In the Linux kernel, the following vulnerability has been resolved: drm/xe/pt: Reset current_op in xe_pt_update_ops_init() xe_pt_update_ops_init() fails to reset current_op to 0. On the vm_bind path, ops_execute() calls xe_pt_update_ops_prepare() inside the xe_validation_guard() / drm_exec_until_all_locked() loop. When that loop retries due to lock contention or OOM eviction (drm_exec_retry_on_contention() / xe_validation_retry_on_oom()), xe_pt_update_ops_prepare() runs again on the same vops, and each call to bind_op_prepare() increments current_op without resetting it. After N retries current_op exceeds the array size allocated by xe_vma_ops_alloc(), causing an out-of-bounds write into SLUB-poisoned memory and a subsequent UAF crash in xe_migrate_update_pgtables_cpu() when reading the corrupted pt_op->bind. Also reset needs_svm_lock and needs_invalidation which are derived in the same prepare pass and would otherwise cause wrong migrate ops selection and redundant TLB invalidation on retry. Fix this by resetting current_op, needs_svm_lock and needs_invalidation in xe_pt_update_ops_init(). v2 (Matt): - Add details in commit message. - Add Fixes tag and Cc to stable@vger.kernel.org (cherry picked from commit 046045543e530605c441063535e7dca0075369a6)

The remote Debian 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4788 advisory.

    -------------------------------------------------------------------------     Debian LTS Advisory DLA-4788-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                        Ben Hutchings     September 19, 2026                            https://wiki.debian.org/LTS
    -------------------------------------------------------------------------

    Package        : linux-6.12     Version        : 6.12.107-1~deb12u1     CVE ID         : CVE-2025-38525 CVE-2025-40054 CVE-2025-40074 CVE-2026-43197                      CVE-2026-53092 CVE-2026-64017 CVE-2026-64216 CVE-2026-64581                      CVE-2026-64586 CVE-2026-68082 CVE-2026-68118 CVE-2026-68132                      CVE-2026-68138 CVE-2026-68159 CVE-2026-68166 CVE-2026-68169                      CVE-2026-68198 CVE-2026-68253 CVE-2026-68254 CVE-2026-68264                      CVE-2026-68266 CVE-2026-68267 CVE-2026-68273 CVE-2026-68276                      CVE-2026-68322 CVE-2026-68367 CVE-2026-68431 CVE-2026-68451                      CVE-2026-68452 CVE-2026-68480 CVE-2026-72111 CVE-2026-74440                      CVE-2026-74441 CVE-2026-74442 CVE-2026-74443 CVE-2026-74444                      CVE-2026-74445 CVE-2026-74446 CVE-2026-74447 CVE-2026-74448                      CVE-2026-74450 CVE-2026-74451 CVE-2026-74452 CVE-2026-74453                      CVE-2026-74454 CVE-2026-74455 CVE-2026-74456 CVE-2026-74457                      CVE-2026-74458 CVE-2026-74459 CVE-2026-74460 CVE-2026-74461                      CVE-2026-74463 CVE-2026-74464 CVE-2026-74465 CVE-2026-74467                      CVE-2026-74468 CVE-2026-74469 CVE-2026-74470 CVE-2026-74471                      CVE-2026-74472 CVE-2026-74473 CVE-2026-74474 CVE-2026-74475                      CVE-2026-74476 CVE-2026-74478 CVE-2026-74479 CVE-2026-74480                      CVE-2026-74481 CVE-2026-74482 CVE-2026-74483 CVE-2026-74484                      CVE-2026-74485 CVE-2026-74487 CVE-2026-74488 CVE-2026-74490                      CVE-2026-74492 CVE-2026-74493 CVE-2026-74494 CVE-2026-74495                      CVE-2026-74497 CVE-2026-74498 CVE-2026-74499 CVE-2026-74500                      CVE-2026-74501 CVE-2026-74502 CVE-2026-74503 CVE-2026-74504                      CVE-2026-74505 CVE-2026-74507 CVE-2026-74508 CVE-2026-74509                      CVE-2026-74510 CVE-2026-74512 CVE-2026-74514 CVE-2026-74515                      CVE-2026-74516 CVE-2026-74517 CVE-2026-74518 CVE-2026-74519                      CVE-2026-74522 CVE-2026-74523 CVE-2026-74524 CVE-2026-74525                      CVE-2026-74531 CVE-2026-74532 CVE-2026-74535 CVE-2026-74536                      CVE-2026-74540 CVE-2026-74541 CVE-2026-74543 CVE-2026-74545                      CVE-2026-74546 CVE-2026-74547 CVE-2026-74548 CVE-2026-74549                      CVE-2026-74550 CVE-2026-74551 CVE-2026-74552 CVE-2026-74553                      CVE-2026-74555 CVE-2026-74556 CVE-2026-74557 CVE-2026-74563                      CVE-2026-74564 CVE-2026-74565 CVE-2026-74566 CVE-2026-74567                      CVE-2026-74569 CVE-2026-74572 CVE-2026-74574 CVE-2026-74575                      CVE-2026-74576 CVE-2026-74577 CVE-2026-74579 CVE-2026-74580                      CVE-2026-74581 CVE-2026-74582 CVE-2026-74583 CVE-2026-74585                      CVE-2026-74586 CVE-2026-74587 CVE-2026-74588 CVE-2026-74589                      CVE-2026-74590 CVE-2026-74592 CVE-2026-74594 CVE-2026-74595                      CVE-2026-74597 CVE-2026-74598 CVE-2026-74599 CVE-2026-74601                      CVE-2026-74602 CVE-2026-74603 CVE-2026-74604 CVE-2026-74606                      CVE-2026-74607 CVE-2026-74608 CVE-2026-74609 CVE-2026-74610                      CVE-2026-74612 CVE-2026-74613 CVE-2026-74614 CVE-2026-74615                      CVE-2026-74616 CVE-2026-74618 CVE-2026-74619 CVE-2026-74620                      CVE-2026-74621 CVE-2026-74622 CVE-2026-74623 CVE-2026-74624                      CVE-2026-74625 CVE-2026-74626 CVE-2026-74628 CVE-2026-74630                      CVE-2026-74631 CVE-2026-74632 CVE-2026-74634 CVE-2026-74635                      CVE-2026-74636 CVE-2026-74637 CVE-2026-74641 CVE-2026-74644                      CVE-2026-74646 CVE-2026-74647 CVE-2026-74648 CVE-2026-74649                      CVE-2026-74650 CVE-2026-74651 CVE-2026-74653 CVE-2026-74654                      CVE-2026-74655 CVE-2026-74656 CVE-2026-74657 CVE-2026-74658                      CVE-2026-74659 CVE-2026-74660 CVE-2026-74661 CVE-2026-74662                      CVE-2026-74663 CVE-2026-74664 CVE-2026-74665 CVE-2026-74666                      CVE-2026-74667 CVE-2026-74668 CVE-2026-74669 CVE-2026-74670                      CVE-2026-74671 CVE-2026-74672 CVE-2026-74673 CVE-2026-74675                      CVE-2026-74676 CVE-2026-74677 CVE-2026-74678 CVE-2026-74679                      CVE-2026-74680 CVE-2026-74682 CVE-2026-74683 CVE-2026-74684                      CVE-2026-74685 CVE-2026-74688 CVE-2026-74689 CVE-2026-74691                      CVE-2026-74692 CVE-2026-74693 CVE-2026-74694 CVE-2026-74696                      CVE-2026-74700 CVE-2026-74701 CVE-2026-74704 CVE-2026-74705                      CVE-2026-74710 CVE-2026-74712 CVE-2026-74714 CVE-2026-74717                      CVE-2026-74718 CVE-2026-74719 CVE-2026-74720 CVE-2026-74722                      CVE-2026-74724 CVE-2026-74725 CVE-2026-74726 CVE-2026-74730                      CVE-2026-74732 CVE-2026-74736 CVE-2026-74737 CVE-2026-74739                      CVE-2026-74740 CVE-2026-74742 CVE-2026-74743 CVE-2026-74744                      CVE-2026-74746 CVE-2026-74748 CVE-2026-80522 CVE-2026-80525                      CVE-2026-80526 CVE-2026-80527 CVE-2026-80528 CVE-2026-80529                      CVE-2026-80530 CVE-2026-80531 CVE-2026-80532 CVE-2026-80533                      CVE-2026-80534 CVE-2026-80535 CVE-2026-80536 CVE-2026-80539                      CVE-2026-80540 CVE-2026-80541 CVE-2026-80547 CVE-2026-80548                      CVE-2026-80549 CVE-2026-80550 CVE-2026-80551 CVE-2026-80552                      CVE-2026-80553 CVE-2026-80554 CVE-2026-80555 CVE-2026-80556                      CVE-2026-80557 CVE-2026-80558 CVE-2026-80559 CVE-2026-80560                      CVE-2026-80561 CVE-2026-80562 CVE-2026-80563 CVE-2026-80565                      CVE-2026-80566 CVE-2026-80567 CVE-2026-80568 CVE-2026-80569                      CVE-2026-80570 CVE-2026-80572 CVE-2026-80573 CVE-2026-80574                      CVE-2026-80575 CVE-2026-80576 CVE-2026-80577 CVE-2026-80578                      CVE-2026-80583 CVE-2026-80584 CVE-2026-80585 CVE-2026-80586                      CVE-2026-80587 CVE-2026-80589 CVE-2026-80590 CVE-2026-80678                      CVE-2026-80679 CVE-2026-80680 CVE-2026-80681 CVE-2026-80684                      CVE-2026-80686 CVE-2026-80689 CVE-2026-80691 CVE-2026-80694                      CVE-2026-80695 CVE-2026-80696 CVE-2026-80700 CVE-2026-80702                      CVE-2026-80703 CVE-2026-80704 CVE-2026-80706 CVE-2026-80707                      CVE-2026-80708 CVE-2026-80709 CVE-2026-80710 CVE-2026-80711                      CVE-2026-80714 CVE-2026-80715 CVE-2026-80716 CVE-2026-80717                      CVE-2026-80718 CVE-2026-80722 CVE-2026-80723 CVE-2026-80725                      CVE-2026-80726 CVE-2026-80727 CVE-2026-80728 CVE-2026-80730                      CVE-2026-80731 CVE-2026-80732 CVE-2026-80733 CVE-2026-80736                      CVE-2026-80737 CVE-2026-80739 CVE-2026-80742 CVE-2026-80743                      CVE-2026-80744 CVE-2026-80749 CVE-2026-80752 CVE-2026-80754                      CVE-2026-80756 CVE-2026-80757 CVE-2026-80759 CVE-2026-80763                      CVE-2026-80764 CVE-2026-80765 CVE-2026-80767 CVE-2026-80770                      CVE-2026-80771 CVE-2026-80772 CVE-2026-80779 CVE-2026-80781                      CVE-2026-80782 CVE-2026-80784 CVE-2026-80788 CVE-2026-80789                      CVE-2026-80790 CVE-2026-80791 CVE-2026-80792 CVE-2026-80793                      CVE-2026-80794 CVE-2026-80795 CVE-2026-80797 CVE-2026-80798                      CVE-2026-80799 CVE-2026-80800 CVE-2026-80801 CVE-2026-80802                      CVE-2026-80803 CVE-2026-80805 CVE-2026-80808 CVE-2026-80809                      CVE-2026-80812 CVE-2026-80814 CVE-2026-80815 CVE-2026-80819                      CVE-2026-80820 CVE-2026-80823 CVE-2026-80887 CVE-2026-80888                      CVE-2026-80889 CVE-2026-80890 CVE-2026-80891 CVE-2026-80892                      CVE-2026-80893 CVE-2026-80894 CVE-2026-80901 CVE-2026-80902                      CVE-2026-80903 CVE-2026-80904 CVE-2026-80906 CVE-2026-80907                      CVE-2026-80908 CVE-2026-80909 CVE-2026-80910 CVE-2026-80911                      CVE-2026-80912 CVE-2026-80913 CVE-2026-80915 CVE-2026-80916                      CVE-2026-80917 CVE-2026-80918     Debian Bug     : 1142912 1143545

    Several vulnerabilities have been discovered in the Linux kernel that     may lead to a privilege escalation, denial of service or information     leaks.

    For Debian 12 bookworm, these problems have been fixed in version     6.12.107-1~deb12u1.  This update additionally includes many more bug     fixes from stable updates 6.12.102-6.12.107, and adds drivers for     Alcor card readers.

    We recommend that you upgrade your linux-6.12 packages.

    For the detailed security status of linux-6.12 please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/linux-6.12

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS     Attachment:
    signature.asc     Description: PGP signature

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:67471 advisory.

    * kernel: tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock() (CVE-2025-40149)
      * kernel: Linux kernel: Denial of Service in qla2xxx SCSI driver due to improper command handling after     chip reset (CVE-2025-68745)
      * kernel: drm/xe: Open-code GGTT MMIO access protection (CVE-2026-23466)
      * kernel: drm/xe: always keep track of remap prev/next (CVE-2026-31479)
      * kernel: drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CVE-2026-31566)
      * kernel: xfrm: hold dev ref until after transport_finish NF_HOOK (CVE-2026-31663)
      * kernel: drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CVE-2026-31656)
      * kernel: smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (CVE-2026-31539)
      * kernel: vhost: move vdpa group bound check to vhost_vdpa (CVE-2026-43248)
      * kernel: drm/i915: Fix potential overflow of shmem scatterlist length (CVE-2026-43368)
      * kernel: drm/amdgpu: Fix use-after-free race in VM acquire (CVE-2026-43370)
      * kernel: scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CVE-2026-46149)
      * kernel: sctp: purge outqueue on stale COOKIE-ECHO handling (CVE-2026-52924)
      * kernel: netfilter: require Ethernet MAC header before using eth_hdr() (CVE-2026-53131)
      * kernel: sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (CVE-2026-53246)
      * kernel: xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (CVE-2026-53239)
      * kernel: af_unix: Set gc_in_progress to true in unix_gc() (CVE-2026-53361)
      * kernel: scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CVE-2026-63889)
      * kernel: ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate() (CVE-2026-63921)
      * kernel: xfrm: input: hold netns during deferred transport reinjection (CVE-2026-63919)
      * kernel: ip6: vti: Use ip6_tnl.net in vti6_changelink() (CVE-2026-63917)
      * kernel: lsm: hold cred_guard_mutex for lsm_set_self_attr() (CVE-2026-64111)
      * kernel: drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (CVE-2026-68264)
      * kernel: xfrm: fix stale skb->prev after async crypto steals a GSO segment (CVE-2026-68426)
      * kernel: scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CVE-2026-74556)


    Bug Fix(es) and Enhancement(s):

      * [almalinux-10.2.z]- Backport MSHV patches for hypervisor OOM handling (JIRA:AlmaLinux-245035)
      * RHIVOS - [backport] S32G Driver Enablement - ADC (JIRA:AlmaLinux-255233)
      * [AlmaLinux10.2z] watchdog: System can panic during reboot when pretimeout is disabled (0)     (JIRA:AlmaLinux-255348)
      * [usb/xhci] kdump on Arrow Lake systems hangs system with dracut-initqueue Timed out errors     [AlmaLinux-10.2.z] (JIRA:AlmaLinux-256731)
      * RHIVOS - [backport] S32G Driver Update - ADC, I2C, and eDMA (JIRA:AlmaLinux-256890)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:67150 advisory.

    * kernel: Linux kernel: Denial of Service in qla2xxx SCSI driver due to improper command handling after     chip reset (CVE-2025-68745)
      * kernel: drm/xe: Open-code GGTT MMIO access protection (CVE-2026-23466)
      * kernel: drm/xe: always keep track of remap prev/next (CVE-2026-31479)
      * kernel: drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CVE-2026-31566)
      * kernel: drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CVE-2026-31656)
      * kernel: rtnetlink: add missing netlink_ns_capable() check for peer netns (CVE-2026-31692)
      * kernel: Bluetooth: SMP: force responder MITM requirements before building the pairing response     (CVE-2026-43334)
      * kernel: drm/i915: Fix potential overflow of shmem scatterlist length (CVE-2026-43368)
      * kernel: drm/amdgpu: Fix use-after-free race in VM acquire (CVE-2026-43370)
      * kernel: Bluetooth: serialize accept_q access (CVE-2026-52918)
      * kernel: sctp: diag: reject stale associations in dump_one path (CVE-2026-52917)
      * kernel: net: pull headers in qdisc_pkt_len_segs_init() (CVE-2026-53091)
      * kernel: iommu/amd: Fix clone_alias() to use the original device's devid (CVE-2026-53053)
      * kernel: Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CVE-2026-53072)
      * kernel: net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (CVE-2026-52947)
      * kernel: Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CVE-2026-53256)
      * kernel: wifi: nl80211: reject oversized EMA RNR lists (CVE-2026-53182)
      * kernel: Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CVE-2026-53209)
      * kernel: sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (CVE-2026-53246)
      * kernel: Bluetooth: RFCOMM: validate skb length in MCC handlers (CVE-2026-53254)
      * kernel: tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (CVE-2026-63801)
      * kernel: scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CVE-2026-63889)
      * kernel: sctp: fix race between sctp_wait_for_connect and peeloff (CVE-2026-63971)
      * kernel: Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CVE-2026-63975)
      * kernel: Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CVE-2026-63947)
      * kernel: Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CVE-2026-63944)
      * kernel: Bluetooth: ISO: fix UAF in iso_recv_frame (CVE-2026-63946)
      * kernel: Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CVE-2026-63945)
      * kernel: wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (CVE-2026-64117)
      * kernel: wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (CVE-2026-64037)
      * kernel: ixgbevf: fix use-after-free in VEPA multicast source pruning (CVE-2026-64113)
      * kernel: wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (CVE-2026-64255)
      * kernel: wifi: mac80211: fix MLE defragmentation (CVE-2026-64515)
      * kernel: mm/khugepaged: write all dirty file folios when collapsing (CVE-2026-68086)
      * kernel: Linux kernel: Wi-Fi subsystem out-of-bounds read via crafted frames (CVE-2026-68402)
      * kernel: sctp: fix auth_hmacs array size in struct sctp_cookie (CVE-2026-68376)
      * kernel: wifi: cfg80211: validate PMSR FTM preamble range (CVE-2026-68406)
      * kernel: tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (CVE-2026-68117)
      * kernel: sctp: auth: verify auth requirement when auth_chunk is NULL (CVE-2026-68300)
      * kernel: drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (CVE-2026-68264)
      * kernel: sctp: validate stream count in sctp_process_strreset_inreq() (CVE-2026-68315)
      * kernel: dm-verity: fix buffer overflow in FEC calculation (CVE-2026-72098)


    Bug Fix(es) and Enhancement(s):

      * gfs2: Various xfstests fixes [almalinux-9.8.z] (JIRA:AlmaLinux-178219)
      * rtla-timerlat-top doesn't stop properly when threshold is reached on multiple CPUs at once     [almalinux-9.8.z] (JIRA:AlmaLinux-193025)
      * qede: build_skb failure causes off-by-one BD ring corruption and kernel panic [almalinux-9.8.z]     (JIRA:AlmaLinux-193050)
      * Customer needs netfilter: nfnetlink_queue: optimize verdict lookup with hash table patch     [almalinux-9.8.z] (JIRA:AlmaLinux-224489)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-674710 advisory.

    - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559]     {CVE-2026-31539}
    - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot)     [RHEL-254596] {CVE-2026-74556}
    - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (Mika Penttila) [RHEL-222461]     {CVE-2026-23466}
    - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222401] {CVE-2026-43370}
    - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222474]     {CVE-2026-43368}
    - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222424]     {CVE-2026-31656}
    - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221279]     {CVE-2026-31566}
    - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222307] {CVE-2026-31479}
    - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222461] {CVE-2026-23466}
    - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (Mika Penttila) [RHEL-236579] {CVE-2026-68264}
    - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663}
    - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663}
    - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663}
    - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227502]     {CVE-2026-63919}
    - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236113]     {CVE-2026-68426}
    - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426}
    - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca)     [RHEL-228006] {CVE-2026-53239}
    - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231756] {CVE-2026-63917}
    - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228943] {CVE-2026-63921}
    - af_unix: Set gc_in_progress to true in unix_gc(). (Davide Caratti) [RHEL-227544] {CVE-2026-53361}
    - af_unix: Give up GC if MSG_PEEK intervened. (Davide Caratti) [RHEL-227544] {CVE-2026-23394}
    - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190194]     {CVE-2026-53246}
    - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235912] {CVE-2025-68745}
    - lsm: hold cred_guard_mutex for lsm_set_self_attr() (Ricardo Robaina) [RHEL-226807] {CVE-2026-64111}
    - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-231909]     {CVE-2025-40149}
    - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230672]     {CVE-2026-53131}
    - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228717]     {CVE-2026-63889}
    - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot)     [RHEL-225792] {CVE-2026-46149}
    - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188199] {CVE-2026-52924}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:67471 advisory.

    * kernel: tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock() (CVE-2025-40149)

    * kernel: Linux kernel: Denial of Service in qla2xxx SCSI driver due to improper command handling after     chip reset (CVE-2025-68745)

    * kernel: drm/xe: Open-code GGTT MMIO access protection (CVE-2026-23466)

    * kernel: drm/xe: always keep track of remap prev/next (CVE-2026-31479)

    * kernel: drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CVE-2026-31566)

    * kernel: xfrm: hold dev ref until after transport_finish NF_HOOK (CVE-2026-31663)

    * kernel: drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CVE-2026-31656)

    * kernel: smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (CVE-2026-31539)

    * kernel: vhost: move vdpa group bound check to vhost_vdpa (CVE-2026-43248)

    * kernel: drm/i915: Fix potential overflow of shmem scatterlist length (CVE-2026-43368)

    * kernel: drm/amdgpu: Fix use-after-free race in VM acquire (CVE-2026-43370)

    * kernel: scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CVE-2026-46149)

    * kernel: sctp: purge outqueue on stale COOKIE-ECHO handling (CVE-2026-52924)

    * kernel: netfilter: require Ethernet MAC header before using eth_hdr() (CVE-2026-53131)

    * kernel: sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (CVE-2026-53246)

    * kernel: xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (CVE-2026-53239)

    * kernel: af_unix: Set gc_in_progress to true in unix_gc() (CVE-2026-53361)

    * kernel: scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CVE-2026-63889)

    * kernel: ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate() (CVE-2026-63921)

    * kernel: xfrm: input: hold netns during deferred transport reinjection (CVE-2026-63919)

    * kernel: ip6: vti: Use ip6_tnl.net in vti6_changelink() (CVE-2026-63917)

    * kernel: lsm: hold cred_guard_mutex for lsm_set_self_attr() (CVE-2026-64111)

    * kernel: drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (CVE-2026-68264)

    * kernel: xfrm: fix stale skb->prev after async crypto steals a GSO segment (CVE-2026-68426)

    * kernel: scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CVE-2026-74556)

    Bug Fix(es) and Enhancement(s):

    * [rhel-10.2.z]- Backport MSHV patches for hypervisor OOM handling  (JIRA:Rocky Linux-245035)

    * RHIVOS - [backport] S32G Driver Enablement - ADC (JIRA:Rocky Linux-255233)

    * [Rocky Linux10.2z] watchdog: System can panic during reboot when pretimeout is disabled (0) (JIRA:Rocky     Linux-255348)

    * [usb/xhci] kdump on Arrow Lake systems hangs system with dracut-initqueue Timed out errors [Rocky     Linux-10.2.z] (JIRA:Rocky Linux-256731)

    * RHIVOS - [backport] S32G Driver Update - ADC, I2C, and eDMA (JIRA:Rocky Linux-256890)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:67150 advisory.

    * kernel: Linux kernel: Denial of Service in qla2xxx SCSI driver due to improper command handling after     chip reset (CVE-2025-68745)

    * kernel: drm/xe: Open-code GGTT MMIO access protection (CVE-2026-23466)

    * kernel: drm/xe: always keep track of remap prev/next (CVE-2026-31479)

    * kernel: drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CVE-2026-31566)

    * kernel: drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CVE-2026-31656)

    * kernel: rtnetlink: add missing netlink_ns_capable() check for peer netns (CVE-2026-31692)

    * kernel: Bluetooth: SMP: force responder MITM requirements before building the pairing response     (CVE-2026-43334)

    * kernel: drm/i915: Fix potential overflow of shmem scatterlist length (CVE-2026-43368)

    * kernel: drm/amdgpu: Fix use-after-free race in VM acquire (CVE-2026-43370)

    * kernel: Bluetooth: serialize accept_q access (CVE-2026-52918)

    * kernel: sctp: diag: reject stale associations in dump_one path (CVE-2026-52917)

    * kernel: net: pull headers in qdisc_pkt_len_segs_init() (CVE-2026-53091)

    * kernel: iommu/amd: Fix clone_alias() to use the original device's devid (CVE-2026-53053)

    * kernel: Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CVE-2026-53072)

    * kernel: net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (CVE-2026-52947)

    * kernel: Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CVE-2026-53256)

    * kernel: wifi: nl80211: reject oversized EMA RNR lists (CVE-2026-53182)

    * kernel: Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CVE-2026-53209)

    * kernel: sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (CVE-2026-53246)

    * kernel: Bluetooth: RFCOMM: validate skb length in MCC handlers (CVE-2026-53254)

    * kernel: tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (CVE-2026-63801)

    * kernel: scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CVE-2026-63889)

    * kernel: sctp: fix race between sctp_wait_for_connect and peeloff (CVE-2026-63971)

    * kernel: Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CVE-2026-63975)

    * kernel: Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CVE-2026-63947)

    * kernel: Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CVE-2026-63944)

    * kernel: Bluetooth: ISO: fix UAF in iso_recv_frame (CVE-2026-63946)

    * kernel: Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CVE-2026-63945)

    * kernel: wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (CVE-2026-64117)

    * kernel: wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (CVE-2026-64037)

    * kernel: ixgbevf: fix use-after-free in VEPA multicast source pruning (CVE-2026-64113)

    * kernel: wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (CVE-2026-64255)

    * kernel: wifi: mac80211: fix MLE defragmentation (CVE-2026-64515)

    * kernel: mm/khugepaged: write all dirty file folios when collapsing (CVE-2026-68086)

    * kernel: Linux kernel: Wi-Fi subsystem out-of-bounds read via crafted frames (CVE-2026-68402)

    * kernel: sctp: fix auth_hmacs array size in struct sctp_cookie (CVE-2026-68376)

    * kernel: wifi: cfg80211: validate PMSR FTM preamble range (CVE-2026-68406)

    * kernel: tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (CVE-2026-68117)

    * kernel: sctp: auth: verify auth requirement when auth_chunk is NULL (CVE-2026-68300)

    * kernel: drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (CVE-2026-68264)

    * kernel: sctp: validate stream count in sctp_process_strreset_inreq() (CVE-2026-68315)

    * kernel: dm-verity: fix buffer overflow in FEC calculation (CVE-2026-72098)

    Bug Fix(es) and Enhancement(s):

    *  gfs2: Various xfstests fixes [rhel-9.8.z] (JIRA:Rocky Linux-178219)

    * rtla-timerlat-top doesn't stop properly when threshold is reached on multiple CPUs at once [rhel-9.8.z]     (JIRA:Rocky Linux-193025)

    * qede: build_skb failure causes off-by-one BD ring corruption and kernel panic [rhel-9.8.z] (JIRA:Rocky     Linux-193050)

    * Customer needs netfilter: nfnetlink_queue: optimize verdict lookup with hash table patch [rhel-9.8.z]     (JIRA:Rocky Linux-224489)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-671500 advisory.

    - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098}
    - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332]     {CVE-2026-68086}
    - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370}
    - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481]     {CVE-2026-43368}
    - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417]     {CVE-2026-31656}
    - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275]     {CVE-2026-31566}
    - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479}
    - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466}
    - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (Jose Exposito) [RHEL-236583] {CVE-2026-68264}
    - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801}
    - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037]     {CVE-2026-68117}
    - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971}
    - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917}
    - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315}
    - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376}
    - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300}
    - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084}
    - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745}
    - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206]     {CVE-2026-53246}
    - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652]     {CVE-2026-68406}
    - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez)     [RHEL-237652] {CVE-2026-68406}
    - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652]     {CVE-2026-68406}
    - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652]     {CVE-2026-68406}
    - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez)     [RHEL-236961] {CVE-2026-68402}
    - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez)     [RHEL-232010] {CVE-2026-64255}
    - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez)     [RHEL-231682] {CVE-2026-64117}
    - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez)     [RHEL-231682] {CVE-2026-64117}
    - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez)     [RHEL-230975] {CVE-2026-64037}
    - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587]     {CVE-2026-53182}
    - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez)     [RHEL-229728] {CVE-2026-52947}
    - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619]     {CVE-2026-64515}
    - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515}
    - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670]     {CVE-2026-53072}
    - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059]     {CVE-2026-63947}
    - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073]     {CVE-2026-53209}
    - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944}
    - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756]     {CVE-2026-63975}
    - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721]     {CVE-2026-63889}
    - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946}
    - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882]     {CVE-2026-64113}
    - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport     Bot) [RHEL-227536] {CVE-2026-43334}
    - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454]     {CVE-2026-53053}
    - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431]     {CVE-2026-63945}
    - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646]     {CVE-2026-53254}
    - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254}
    - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576]     {CVE-2026-53256}
    - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918}
    - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091}
    - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091}
    - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091}
    - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228]     {CVE-2026-53091}
    - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091}
    - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091}
    - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091}
    - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532]     {CVE-2026-31692}
    - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532]     {CVE-2026-31692}
    - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692}
    - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692}
    - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692}
    - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:67471 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock() (CVE-2025-40149)

    * kernel: Linux kernel: Denial of Service in qla2xxx SCSI driver due to improper command handling after     chip reset (CVE-2025-68745)

    * kernel: drm/xe: Open-code GGTT MMIO access protection (CVE-2026-23466)

    * kernel: drm/xe: always keep track of remap prev/next (CVE-2026-31479)

    * kernel: drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CVE-2026-31566)

    * kernel: xfrm: hold dev ref until after transport_finish NF_HOOK (CVE-2026-31663)

    * kernel: drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CVE-2026-31656)

    * kernel: smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (CVE-2026-31539)

    * kernel: vhost: move vdpa group bound check to vhost_vdpa (CVE-2026-43248)

    * kernel: drm/i915: Fix potential overflow of shmem scatterlist length (CVE-2026-43368)

    * kernel: drm/amdgpu: Fix use-after-free race in VM acquire (CVE-2026-43370)

    * kernel: scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CVE-2026-46149)

    * kernel: sctp: purge outqueue on stale COOKIE-ECHO handling (CVE-2026-52924)

    * kernel: netfilter: require Ethernet MAC header before using eth_hdr() (CVE-2026-53131)

    * kernel: sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (CVE-2026-53246)

    * kernel: xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (CVE-2026-53239)

    * kernel: af_unix: Set gc_in_progress to true in unix_gc() (CVE-2026-53361)

    * kernel: scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CVE-2026-63889)

    * kernel: ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate() (CVE-2026-63921)

    * kernel: xfrm: input: hold netns during deferred transport reinjection (CVE-2026-63919)

    * kernel: ip6: vti: Use ip6_tnl.net in vti6_changelink() (CVE-2026-63917)

    * kernel: lsm: hold cred_guard_mutex for lsm_set_self_attr() (CVE-2026-64111)

    * kernel: drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (CVE-2026-68264)

    * kernel: xfrm: fix stale skb->prev after async crypto steals a GSO segment (CVE-2026-68426)

    * kernel: scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CVE-2026-74556)

    Bug Fix(es) and Enhancement(s):

    * [rhel-10.2.z]- Backport MSHV patches for hypervisor OOM handling  (JIRA:RHEL-245035)

    * RHIVOS - [backport] S32G Driver Enablement - ADC (JIRA:RHEL-255233)

    * [RHEL10.2z] watchdog: System can panic during reboot when pretimeout is disabled (0) (JIRA:RHEL-255348)

    * [usb/xhci] kdump on Arrow Lake systems hangs system with dracut-initqueue Timed out errors [RHEL-10.2.z]     (JIRA:RHEL-256731)

    * RHIVOS - [backport] S32G Driver Update - ADC, I2C, and eDMA (JIRA:RHEL-256890)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:67150 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: Linux kernel: Denial of Service in qla2xxx SCSI driver due to improper command handling after     chip reset (CVE-2025-68745)

    * kernel: drm/xe: Open-code GGTT MMIO access protection (CVE-2026-23466)

    * kernel: drm/xe: always keep track of remap prev/next (CVE-2026-31479)

    * kernel: drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CVE-2026-31566)

    * kernel: drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CVE-2026-31656)

    * kernel: rtnetlink: add missing netlink_ns_capable() check for peer netns (CVE-2026-31692)

    * kernel: Bluetooth: SMP: force responder MITM requirements before building the pairing response     (CVE-2026-43334)

    * kernel: drm/i915: Fix potential overflow of shmem scatterlist length (CVE-2026-43368)

    * kernel: drm/amdgpu: Fix use-after-free race in VM acquire (CVE-2026-43370)

    * kernel: Bluetooth: serialize accept_q access (CVE-2026-52918)

    * kernel: sctp: diag: reject stale associations in dump_one path (CVE-2026-52917)

    * kernel: net: pull headers in qdisc_pkt_len_segs_init() (CVE-2026-53091)

    * kernel: iommu/amd: Fix clone_alias() to use the original device's devid (CVE-2026-53053)

    * kernel: Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CVE-2026-53072)

    * kernel: net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (CVE-2026-52947)

    * kernel: Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CVE-2026-53256)

    * kernel: wifi: nl80211: reject oversized EMA RNR lists (CVE-2026-53182)

    * kernel: Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CVE-2026-53209)

    * kernel: sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (CVE-2026-53246)

    * kernel: Bluetooth: RFCOMM: validate skb length in MCC handlers (CVE-2026-53254)

    * kernel: tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (CVE-2026-63801)

    * kernel: scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CVE-2026-63889)

    * kernel: sctp: fix race between sctp_wait_for_connect and peeloff (CVE-2026-63971)

    * kernel: Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CVE-2026-63975)

    * kernel: Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CVE-2026-63947)

    * kernel: Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CVE-2026-63944)

    * kernel: Bluetooth: ISO: fix UAF in iso_recv_frame (CVE-2026-63946)

    * kernel: Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CVE-2026-63945)

    * kernel: wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (CVE-2026-64117)

    * kernel: wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (CVE-2026-64037)

    * kernel: ixgbevf: fix use-after-free in VEPA multicast source pruning (CVE-2026-64113)

    * kernel: wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (CVE-2026-64255)

    * kernel: wifi: mac80211: fix MLE defragmentation (CVE-2026-64515)

    * kernel: mm/khugepaged: write all dirty file folios when collapsing (CVE-2026-68086)

    * kernel: Linux kernel: Wi-Fi subsystem out-of-bounds read via crafted frames (CVE-2026-68402)

    * kernel: sctp: fix auth_hmacs array size in struct sctp_cookie (CVE-2026-68376)

    * kernel: wifi: cfg80211: validate PMSR FTM preamble range (CVE-2026-68406)

    * kernel: tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (CVE-2026-68117)

    * kernel: sctp: auth: verify auth requirement when auth_chunk is NULL (CVE-2026-68300)

    * kernel: drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (CVE-2026-68264)

    * kernel: sctp: validate stream count in sctp_process_strreset_inreq() (CVE-2026-68315)

    * kernel: dm-verity: fix buffer overflow in FEC calculation (CVE-2026-72098)

    Bug Fix(es) and Enhancement(s):

    *  gfs2: Various xfstests fixes [rhel-9.8.z] (JIRA:RHEL-178219)

    * rtla-timerlat-top doesn't stop properly when threshold is reached on multiple CPUs at once [rhel-9.8.z]     (JIRA:RHEL-193025)

    * qede: build_skb failure causes off-by-one BD ring corruption and kernel panic [rhel-9.8.z]     (JIRA:RHEL-193050)

    * Customer needs netfilter: nfnetlink_queue: optimize verdict lookup with hash table patch [rhel-9.8.z]     (JIRA:RHEL-224489)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6466 advisory.

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-6466-1                   security@debian.org     https://www.debian.org/security/                     Salvatore Bonaccorso     August 25, 2026                       https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : linux     CVE ID         : CVE-2025-38525 CVE-2025-40054 CVE-2026-43197 CVE-2026-53092                      CVE-2026-64017 CVE-2026-64586 CVE-2026-68082 CVE-2026-68118                      CVE-2026-68132 CVE-2026-68138 CVE-2026-68159 CVE-2026-68166                      CVE-2026-68169 CVE-2026-68198 CVE-2026-68253 CVE-2026-68254                      CVE-2026-68264 CVE-2026-68266 CVE-2026-68267 CVE-2026-68273                      CVE-2026-68276 CVE-2026-68322 CVE-2026-68367 CVE-2026-68431                      CVE-2026-68451 CVE-2026-68452 CVE-2026-68480 CVE-2026-72111                      CVE-2026-74440 CVE-2026-74441 CVE-2026-74442 CVE-2026-74443                      CVE-2026-74444 CVE-2026-74445 CVE-2026-74446 CVE-2026-74447                      CVE-2026-74448 CVE-2026-74450 CVE-2026-74451 CVE-2026-74452                      CVE-2026-74453 CVE-2026-74454 CVE-2026-74455 CVE-2026-74456                      CVE-2026-74457 CVE-2026-74458 CVE-2026-74459 CVE-2026-74460                      CVE-2026-74461 CVE-2026-74463 CVE-2026-74464 CVE-2026-74465                      CVE-2026-74467 CVE-2026-74468 CVE-2026-74469 CVE-2026-74470                      CVE-2026-74471 CVE-2026-74472 CVE-2026-74473 CVE-2026-74474                      CVE-2026-74475 CVE-2026-74476 CVE-2026-74478 CVE-2026-74479                      CVE-2026-74480 CVE-2026-74481 CVE-2026-74482 CVE-2026-74483                      CVE-2026-74484 CVE-2026-74485 CVE-2026-74487 CVE-2026-74488                      CVE-2026-74490 CVE-2026-74492 CVE-2026-74493 CVE-2026-74494                      CVE-2026-74495 CVE-2026-74497 CVE-2026-74498 CVE-2026-74499                      CVE-2026-74500 CVE-2026-74501 CVE-2026-74502 CVE-2026-74503                      CVE-2026-74504 CVE-2026-74505 CVE-2026-74507 CVE-2026-74508                      CVE-2026-74509 CVE-2026-74510 CVE-2026-74512 CVE-2026-74514                      CVE-2026-74515 CVE-2026-74516 CVE-2026-74517 CVE-2026-74518                      CVE-2026-74519 CVE-2026-74522 CVE-2026-74523 CVE-2026-74524                      CVE-2026-74525 CVE-2026-74531 CVE-2026-74532 CVE-2026-74535                      CVE-2026-74536 CVE-2026-74540 CVE-2026-74541 CVE-2026-74543                      CVE-2026-74545 CVE-2026-74546 CVE-2026-74547 CVE-2026-74548                      CVE-2026-74549 CVE-2026-74550 CVE-2026-74551 CVE-2026-74552                      CVE-2026-74553 CVE-2026-74555 CVE-2026-74556 CVE-2026-74557                      CVE-2026-74563 CVE-2026-74564 CVE-2026-74565 CVE-2026-74566                      CVE-2026-74567 CVE-2026-74569 CVE-2026-74572 CVE-2026-74574                      CVE-2026-74575 CVE-2026-74576 CVE-2026-74577 CVE-2026-74579                      CVE-2026-74580 CVE-2026-74581 CVE-2026-74582 CVE-2026-74583                      CVE-2026-74585 CVE-2026-74586 CVE-2026-74587 CVE-2026-74588                      CVE-2026-74589 CVE-2026-74590 CVE-2026-74592 CVE-2026-74594                      CVE-2026-74595 CVE-2026-74597 CVE-2026-74598 CVE-2026-74599                      CVE-2026-74601 CVE-2026-74602 CVE-2026-74603 CVE-2026-74604                      CVE-2026-74606 CVE-2026-74607 CVE-2026-74608 CVE-2026-74609                      CVE-2026-74610 CVE-2026-74612 CVE-2026-74613 CVE-2026-74614                      CVE-2026-74615 CVE-2026-74616 CVE-2026-74618 CVE-2026-74619                      CVE-2026-74620 CVE-2026-74621 CVE-2026-74622 CVE-2026-74623                      CVE-2026-74624 CVE-2026-74625 CVE-2026-74628 CVE-2026-74630                      CVE-2026-74631 CVE-2026-74632 CVE-2026-74634 CVE-2026-74635                      CVE-2026-74636 CVE-2026-74637 CVE-2026-74641 CVE-2026-74644                      CVE-2026-74646 CVE-2026-74647 CVE-2026-74648 CVE-2026-74649                      CVE-2026-74650 CVE-2026-74651 CVE-2026-74654 CVE-2026-74655                      CVE-2026-74656 CVE-2026-74657 CVE-2026-74658 CVE-2026-74659                      CVE-2026-74660 CVE-2026-74661 CVE-2026-74663 CVE-2026-74664                      CVE-2026-74665 CVE-2026-74666 CVE-2026-74667 CVE-2026-74668                      CVE-2026-74669 CVE-2026-74670 CVE-2026-74671 CVE-2026-74672                      CVE-2026-74673 CVE-2026-74675 CVE-2026-74676 CVE-2026-74677                      CVE-2026-74678 CVE-2026-74679 CVE-2026-74680 CVE-2026-74682                      CVE-2026-74683 CVE-2026-74684 CVE-2026-74685 CVE-2026-74688                      CVE-2026-74689 CVE-2026-74691 CVE-2026-74692 CVE-2026-74693                      CVE-2026-74694 CVE-2026-74696 CVE-2026-74700 CVE-2026-74701                      CVE-2026-74704 CVE-2026-74705 CVE-2026-74710 CVE-2026-74712                      CVE-2026-74714 CVE-2026-74717 CVE-2026-74718 CVE-2026-74719                      CVE-2026-74720 CVE-2026-74722 CVE-2026-74724 CVE-2026-74725                      CVE-2026-74726 CVE-2026-74730 CVE-2026-74732     Debian Bug     : 1142912 1143545

    Several vulnerabilities have been discovered in the Linux kernel that     may lead to a privilege escalation, denial of service or information     leaks.

    For the stable distribution (trixie), these problems have been fixed in     version 6.12.105-1.

    We recommend that you upgrade your linux packages.

    For the detailed security status of linux please refer to its security     tracker page at:
    https://security-tracker.debian.org/tracker/linux

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the linux package has been released.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() xe_pt_update_ops_init() fails to reset current_op     to 0. On the vm_bind path, ops_execute() calls xe_pt_update_ops_prepare() inside the xe_validation_guard()     / drm_exec_until_all_locked() loop. When that loop retries due to lock contention or OOM eviction     (drm_exec_retry_on_contention() / xe_validation_retry_on_oom()), xe_pt_update_ops_prepare() runs again on     the same vops, and each call to bind_op_prepare() increments current_op without resetting it. After N     retries current_op exceeds the array size allocated by xe_vma_ops_alloc(), causing an out-of-bounds write     into SLUB-poisoned memory and a subsequent UAF crash in xe_migrate_update_pgtables_cpu() when reading the     corrupted pt_op->bind. Also reset needs_svm_lock and needs_invalidation which are derived in the same     prepare pass and would otherwise cause wrong migrate ops selection and redundant TLB invalidation on     retry. Fix this by resetting current_op, needs_svm_lock and needs_invalidation in xe_pt_update_ops_init().
    v2 (Matt): - Add details in commit message. - Add Fixes tag and Cc to stable@vger.kernel.org (cherry     picked from commit 046045543e530605c441063535e7dca0075369a6) (CVE-2026-68264)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
348574	Debian dla-4788 : ata-modules-6.12.100+deb12-armmp-di - security update	Nessus	Debian Local Security Checks	Local	medium
346879	AlmaLinux 10 : kernel (ALSA-2026:67471)	Nessus	Alma Linux Local Security Checks	Local	high
346870	AlmaLinux 9 : kernel (ALSA-2026:67150)	Nessus	Alma Linux Local Security Checks	Local	high
346426	Oracle Linux 10 : ELSA-2026-67471-0: / kernel (ELSA-2026-674710)	Nessus	Oracle Linux Local Security Checks	Local	high
346311	RockyLinux 10 : kernel (RLSA-2026:67471)	Nessus	Rocky Linux Local Security Checks	Local	high
346033	RockyLinux 9 : kernel (RLSA-2026:67150)	Nessus	Rocky Linux Local Security Checks	Local	high
345896	Oracle Linux 9 : ELSA-2026-67150-0: / kernel (ELSA-2026-671500)	Nessus	Oracle Linux Local Security Checks	Local	high
345863	RHEL 10 : kernel (RHSA-2026:67471)	Nessus	Red Hat Local Security Checks	Local	high
345600	RHEL 9 : kernel (RHSA-2026:67150)	Nessus	Red Hat Local Security Checks	Local	high
343049	Oracle Linux 10 / 9 : Unbreakable Enterprise kernel (ELSA-2026-500248)	Nessus	Oracle Linux Local Security Checks	Local	high
339550	Debian dsa-6466 : ata-modules-6.12.101+deb13-armmp-di - security update	Nessus	Debian Local Security Checks	Local	medium
334784	Photon OS 5.0: Linux PHSA-2026-5.0-92-0952	Nessus	PhotonOS Local Security Checks	Local	high
334356	Linux Distros Unpatched Vulnerability : CVE-2026-68264	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2026-68264

high

Tenable Plugins

medium

high

high

high

high

high

high

high

high

high

medium

high

high