In the Linux kernel, the following vulnerability has been resolved: iomap: fix out-of-bounds bitmap_set() with zero-length range ifs_set_range_dirty() and ifs_set_range_uptodate() compute last_blk as (off + len - 1) >> i_blkbits. When off is 0 and len is 0, the unsigned subtraction underflows to SIZE_MAX, producing a huge last_blk and nr_blks value that causes bitmap_set() to write far beyond the ifs->state allocation. Regarding ifs_set_range_uptodate(), it is temporarily safe because len cannot be passed in as 0. However, for ifs_set_range_dirty() this is reachable from __iomap_write_end(): when copy_folio_from_iter_atomic() returns 0 (e.g. user buffer fault) and the folio is already uptodate, the guard at the top of __iomap_write_end() does not trigger because !folio_test_uptodate() is false, and iomap_set_range_dirty() is called with copied == 0. Add a !len guard to both functions before the computation, so that a zero-length range is a no-op.

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:63129 advisory.

    * kernel: smc: Fix use-after-free in __pnet_find_base_ndev() (CVE-2025-40064)
      * kernel: Linux kernel: Denial of Service due to memory leak in tpm2_load_cmd (CVE-2025-71147)
      * kernel: bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CVE-2026-45970)
      * kernel: smb/client: fix out-of-bounds read in symlink_data() (CVE-2026-46185)
      * kernel: Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CVE-2026-53073)
      * kernel: pNFS: Fix use-after-free in pnfs_update_layout() (CVE-2026-63800)
      * kernel: nfsd: fix posix_acl leak on SETACL decode failure (CVE-2026-53397)
      * kernel: exfat: fix potential use-after-free in exfat_find_dir_entry() (CVE-2026-63808)
      * kernel: nfsd: release layout stid on setlease failure (CVE-2026-53399)
      * kernel: NFSv4/flexfiles: reject zero filehandle version count (CVE-2026-53392)
      * kernel: KEYS: fix overflow in keyctl_pkey_params_get_2() (CVE-2026-63824)
      * kernel: NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CVE-2026-53391)
      * kernel: scsi: target: iscsi: Validate CHAP_R length before base64 decode (CVE-2026-63886)
      * kernel: ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table()     (CVE-2026-64002)
      * kernel: net: mana: validate rx_req_idx to prevent out-of-bounds array access (CVE-2026-64018)
      * kernel: scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (CVE-2026-63887)
      * kernel: smb: client: fix query directory replay double-free (CVE-2026-64387)
      * kernel: Kernel: Remote out-of-bounds write in RDMA/siw (CVE-2026-64268)
      * kernel: crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (CVE-2026-64438)
      * kernel: crypto: qat - validate RSA CRT component lengths (CVE-2026-64304)
      * kernel: NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CVE-2026-64298)
      * kernel: ALSA: virtio: Validate control metadata from the device (CVE-2026-64490)
      * kernel: AMD-SN-7061: Safe RET Interrupt Vulnerability (CVE-2026-68480)
      * kernel: Linux kernel: Arbitrary code execution via userfaultfd shadow stack manipulation     (CVE-2026-68166)
      * kernel: iomap: fix out-of-bounds bitmap_set() with zero-length range (CVE-2026-68145)
      * kernel: locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (CVE-2026-72069)
      * kernel: nvmet-auth: reject short AUTH_RECEIVE buffers (CVE-2026-72130)


    Bug Fix(es) and Enhancement(s):

      * [AlmaLinux 9] TPM becomes completely unresponsive and requires a full reboot to clear     [almalinux-9.8.z] (JIRA:AlmaLinux-213940)
      * RT scheduler livelock caused by missing backport of 94894c9c477e [almalinux-9.8.z]     (JIRA:AlmaLinux-240634)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-631290 advisory.

    - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684]     {CVE-2026-72069}
    - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191]     {CVE-2026-68145}
    - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191]     {CVE-2026-68145}
    - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461]     {CVE-2026-63808}
    - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot)     [RHEL-227266] {CVE-2026-64002}
    - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126]     {CVE-2026-53073}
    - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi)     [RHEL-213202] {CVE-2026-63887}
    - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130}
    - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064}
    - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166}
    - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043]     {CVE-2026-64298}
    - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399}
    - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392}
    - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038]     {CVE-2026-53391}
    - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800}
    - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397}
    - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488]     {CVE-2026-64438}
    - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824}
    - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627]     {CVE-2026-63824}
    - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480}
    - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304}
    - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886}
    - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664]     {CVE-2026-63886}
    - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139]     {CVE-2026-64490}
    - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228]     {CVE-2026-64018}
    - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185}
    - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285]     {CVE-2026-45970}
    - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525]     {CVE-2026-64268}
    - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:63128 advisory.

    * kernel: Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CVE-2026-53073)
      * kernel: exfat: fix potential use-after-free in exfat_find_dir_entry() (CVE-2026-63808)
      * kernel: KEYS: fix overflow in keyctl_pkey_params_get_2() (CVE-2026-63824)
      * kernel: smb: client: fix query directory replay double-free (CVE-2026-64387)
      * kernel: iomap: fix out-of-bounds bitmap_set() with zero-length range (CVE-2026-68145)
      * kernel: net: ipv6: use-after-free in fib6_rule_suppress due to stale res->rt6 pointer (CVE-2026-74581)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the kernel-5.14.0-742.el9 build changelog.

  - In the Linux kernel, the following vulnerability has been resolved: xen/privcmd: fix double free via VMA     splitting privcmd_vm_ops defines .close (privcmd_close), but neither .may_split nor .open. When userspace     does a partial munmap() on a privcmd mapping, the kernel splits the VMA via __split_vma(). Since may_split     is NULL, the split is allowed. vm_area_dup() copies vm_private_data (a pages array allocated in     alloc_empty_pages()) into the new VMA without any fixup, because there is no .open callback. Both VMAs now     point to the same pages array. When the unmapped portion is closed, privcmd_close() calls: -     xen_unmap_domain_gfn_range() - xen_free_unpopulated_pages() - kvfree(pages) The surviving VMA still holds     the dangling pointer. When it is later destroyed, the same sequence runs again, which leads to a double     free. Fix this issue by adding a .may_split callback denying the VMA split. This is XSA-487 /     CVE-2026-31787 (CVE-2026-31787)

  - In the Linux kernel, the following vulnerability has been resolved: Buffer overflow in drivers/xen/sys-     hypervisor.c The build id returned by HYPERVISOR_xen_version(XENVER_build_id) is neither NUL terminated     nor a string. The first causes a buffer overflow as sprintf in buildid_show will read and copy till it     finds a NUL. 00000000 f4 91 51 f4 dd 38 9e 9d 65 47 52 eb 10 71 db 50 |..Q..8..eGR..q.P| 00000010 b9 a8 01     42 6f 2e 32 |...Bo.2| 00000017 So use a memcpy instead of sprintf to have the correct value: 00000000 f4     91 51 f4 dd 00 9e 9d 65 47 52 eb 10 71 db 50 |..Q.....eGR..q.P| 00000010 b9 a8 01 42 |...B| 00000014 (the     above have a hack to embed a zero inside and check it's returned correctly). This is XSA-485 /     CVE-2026-31786 (CVE-2026-31786)

  - In the Linux kernel, the following vulnerability has been resolved: sctp: diag: reject stale associations     in dump_one path The SCTP exact sock_diag lookup can hold a transport reference, block on lock_sock(sk),     and then resume after sctp_association_free() has marked the association dead and freed its bind address     list. When that happens, inet_assoc_attr_size() and inet_diag_msg_sctpasoc_fill() can still dereference     association state that is no longer valid for reporting. In particular, inet_diag_msg_sctpasoc_fill() may     read an empty bind-address list as a real sctp_sockaddr_entry and trigger an out-of-bounds read from     unrelated association memory. Reject the association after taking the socket lock if it has been reaped or     detached from the endpoint, and report the lookup as stale. This keeps the exact dump-one path from     formatting torn association state. (CVE-2026-52917)

  - In the Linux kernel, the following vulnerability has been resolved: NFSv4/pNFS: reject zero-length r_addr     in nfs4_decode_mp_ds_addr nfs4_decode_mp_ds_addr() decodes the r_netid and r_addr opaques of a netaddr4     from a GETDEVICEINFO multipath-DS body, then immediately calls strrchr(buf, '.') to locate the port     separator. Both decodes use xdr_stream_decode_string_dup(), and the current code checks only nlen < 0 /     rlen < 0 before dereferencing the returned string. When the on-wire opaque has length zero,     xdr_stream_decode_opaque_inline() returns 0 and xdr_stream_decode_string_dup() falls through to its *str     = NULL; return ret tail, leaving buf NULL with a return value of 0. The < 0 check does not catch this,     and the next line is strrchr(NULL, '.'), a kernel NULL pointer dereference reachable from any pNFS-     flexfile client mounted against a malicious or compromised metadata server. Reject the zero-length cases     explicitly so the decoder fails with -EBADMSG (treated as a malformed GETDEVICEINFO body) instead of     panicking the client. (CVE-2026-53391)

  - In the Linux kernel, the following vulnerability has been resolved: NFSv4/flexfiles: reject zero     filehandle version count ff_layout_alloc_lseg() decodes the filehandle-version array count from the     flexfiles layout body. The value is used as the count for kzalloc_objs(), and the current code only     rejects NULL. A zero count yields ZERO_SIZE_PTR, which can be stored in dss_info->fh_versions even though     later flexfiles paths assume that at least one filehandle version exists. Reject fh_count == 0 before the     allocation, matching the existing zero version_count validation in the flexfiles GETDEVICEINFO parser. A     QEMU/KASAN run with a malformed flexfiles layout hit: KASAN: null-ptr-deref in range     [0x0000000000000010-0x0000000000000017] RIP: 0010:ff_layout_encode_ff_layoutupdate.isra.0+0x15f/0x750     ff_layout_encode_layoutreturn+0x683/0x970 nfs4_xdr_enc_layoutreturn+0x278/0x3a0 Kernel panic - not     syncing: Fatal exception The patched kernel rejects the malformed layout without KASAN/oops/panic, and a     valid fh_count=1 regression still opens, reads, and unmounts cleanly. (CVE-2026-53392)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-631280 advisory.

    - net: ipv6: clear suppressed fib6 rule result (Jamie Bainbridge) [RHEL-246368] {CVE-2026-74581}
    - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240183]     {CVE-2026-68145}
    - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231559]     {CVE-2026-63808}
    - KEYS: fix overflow in keyctl_pkey_params_get_2() (CKI Backport Bot) [RHEL-229621] {CVE-2026-63824}
    - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223128]     {CVE-2026-53073}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:63128 advisory.

    * kernel: Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CVE-2026-53073)

    * kernel: exfat: fix potential use-after-free in exfat_find_dir_entry() (CVE-2026-63808)

    * kernel: KEYS: fix overflow in keyctl_pkey_params_get_2() (CVE-2026-63824)

    * kernel: smb: client: fix query directory replay double-free (CVE-2026-64387)

    * kernel: iomap: fix out-of-bounds bitmap_set() with zero-length range (CVE-2026-68145)

    * kernel: net: ipv6: use-after-free in fib6_rule_suppress due to stale res->rt6 pointer (CVE-2026-74581)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:63129 advisory.

    * kernel: smc: Fix use-after-free in __pnet_find_base_ndev() (CVE-2025-40064)

    * kernel: Linux kernel: Denial of Service due to memory leak in tpm2_load_cmd (CVE-2025-71147)

    * kernel: bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CVE-2026-45970)

    * kernel: smb/client: fix out-of-bounds read in symlink_data() (CVE-2026-46185)

    * kernel: Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CVE-2026-53073)

    * kernel: pNFS: Fix use-after-free in pnfs_update_layout() (CVE-2026-63800)

    * kernel: nfsd: fix posix_acl leak on SETACL decode failure (CVE-2026-53397)

    * kernel: exfat: fix potential use-after-free in exfat_find_dir_entry() (CVE-2026-63808)

    * kernel: nfsd: release layout stid on setlease failure (CVE-2026-53399)

    * kernel: NFSv4/flexfiles: reject zero filehandle version count (CVE-2026-53392)

    * kernel: KEYS: fix overflow in keyctl_pkey_params_get_2() (CVE-2026-63824)

    * kernel: NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CVE-2026-53391)

    * kernel: scsi: target: iscsi: Validate CHAP_R length before base64 decode (CVE-2026-63886)

    * kernel: ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table()     (CVE-2026-64002)

    * kernel: net: mana: validate rx_req_idx to prevent out-of-bounds array access (CVE-2026-64018)

    * kernel: scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (CVE-2026-63887)

    * kernel: smb: client: fix query directory replay double-free (CVE-2026-64387)

    * kernel: Kernel: Remote out-of-bounds write in RDMA/siw (CVE-2026-64268)

    * kernel: crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (CVE-2026-64438)

    * kernel: crypto: qat - validate RSA CRT component lengths (CVE-2026-64304)

    * kernel: NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CVE-2026-64298)

    * kernel: ALSA: virtio: Validate control metadata from the device (CVE-2026-64490)

    * kernel: AMD-SN-7061: Safe RET Interrupt Vulnerability (CVE-2026-68480)

    * kernel: Linux kernel: Arbitrary code execution via userfaultfd shadow stack manipulation     (CVE-2026-68166)

    * kernel: iomap: fix out-of-bounds bitmap_set() with zero-length range (CVE-2026-68145)

    * kernel: locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (CVE-2026-72069)

    * kernel: nvmet-auth: reject short AUTH_RECEIVE buffers (CVE-2026-72130)

    Bug Fix(es) and Enhancement(s):

    * [Rocky Linux 9] TPM becomes completely unresponsive and requires a full reboot to clear [rhel-9.8.z]     (JIRA:Rocky Linux-213940)

    * RT scheduler livelock caused by missing backport of 94894c9c477e [rhel-9.8.z] (JIRA:Rocky Linux-240634)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:63129 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: smc: Fix use-after-free in __pnet_find_base_ndev() (CVE-2025-40064)

    * kernel: Linux kernel: Denial of Service due to memory leak in tpm2_load_cmd (CVE-2025-71147)

    * kernel: bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CVE-2026-45970)

    * kernel: smb/client: fix out-of-bounds read in symlink_data() (CVE-2026-46185)

    * kernel: Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CVE-2026-53073)

    * kernel: pNFS: Fix use-after-free in pnfs_update_layout() (CVE-2026-63800)

    * kernel: nfsd: fix posix_acl leak on SETACL decode failure (CVE-2026-53397)

    * kernel: exfat: fix potential use-after-free in exfat_find_dir_entry() (CVE-2026-63808)

    * kernel: nfsd: release layout stid on setlease failure (CVE-2026-53399)

    * kernel: NFSv4/flexfiles: reject zero filehandle version count (CVE-2026-53392)

    * kernel: KEYS: fix overflow in keyctl_pkey_params_get_2() (CVE-2026-63824)

    * kernel: NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CVE-2026-53391)

    * kernel: scsi: target: iscsi: Validate CHAP_R length before base64 decode (CVE-2026-63886)

    * kernel: ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table()     (CVE-2026-64002)

    * kernel: net: mana: validate rx_req_idx to prevent out-of-bounds array access (CVE-2026-64018)

    * kernel: scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (CVE-2026-63887)

    * kernel: smb: client: fix query directory replay double-free (CVE-2026-64387)

    * kernel: Kernel: Remote out-of-bounds write in RDMA/siw (CVE-2026-64268)

    * kernel: crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (CVE-2026-64438)

    * kernel: crypto: qat - validate RSA CRT component lengths (CVE-2026-64304)

    * kernel: NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CVE-2026-64298)

    * kernel: ALSA: virtio: Validate control metadata from the device (CVE-2026-64490)

    * kernel: AMD-SN-7061: Safe RET Interrupt Vulnerability (CVE-2026-68480)

    * kernel: Linux kernel: Arbitrary code execution via userfaultfd shadow stack manipulation     (CVE-2026-68166)

    * kernel: iomap: fix out-of-bounds bitmap_set() with zero-length range (CVE-2026-68145)

    * kernel: locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (CVE-2026-72069)

    * kernel: nvmet-auth: reject short AUTH_RECEIVE buffers (CVE-2026-72130)

    Bug Fix(es) and Enhancement(s):

    * [RHEL 9] TPM becomes completely unresponsive and requires a full reboot to clear [rhel-9.8.z]     (JIRA:RHEL-213940)

    * RT scheduler livelock caused by missing backport of 94894c9c477e [rhel-9.8.z] (JIRA:RHEL-240634)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:63128 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CVE-2026-53073)

    * kernel: exfat: fix potential use-after-free in exfat_find_dir_entry() (CVE-2026-63808)

    * kernel: KEYS: fix overflow in keyctl_pkey_params_get_2() (CVE-2026-63824)

    * kernel: smb: client: fix query directory replay double-free (CVE-2026-64387)

    * kernel: iomap: fix out-of-bounds bitmap_set() with zero-length range (CVE-2026-68145)

    * kernel: net: ipv6: use-after-free in fib6_rule_suppress due to stale res->rt6 pointer (CVE-2026-74581)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4745 advisory.

    -------------------------------------------------------------------------     Debian LTS Advisory DLA-4745-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                        Ben Hutchings     August 18, 2026                               https://wiki.debian.org/LTS
    -------------------------------------------------------------------------

    Package        : linux-6.12     Version        : 6.12.101-1~deb12u1     CVE ID         : CVE-2025-40098 CVE-2026-45897 CVE-2026-45901 CVE-2026-53078                      CVE-2026-53090 CVE-2026-64205 CVE-2026-64280 CVE-2026-64290                      CVE-2026-64561 CVE-2026-64562 CVE-2026-64563 CVE-2026-64564                      CVE-2026-64565 CVE-2026-64567 CVE-2026-64568 CVE-2026-64569                      CVE-2026-64570 CVE-2026-64571 CVE-2026-64572 CVE-2026-64573                      CVE-2026-64574 CVE-2026-64576 CVE-2026-64577 CVE-2026-64578                      CVE-2026-64579 CVE-2026-64580 CVE-2026-64583 CVE-2026-64584                      CVE-2026-68093 CVE-2026-68096 CVE-2026-68097 CVE-2026-68098                      CVE-2026-68099 CVE-2026-68100 CVE-2026-68102 CVE-2026-68104                      CVE-2026-68106 CVE-2026-68107 CVE-2026-68108 CVE-2026-68110                      CVE-2026-68111 CVE-2026-68112 CVE-2026-68113 CVE-2026-68115                      CVE-2026-68116 CVE-2026-68117 CVE-2026-68119 CVE-2026-68120                      CVE-2026-68121 CVE-2026-68123 CVE-2026-68124 CVE-2026-68125                      CVE-2026-68126 CVE-2026-68127 CVE-2026-68128 CVE-2026-68129                      CVE-2026-68130 CVE-2026-68131 CVE-2026-68133 CVE-2026-68135                      CVE-2026-68136 CVE-2026-68137 CVE-2026-68139 CVE-2026-68140                      CVE-2026-68141 CVE-2026-68142 CVE-2026-68143 CVE-2026-68144                      CVE-2026-68145 CVE-2026-68146 CVE-2026-68147 CVE-2026-68148                      CVE-2026-68149 CVE-2026-68151 CVE-2026-68152 CVE-2026-68153                      CVE-2026-68154 CVE-2026-68155 CVE-2026-68156 CVE-2026-68157                      CVE-2026-68158 CVE-2026-68160 CVE-2026-68161 CVE-2026-68162                      CVE-2026-68164 CVE-2026-68165 CVE-2026-68175 CVE-2026-68176                      CVE-2026-68178 CVE-2026-68179 CVE-2026-68180 CVE-2026-68181                      CVE-2026-68182 CVE-2026-68183 CVE-2026-68184 CVE-2026-68185                      CVE-2026-68186 CVE-2026-68187 CVE-2026-68188 CVE-2026-68189                      CVE-2026-68190 CVE-2026-68192 CVE-2026-68193 CVE-2026-68194                      CVE-2026-68195 CVE-2026-68196 CVE-2026-68197 CVE-2026-68199                      CVE-2026-68200 CVE-2026-68201 CVE-2026-68202 CVE-2026-68203                      CVE-2026-68204 CVE-2026-68205 CVE-2026-68206 CVE-2026-68207                      CVE-2026-68209 CVE-2026-68210 CVE-2026-68212 CVE-2026-68213                      CVE-2026-68214 CVE-2026-68215 CVE-2026-68216 CVE-2026-68217                      CVE-2026-68218 CVE-2026-68219 CVE-2026-68220 CVE-2026-68221                      CVE-2026-68222 CVE-2026-68223 CVE-2026-68225 CVE-2026-68226                      CVE-2026-68227 CVE-2026-68228 CVE-2026-68229 CVE-2026-68231                      CVE-2026-68234 CVE-2026-68235 CVE-2026-68236 CVE-2026-68243                      CVE-2026-68244 CVE-2026-68245 CVE-2026-68246 CVE-2026-68247                      CVE-2026-68248 CVE-2026-68249 CVE-2026-68250 CVE-2026-68251                      CVE-2026-68252 CVE-2026-68255 CVE-2026-68256 CVE-2026-68257                      CVE-2026-68259 CVE-2026-68260 CVE-2026-68261 CVE-2026-68262                      CVE-2026-68263 CVE-2026-68269 CVE-2026-68271 CVE-2026-68272                      CVE-2026-68277 CVE-2026-68278 CVE-2026-68279 CVE-2026-68280                      CVE-2026-68281 CVE-2026-68284 CVE-2026-68290 CVE-2026-68293                      CVE-2026-68294 CVE-2026-68296 CVE-2026-68297 CVE-2026-68299                      CVE-2026-68300 CVE-2026-68301 CVE-2026-68302 CVE-2026-68304                      CVE-2026-68306 CVE-2026-68307 CVE-2026-68308 CVE-2026-68309                      CVE-2026-68310 CVE-2026-68311 CVE-2026-68313 CVE-2026-68314                      CVE-2026-68315 CVE-2026-68317 CVE-2026-68318 CVE-2026-68319                      CVE-2026-68320 CVE-2026-68321 CVE-2026-68324 CVE-2026-68325                      CVE-2026-68326 CVE-2026-68327 CVE-2026-68328 CVE-2026-68329                      CVE-2026-68331 CVE-2026-68333 CVE-2026-68335 CVE-2026-68336                      CVE-2026-68338 CVE-2026-68339 CVE-2026-68340 CVE-2026-68343                      CVE-2026-68344 CVE-2026-68346 CVE-2026-68348 CVE-2026-68349                      CVE-2026-68350 CVE-2026-68351 CVE-2026-68352 CVE-2026-68353                      CVE-2026-68354 CVE-2026-68355 CVE-2026-68357 CVE-2026-68358                      CVE-2026-68359 CVE-2026-68360 CVE-2026-68361 CVE-2026-68362                      CVE-2026-68363 CVE-2026-68365 CVE-2026-68366 CVE-2026-68368                      CVE-2026-68369 CVE-2026-68370 CVE-2026-68371 CVE-2026-68372                      CVE-2026-68373 CVE-2026-68374 CVE-2026-68376 CVE-2026-68377                      CVE-2026-68381 CVE-2026-68385 CVE-2026-68386 CVE-2026-68388                      CVE-2026-68389 CVE-2026-68391 CVE-2026-68392 CVE-2026-68394                      CVE-2026-68395 CVE-2026-68396 CVE-2026-68397 CVE-2026-68398                      CVE-2026-68402 CVE-2026-68403 CVE-2026-68405 CVE-2026-68406                      CVE-2026-68407 CVE-2026-68408 CVE-2026-68410 CVE-2026-68411                      CVE-2026-68413 CVE-2026-68414 CVE-2026-68416 CVE-2026-68417                      CVE-2026-68419 CVE-2026-68422 CVE-2026-68425 CVE-2026-68427                      CVE-2026-68428 CVE-2026-68429 CVE-2026-68430 CVE-2026-68432                      CVE-2026-68433 CVE-2026-68434 CVE-2026-68437 CVE-2026-68439                      CVE-2026-68442 CVE-2026-68443 CVE-2026-68444 CVE-2026-68445                      CVE-2026-68446 CVE-2026-68449 CVE-2026-68450 CVE-2026-72015                      CVE-2026-72017 CVE-2026-72023 CVE-2026-72030 CVE-2026-72032                      CVE-2026-72040 CVE-2026-72045 CVE-2026-72046 CVE-2026-72051                      CVE-2026-72062 CVE-2026-72065 CVE-2026-72069 CVE-2026-72070                      CVE-2026-72101 CVE-2026-72103 CVE-2026-72113 CVE-2026-72114                      CVE-2026-72115 CVE-2026-72116 CVE-2026-72117 CVE-2026-72118                      CVE-2026-72119 CVE-2026-72121 CVE-2026-72124 CVE-2026-72125                      CVE-2026-72130 CVE-2026-72137 CVE-2026-72142 CVE-2026-72146                      CVE-2026-72147 CVE-2026-72168 CVE-2026-72175 CVE-2026-72183                      CVE-2026-72213 CVE-2026-72244 CVE-2026-72253 CVE-2026-72254                      CVE-2026-72260 CVE-2026-72299 CVE-2026-72305 CVE-2026-72372                      CVE-2026-74436     Debian Bug     : 1143721

    Several vulnerabilities have been discovered in the Linux kernel that     may lead to a privilege escalation, denial of service or information     leaks.  This update additionally includes many more bug fixes from     stable update 6.12.101.

    For Debian 12 bookworm, these problems have been fixed in version     6.12.101-1~deb12u1.

    We recommend that you upgrade your linux-6.12 packages.

    For the detailed security status of linux-6.12 please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/linux-6.12

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS     Attachment:
    signature.asc     Description: PGP signature

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the linux package has been released.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - iomap: fix out-of-bounds bitmap_set() with zero-length range ifs_set_range_dirty() and     ifs_set_range_uptodate() compute last_blk as (off + len - 1) >> i_blkbits. When off is 0 and len is 0, the     unsigned subtraction underflows to SIZE_MAX, producing a huge last_blk and nr_blks value that causes     bitmap_set() to write far beyond the ifs->state allocation. Regarding ifs_set_range_uptodate(), it is     temporarily safe because len cannot be passed in as 0. However, for ifs_set_range_dirty() this is     reachable from __iomap_write_end(): when copy_folio_from_iter_atomic() returns 0 (e.g. user buffer fault)     and the folio is already uptodate, the guard at the top of __iomap_write_end() does not trigger because     !folio_test_uptodate() is false, and iomap_set_range_dirty() is called with copied == 0. Add a !len guard     to both functions before the computation, so that a zero-length range is a no-op. (CVE-2026-68145)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
347900	SUSE SLED15: cluster-md-kmp-default / dlm-kmp-default / gfs2-kmp-default / etc (SUSE-SU-2026:4254-1)	Nessus	SuSE Local Security Checks	Local	high
344513	AlmaLinux 9 : kernel (ALSA-2026:63129)	Nessus	Alma Linux Local Security Checks	Local	medium
344280	Oracle Linux 9 : ELSA-2026-63129-0: / kernel (ELSA-2026-631290)	Nessus	Oracle Linux Local Security Checks	Local	medium
344044	AlmaLinux 10 : kernel (ALSA-2026:63128)	Nessus	Alma Linux Local Security Checks	Local	medium
343845	CentOS 9 : kernel-5.14.0-742.el9	Nessus	CentOS Local Security Checks	Local	high
343488	Oracle Linux 10 : ELSA-2026-63128-0: / kernel (ELSA-2026-631280)	Nessus	Oracle Linux Local Security Checks	Local	medium
343110	RockyLinux 10 : kernel (RLSA-2026:63128)	Nessus	Rocky Linux Local Security Checks	Local	medium
343109	RockyLinux 9 : kernel (RLSA-2026:63129)	Nessus	Rocky Linux Local Security Checks	Local	medium
343049	Oracle Linux 10 / 9 : Unbreakable Enterprise kernel (ELSA-2026-500248)	Nessus	Oracle Linux Local Security Checks	Local	high
342785	RHEL 9 : kernel (RHSA-2026:63129)	Nessus	Red Hat Local Security Checks	Local	medium
342784	RHEL 10 : kernel (RHSA-2026:63128)	Nessus	Red Hat Local Security Checks	Local	medium
341899	Amazon Linux 2023 : bpftool6.12, kernel6.12, kernel6.12-devel (ALAS2023-2026-2110)	Nessus	Amazon Linux Local Security Checks	Local	medium
341888	Amazon Linux 2023 : bpftool6.18, kernel6.18, kernel6.18-devel (ALAS2023-2026-2106)	Nessus	Amazon Linux Local Security Checks	Local	high
337079	Debian dla-4745 : ata-modules-6.12.100+deb12-armmp-di - security update	Nessus	Debian Local Security Checks	Local	medium
334784	Photon OS 5.0: Linux PHSA-2026-5.0-92-0952	Nessus	PhotonOS Local Security Checks	Local	high
334677	Linux Distros Unpatched Vulnerability : CVE-2026-68145	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2026-68145

high

Tenable Plugins

high

medium

medium

medium

high

medium

medium

medium

high

medium

medium

medium

high

medium

high

high