet.c:3108      sock_sendmsg_nosec net/socket.c:727 [inline]
     __sock_sendmsg net/socket.c:742 [inline]
     ____sys_sendmsg+0xa54/0xc30 net/socket.c:2592
     ___sys_sendmsg+0x190/0x1e0 net/socket.c:2646
     __sys_sendmsg+0x170/0x220 net/socket.c:2678      do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]      do_syscall_64+0x106/0xf80 arch/x86/entry/syscall_64.c:94      entry_SYSCALL_64_after_hwframe+0x77/0x7f     RIP: 0033:0x7fe1a0e6c1a9

    When a non-Ethernet device (e.g. GRE tunnel) is enslaved to a bond,     bond_setup_by_slave() directly copies the slave's header_ops to the     bond device:

      bond_dev->header_ops = slave_dev->header_ops;

    This causes a type confusion when dev_hard_header() is later called     on the bond device. Functions like ipgre_header(), ip6gre_header(),all use     netdev_priv(dev) to access their device-specific private data. When     called with the bond device, netdev_priv() returns the bond's private     data (struct bonding) instead of the expected type (e.g. struct     ip_tunnel), leading to garbage values being read and kernel crashes.

    Fix this by introducing bond_header_ops with wrapper functions that     delegate to the active slave's header_ops using the slave's own     device. This ensures netdev_priv() in the slave's header functions     always receives the correct device.

    The fix is placed in the bonding driver rather than individual device     drivers, as the root cause is bond blindly inheriting header_ops from     the slave without considering that these callbacks expect a specific     netdev_priv() layout.

    The type confusion can be observed by adding a printk in     ipgre_header() and running the following commands:

      ip link add dummy0 type dummy       ip addr add 10.0.0.1/24 dev dummy0       ip link set dummy0 up       ip link add gre1 type gre local 10.0.0.1       ip link add bond1 type bond mode active-backup       ip link set gre1 master bond1       ip link set gre1 up       ip link set bond1 up       ip addr add fe80::1/64 dev bond1

    CVE-2026-64600:
    In the Linux kernel, the following vulnerability has been resolved:

    team: fix header_ops type confusion with non-Ethernet ports

    Similar to commit 950803f72547 (bonding: fix type confusion in     bond_setup_by_slave()) team has the same class of header_ops type     confusion.

    For non-Ethernet ports, team_setup_by_port() copies port_dev->header_ops     directly. When the team device later calls dev_hard_header() or     dev_parse_header(), these callbacks can run with the team net_device     instead of the real lower device, so netdev_priv(dev) is interpreted as     the wrong private type and can crash.

    The syzbot report shows a crash in bond_header_create(), but the root     cause is in team: the topology is gre -> bond -> team, and team calls     the inherited header_ops with its own net_device instead of the lower     device, so bond_header_create() receives a team device and interprets     netdev_priv() as bonding private data, causing a type confusion crash.

    Fix this by introducing team header_ops wrappers for create/parse,     selecting a team port under RCU, and calling the lower device callbacks     with port->dev, so each callback always sees the correct net_device     context.

    Also pass the selected lower device to the lower parse callback, so     recursion is bounded in stacked non-Ethernet topologies and parse     callbacks always run with the correct device context.

    CVE-2026-23451:
    In the Linux kernel, the following vulnerability has been resolved:

    bonding: prevent potential infinite loop in bond_header_parse()

    bond_header_parse() can loop if a stack of two bonding devices is setup,     because skb->dev always points to the hierarchy top.

    Add new const struct net_device *dev parameter to     (struct header_ops)->parse() method to make sure the recursion     is bounded, and that the final leaf parse method is called.

    CVE-2026-64564:
    In the Linux kernel, the following vulnerability has been resolved: sctp: don't free the ASCONF's own     transport in DEL-IP processing. sctp_process_asconf() caches the transport the ASCONF chunk is processed     against in asconf->transport. For an ASCONF located through its Address Parameter, that cached transport     corresponds to the Address Parameter, which need not be the packet's source address. A single ASCONF can     carry DEL-IP for the cached transport followed by a wildcard DEL-IP, causing use-after-free of the freed     transport.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:0792 advisory.

    Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:

    CVE-2026-31502:
    In the Linux kernel, the following vulnerability has been resolved: xfs: resample the data fork mapping     after cycling ILOCK. xfs_reflink_fill_{cow_hole,delalloc} are both presented with an inode, a data fork     mapping, and a cow fork mapping. Unfortunately, these two helpers cycle the ILOCK to grab a transaction,     which means that the mappings are stale as soon as we reacquire the ILOCK. Currently we refresh the cow     fork mapping by re-calling xfs_find_trim_cow_extent, but we don't refresh the data fork mapping     beforehand, which means that the xfs_bmap_trim_cow in that function queries the refcount btree about the     wrong physical blocks and returns an inaccurate value in *shared. If *shared is now false, the directio     write proceeds with a stale data fork mapping. Fix this by querying the data fork mapping if the sequence     counter changes across the ILOCK cycle.

    CVE-2026-53362:
    In the Linux kernel, the following vulnerability has been resolved:

    eventpoll: fix ep_remove struct eventpoll / struct file UAF

    ep_remove() (via ep_remove_file()) cleared file->f_ep under     file->f_lock but then kept using @file inside the critical section     (is_file_epoll(), hlist_del_rcu() through the head, spin_unlock).
    A concurrent __fput() taking the eventpoll_release() fastpath in     that window observed the transient NULL, skipped     eventpoll_release_file() and ran to f_op->release / file_free().

    For the epoll-watches-epoll case, f_op->release is     ep_eventpoll_release() -> ep_clear_and_put() -> ep_free(), which     kfree()s the watched struct eventpoll. Its embedded ->refs     hlist_head is exactly where epi->fllink.pprev points, so the     subsequent hlist_del_rcu()'s *pprev = next scribbles into freed     kmalloc-192 memory.

    In addition, struct file is SLAB_TYPESAFE_BY_RCU, so the slot     backing @file could be recycled by alloc_empty_file() --     reinitializing f_lock and f_ep -- while ep_remove() is still     nominally inside that lock. The upshot is an attacker-controllable     kmem_cache_free() against the wrong slab cache.

    Pin @file via epi_fget() at the top of ep_remove() and gate the     critical section on the pin succeeding. With the pin held @file     cannot reach refcount zero, which holds __fput() off and     transitively keeps the watched struct eventpoll alive across the     hlist_del_rcu() and the f_lock use, closing both UAFs.

    If the pin fails @file has already reached refcount zero and its
    __fput() is in flight. Because we bailed before clearing f_ep,     that path takes the eventpoll_release() slow path into     eventpoll_release_file() and blocks on ep->mtx until the waiter     side's ep_clear_and_put() drops it. The bailed epi's share of     ep->refcount stays intact, so the trailing ep_refcount_dec_and_test()     in ep_clear_and_put() cannot free the eventpoll out from under     eventpoll_release_file(); the orphaned epi is then cleaned up     there.

    A successful pin also proves we are not racing     eventpoll_release_file() on this epi, so drop the now-redundant     re-check of epi->dying under f_lock. The cheap lockless     READ_ONCE(epi->dying) fast-path bailout stays.

    CVE-2026-43456:
    In the Linux kernel, the following vulnerability has been resolved:

    ipv6: account for fraggap on the paged allocation path

    In __ip6_append_data(), when the paged-allocation branch is taken     (MSG_MORE / NETIF_F_SG / large fraglen), alloclen and pagedlen are     computed as

            alloclen = fragheaderlen + transhdrlen;
            pagedlen = datalen - transhdrlen;

    datalen already includes fraggap (datalen = length + fraggap). When     fraggap is non-zero, this is not the first skb and transhdrlen is zero.
    The fraggap bytes carried over from the previous skb are copied just past     the fragment headers in the new skb's linear area. The linear area is     therefore undersized by fraggap bytes while pagedlen is overstated by the     same amount, and the copy writes past skb->end into the trailing     skb_shared_info.

    An unprivileged user can trigger this via a UDPv6 socket using     MSG_MORE together with MSG_SPLICE_PAGES.

    The bad accounting was introduced by commit 773ba4fe9104 (ipv6:
    avoid partial copy for zc). Before commit ce650a166335 (udp6: Fix
    __ip6_append_data()'s handling of MSG_SPLICE_PAGES), the negative     copy value caused -EINVAL to be returned. That later commit allowed     MSG_SPLICE_PAGES to proceed in this case, making the corruption     triggerable.

    The non-paged branch sets alloclen to fraglen, which already accounts     for fraggap because datalen does. Bring the paged branch in line by     adding fraggap to alloclen and subtracting it from pagedlen.

    After this adjustment, copy no longer collapses to -fraggap on the     paged path, so remove the stale comment describing that old arithmetic.
    Since a negative copy is no longer expected for a valid MSG_SPLICE_PAGES     case, remove the MSG_SPLICE_PAGES exception from the negative copy check.

    CVE-2026-46242:
    In the Linux kernel, the following vulnerability has been resolved:

    bonding: fix type confusion in bond_setup_by_slave()

    kernel BUG at net/core/skbuff.c:2306!     Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI     RIP: 0010:pskb_expand_head+0xa08/0xfe0 net/core/skbuff.c:2306     RSP: 0018:ffffc90004aff760 EFLAGS: 00010293     RAX: 0000000000000000 RBX: ffff88807e3c8780 RCX: ffffffff89593e0e     RDX: ffff88807b7c4900 RSI: ffffffff89594747 RDI: ffff88807b7c4900     RBP: 0000000000000820 R08: 0000000000000005 R09: 0000000000000000     R10: 00000000961a63e0 R11: 0000000000000000 R12: ffff88807e3c8780     R13: 00000000961a6560 R14: dffffc0000000000 R15: 00000000961a63e0     CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033     CR2: 00007fe1a0ed8df0 CR3: 000000002d816000 CR4: 00000000003526f0     Call Trace:
     <TASK>      ipgre_header+0xdd/0x540 net/ipv4/ip_gre.c:900      dev_hard_header include/linux/netdevice.h:3439 [inline]      packet_snd net/packet/af_packet.c:3028 [inline]      packet_sendmsg+0x3ae5/0x53c0 net/packet/af_packet.c:3108      sock_sendmsg_nosec net/socket.c:727 [inline]
     __sock_sendmsg net/socket.c:742 [inline]
     ____sys_sendmsg+0xa54/0xc30 net/socket.c:2592
     ___sys_sendmsg+0x190/0x1e0 net/socket.c:2646
     __sys_sendmsg+0x170/0x220 net/socket.c:2678      do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]      do_syscall_64+0x106/0xf80 arch/x86/entry/syscall_64.c:94      entry_SYSCALL_64_after_hwframe+0x77/0x7f     RIP: 0033:0x7fe1a0e6c1a9

    When a non-Ethernet device (e.g. GRE tunnel) is enslaved to a bond,     bond_setup_by_slave() directly copies the slave's header_ops to the     bond device:

      bond_dev->header_ops = slave_dev->header_ops;

    This causes a type confusion when dev_hard_header() is later called     on the bond device. Functions like ipgre_header(), ip6gre_header(),all use     netdev_priv(dev) to access their device-specific private data. When     called with the bond device, netdev_priv() returns the bond's private     data (struct bonding) instead of the expected type (e.g. struct     ip_tunnel), leading to garbage values being read and kernel crashes.

    Fix this by introducing bond_header_ops with wrapper functions that     delegate to the active slave's header_ops using the slave's own     device. This ensures netdev_priv() in the slave's header functions     always receives the correct device.

    The fix is placed in the bonding driver rather than individual device     drivers, as the root cause is bond blindly inheriting header_ops from     the slave without considering that these callbacks expect a specific     netdev_priv() layout.

    The type confusion can be observed by adding a printk in     ipgre_header() and running the following commands:

      ip link add dummy0 type dummy       ip addr add 10.0.0.1/24 dev dummy0       ip link set dummy0 up       ip link add gre1 type gre local 10.0.0.1       ip link add bond1 type bond mode active-backup       ip link set gre1 master bond1       ip link set gre1 up       ip link set bond1 up       ip addr add fe80::1/64 dev bond1

    CVE-2026-23451:
    In the Linux kernel, the following vulnerability has been resolved:

    team: fix header_ops type confusion with non-Ethernet ports

    Similar to commit 950803f72547 (bonding: fix type confusion in     bond_setup_by_slave()) team has the same class of header_ops type     confusion.

    For non-Ethernet ports, team_setup_by_port() copies port_dev->header_ops     directly. When the team device later calls dev_hard_header() or     dev_parse_header(), these callbacks can run with the team net_device     instead of the real lower device, so netdev_priv(dev) is interpreted as     the wrong private type and can crash.

    The syzbot report shows a crash in bond_header_create(), but the root     cause is in team: the topology is gre -> bond -> team, and team calls     the inherited header_ops with its own net_device instead of the lower     device, so bond_header_create() receives a team device and interprets     netdev_priv() as bonding private data, causing a type confusion crash.

    Fix this by introducing team header_ops wrappers for create/parse,     selecting a team port under RCU, and calling the lower device callbacks     with port->dev, so each callback always sees the correct net_device     context.

    Also pass the selected lower device to the lower parse callback, so     recursion is bounded in stacked non-Ethernet topologies and parse     callbacks always run with the correct device context.

    CVE-2026-64600:
    In the Linux kernel, the following vulnerability has been resolved:

    bonding: prevent potential infinite loop in bond_header_parse()

    bond_header_parse() can loop if a stack of two bonding devices is setup,     because skb->dev always points to the hierarchy top.

    Add new const struct net_device *dev parameter to     (struct header_ops)->parse() method to make sure the recursion     is bounded, and that the final leaf parse method is called.

    CVE-2026-64531:
    In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: reject oversized     nested action attrs. Open vSwitch stores generated flow actions as nlattrs, whose nla_len field is u16. An     oversized generated container can be closed with a truncated nla_len, causing later dump or teardown to     walk a structurally different stream than the one that was validated. An oversized nested CLONE/CT action     may cause subsequent bytes to be interpreted as independent actions.

    CVE-2026-64564:
    In the Linux kernel, the following vulnerability has been resolved: sctp: don't free the ASCONF's own     transport in DEL-IP processing. sctp_process_asconf() caches the transport the ASCONF chunk is processed     against in asconf->transport. For an ASCONF located through its Address Parameter, that cached transport     corresponds to the Address Parameter, which need not be the packet's source address. A single ASCONF can     carry DEL-IP for the cached transport followed by a wildcard DEL-IP, causing use-after-free of the freed     transport.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:0796 advisory.

    Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:

    CVE-2026-31502:
    In the Linux kernel, the following vulnerability has been resolved: xfs: resample the data fork mapping     after cycling ILOCK. xfs_reflink_fill_{cow_hole,delalloc} are both presented with an inode, a data fork     mapping, and a cow fork mapping. Unfortunately, these two helpers cycle the ILOCK to grab a transaction,     which means that the mappings are stale as soon as we reacquire the ILOCK. Currently we refresh the cow     fork mapping by re-calling xfs_find_trim_cow_extent, but we don't refresh the data fork mapping     beforehand, which means that the xfs_bmap_trim_cow in that function queries the refcount btree about the     wrong physical blocks and returns an inaccurate value in *shared. If *shared is now false, the directio     write proceeds with a stale data fork mapping. Fix this by querying the data fork mapping if the sequence     counter changes across the ILOCK cycle.

    CVE-2026-43456:
    In the Linux kernel, the following vulnerability has been resolved:

    bonding: fix type confusion in bond_setup_by_slave()

    kernel BUG at net/core/skbuff.c:2306!     Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI     RIP: 0010:pskb_expand_head+0xa08/0xfe0 net/core/skbuff.c:2306     RSP: 0018:ffffc90004aff760 EFLAGS: 00010293     RAX: 0000000000000000 RBX: ffff88807e3c8780 RCX: ffffffff89593e0e     RDX: ffff88807b7c4900 RSI: ffffffff89594747 RDI: ffff88807b7c4900     RBP: 0000000000000820 R08: 0000000000000005 R09: 0000000000000000     R10: 00000000961a63e0 R11: 0000000000000000 R12: ffff88807e3c8780     R13: 00000000961a6560 R14: dffffc0000000000 R15: 00000000961a63e0     CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033     CR2: 00007fe1a0ed8df0 CR3: 000000002d816000 CR4: 00000000003526f0     Call Trace:
     <TASK>      ipgre_header+0xdd/0x540 net/ipv4/ip_gre.c:900      dev_hard_header include/linux/netdevice.h:3439 [inline]      packet_snd net/packet/af_packet.c:3028 [inline]      packet_sendmsg+0x3ae5/0x53c0 net/packet/af_packet.c:3108      sock_sendmsg_nosec net/socket.c:727 [inline]
     __sock_sendmsg net/socket.c:742 [inline]
     ____sys_sendmsg+0xa54/0xc30 net/socket.c:2592
     ___sys_sendmsg+0x190/0x1e0 net/socket.c:2646
     __sys_sendmsg+0x170/0x220 net/socket.c:2678      do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]      do_syscall_64+0x106/0xf80 arch/x86/entry/syscall_64.c:94      entry_SYSCALL_64_after_hwframe+0x77/0x7f     RIP: 0033:0x7fe1a0e6c1a9

    When a non-Ethernet device (e.g. GRE tunnel) is enslaved to a bond,     bond_setup_by_slave() directly copies the slave's header_ops to the     bond device:

      bond_dev->header_ops = slave_dev->header_ops;

    This causes a type confusion when dev_hard_header() is later called     on the bond device. Functions like ipgre_header(), ip6gre_header(),all use     netdev_priv(dev) to access their device-specific private data. When     called with the bond device, netdev_priv() returns the bond's private     data (struct bonding) instead of the expected type (e.g. struct     ip_tunnel), leading to garbage values being read and kernel crashes.

    Fix this by introducing bond_header_ops with wrapper functions that     delegate to the active slave's header_ops using the slave's own     device. This ensures netdev_priv() in the slave's header functions     always receives the correct device.

    The fix is placed in the bonding driver rather than individual device     drivers, as the root cause is bond blindly inheriting header_ops from     the slave without considering that these callbacks expect a specific     netdev_priv() layout.

    The type confusion can be observed by adding a printk in     ipgre_header() and running the following commands:

      ip link add dummy0 type dummy       ip addr add 10.0.0.1/24 dev dummy0       ip link set dummy0 up       ip link add gre1 type gre local 10.0.0.1       ip link add bond1 type bond mode active-backup       ip link set gre1 master bond1       ip link set gre1 up       ip link set bond1 up       ip addr add fe80::1/64 dev bond1

    CVE-2026-23451:
    In the Linux kernel, the following vulnerability has been resolved:

    team: fix header_ops type confusion with non-Ethernet ports

    Similar to commit 950803f72547 (bonding: fix type confusion in     bond_setup_by_slave()) team has the same class of header_ops type     confusion.

    For non-Ethernet ports, team_setup_by_port() copies port_dev->header_ops     directly. When the team device later calls dev_hard_header() or     dev_parse_header(), these callbacks can run with the team net_device     instead of the real lower device, so netdev_priv(dev) is interpreted as     the wrong private type and can crash.

    The syzbot report shows a crash in bond_header_create(), but the root     cause is in team: the topology is gre -> bond -> team, and team calls     the inherited header_ops with its own net_device instead of the lower     device, so bond_header_create() receives a team device and interprets     netdev_priv() as bonding private data, causing a type confusion crash.

    Fix this by introducing team header_ops wrappers for create/parse,     selecting a team port under RCU, and calling the lower device callbacks     with port->dev, so each callback always sees the correct net_device     context.

    Also pass the selected lower device to the lower parse callback, so     recursion is bounded in stacked non-Ethernet topologies and parse     callbacks always run with the correct device context.

    CVE-2026-64600:
    In the Linux kernel, the following vulnerability has been resolved:

    bonding: prevent potential infinite loop in bond_header_parse()

    bond_header_parse() can loop if a stack of two bonding devices is setup,     because skb->dev always points to the hierarchy top.

    Add new const struct net_device *dev parameter to     (struct header_ops)->parse() method to make sure the recursion     is bounded, and that the final leaf parse method is called.

    CVE-2026-64564:
    In the Linux kernel, the following vulnerability has been resolved: sctp: don't free the ASCONF's own     transport in DEL-IP processing. sctp_process_asconf() caches the transport the ASCONF chunk is processed     against in asconf->transport. For an ASCONF located through its Address Parameter, that cached transport     corresponds to the Address Parameter, which need not be the packet's source address. A single ASCONF can     carry DEL-IP for the cached transport followed by a wildcard DEL-IP, causing use-after-free of the freed     transport.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6415 advisory.

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-6415-1                   security@debian.org     https://www.debian.org/security/                     Salvatore Bonaccorso     August 06, 2026                       https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : linux     CVE ID         : CVE-2025-40098 CVE-2026-45897 CVE-2026-45901 CVE-2026-53078                      CVE-2026-53090 CVE-2026-64205 CVE-2026-64280 CVE-2026-64290                      CVE-2026-64561 CVE-2026-64562 CVE-2026-64563 CVE-2026-64564                      CVE-2026-64565 CVE-2026-64567 CVE-2026-64568 CVE-2026-64569                      CVE-2026-64570 CVE-2026-64571 CVE-2026-64572 CVE-2026-64573                      CVE-2026-64574 CVE-2026-64576 CVE-2026-64577 CVE-2026-64578                      CVE-2026-64579 CVE-2026-64580 CVE-2026-64583 CVE-2026-64584     Debian Bug     : 1143721

    Several vulnerabilities have been discovered in the Linux kernel that     may lead to a privilege escalation, denial of service or information     leaks.

    For the stable distribution (trixie), these problems have been fixed in     version 6.12.101-1.

    We recommend that you upgrade your linux packages.

    For the detailed security status of linux please refer to its security     tracker page at:
    https://security-tracker.debian.org/tracker/linux

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - sctp: don't free the ASCONF's own transport in DEL-IP processing sctp_process_asconf() caches the     transport the ASCONF chunk is processed against in asconf->transport (== chunk->transport, set once in     sctp_rcv()). For an ASCONF located through its Address Parameter by __sctp_rcv_asconf_lookup(), that     cached transport corresponds to the Address Parameter, which need not be the packet's source address.
    sctp_process_asconf_param() rejects a DEL-IP for the packet source address (ADDIP D8,     SCTP_ERROR_DEL_SRC_IP), but nothing protects asconf->transport. A single ASCONF can therefore carry, in     order: [Address Parameter L] [DEL-IP L] [DEL-IP 0.0.0.0] where L differs from the source. The DEL-IP for L     passes the D8 check and calls sctp_assoc_rm_peer() on the transport that asconf->transport still points     at, freeing it (RCU-deferred). The following wildcard DEL-IP then reuses the now-dangling     asconf->transport in sctp_assoc_set_primary() and sctp_assoc_del_nonprimary_peers(): set_primary()     dereferences the freed transport (->ipaddr, ->state) and plants the dangling pointer into     asoc->peer.primary_path / active_path, and del_nonprimary_peers(), keeping only the pointer that is no     longer on the list, removes every real transport, leaving the association with a transport_count of 0 and     primary_path/active_path pointing at freed memory. Reject a DEL-IP that targets the transport the ASCONF     is being processed against, mirroring the existing source-address guard, so the wildcard branch can never     reuse a freed transport. (CVE-2026-64564)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
339710	CentOS 9 : kernel-5.14.0-741.el9	Nessus	CentOS Local Security Checks	Local	critical
337079	Debian dla-4745 : ata-modules-6.12.100+deb12-armmp-di - security update	Nessus	Debian Local Security Checks	Local	medium
336611	Unity Linux 20.1050a Security Update: kernel (UTSA-2026-099242)	Nessus	Unity Linux Local Security Checks	Local	critical
335327	SUSE SLES15: cluster-md-kmp-default / dlm-kmp-default / gfs2-kmp-default / etc (SUSE-SU-2026:3602-1)	Nessus	SuSE Local Security Checks	Local	high
335101	SUSE SLES15: cluster-md-kmp-default / dlm-kmp-default / gfs2-kmp-default / etc (SUSE-SU-2026:3595-1)	Nessus	SuSE Local Security Checks	Local	high
335098	SUSE SLES15: cluster-md-kmp-default / dlm-kmp-default / gfs2-kmp-default / etc (SUSE-SU-2026:3593-1)	Nessus	SuSE Local Security Checks	Local	high
335089	SUSE SLES12: cluster-md-kmp-default / dlm-kmp-default / gfs2-kmp-default / etc (SUSE-SU-2026:3594-1)	Nessus	SuSE Local Security Checks	Local	high
335080	openSUSE 16: cluster-md-kmp-64kb / cluster-md-kmp-azure / cluster-md-kmp-default / etc (openSUSE-SU-2026:21555-1)	Nessus	SuSE Local Security Checks	Local	high
334784	Photon OS 5.0: Linux PHSA-2026-5.0-92-0952	Nessus	PhotonOS Local Security Checks	Local	medium
333145	TencentOS Server 2: kernel (TSSA-2026:0797)	Nessus	Tencent Local Security Checks	Local	critical
333137	TencentOS Server 3: kernel (TSSA-2026:0793)	Nessus	Tencent Local Security Checks	Local	critical
333128	TencentOS Server 4: kernel (TSSA-2026:0792)	Nessus	Tencent Local Security Checks	Local	critical
333127	TencentOS Server 3: kernel (TSSA-2026:0796)	Nessus	Tencent Local Security Checks	Local	critical
333110	Debian dsa-6415 : ata-modules-6.12.100+deb13-armmp-di - security update	Nessus	Debian Local Security Checks	Local	medium
331886	Linux Distros Unpatched Vulnerability : CVE-2026-64564	Nessus	Misc.	Local	critical

Detections

Analytics

CVE-2026-64564

critical

Tenable Plugins

critical

medium

critical

high

high

high

high

high

medium

critical

critical

critical

critical

medium

critical