In the Linux kernel, the following vulnerability has been resolved: drm/xe: Hold a dma-buf reference for imported BOs An imported dma-buf BO is created as a ttm_bo_type_sg BO whose reservation object is the exporter's dma_buf->resv. The importer, however, only takes a dma-buf reference after a successful dma_buf_dynamic_attach(). Until then nothing keeps the exporter alive, so if the exporter is freed while the BO still references its resv, a later access to that resv is a use-after-free: Oops: general protection fault, probably for non-canonical address 0x6b6b6b6b6b6b6b9c Workqueue: ttm ttm_bo_delayed_delete [ttm] RIP: 0010:mutex_can_spin_on_owner+0x3f/0xc0 This can be reached on two paths: - dma_buf_dynamic_attach() fails, or - ttm_bo_init_reserved() fails during BO creation. In both cases the BO already has bo->base.resv pointing at the exporter resv, and sg BOs are always torn down via ttm_bo_delayed_delete(), which locks bo->base.resv asynchronously - potentially after the exporter has been freed. Take the dma-buf reference in xe_bo_init_locked(), before ttm_bo_init_reserved(), so it also covers a creation failure there, and release it in xe_ttm_bo_destroy(). The reference is held for the whole BO lifetime, keeping the shared resv alive on every path. v2: - Reworked the fix to avoid creating the imported sg BO before dma_buf_dynamic_attach() succeeds. - Attach with importer_priv == NULL and make invalidate_mappings ignore incomplete imports. v3: - Dropped the xe-side reordering approach since importer_priv must be valid when dma_buf_dynamic_attach() publishes the attachment. - Per Christian's suggestion on the v1 thread, keyed the check on import_attach rather than removing the sg guard entirely. - Fixes both xe and amdgpu in a single TTM patch. v4: - Moved import_attach check to after dma_resv_copy_fences() so fences are copied before returning for successful imports (Thomas). - Removed exporter-alive claim from commit message (Thomas). v5: - Add drm/xe patch to keep imported sg BOs off the LRU before attach succeeds; the TTM fix alone is not sufficient for xe if the BO is already LRU-visible. (Thomas) v4 patch: https://patchwork.freedesktop.org/patch/736663/?series=169129&rev=2 - Patch 1 (drm/ttm) carries Christian's Reviewed-by from v4. v6: - Reworked the fix based on Thomas' suggestion. Instead of the TTM resv individualization (v1-v5) plus the xe off-LRU/placement handling (v5), just hold a dma-buf reference for the imported BO lifetime so the shared resv can never be freed while the BO still references it. Single xe patch, no TTM change. (Thomas) - Take the reference in xe_bo_init_locked() before ttm_bo_init_reserved() so a TTM creation failure is covered too (Thomas). - Dropped the v5 series (drm/ttm + drm/xe off-LRU); the off-LRU approach also regressed in CI BAT via ttm_bo_pipeline_gutting() creating a ghost BO that outlived the exporter. Link to v5: https://patchwork.freedesktop.org/series/169984/ v7: - Move changelog above --- so it stays in the commit message. - Reorder changelog entries oldest-to-newest. (Thomas) (cherry picked from commit 3516f3fae6be35642f8f06f8a218da6425c0306a)

ubuntu_linux USN-8887-1: Ubuntu 26.04 LTS : Linux kernel vulnerabilities (USN-8887-1)

ubuntu_linux USN-8889-1: Ubuntu 26.04 LTS : Linux kernel (OEM) vulnerabilities (USN-8889-1)

ubuntu_linux USN-8886-1: Ubuntu 24.04 LTS / Ubuntu Pro Realtime 24.04 LTS : Linux kernel (NVIDIA Tegra) vulnerabilities (USN-8886-1)

ubuntu_linux USN-8888-1: Ubuntu 26.04 LTS : Linux kernel (Azure) vulnerabilities (USN-8888-1)

The remote CentOS Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the kernel-5.14.0-756.el9 build changelog.

  - In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: bound element ID read     when checking non-inheritance cfg80211_is_element_inherited() reads the first data octet of the candidate     element (id = elem->data[0]) to look it up in an extension non-inheritance list. It does so after testing     elem->id, but without verifying that the element actually has a data octet. A zero-length extension     element (WLAN_EID_EXTENSION with length 0) therefore makes it read one octet past the end of the element.
    _ieee802_11_parse_elems_full() runs this check for every element of a frame once a non-inheritance context     exists -- e.g. while parsing a per-STA profile of a Multi-Link element in a (re)association response, or a     non-transmitted BSS profile -- so a crafted frame from an AP can trigger a one-octet slab-out-of-bounds     read during element parsing: BUG: KASAN: slab-out-of-bounds in cfg80211_is_element_inherited Read of size     1 ... in net/wireless/scan.c Return early (treat the element as inherited) when an extension element     carries no data, mirroring the existing handling of empty ID lists. The bug was found by fuzzing     ieee802_11_parse_elems_full() under KASAN. (CVE-2026-68402)

  - In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: Reject MPA FPDU length     underflow before signed receive math A malicious connected siw peer can send an iWARP FPDU whose MPA     length field (c_hdr->mpa_len, 16 bit big-endian, peer-controlled) is smaller than the fixed DDP/RDMAP     header for the announced opcode. Soft-iWARP parses the full header in siw_get_hdr() based on     iwarp_pktinfo[opcode] .hdr_len, but never compares mpa_len against that header length. siw_tcp_rx_data()     then derives srx->fpdu_part_rem = be16_to_cpu(mpa_len) - fpdu_part_rcvd + MPA_HDR_SIZE; where     fpdu_part_rcvd equals iwarp_pktinfo[opcode].hdr_len at this point. For a tagged WRITE (hdr_len 16,     MPA_HDR_SIZE 2) the smallest on-wire mpa_len of 0 yields fpdu_part_rem = -14, and any mpa_len below     hdr_len - MPA_HDR_SIZE underflows to a negative int. The signed value then flows into     siw_proc_write()/siw_proc_rresp() as bytes = min(srx->fpdu_part_rem, srx->skb_new); is handed to     siw_check_mem() as an int len (whose interval check addr + len > mem->va + mem->len is satisfied for a     valid base when len is negative), and reaches siw_rx_data() -> siw_rx_kva() / siw_rx_umem() ->     skb_copy_bits() as a signed copy length. The header copy branch in skb_copy_bits() promotes that to     size_t, producing a multi-gigabyte read. KASAN under a KUnit harness that drives the real kernel TCP     receive path -- a loopback AF_INET socketpair, the malformed FPDU written via kernel_sendmsg,     sk_data_ready firing in softirq, tcp_read_sock dispatching to siw_tcp_rx_data -- reports: BUG: KASAN: use-     after-free in skb_copy_bits+0x284/0x480 Read of size 4294967295 at addr ffff888... Call Trace:
    skb_copy_bits siw_rx_kva siw_rx_data siw_check_mem siw_proc_write siw_tcp_rx_data __tcp_read_sock     siw_qp_llp_data_ready tcp_data_ready tcp_data_queue Add the missing invariant at the earliest point where     the peer header is fully assembled. iwarp_pktinfo[*].hdr_len - MPA_HDR_SIZE is exactly the value the siw     transmitter uses as the minimum mpa_len for each opcode (drivers/infiniband/sw/siw/siw_qp.c:33), so this     matches the protocol contract. Out-of-range FPDUs terminate the connection with TERM_ERROR_LAYER_LLP /     LLP_ETYPE_MPA / LLP_ECODE_FPDU_START -- which is RFC 5044 Section 8 error code 3 (Marker and ULPDU Length     fields do not agree on the start of an FPDU), the correct framing-error class for this inconsistency.
    (CVE-2026-64102)

  - In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix race condition in QP     timer handlers I encontered the following warning: WARNING: drivers/infiniband/sw/rxe/rxe_task.c:249 at     rxe_sched_task+0x1c8/0x238 [rdma_rxe], CPU#0: swapper/0/0 ... libsha1 [last unloaded: ip6_udp_tunnel] CPU:
    0 UID: 0 PID: 0 Comm: swapper/0 Tainted: G C 6.19.0-rc5-64k-v8+ #37 PREEMPT Tainted: [C]=CRAP Hardware     name: Raspberry Pi 4 Model B Rev 1.2 Call trace: rxe_sched_task+0x1c8/0x238 [rdma_rxe] (P)     retransmit_timer+0x130/0x188 [rdma_rxe] call_timer_fn+0x68/0x4d0 __run_timers+0x630/0x888 ... WARNING:
    drivers/infiniband/sw/rxe/rxe_task.c:38 at rxe_sched_task+0x1c0/0x238 [rdma_rxe], CPU#0: swapper/0/0 ...
    WARNING: drivers/infiniband/sw/rxe/rxe_task.c:111 at do_work+0x488/0x5c8 [rdma_rxe], CPU#3:
    kworker/u17:4/93400 ... refcount_t: underflow; use-after-free. WARNING: lib/refcount.c:28 at     refcount_warn_saturate+0x138/0x1a0, CPU#3: kworker/u17:4/93400 The issue is caused by a race condition     between retransmit_timer() and rxe_destroy_qp, leading to the Queue Pair's (QP) reference count dropping     to zero during timer handler execution. It seems this warning is harmless because rxe_qp_do_cleanup() will     flush all pending timers and requests. Example of flow causing the issue: CPU0 CPU1 retransmit_timer() {     spin_lock_irqsave rxe_destroy_qp() __rxe_cleanup() __rxe_put() // qp->ref_count decrease to 0     rxe_qp_do_cleanup() { if (qp->valid) { rxe_sched_task() { WARN_ON(rxe_read(task->qp) <= 0); } }     spin_unlock_irqrestore } spin_lock_irqsave qp->valid = 0 spin_unlock_irqrestore } Ensure the QP's     reference count is maintained and its validity is checked within the timer callbacks by adding calls to     rxe_get(qp) and corresponding rxe_put(qp) after use. (CVE-2026-45910)

  - In the Linux kernel, the following vulnerability has been resolved: ext4: fix e4b bitmap inconsistency     reports A bitmap inconsistency issue was observed during stress tests under mixed huge-page workloads.
    Ext4 reported multiple e4b bitmap check failures like: ext4_mb_complex_scan_group:2508: group 350, 8179     free clusters as per group info. But got 8192 blocks Analysis and experimentation confirmed that the issue     is caused by a race condition between page migration and bitmap modification. Although this timing window     is extremely narrow, it is still hit in practice: folio_lock ext4_mb_load_buddy __migrate_folio check ref     count folio_mc_copy __filemap_get_folio folio_try_get(folio) ...... mb_mark_used ext4_mb_unload_buddy
    __folio_migrate_mapping folio_ref_freeze folio_unlock The root cause of this issue is that the fast path     of load_buddy only increments the folio's reference count, which is insufficient to prevent concurrent     folio migration. We observed that the folio migration process acquires the folio lock. Therefore, we can     determine whether to take the fast path in load_buddy by checking the lock status. If the folio is locked,     we opt for the slow path (which acquires the lock) to close this concurrency window. Additionally, this     change addresses the following issues: When the DOUBLE_CHECK macro is enabled to inspect bitmap-related     issues, the following error may be triggered: corruption in group 324 at byte 784(6272): f in copy != ff     on disk/prealloc Analysis reveals that this is a false positive. There is a specific race window where the     bitmap and the group descriptor become momentarily inconsistent, leading to this error report:
    ext4_mb_load_buddy ext4_mb_load_buddy __filemap_get_folio(create|lock) folio_lock ext4_mb_init_cache     folio_mark_uptodate __filemap_get_folio(no lock) ...... mb_mark_used mb_mark_used_double mb_cmp_bitmaps     mb_set_bits(e4b->bd_bitmap) folio_unlock The original logic assumed that since mb_cmp_bitmaps is called     when the bitmap is newly loaded from disk, the folio lock would be sufficient to prevent concurrent     access. However, this overlooks a specific race condition: if another process attempts to load buddy and     finds the folio is already in an uptodate state, it will immediately begin using it without holding folio     lock. (CVE-2026-45942)

  - In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Validate pad and ICRC before     payload_size() in rxe_rcv rxe_rcv() currently checks only that the incoming packet is at least     header_size(pkt) bytes long before payload_size() is used. However, payload_size() subtracts both the     attacker-controlled BTH pad field and RXE_ICRC_SIZE from pkt->paylen: payload_size = pkt->paylen -     offset[RXE_PAYLOAD] - bth_pad(pkt) - RXE_ICRC_SIZE This means a short packet can still make payload_size()     underflow even if it includes enough bytes for the fixed headers. Simply requiring header_size(pkt) +     RXE_ICRC_SIZE is not sufficient either, because a packet with a forged non-zero BTH pad can still leave     payload_size() negative and pass an underflowed value to later receive-path users. Fix this by validating     pkt->paylen against the full minimum length required by payload_size(): header_size(pkt) + bth_pad(pkt) +     RXE_ICRC_SIZE. (CVE-2026-46043)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-71602 advisory.

    - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-242509] {CVE-2026-68121}
    - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263403]     {CVE-2026-89481}
    - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229262] {CVE-2026-53005}
    - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255860] {CVE-2026-80714}
    - drm/amdgpu/vce: fix integer overflow in image size (Mika Penttila) [RHEL-257136] {CVE-2026-68108}
    - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (Mika Penttila) [RHEL-237844]     {CVE-2026-68257}
    - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236300] {CVE-2026-68266}
    - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229327]     {CVE-2026-64098}
    - drm/amdgpu/userq: fix access to stale wptr mapping (Mika Penttila) [RHEL-225409] {CVE-2026-46311}
    - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (Mika Penttila) [RHEL-225409]     {CVE-2026-46311}
    - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236714] {CVE-2026-68273}
    - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237962]     {CVE-2026-68267}
    - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237962]     {CVE-2026-68267}
    - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267}
    - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229371]     {CVE-2026-53290}
    - drm/amdgpu/vcn3: Avoid overflow on msg bound check (Mika Penttila) [RHEL-225316] {CVE-2026-46230}
    - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (Mika Penttila) [RHEL-225316] {CVE-2026-46230}
    - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226047] {CVE-2026-46204}
    - fbcon: Set fb_display[i]->mode to NULL when the mode is released (Mika Penttila) [RHEL-250108]     {CVE-2025-40323}
    - drm/amdgpu/vcn4: Avoid overflow on msg bound check (Mika Penttila) [RHEL-225444] {CVE-2026-46199}
    - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (Mika Penttila) [RHEL-225444] {CVE-2026-46199}
    - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230647]     {CVE-2026-53203}
    - libceph: fix potential use-after-free in have_mon_and_osd_map() (CKI Backport Bot) [RHEL-169081]     {CVE-2025-68285}
    - libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169079] {CVE-2026-23136}
    - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169072]     {CVE-2026-22990}
    - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169068]     {CVE-2026-22984}
    - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169064]     {CVE-2025-71116}
    - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264371] {CVE-2026-81000}
    - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264303] {CVE-2026-80844}
    - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262556]     {CVE-2026-89846}
    - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot)     [RHEL-260585] {CVE-2026-74569}
    - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258024]     {CVE-2026-72243}
    - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253205] {CVE-2026-64383}
    - RHEL: revert 'block: only zero non-PI metadata tuples in bio_integrity_prep' (Jeff Moyer) [RHEL-189638]     {CVE-2026-23007}
    - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232375] {CVE-2026-64053}
    - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230292] {CVE-2026-63802}
    - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236084]     {CVE-2026-68201}
    - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234288]     {CVE-2026-64564}
    - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231034]     {CVE-2026-63831}
    - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-190036] {CVE-2026-53266}
    - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264234]     {CVE-2025-39964}
    - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264234]     {CVE-2025-39964}
    - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot)     [RHEL-260452] {CVE-2026-64534}
    - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254491]     {CVE-2026-74518}
    - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237164]     {CVE-2026-68159}
    - libceph: Amend checking to fix make W=1 build breakage (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159}
    - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-241107] {CVE-2026-68188}
    - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-240892] {CVE-2026-68155}
    - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228471]     {CVE-2026-45945}
    - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228471]     {CVE-2026-45944}
    - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228471]     {CVE-2026-45894}
    - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236849]     {CVE-2026-68391}
    - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236786]     {CVE-2026-68293}
    - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231825]     {CVE-2026-53062}
    - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231825]     {CVE-2026-53062}
    - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230408]     {CVE-2026-45959}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:71602 advisory.

    * kernel: fbcon: Set fb_display[i]->mode to NULL when the mode is released (CVE-2025-40323)
      * kernel: libceph: fix potential use-after-free in have_mon_and_osd_map() (CVE-2025-68285)
      * kernel: libceph: make decode_pool() more resilient against corrupted osdmaps (CVE-2025-71116)
      * kernel: libceph: prevent potential out-of-bounds reads in handle_auth_done() (CVE-2026-22984)
      * kernel: libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CVE-2026-22990)
      * kernel: Linux kernel: Denial of Service in libceph OSD client due to unreset sparse-read state     (CVE-2026-23136)
      * kernel: drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (CVE-2026-46230)
      * kernel: drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CVE-2026-46204)
      * kernel: drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (CVE-2026-46199)
      * kernel: drm/amdgpu/userq: fix access to stale wptr mapping (CVE-2026-46311)
      * kernel: af_unix: Drop all SCM attributes for SOCKMAP (CVE-2026-53005)
      * kernel: accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CVE-2026-53203)
      * kernel: drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CVE-2026-53290)
      * kernel: drm/virtio: use uninterruptible resv lock for plane updates (CVE-2026-64098)
      * kernel: Linux kernel: PPPoE memory corruption via stale pointer (CVE-2026-68121)
      * kernel: drm/amdgpu/vce: fix integer overflow in image size (CVE-2026-68108)
      * kernel: drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CVE-2026-68257)
      * kernel: drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CVE-2026-68267)
      * kernel: drm/xe: Hold a dma-buf reference for imported BOs (CVE-2026-68266)
      * kernel: drm/amdgpu: Fix context pstate override handling (CVE-2026-68273)
      * kernel: Linux kernel IPVS: Denial of Service due to stale memory references (CVE-2026-80714)
      * kernel: nvme-tcp: fix host memory disclosure on R2T for a read command (CVE-2026-89481)


    Bug Fix(es) and Enhancement(s):

      * Bypass DMA APIs for coherent allocations for pre-mapped memory [almalinux-10.2.z]     (JIRA:AlmaLinux-252331)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Rocky Linux 10.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-2026_71602 advisory.

    * kernel: fbcon: Set fb_display[i]->mode to NULL when the mode is released (CVE-2025-40323)

    * kernel: libceph: fix potential use-after-free in have_mon_and_osd_map() (CVE-2025-68285)

    * kernel: libceph: make decode_pool() more resilient against corrupted osdmaps (CVE-2025-71116)

    * kernel: libceph: prevent potential out-of-bounds reads in handle_auth_done() (CVE-2026-22984)

    * kernel: libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CVE-2026-22990)

    * kernel: Linux kernel: Denial of Service in libceph OSD client due to unreset sparse-read state     (CVE-2026-23136)

    * kernel: drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (CVE-2026-46230)

    * kernel: drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CVE-2026-46204)

    * kernel: drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (CVE-2026-46199)

    * kernel: drm/amdgpu/userq: fix access to stale wptr mapping (CVE-2026-46311)

    * kernel: af_unix: Drop all SCM attributes for SOCKMAP (CVE-2026-53005)

    * kernel: accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CVE-2026-53203)

    * kernel: drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CVE-2026-53290)

    * kernel: drm/virtio: use uninterruptible resv lock for plane updates (CVE-2026-64098)

    * kernel: Linux kernel: PPPoE memory corruption via stale pointer (CVE-2026-68121)

    * kernel: drm/amdgpu/vce: fix integer overflow in image size (CVE-2026-68108)

    * kernel: drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CVE-2026-68257)

    * kernel: drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CVE-2026-68267)

    * kernel: drm/xe: Hold a dma-buf reference for imported BOs (CVE-2026-68266)

    * kernel: drm/amdgpu: Fix context pstate override handling (CVE-2026-68273)

    * kernel: Linux kernel IPVS: Denial of Service due to stale memory references (CVE-2026-80714)

    * kernel: nvme-tcp: fix host memory disclosure on R2T for a read command (CVE-2026-89481)

    Bug Fix(es) and Enhancement(s):

    * Bypass DMA APIs for coherent allocations for pre-mapped memory [rhel-10.2.z] (JIRA:Rocky Linux-252331)

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-2026_71700 advisory.

    * kernel: fbcon: Set fb_display[i]->mode to NULL when the mode is released (CVE-2025-40323)

    * kernel: smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (CVE-2026-31539)

    * kernel: drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (CVE-2026-46230)

    * kernel: drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CVE-2026-46204)

    * kernel: drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (CVE-2026-46199)

    * kernel: drm/amdgpu/userq: fix access to stale wptr mapping (CVE-2026-46311)

    * kernel: netfilter: nf_queue: hold bridge skb->dev while queued (CVE-2026-52912)

    * kernel: accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CVE-2026-53203)

    * kernel: drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CVE-2026-53290)

    * kernel: drm/virtio: use uninterruptible resv lock for plane updates (CVE-2026-64098)

    * kernel: Linux kernel: PPPoE memory corruption via stale pointer (CVE-2026-68121)

    * kernel: drm/amdgpu/vce: fix integer overflow in image size (CVE-2026-68108)

    * kernel: drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CVE-2026-68257)

    * kernel: drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CVE-2026-68267)

    * kernel: drm/xe: Hold a dma-buf reference for imported BOs (CVE-2026-68266)

    * kernel: drm/amdgpu: Fix context pstate override handling (CVE-2026-68273)

    * kernel: Linux kernel IPVS: Denial of Service due to stale memory references (CVE-2026-80714)

    Bug Fix(es) and Enhancement(s):

    * MADVISE i/o size in Rocky Linux 9 additionally limited by read_ahead_kb - Was addressed in Rocky Linux8     via Rocky Linux-22476 [rhel-9.8.z] (JIRA:Rocky Linux-260938)

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:71700 advisory.

    * kernel: fbcon: Set fb_display[i]->mode to NULL when the mode is released (CVE-2025-40323)
      * kernel: smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (CVE-2026-31539)
      * kernel: drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (CVE-2026-46230)
      * kernel: drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CVE-2026-46204)
      * kernel: drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (CVE-2026-46199)
      * kernel: drm/amdgpu/userq: fix access to stale wptr mapping (CVE-2026-46311)
      * kernel: netfilter: nf_queue: hold bridge skb->dev while queued (CVE-2026-52912)
      * kernel: accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CVE-2026-53203)
      * kernel: drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CVE-2026-53290)
      * kernel: drm/virtio: use uninterruptible resv lock for plane updates (CVE-2026-64098)
      * kernel: Linux kernel: PPPoE memory corruption via stale pointer (CVE-2026-68121)
      * kernel: drm/amdgpu/vce: fix integer overflow in image size (CVE-2026-68108)
      * kernel: drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CVE-2026-68257)
      * kernel: drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CVE-2026-68267)
      * kernel: drm/xe: Hold a dma-buf reference for imported BOs (CVE-2026-68266)
      * kernel: drm/amdgpu: Fix context pstate override handling (CVE-2026-68273)
      * kernel: Linux kernel IPVS: Denial of Service due to stale memory references (CVE-2026-80714)


    Bug Fix(es) and Enhancement(s):

      * MADVISE i/o size in AlmaLinux 9 additionally limited by read_ahead_kb - Was addressed in AlmaLinux8     via AlmaLinux-22476 [almalinux-9.8.z] (JIRA:AlmaLinux-260938)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-71700 advisory.

    - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121}
    - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561]     {CVE-2026-31539}
    - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714}
    - drm/amdgpu/userq: fix access to stale wptr mapping (Jose Exposito) [RHEL-225416] {CVE-2026-46311}
    - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266}
    - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273}
    - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964]     {CVE-2026-68267}
    - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833]     {CVE-2026-68257}
    - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328]     {CVE-2026-64098}
    - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (Jose Exposito) [RHEL-225299] {CVE-2026-46230}
    - fbcon: Set fb_display[i]->mode to NULL when the mode is released (Jose Exposito) [RHEL-250107]     {CVE-2025-40323}
    - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108}
    - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378]     {CVE-2026-53290}
    - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204}
    - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (Jose Exposito) [RHEL-225443] {CVE-2026-46199}
    - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:71700 advisory.

    * kernel: fbcon: Set fb_display[i]->mode to NULL when the mode is released (CVE-2025-40323)

    * kernel: smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (CVE-2026-31539)

    * kernel: drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (CVE-2026-46230)

    * kernel: drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CVE-2026-46204)

    * kernel: drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (CVE-2026-46199)

    * kernel: drm/amdgpu/userq: fix access to stale wptr mapping (CVE-2026-46311)

    * kernel: netfilter: nf_queue: hold bridge skb->dev while queued (CVE-2026-52912)

    * kernel: accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CVE-2026-53203)

    * kernel: drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CVE-2026-53290)

    * kernel: drm/virtio: use uninterruptible resv lock for plane updates (CVE-2026-64098)

    * kernel: Linux kernel: PPPoE memory corruption via stale pointer (CVE-2026-68121)

    * kernel: drm/amdgpu/vce: fix integer overflow in image size (CVE-2026-68108)

    * kernel: drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CVE-2026-68257)

    * kernel: drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CVE-2026-68267)

    * kernel: drm/xe: Hold a dma-buf reference for imported BOs (CVE-2026-68266)

    * kernel: drm/amdgpu: Fix context pstate override handling (CVE-2026-68273)

    * kernel: Linux kernel IPVS: Denial of Service due to stale memory references (CVE-2026-80714)

    Bug Fix(es) and Enhancement(s):

    * MADVISE i/o size in Rocky Linux 9 additionally limited by read_ahead_kb - Was addressed in Rocky Linux8     via Rocky Linux-22476 [rhel-9.8.z] (JIRA:Rocky Linux-260938)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:71602 advisory.

    * kernel: fbcon: Set fb_display[i]->mode to NULL when the mode is released (CVE-2025-40323)

    * kernel: libceph: fix potential use-after-free in have_mon_and_osd_map() (CVE-2025-68285)

    * kernel: libceph: make decode_pool() more resilient against corrupted osdmaps (CVE-2025-71116)

    * kernel: libceph: prevent potential out-of-bounds reads in handle_auth_done() (CVE-2026-22984)

    * kernel: libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CVE-2026-22990)

    * kernel: Linux kernel: Denial of Service in libceph OSD client due to unreset sparse-read state     (CVE-2026-23136)

    * kernel: drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (CVE-2026-46230)

    * kernel: drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CVE-2026-46204)

    * kernel: drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (CVE-2026-46199)

    * kernel: drm/amdgpu/userq: fix access to stale wptr mapping (CVE-2026-46311)

    * kernel: af_unix: Drop all SCM attributes for SOCKMAP (CVE-2026-53005)

    * kernel: accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CVE-2026-53203)

    * kernel: drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CVE-2026-53290)

    * kernel: drm/virtio: use uninterruptible resv lock for plane updates (CVE-2026-64098)

    * kernel: Linux kernel: PPPoE memory corruption via stale pointer (CVE-2026-68121)

    * kernel: drm/amdgpu/vce: fix integer overflow in image size (CVE-2026-68108)

    * kernel: drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CVE-2026-68257)

    * kernel: drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CVE-2026-68267)

    * kernel: drm/xe: Hold a dma-buf reference for imported BOs (CVE-2026-68266)

    * kernel: drm/amdgpu: Fix context pstate override handling (CVE-2026-68273)

    * kernel: Linux kernel IPVS: Denial of Service due to stale memory references (CVE-2026-80714)

    * kernel: nvme-tcp: fix host memory disclosure on R2T for a read command (CVE-2026-89481)

    Bug Fix(es) and Enhancement(s):

    * Bypass DMA APIs for coherent allocations for pre-mapped memory [rhel-10.2.z] (JIRA:Rocky Linux-252331)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:71700 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: fbcon: Set fb_display[i]->mode to NULL when the mode is released (CVE-2025-40323)

    * kernel: smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (CVE-2026-31539)

    * kernel: drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (CVE-2026-46230)

    * kernel: drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CVE-2026-46204)

    * kernel: drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (CVE-2026-46199)

    * kernel: drm/amdgpu/userq: fix access to stale wptr mapping (CVE-2026-46311)

    * kernel: netfilter: nf_queue: hold bridge skb->dev while queued (CVE-2026-52912)

    * kernel: accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CVE-2026-53203)

    * kernel: drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CVE-2026-53290)

    * kernel: drm/virtio: use uninterruptible resv lock for plane updates (CVE-2026-64098)

    * kernel: Linux kernel: PPPoE memory corruption via stale pointer (CVE-2026-68121)

    * kernel: drm/amdgpu/vce: fix integer overflow in image size (CVE-2026-68108)

    * kernel: drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CVE-2026-68257)

    * kernel: drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CVE-2026-68267)

    * kernel: drm/xe: Hold a dma-buf reference for imported BOs (CVE-2026-68266)

    * kernel: drm/amdgpu: Fix context pstate override handling (CVE-2026-68273)

    * kernel: Linux kernel IPVS: Denial of Service due to stale memory references (CVE-2026-80714)

    Bug Fix(es) and Enhancement(s):

    * MADVISE i/o size in RHEL 9 additionally limited by read_ahead_kb - Was addressed in RHEL8 via RHEL-22476     [rhel-9.8.z] (JIRA:RHEL-260938)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:71602 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: fbcon: Set fb_display[i]->mode to NULL when the mode is released (CVE-2025-40323)

    * kernel: libceph: fix potential use-after-free in have_mon_and_osd_map() (CVE-2025-68285)

    * kernel: libceph: make decode_pool() more resilient against corrupted osdmaps (CVE-2025-71116)

    * kernel: libceph: prevent potential out-of-bounds reads in handle_auth_done() (CVE-2026-22984)

    * kernel: libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CVE-2026-22990)

    * kernel: Linux kernel: Denial of Service in libceph OSD client due to unreset sparse-read state     (CVE-2026-23136)

    * kernel: drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (CVE-2026-46230)

    * kernel: drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CVE-2026-46204)

    * kernel: drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (CVE-2026-46199)

    * kernel: drm/amdgpu/userq: fix access to stale wptr mapping (CVE-2026-46311)

    * kernel: af_unix: Drop all SCM attributes for SOCKMAP (CVE-2026-53005)

    * kernel: accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CVE-2026-53203)

    * kernel: drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CVE-2026-53290)

    * kernel: drm/virtio: use uninterruptible resv lock for plane updates (CVE-2026-64098)

    * kernel: Linux kernel: PPPoE memory corruption via stale pointer (CVE-2026-68121)

    * kernel: drm/amdgpu/vce: fix integer overflow in image size (CVE-2026-68108)

    * kernel: drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CVE-2026-68257)

    * kernel: drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CVE-2026-68267)

    * kernel: drm/xe: Hold a dma-buf reference for imported BOs (CVE-2026-68266)

    * kernel: drm/amdgpu: Fix context pstate override handling (CVE-2026-68273)

    * kernel: Linux kernel IPVS: Denial of Service due to stale memory references (CVE-2026-80714)

    * kernel: nvme-tcp: fix host memory disclosure on R2T for a read command (CVE-2026-89481)

    Bug Fix(es) and Enhancement(s):

    * Bypass DMA APIs for coherent allocations for pre-mapped memory [rhel-10.2.z] (JIRA:RHEL-252331)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4788 advisory.

    -------------------------------------------------------------------------     Debian LTS Advisory DLA-4788-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                        Ben Hutchings     September 19, 2026                            https://wiki.debian.org/LTS
    -------------------------------------------------------------------------

    Package        : linux-6.12     Version        : 6.12.107-1~deb12u1     CVE ID         : CVE-2025-38525 CVE-2025-40054 CVE-2025-40074 CVE-2026-43197                      CVE-2026-53092 CVE-2026-64017 CVE-2026-64216 CVE-2026-64581                      CVE-2026-64586 CVE-2026-68082 CVE-2026-68118 CVE-2026-68132                      CVE-2026-68138 CVE-2026-68159 CVE-2026-68166 CVE-2026-68169                      CVE-2026-68198 CVE-2026-68253 CVE-2026-68254 CVE-2026-68264                      CVE-2026-68266 CVE-2026-68267 CVE-2026-68273 CVE-2026-68276                      CVE-2026-68322 CVE-2026-68367 CVE-2026-68431 CVE-2026-68451                      CVE-2026-68452 CVE-2026-68480 CVE-2026-72111 CVE-2026-74440                      CVE-2026-74441 CVE-2026-74442 CVE-2026-74443 CVE-2026-74444                      CVE-2026-74445 CVE-2026-74446 CVE-2026-74447 CVE-2026-74448                      CVE-2026-74450 CVE-2026-74451 CVE-2026-74452 CVE-2026-74453                      CVE-2026-74454 CVE-2026-74455 CVE-2026-74456 CVE-2026-74457                      CVE-2026-74458 CVE-2026-74459 CVE-2026-74460 CVE-2026-74461                      CVE-2026-74463 CVE-2026-74464 CVE-2026-74465 CVE-2026-74467                      CVE-2026-74468 CVE-2026-74469 CVE-2026-74470 CVE-2026-74471                      CVE-2026-74472 CVE-2026-74473 CVE-2026-74474 CVE-2026-74475                      CVE-2026-74476 CVE-2026-74478 CVE-2026-74479 CVE-2026-74480                      CVE-2026-74481 CVE-2026-74482 CVE-2026-74483 CVE-2026-74484                      CVE-2026-74485 CVE-2026-74487 CVE-2026-74488 CVE-2026-74490                      CVE-2026-74492 CVE-2026-74493 CVE-2026-74494 CVE-2026-74495                      CVE-2026-74497 CVE-2026-74498 CVE-2026-74499 CVE-2026-74500                      CVE-2026-74501 CVE-2026-74502 CVE-2026-74503 CVE-2026-74504                      CVE-2026-74505 CVE-2026-74507 CVE-2026-74508 CVE-2026-74509                      CVE-2026-74510 CVE-2026-74512 CVE-2026-74514 CVE-2026-74515                      CVE-2026-74516 CVE-2026-74517 CVE-2026-74518 CVE-2026-74519                      CVE-2026-74522 CVE-2026-74523 CVE-2026-74524 CVE-2026-74525                      CVE-2026-74531 CVE-2026-74532 CVE-2026-74535 CVE-2026-74536                      CVE-2026-74540 CVE-2026-74541 CVE-2026-74543 CVE-2026-74545                      CVE-2026-74546 CVE-2026-74547 CVE-2026-74548 CVE-2026-74549                      CVE-2026-74550 CVE-2026-74551 CVE-2026-74552 CVE-2026-74553                      CVE-2026-74555 CVE-2026-74556 CVE-2026-74557 CVE-2026-74563                      CVE-2026-74564 CVE-2026-74565 CVE-2026-74566 CVE-2026-74567                      CVE-2026-74569 CVE-2026-74572 CVE-2026-74574 CVE-2026-74575                      CVE-2026-74576 CVE-2026-74577 CVE-2026-74579 CVE-2026-74580                      CVE-2026-74581 CVE-2026-74582 CVE-2026-74583 CVE-2026-74585                      CVE-2026-74586 CVE-2026-74587 CVE-2026-74588 CVE-2026-74589                      CVE-2026-74590 CVE-2026-74592 CVE-2026-74594 CVE-2026-74595                      CVE-2026-74597 CVE-2026-74598 CVE-2026-74599 CVE-2026-74601                      CVE-2026-74602 CVE-2026-74603 CVE-2026-74604 CVE-2026-74606                      CVE-2026-74607 CVE-2026-74608 CVE-2026-74609 CVE-2026-74610                      CVE-2026-74612 CVE-2026-74613 CVE-2026-74614 CVE-2026-74615                      CVE-2026-74616 CVE-2026-74618 CVE-2026-74619 CVE-2026-74620                      CVE-2026-74621 CVE-2026-74622 CVE-2026-74623 CVE-2026-74624                      CVE-2026-74625 CVE-2026-74626 CVE-2026-74628 CVE-2026-74630                      CVE-2026-74631 CVE-2026-74632 CVE-2026-74634 CVE-2026-74635                      CVE-2026-74636 CVE-2026-74637 CVE-2026-74641 CVE-2026-74644                      CVE-2026-74646 CVE-2026-74647 CVE-2026-74648 CVE-2026-74649                      CVE-2026-74650 CVE-2026-74651 CVE-2026-74653 CVE-2026-74654                      CVE-2026-74655 CVE-2026-74656 CVE-2026-74657 CVE-2026-74658                      CVE-2026-74659 CVE-2026-74660 CVE-2026-74661 CVE-2026-74662                      CVE-2026-74663 CVE-2026-74664 CVE-2026-74665 CVE-2026-74666                      CVE-2026-74667 CVE-2026-74668 CVE-2026-74669 CVE-2026-74670                      CVE-2026-74671 CVE-2026-74672 CVE-2026-74673 CVE-2026-74675                      CVE-2026-74676 CVE-2026-74677 CVE-2026-74678 CVE-2026-74679                      CVE-2026-74680 CVE-2026-74682 CVE-2026-74683 CVE-2026-74684                      CVE-2026-74685 CVE-2026-74688 CVE-2026-74689 CVE-2026-74691                      CVE-2026-74692 CVE-2026-74693 CVE-2026-74694 CVE-2026-74696                      CVE-2026-74700 CVE-2026-74701 CVE-2026-74704 CVE-2026-74705                      CVE-2026-74710 CVE-2026-74712 CVE-2026-74714 CVE-2026-74717                      CVE-2026-74718 CVE-2026-74719 CVE-2026-74720 CVE-2026-74722                      CVE-2026-74724 CVE-2026-74725 CVE-2026-74726 CVE-2026-74730                      CVE-2026-74732 CVE-2026-74736 CVE-2026-74737 CVE-2026-74739                      CVE-2026-74740 CVE-2026-74742 CVE-2026-74743 CVE-2026-74744                      CVE-2026-74746 CVE-2026-74748 CVE-2026-80522 CVE-2026-80525                      CVE-2026-80526 CVE-2026-80527 CVE-2026-80528 CVE-2026-80529                      CVE-2026-80530 CVE-2026-80531 CVE-2026-80532 CVE-2026-80533                      CVE-2026-80534 CVE-2026-80535 CVE-2026-80536 CVE-2026-80539                      CVE-2026-80540 CVE-2026-80541 CVE-2026-80547 CVE-2026-80548                      CVE-2026-80549 CVE-2026-80550 CVE-2026-80551 CVE-2026-80552                      CVE-2026-80553 CVE-2026-80554 CVE-2026-80555 CVE-2026-80556                      CVE-2026-80557 CVE-2026-80558 CVE-2026-80559 CVE-2026-80560                      CVE-2026-80561 CVE-2026-80562 CVE-2026-80563 CVE-2026-80565                      CVE-2026-80566 CVE-2026-80567 CVE-2026-80568 CVE-2026-80569                      CVE-2026-80570 CVE-2026-80572 CVE-2026-80573 CVE-2026-80574                      CVE-2026-80575 CVE-2026-80576 CVE-2026-80577 CVE-2026-80578                      CVE-2026-80583 CVE-2026-80584 CVE-2026-80585 CVE-2026-80586                      CVE-2026-80587 CVE-2026-80589 CVE-2026-80590 CVE-2026-80678                      CVE-2026-80679 CVE-2026-80680 CVE-2026-80681 CVE-2026-80684                      CVE-2026-80686 CVE-2026-80689 CVE-2026-80691 CVE-2026-80694                      CVE-2026-80695 CVE-2026-80696 CVE-2026-80700 CVE-2026-80702                      CVE-2026-80703 CVE-2026-80704 CVE-2026-80706 CVE-2026-80707                      CVE-2026-80708 CVE-2026-80709 CVE-2026-80710 CVE-2026-80711                      CVE-2026-80714 CVE-2026-80715 CVE-2026-80716 CVE-2026-80717                      CVE-2026-80718 CVE-2026-80722 CVE-2026-80723 CVE-2026-80725                      CVE-2026-80726 CVE-2026-80727 CVE-2026-80728 CVE-2026-80730                      CVE-2026-80731 CVE-2026-80732 CVE-2026-80733 CVE-2026-80736                      CVE-2026-80737 CVE-2026-80739 CVE-2026-80742 CVE-2026-80743                      CVE-2026-80744 CVE-2026-80749 CVE-2026-80752 CVE-2026-80754                      CVE-2026-80756 CVE-2026-80757 CVE-2026-80759 CVE-2026-80763                      CVE-2026-80764 CVE-2026-80765 CVE-2026-80767 CVE-2026-80770                      CVE-2026-80771 CVE-2026-80772 CVE-2026-80779 CVE-2026-80781                      CVE-2026-80782 CVE-2026-80784 CVE-2026-80788 CVE-2026-80789                      CVE-2026-80790 CVE-2026-80791 CVE-2026-80792 CVE-2026-80793                      CVE-2026-80794 CVE-2026-80795 CVE-2026-80797 CVE-2026-80798                      CVE-2026-80799 CVE-2026-80800 CVE-2026-80801 CVE-2026-80802                      CVE-2026-80803 CVE-2026-80805 CVE-2026-80808 CVE-2026-80809                      CVE-2026-80812 CVE-2026-80814 CVE-2026-80815 CVE-2026-80819                      CVE-2026-80820 CVE-2026-80823 CVE-2026-80887 CVE-2026-80888                      CVE-2026-80889 CVE-2026-80890 CVE-2026-80891 CVE-2026-80892                      CVE-2026-80893 CVE-2026-80894 CVE-2026-80901 CVE-2026-80902                      CVE-2026-80903 CVE-2026-80904 CVE-2026-80906 CVE-2026-80907                      CVE-2026-80908 CVE-2026-80909 CVE-2026-80910 CVE-2026-80911                      CVE-2026-80912 CVE-2026-80913 CVE-2026-80915 CVE-2026-80916                      CVE-2026-80917 CVE-2026-80918     Debian Bug     : 1142912 1143545

    Several vulnerabilities have been discovered in the Linux kernel that     may lead to a privilege escalation, denial of service or information     leaks.

    For Debian 12 bookworm, these problems have been fixed in version     6.12.107-1~deb12u1.  This update additionally includes many more bug     fixes from stable updates 6.12.102-6.12.107, and adds drivers for     Alcor card readers.

    We recommend that you upgrade your linux-6.12 packages.

    For the detailed security status of linux-6.12 please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/linux-6.12

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS     Attachment:
    signature.asc     Description: PGP signature

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6466 advisory.

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-6466-1                   security@debian.org     https://www.debian.org/security/                     Salvatore Bonaccorso     August 25, 2026                       https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : linux     CVE ID         : CVE-2025-38525 CVE-2025-40054 CVE-2026-43197 CVE-2026-53092                      CVE-2026-64017 CVE-2026-64586 CVE-2026-68082 CVE-2026-68118                      CVE-2026-68132 CVE-2026-68138 CVE-2026-68159 CVE-2026-68166                      CVE-2026-68169 CVE-2026-68198 CVE-2026-68253 CVE-2026-68254                      CVE-2026-68264 CVE-2026-68266 CVE-2026-68267 CVE-2026-68273                      CVE-2026-68276 CVE-2026-68322 CVE-2026-68367 CVE-2026-68431                      CVE-2026-68451 CVE-2026-68452 CVE-2026-68480 CVE-2026-72111                      CVE-2026-74440 CVE-2026-74441 CVE-2026-74442 CVE-2026-74443                      CVE-2026-74444 CVE-2026-74445 CVE-2026-74446 CVE-2026-74447                      CVE-2026-74448 CVE-2026-74450 CVE-2026-74451 CVE-2026-74452                      CVE-2026-74453 CVE-2026-74454 CVE-2026-74455 CVE-2026-74456                      CVE-2026-74457 CVE-2026-74458 CVE-2026-74459 CVE-2026-74460                      CVE-2026-74461 CVE-2026-74463 CVE-2026-74464 CVE-2026-74465                      CVE-2026-74467 CVE-2026-74468 CVE-2026-74469 CVE-2026-74470                      CVE-2026-74471 CVE-2026-74472 CVE-2026-74473 CVE-2026-74474                      CVE-2026-74475 CVE-2026-74476 CVE-2026-74478 CVE-2026-74479                      CVE-2026-74480 CVE-2026-74481 CVE-2026-74482 CVE-2026-74483                      CVE-2026-74484 CVE-2026-74485 CVE-2026-74487 CVE-2026-74488                      CVE-2026-74490 CVE-2026-74492 CVE-2026-74493 CVE-2026-74494                      CVE-2026-74495 CVE-2026-74497 CVE-2026-74498 CVE-2026-74499                      CVE-2026-74500 CVE-2026-74501 CVE-2026-74502 CVE-2026-74503                      CVE-2026-74504 CVE-2026-74505 CVE-2026-74507 CVE-2026-74508                      CVE-2026-74509 CVE-2026-74510 CVE-2026-74512 CVE-2026-74514                      CVE-2026-74515 CVE-2026-74516 CVE-2026-74517 CVE-2026-74518                      CVE-2026-74519 CVE-2026-74522 CVE-2026-74523 CVE-2026-74524                      CVE-2026-74525 CVE-2026-74531 CVE-2026-74532 CVE-2026-74535                      CVE-2026-74536 CVE-2026-74540 CVE-2026-74541 CVE-2026-74543                      CVE-2026-74545 CVE-2026-74546 CVE-2026-74547 CVE-2026-74548                      CVE-2026-74549 CVE-2026-74550 CVE-2026-74551 CVE-2026-74552                      CVE-2026-74553 CVE-2026-74555 CVE-2026-74556 CVE-2026-74557                      CVE-2026-74563 CVE-2026-74564 CVE-2026-74565 CVE-2026-74566                      CVE-2026-74567 CVE-2026-74569 CVE-2026-74572 CVE-2026-74574                      CVE-2026-74575 CVE-2026-74576 CVE-2026-74577 CVE-2026-74579                      CVE-2026-74580 CVE-2026-74581 CVE-2026-74582 CVE-2026-74583                      CVE-2026-74585 CVE-2026-74586 CVE-2026-74587 CVE-2026-74588                      CVE-2026-74589 CVE-2026-74590 CVE-2026-74592 CVE-2026-74594                      CVE-2026-74595 CVE-2026-74597 CVE-2026-74598 CVE-2026-74599                      CVE-2026-74601 CVE-2026-74602 CVE-2026-74603 CVE-2026-74604                      CVE-2026-74606 CVE-2026-74607 CVE-2026-74608 CVE-2026-74609                      CVE-2026-74610 CVE-2026-74612 CVE-2026-74613 CVE-2026-74614                      CVE-2026-74615 CVE-2026-74616 CVE-2026-74618 CVE-2026-74619                      CVE-2026-74620 CVE-2026-74621 CVE-2026-74622 CVE-2026-74623                      CVE-2026-74624 CVE-2026-74625 CVE-2026-74628 CVE-2026-74630                      CVE-2026-74631 CVE-2026-74632 CVE-2026-74634 CVE-2026-74635                      CVE-2026-74636 CVE-2026-74637 CVE-2026-74641 CVE-2026-74644                      CVE-2026-74646 CVE-2026-74647 CVE-2026-74648 CVE-2026-74649                      CVE-2026-74650 CVE-2026-74651 CVE-2026-74654 CVE-2026-74655                      CVE-2026-74656 CVE-2026-74657 CVE-2026-74658 CVE-2026-74659                      CVE-2026-74660 CVE-2026-74661 CVE-2026-74663 CVE-2026-74664                      CVE-2026-74665 CVE-2026-74666 CVE-2026-74667 CVE-2026-74668                      CVE-2026-74669 CVE-2026-74670 CVE-2026-74671 CVE-2026-74672                      CVE-2026-74673 CVE-2026-74675 CVE-2026-74676 CVE-2026-74677                      CVE-2026-74678 CVE-2026-74679 CVE-2026-74680 CVE-2026-74682                      CVE-2026-74683 CVE-2026-74684 CVE-2026-74685 CVE-2026-74688                      CVE-2026-74689 CVE-2026-74691 CVE-2026-74692 CVE-2026-74693                      CVE-2026-74694 CVE-2026-74696 CVE-2026-74700 CVE-2026-74701                      CVE-2026-74704 CVE-2026-74705 CVE-2026-74710 CVE-2026-74712                      CVE-2026-74714 CVE-2026-74717 CVE-2026-74718 CVE-2026-74719                      CVE-2026-74720 CVE-2026-74722 CVE-2026-74724 CVE-2026-74725                      CVE-2026-74726 CVE-2026-74730 CVE-2026-74732     Debian Bug     : 1142912 1143545

    Several vulnerabilities have been discovered in the Linux kernel that     may lead to a privilege escalation, denial of service or information     leaks.

    For the stable distribution (trixie), these problems have been fixed in     version 6.12.105-1.

    We recommend that you upgrade your linux packages.

    For the detailed security status of linux please refer to its security     tracker page at:
    https://security-tracker.debian.org/tracker/linux

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the linux package has been released.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - drm/xe: Hold a dma-buf reference for imported BOs An imported dma-buf BO is created as a ttm_bo_type_sg BO     whose reservation object is the exporter's dma_buf->resv. The importer, however, only takes a dma-buf     reference after a successful dma_buf_dynamic_attach(). Until then nothing keeps the exporter alive, so if     the exporter is freed while the BO still references its resv, a later access to that resv is a use-after-     free: Oops: general protection fault, probably for non-canonical address 0x6b6b6b6b6b6b6b9c Workqueue: ttm     ttm_bo_delayed_delete [ttm] RIP: 0010:mutex_can_spin_on_owner+0x3f/0xc0 This can be reached on two paths:
    - dma_buf_dynamic_attach() fails, or - ttm_bo_init_reserved() fails during BO creation. In both cases the     BO already has bo->base.resv pointing at the exporter resv, and sg BOs are always torn down via     ttm_bo_delayed_delete(), which locks bo->base.resv asynchronously - potentially after the exporter has     been freed. Take the dma-buf reference in xe_bo_init_locked(), before ttm_bo_init_reserved(), so it also     covers a creation failure there, and release it in xe_ttm_bo_destroy(). The reference is held for the     whole BO lifetime, keeping the shared resv alive on every path. v2: - Reworked the fix to avoid creating     the imported sg BO before dma_buf_dynamic_attach() succeeds. - Attach with importer_priv == NULL and make     invalidate_mappings ignore incomplete imports. v3: - Dropped the xe-side reordering approach since     importer_priv must be valid when dma_buf_dynamic_attach() publishes the attachment. - Per Christian's     suggestion on the v1 thread, keyed the check on import_attach rather than removing the sg guard entirely.
    - Fixes both xe and amdgpu in a single TTM patch. v4: - Moved import_attach check to after     dma_resv_copy_fences() so fences are copied before returning for successful imports (Thomas). - Removed     exporter-alive claim from commit message (Thomas). v5: - Add drm/xe patch to keep imported sg BOs off the     LRU before attach succeeds; the TTM fix alone is not sufficient for xe if the BO is already LRU-visible.
    (Thomas) v4 patch: https://patchwork.freedesktop.org/patch/736663/?series=169129&rev=2 - Patch 1 (drm/ttm)     carries Christian's Reviewed-by from v4. v6: - Reworked the fix based on Thomas' suggestion. Instead of     the TTM resv individualization (v1-v5) plus the xe off-LRU/placement handling (v5), just hold a dma-buf     reference for the imported BO lifetime so the shared resv can never be freed while the BO still references     it. Single xe patch, no TTM change. (Thomas) - Take the reference in xe_bo_init_locked() before     ttm_bo_init_reserved() so a TTM creation failure is covered too (Thomas). - Dropped the v5 series (drm/ttm     + drm/xe off-LRU); the off-LRU approach also regressed in CI BAT via ttm_bo_pipeline_gutting() creating a     ghost BO that outlived the exporter. Link to v5: https://patchwork.freedesktop.org/series/169984/ v7: -     Move changelog above --- so it stays in the commit message. - Reorder changelog entries oldest-to-newest.
    (Thomas) (cherry picked from commit 3516f3fae6be35642f8f06f8a218da6425c0306a) (CVE-2026-68266)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
364137	Oracle Linux 10 / 9 : Unbreakable Enterprise kernel (ELSA-2026-500374)	Nessus	Oracle Linux Local Security Checks	Local	high
363461	CentOS 9 : kernel-5.14.0-756.el9	Nessus	CentOS Local Security Checks	Local	critical
362992	Oracle Linux 10 : kernel (ELSA-2026-71602)	Nessus	Oracle Linux Local Security Checks	Local	high
362945	AlmaLinux 10 : kernel (ALSA-2026:71602)	Nessus	Alma Linux Local Security Checks	Local	high
354966	Rocky Linux 10.2 [CIQ] Security Update: kernel / kernel-64k / kernel-64k-core / kernel-64k-debug / etc Multiple Vulnerabilities (crlsa-2026_71602)	Nessus	Rocky Linux Local Security Checks	Local	high
354229	Rocky Linux 9 [CIQ] Security Update: kernel / kernel-64k / kernel-64k-core / kernel-64k-debug / etc Multiple Vulnerabilities (crlsa-2026_71700)	Nessus	Rocky Linux Local Security Checks	Local	critical
351154	AlmaLinux 9 : kernel (ALSA-2026:71700)	Nessus	Alma Linux Local Security Checks	Local	critical
350941	Oracle Linux 9 : kernel (ELSA-2026-71700)	Nessus	Oracle Linux Local Security Checks	Local	critical
350785	RockyLinux 9 : kernel (RLSA-2026:71700)	Nessus	Rocky Linux Local Security Checks	Local	critical
350784	RockyLinux 10 : kernel (RLSA-2026:71602)	Nessus	Rocky Linux Local Security Checks	Local	high
350192	RHEL 9 : kernel (RHSA-2026:71700)	Nessus	Red Hat Local Security Checks	Local	critical
349906	RHEL 10 : kernel (RHSA-2026:71602)	Nessus	Red Hat Local Security Checks	Local	high
348574	Debian dla-4788 : ata-modules-6.12.100+deb12-armmp-di - security update	Nessus	Debian Local Security Checks	Local	medium
343049	Oracle Linux 10 / 9 : Unbreakable Enterprise kernel (ELSA-2026-500248)	Nessus	Oracle Linux Local Security Checks	Local	high
339550	Debian dsa-6466 : ata-modules-6.12.101+deb13-armmp-di - security update	Nessus	Debian Local Security Checks	Local	medium
334784	Photon OS 5.0: Linux PHSA-2026-5.0-92-0952	Nessus	PhotonOS Local Security Checks	Local	high
334264	Linux Distros Unpatched Vulnerability : CVE-2026-68266	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2026-68266

high

Tenable Plugins

Coming Soon

high

critical

high

high

high

critical

critical

critical

critical

high

critical

high

medium

high

medium

high

high