In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: fix NULL pointer dereference in ath11k_hal_srng_access_begin In ATH11K_QMI_EVENT_FW_READY, ATH11K_FLAG_REGISTERED is set unconditionally even when ath11k_core_qmi_firmware_ready() fails. This leaves the driver in an inconsistent state where initialization is considered complete although the firmware ready handling did not finish successfully. During the subsequent SSR, the driver enters the restart path based on this incorrect state and dereferences uninitialized srng members, resulting in a NULL pointer dereference. Call trace: ath11k_hal_srng_access_begin+0xc/0x60 [ath11k] (P) ath11k_ce_cleanup_pipes+0x17c/0x180 [ath11k] ath11k_core_restart+0x40/0x168 [ath11k] Fix this by: - skipping firmware_ready if ATH11K_FLAG_REGISTERED is already set - setting ATH11K_FLAG_REGISTERED only when firmware_ready succeeds - setting ATH11K_FLAG_QMI_FAIL and aborting the FW_READY handling on error Tested-on: WCN6750 hw1.0 AHB WLAN.MSL.2.0.c2-00204-QCAMSLSWPLZ-1

ubuntu_linux USN-8887-1: Ubuntu 26.04 LTS : Linux kernel vulnerabilities (USN-8887-1)

ubuntu_linux USN-8889-1: Ubuntu 26.04 LTS : Linux kernel (OEM) vulnerabilities (USN-8889-1)

ubuntu_linux USN-8888-1: Ubuntu 26.04 LTS : Linux kernel (Azure) vulnerabilities (USN-8888-1)

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1791741836 advisory.

  - In the Linux kernel, the following vulnerability has been resolved: vhost: fix hung thread due to     erroneous iotlb entries In vhost_iotlb_add_range_ctx(), range size can overflow to 0 when start is 0 and     last is ULONG_MAX. One instance where it can happen is when userspace sends an IOTLB message with     iova=size=uaddr=0 (vhost_process_iotlb_msg). So, an entry with size = 0, start = 0, last = ULONG_MAX ends     up in the iotlb. Next time a packet is sent, iotlb_access_ok() loops indefinitely due to that erroneous     entry. Call Trace: <TASK> iotlb_access_ok+0x21b/0x3e0 drivers/vhost/vhost.c:1340     vq_meta_prefetch+0xbc/0x280 drivers/vhost/vhost.c:1366 vhost_transport_do_send_pkt+0xe0/0xfd0     drivers/vhost/vsock.c:104 vhost_worker+0x23d/0x3d0 drivers/vhost/vhost.c:372 kthread+0x2e9/0x3a0     kernel/kthread.c:377 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295 </TASK> Reported by syzbot at:
    https://syzkaller.appspot.com/bug?extid=0abd373e2e50d704db87 To fix this, do two things: 1. Return -EINVAL     in vhost_chr_write_iter() when userspace asks to map a range with size 0. 2. Fix     vhost_iotlb_add_range_ctx() to handle the range [0, ULONG_MAX] by splitting it into two entries.
    (CVE-2022-48862)

  - In the Linux kernel, the following vulnerability has been resolved: net: hns3: add vlan list lock to     protect vlan list When adding port base VLAN, vf VLAN need to remove from HW and modify the vlan state in     vf VLAN list as false. If the periodicity task is freeing the same node, it may cause use after free     error. This patch adds a vlan list lock to protect the vlan list. (CVE-2022-49182)

  - In the Linux kernel, the following vulnerability has been resolved: perf/x86/amd: Fix crash due to race     between amd_pmu_enable_all, perf NMI and throttling amd_pmu_enable_all() does: if (!test_bit(idx,     cpuc->active_mask)) continue; amd_pmu_enable_event(cpuc->events[idx]); A perf NMI of another event can     come between these two steps. Perf NMI handler internally disables and enables _all_ events, including the     one which nmi-intercepted amd_pmu_enable_all() was in process of enabling. If that unintentionally enabled     event has very low sampling period and causes immediate successive NMI, causing the event to be throttled,     cpuc->events[idx] and cpuc->active_mask gets cleared by x86_pmu_stop(). This will result in     amd_pmu_enable_event() getting called with event=NULL when amd_pmu_enable_all() resumes after handling the     NMIs. This causes a kernel crash: BUG: kernel NULL pointer dereference, address: 0000000000000198 #PF:
    supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page [...] Call Trace: <TASK>     amd_pmu_enable_all+0x68/0xb0 ctx_resched+0xd9/0x150 event_function+0xb8/0x130 ?     hrtimer_start_range_ns+0x141/0x4a0 ? perf_duration_warn+0x30/0x30 remote_function+0x4d/0x60
    __flush_smp_call_function_queue+0xc4/0x500 flush_smp_call_function_queue+0x11d/0x1b0 do_idle+0x18f/0x2d0     cpu_startup_entry+0x19/0x20 start_secondary+0x121/0x160 secondary_startup_64_no_verify+0xe5/0xeb </TASK>     amd_pmu_disable_all()/amd_pmu_enable_all() calls inside perf NMI handler were recently added as part of     BRS enablement but I'm not sure whether we really need them. We can just disable BRS in the beginning and     enable it back while returning from NMI. This will solve the issue by not enabling those events whose     active_masks are set but are not yet enabled in hw pmu. (CVE-2022-49781)

  - In the Linux kernel, the following vulnerability has been resolved: blk-iolatency: Fix memory leak on     add_disk() failures When a gendisk is successfully initialized but add_disk() fails such as when a loop     device has invalid number of minor device numbers specified, blkcg_init_disk() is called during init and     then blkcg_exit_disk() during error handling. Unfortunately, iolatency gets initialized in the former but     doesn't get cleaned up in the latter. This is because, in non-error cases, the cleanup is performed by     del_gendisk() calling rq_qos_exit(), the assumption being that rq_qos policies, iolatency being one of     them, can only be activated once the disk is fully registered and visible. That assumption is true for wbt     and iocost, but not so for iolatency as it gets initialized before add_disk() is called. It is desirable     to lazy-init rq_qos policies because they are optional features and add to hot path overhead once     initialized - each IO has to walk all the registered rq_qos policies. So, we want to switch iolatency to     lazy init too. However, that's a bigger change. As a fix for the immediate problem, let's just add an     extra call to rq_qos_exit() in blkcg_exit_disk(). This is safe because duplicate calls to rq_qos_exit()     become noop's. (CVE-2022-50550)

  - In the Linux kernel, the following vulnerability has been resolved: usb: roles: fix NULL pointer issue     when put module's reference In current design, usb role class driver will get usb_role_switch parent's     module reference after the user get usb_role_switch device and put the reference after the user put the     usb_role_switch device. However, the parent device of usb_role_switch may be removed before the user put     the usb_role_switch. If so, then, NULL pointer issue will be met when the user put the parent module's     reference. This will save the module pointer in structure of usb_role_switch. Then, we don't need to find     module by iterating long relations. (CVE-2024-26747)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The AlmaLinux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1789986443 advisory.

  - In the Linux kernel, the following vulnerability has been resolved: net: hns3: add vlan list lock to     protect vlan list When adding port base VLAN, vf VLAN need to remove from HW and modify the vlan state in     vf VLAN list as false. If the periodicity task is freeing the same node, it may cause use after free     error. This patch adds a vlan list lock to protect the vlan list. (CVE-2022-49182)

  - In the Linux kernel, the following vulnerability has been resolved: tracing: Fix reading strings from     synthetic events The follow commands caused a crash: # cd /sys/kernel/tracing # echo 's:open char file[]'     > dynamic_events # echo 'hist:keys=common_pid:file=filename:onchange($file).trace(open,$file)' >     events/syscalls/sys_enter_openat/trigger' # echo 1 > events/synthetic/open/enable BOOM! The problem is     that the synthetic event field char file[] will read the value given to it as a string without any     memory checks to make sure the address is valid. The above example will pass in the user space address and     the sythetic event code will happily call strlen() on it and then strscpy() where either one will cause an     oops when accessing user space addresses. Use the helper functions from trace_kprobe and trace_eprobe that     can read strings safely (and actually succeed when the address is from user space and the memory is mapped     in). Now the above can show: packagekitd-1721 [000] ...2. 104.597170: open:
    file=/usr/lib/rpm/fileattrs/cmake.attr in:imjournal-978 [006] ...2. 104.599642: open:
    file=/var/lib/rsyslog/imjournal.state.tmp packagekitd-1721 [000] ...2. 104.626308: open:
    file=/usr/lib/rpm/fileattrs/debuginfo.attr (CVE-2022-50255)

  - In the Linux kernel, the following vulnerability has been resolved: ipc: fix memleak if msg_init_ns failed     in create_ipc_ns Percpu memory allocation may failed during create_ipc_ns however this fail is not handled     properly since ipc sysctls and mq sysctls is not released properly. Fix this by release these two resource     when failure. Here is the kmemleak stack when percpu failed: unreferenced object 0xffff88819de2a600 (size     512): comm shmem_2nstest, pid 120711, jiffies 4300542254 hex dump (first 32 bytes): 60 aa 9d 84 ff ff ff     ff fc 18 48 b2 84 88 ff ff `.........H..... 04 00 00 00 a4 01 00 00 20 e4 56 81 ff ff ff ff ........
    .V..... backtrace (crc be7cba35): [<ffffffff81b43f83>] __kmalloc_node_track_caller_noprof+0x333/0x420     [<ffffffff81a52e56>] kmemdup_noprof+0x26/0x50 [<ffffffff821b2f37>] setup_mq_sysctls+0x57/0x1d0     [<ffffffff821b29cc>] copy_ipcs+0x29c/0x3b0 [<ffffffff815d6a10>] create_new_namespaces+0x1d0/0x920     [<ffffffff815d7449>] copy_namespaces+0x2e9/0x3e0 [<ffffffff815458f3>] copy_process+0x29f3/0x7ff0     [<ffffffff8154b080>] kernel_clone+0xc0/0x650 [<ffffffff8154b6b1>] __do_sys_clone+0xa1/0xe0     [<ffffffff843df8ff>] do_syscall_64+0xbf/0x1c0 [<ffffffff846000b0>]     entry_SYSCALL_64_after_hwframe+0x4b/0x53 (CVE-2024-53175)

  - In the Linux kernel, the following vulnerability has been resolved: net/mlx5: HWS, change error flow on     matcher disconnect Currently, when firmware failure occurs during matcher disconnect flow, the error flow     of the function reconnects the matcher back and returns an error, which continues running the calling     function and eventually frees the matcher that is being disconnected. This leads to a case where we have a     freed matcher on the matchers list, which in turn leads to use-after-free and eventual crash. This patch     fixes that by not trying to reconnect the matcher back when some FW command fails during disconnect. Note     that we're dealing here with FW error. We can't overcome this problem. This might lead to bad steering     state (e.g. wrong connection between matchers), and will also lead to resource leakage, as it is the case     with any other error handling during resource destruction. However, the goal here is to allow the driver     to continue and not crash the machine with use-after-free error. (CVE-2025-21751)

  - In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: Avoid memory leak while     enabling statistics Driver uses monitor destination rings for extended statistics mode and standalone     monitor mode. In extended statistics mode, TLVs are parsed from the buffer received from the monitor     destination ring and assigned to the ppdu_info structure to update per-packet statistics. In standalone     monitor mode, along with per-packet statistics, the packet data (payload) is captured, and the driver     updates per MSDU to mac80211. When the AP interface is enabled, only extended statistics mode is     activated. As part of enabling monitor rings for collecting statistics, the driver subscribes to     HAL_RX_MPDU_START TLV in the filter configuration. This TLV is received from the monitor destination ring,     and kzalloc for the mon_mpdu object occurs, which is not freed, leading to a memory leak. The kzalloc for     the mon_mpdu object is only required while enabling the standalone monitor interface. This causes a memory     leak while enabling extended statistics mode in the driver. Fix this memory leak by removing the kzalloc     for the mon_mpdu object in the HAL_RX_MPDU_START TLV handling. Additionally, remove the standalone monitor     mode handlings in the HAL_MON_BUF_ADDR and HAL_RX_MSDU_END TLVs. These TLV tags will be handled properly     when enabling standalone monitor mode in the future. Tested-on: QCN9274 hw2.0 PCI     WLAN.WBE.1.3.1-00173-QCAHKSWPL_SILICONZ-1 Tested-on: WCN7850 hw2.0 PCI     WLAN.HMT.1.0.c5-00481-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3 (CVE-2025-37743)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1789986443 advisory.

  - In the Linux kernel, the following vulnerability has been resolved: net: hns3: add vlan list lock to     protect vlan list When adding port base VLAN, vf VLAN need to remove from HW and modify the vlan state in     vf VLAN list as false. If the periodicity task is freeing the same node, it may cause use after free     error. This patch adds a vlan list lock to protect the vlan list. (CVE-2022-49182)

  - In the Linux kernel, the following vulnerability has been resolved: tracing: Fix reading strings from     synthetic events The follow commands caused a crash: # cd /sys/kernel/tracing # echo 's:open char file[]'     > dynamic_events # echo 'hist:keys=common_pid:file=filename:onchange($file).trace(open,$file)' >     events/syscalls/sys_enter_openat/trigger' # echo 1 > events/synthetic/open/enable BOOM! The problem is     that the synthetic event field char file[] will read the value given to it as a string without any     memory checks to make sure the address is valid. The above example will pass in the user space address and     the sythetic event code will happily call strlen() on it and then strscpy() where either one will cause an     oops when accessing user space addresses. Use the helper functions from trace_kprobe and trace_eprobe that     can read strings safely (and actually succeed when the address is from user space and the memory is mapped     in). Now the above can show: packagekitd-1721 [000] ...2. 104.597170: open:
    file=/usr/lib/rpm/fileattrs/cmake.attr in:imjournal-978 [006] ...2. 104.599642: open:
    file=/var/lib/rsyslog/imjournal.state.tmp packagekitd-1721 [000] ...2. 104.626308: open:
    file=/usr/lib/rpm/fileattrs/debuginfo.attr (CVE-2022-50255)

  - In the Linux kernel, the following vulnerability has been resolved: ipc: fix memleak if msg_init_ns failed     in create_ipc_ns Percpu memory allocation may failed during create_ipc_ns however this fail is not handled     properly since ipc sysctls and mq sysctls is not released properly. Fix this by release these two resource     when failure. Here is the kmemleak stack when percpu failed: unreferenced object 0xffff88819de2a600 (size     512): comm shmem_2nstest, pid 120711, jiffies 4300542254 hex dump (first 32 bytes): 60 aa 9d 84 ff ff ff     ff fc 18 48 b2 84 88 ff ff `.........H..... 04 00 00 00 a4 01 00 00 20 e4 56 81 ff ff ff ff ........
    .V..... backtrace (crc be7cba35): [<ffffffff81b43f83>] __kmalloc_node_track_caller_noprof+0x333/0x420     [<ffffffff81a52e56>] kmemdup_noprof+0x26/0x50 [<ffffffff821b2f37>] setup_mq_sysctls+0x57/0x1d0     [<ffffffff821b29cc>] copy_ipcs+0x29c/0x3b0 [<ffffffff815d6a10>] create_new_namespaces+0x1d0/0x920     [<ffffffff815d7449>] copy_namespaces+0x2e9/0x3e0 [<ffffffff815458f3>] copy_process+0x29f3/0x7ff0     [<ffffffff8154b080>] kernel_clone+0xc0/0x650 [<ffffffff8154b6b1>] __do_sys_clone+0xa1/0xe0     [<ffffffff843df8ff>] do_syscall_64+0xbf/0x1c0 [<ffffffff846000b0>]     entry_SYSCALL_64_after_hwframe+0x4b/0x53 (CVE-2024-53175)

  - In the Linux kernel, the following vulnerability has been resolved: net/mlx5: HWS, change error flow on     matcher disconnect Currently, when firmware failure occurs during matcher disconnect flow, the error flow     of the function reconnects the matcher back and returns an error, which continues running the calling     function and eventually frees the matcher that is being disconnected. This leads to a case where we have a     freed matcher on the matchers list, which in turn leads to use-after-free and eventual crash. This patch     fixes that by not trying to reconnect the matcher back when some FW command fails during disconnect. Note     that we're dealing here with FW error. We can't overcome this problem. This might lead to bad steering     state (e.g. wrong connection between matchers), and will also lead to resource leakage, as it is the case     with any other error handling during resource destruction. However, the goal here is to allow the driver     to continue and not crash the machine with use-after-free error. (CVE-2025-21751)

  - In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: Avoid memory leak while     enabling statistics Driver uses monitor destination rings for extended statistics mode and standalone     monitor mode. In extended statistics mode, TLVs are parsed from the buffer received from the monitor     destination ring and assigned to the ppdu_info structure to update per-packet statistics. In standalone     monitor mode, along with per-packet statistics, the packet data (payload) is captured, and the driver     updates per MSDU to mac80211. When the AP interface is enabled, only extended statistics mode is     activated. As part of enabling monitor rings for collecting statistics, the driver subscribes to     HAL_RX_MPDU_START TLV in the filter configuration. This TLV is received from the monitor destination ring,     and kzalloc for the mon_mpdu object occurs, which is not freed, leading to a memory leak. The kzalloc for     the mon_mpdu object is only required while enabling the standalone monitor interface. This causes a memory     leak while enabling extended statistics mode in the driver. Fix this memory leak by removing the kzalloc     for the mon_mpdu object in the HAL_RX_MPDU_START TLV handling. Additionally, remove the standalone monitor     mode handlings in the HAL_MON_BUF_ADDR and HAL_RX_MSDU_END TLVs. These TLV tags will be handled properly     when enabling standalone monitor mode in the future. Tested-on: QCN9274 hw2.0 PCI     WLAN.WBE.1.3.1-00173-QCAHKSWPL_SILICONZ-1 Tested-on: WCN7850 hw2.0 PCI     WLAN.HMT.1.0.c5-00481-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3 (CVE-2025-37743)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4777 advisory.

    - -------------------------------------------------------------------------     Debian LTS Advisory DLA-4777-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                 Salvatore Bonaccorso     September 08, 2026                            https://wiki.debian.org/LTS
    - -------------------------------------------------------------------------

    Package        : linux     Version        : 6.1.187-1     CVE ID         : CVE-2023-53706 CVE-2023-54141 CVE-2023-54263 CVE-2024-38620                      CVE-2024-46754 CVE-2024-58094 CVE-2024-58095 CVE-2025-22104                      CVE-2025-38117 CVE-2025-38203 CVE-2025-38206 CVE-2025-38237                      CVE-2025-38616 CVE-2025-39833 CVE-2025-39901 CVE-2025-39925                      CVE-2025-40054 CVE-2025-40064 CVE-2025-40102 CVE-2025-40139                      CVE-2025-40168 CVE-2025-40206 CVE-2025-40307 CVE-2025-68794                      CVE-2026-23394 CVE-2026-31419 CVE-2026-43491 CVE-2026-45963                      CVE-2026-46111 CVE-2026-46158 CVE-2026-46170 CVE-2026-46266                      CVE-2026-53089 CVE-2026-53090 CVE-2026-53361 CVE-2026-64082                      CVE-2026-64139 CVE-2026-64192 CVE-2026-64270 CVE-2026-64272                      CVE-2026-64280 CVE-2026-64294 CVE-2026-64434 CVE-2026-64507                      CVE-2026-64508 CVE-2026-64542 CVE-2026-64543 CVE-2026-64561                      CVE-2026-64562 CVE-2026-64563 CVE-2026-64564 CVE-2026-64565                      CVE-2026-64567 CVE-2026-64569 CVE-2026-64571 CVE-2026-64572                      CVE-2026-64573 CVE-2026-64576 CVE-2026-64577 CVE-2026-64578                      CVE-2026-64579 CVE-2026-64580 CVE-2026-64581 CVE-2026-64582                      CVE-2026-64583 CVE-2026-64584 CVE-2026-64586 CVE-2026-64590                      CVE-2026-68082 CVE-2026-68093 CVE-2026-68096 CVE-2026-68099                      CVE-2026-68100 CVE-2026-68104 CVE-2026-68106 CVE-2026-68108                      CVE-2026-68111 CVE-2026-68115 CVE-2026-68117 CVE-2026-68121                      CVE-2026-68123 CVE-2026-68124 CVE-2026-68125 CVE-2026-68127                      CVE-2026-68129 CVE-2026-68130 CVE-2026-68131 CVE-2026-68132                      CVE-2026-68135 CVE-2026-68136 CVE-2026-68137 CVE-2026-68138                      CVE-2026-68140 CVE-2026-68141 CVE-2026-68142 CVE-2026-68143                      CVE-2026-68144 CVE-2026-68146 CVE-2026-68147 CVE-2026-68148                      CVE-2026-68151 CVE-2026-68153 CVE-2026-68154 CVE-2026-68155                      CVE-2026-68156 CVE-2026-68157 CVE-2026-68158 CVE-2026-68159                      CVE-2026-68160 CVE-2026-68162 CVE-2026-68164 CVE-2026-68165                      CVE-2026-68169 CVE-2026-68175 CVE-2026-68176 CVE-2026-68180                      CVE-2026-68181 CVE-2026-68182 CVE-2026-68183 CVE-2026-68184                      CVE-2026-68186 CVE-2026-68187 CVE-2026-68188 CVE-2026-68189                      CVE-2026-68190 CVE-2026-68192 CVE-2026-68194 CVE-2026-68195                      CVE-2026-68196 CVE-2026-68197 CVE-2026-68198 CVE-2026-68199                      CVE-2026-68202 CVE-2026-68204 CVE-2026-68206 CVE-2026-68207                      CVE-2026-68209 CVE-2026-68210 CVE-2026-68212 CVE-2026-68213                      CVE-2026-68214 CVE-2026-68215 CVE-2026-68216 CVE-2026-68217                      CVE-2026-68218 CVE-2026-68222 CVE-2026-68223 CVE-2026-68226                      CVE-2026-68227 CVE-2026-68229 CVE-2026-68231 CVE-2026-68234                      CVE-2026-68243 CVE-2026-68244 CVE-2026-68246 CVE-2026-68248                      CVE-2026-68249 CVE-2026-68250 CVE-2026-68251 CVE-2026-68253                      CVE-2026-68254 CVE-2026-68255 CVE-2026-68259 CVE-2026-68269                      CVE-2026-68277 CVE-2026-68278 CVE-2026-68279 CVE-2026-68280                      CVE-2026-68284 CVE-2026-68294 CVE-2026-68297 CVE-2026-68299                      CVE-2026-68300 CVE-2026-68301 CVE-2026-68302 CVE-2026-68304                      CVE-2026-68309 CVE-2026-68310 CVE-2026-68313 CVE-2026-68315                      CVE-2026-68320 CVE-2026-68322 CVE-2026-68324 CVE-2026-68325                      CVE-2026-68326 CVE-2026-68327 CVE-2026-68328 CVE-2026-68331                      CVE-2026-68333 CVE-2026-68335 CVE-2026-68336 CVE-2026-68338                      CVE-2026-68340 CVE-2026-68343 CVE-2026-68344 CVE-2026-68349                      CVE-2026-68350 CVE-2026-68351 CVE-2026-68352 CVE-2026-68353                      CVE-2026-68354 CVE-2026-68355 CVE-2026-68357 CVE-2026-68359                      CVE-2026-68360 CVE-2026-68361 CVE-2026-68362 CVE-2026-68363                      CVE-2026-68365 CVE-2026-68366 CVE-2026-68367 CVE-2026-68368                      CVE-2026-68369 CVE-2026-68370 CVE-2026-68371 CVE-2026-68373                      CVE-2026-68376 CVE-2026-68377 CVE-2026-68386 CVE-2026-68388                      CVE-2026-68395 CVE-2026-68397 CVE-2026-68398 CVE-2026-68402                      CVE-2026-68403 CVE-2026-68405 CVE-2026-68406 CVE-2026-68407                      CVE-2026-68410 CVE-2026-68411 CVE-2026-68413 CVE-2026-68414                      CVE-2026-68417 CVE-2026-68422 CVE-2026-68425 CVE-2026-68427                      CVE-2026-68428 CVE-2026-68430 CVE-2026-68431 CVE-2026-68432                      CVE-2026-68433 CVE-2026-68434 CVE-2026-68444 CVE-2026-68446                      CVE-2026-68450 CVE-2026-68451 CVE-2026-68452 CVE-2026-68476                      CVE-2026-68480 CVE-2026-72012 CVE-2026-72015 CVE-2026-72017                      CVE-2026-72023 CVE-2026-72030 CVE-2026-72035 CVE-2026-72040                      CVE-2026-72041 CVE-2026-72045 CVE-2026-72051 CVE-2026-72057                      CVE-2026-72062 CVE-2026-72063 CVE-2026-72065 CVE-2026-72069                      CVE-2026-72070 CVE-2026-72077 CVE-2026-72096 CVE-2026-72099                      CVE-2026-72110 CVE-2026-72113 CVE-2026-72114 CVE-2026-72115                      CVE-2026-72116 CVE-2026-72117 CVE-2026-72118 CVE-2026-72119                      CVE-2026-72121 CVE-2026-72124 CVE-2026-72125 CVE-2026-72142                      CVE-2026-72146 CVE-2026-72157 CVE-2026-72170 CVE-2026-72172                      CVE-2026-72191 CVE-2026-72216 CVE-2026-72236 CVE-2026-72237                      CVE-2026-72242 CVE-2026-72252 CVE-2026-72253 CVE-2026-72260                      CVE-2026-72262 CVE-2026-72299 CVE-2026-72305 CVE-2026-72308                      CVE-2026-72323 CVE-2026-72392 CVE-2026-74436 CVE-2026-74441                      CVE-2026-74443 CVE-2026-74444 CVE-2026-74446 CVE-2026-74450                      CVE-2026-74453 CVE-2026-74454 CVE-2026-74455 CVE-2026-74456                      CVE-2026-74457 CVE-2026-74458 CVE-2026-74459 CVE-2026-74460                      CVE-2026-74461 CVE-2026-74463 CVE-2026-74464 CVE-2026-74465                      CVE-2026-74467 CVE-2026-74468 CVE-2026-74469 CVE-2026-74470                      CVE-2026-74471 CVE-2026-74472 CVE-2026-74473 CVE-2026-74475                      CVE-2026-74476 CVE-2026-74478 CVE-2026-74479 CVE-2026-74480                      CVE-2026-74481 CVE-2026-74482 CVE-2026-74485 CVE-2026-74487                      CVE-2026-74488 CVE-2026-74490 CVE-2026-74492 CVE-2026-74493                      CVE-2026-74494 CVE-2026-74495 CVE-2026-74497 CVE-2026-74498                      CVE-2026-74499 CVE-2026-74505 CVE-2026-74507 CVE-2026-74508                      CVE-2026-74509 CVE-2026-74510 CVE-2026-74512 CVE-2026-74514                      CVE-2026-74515 CVE-2026-74516 CVE-2026-74518 CVE-2026-74519                      CVE-2026-74522 CVE-2026-74523 CVE-2026-74525 CVE-2026-74540                      CVE-2026-74546 CVE-2026-74547 CVE-2026-74548 CVE-2026-74549                      CVE-2026-74550 CVE-2026-74551 CVE-2026-74552 CVE-2026-74553                      CVE-2026-74555 CVE-2026-74556 CVE-2026-74557 CVE-2026-74563                      CVE-2026-74564 CVE-2026-74566 CVE-2026-74567 CVE-2026-74569                      CVE-2026-74575 CVE-2026-74577 CVE-2026-74579 CVE-2026-74580                      CVE-2026-74581 CVE-2026-74582 CVE-2026-74583 CVE-2026-74585                      CVE-2026-74586 CVE-2026-74587 CVE-2026-74588 CVE-2026-74589                      CVE-2026-74594 CVE-2026-74595 CVE-2026-74597 CVE-2026-74598                      CVE-2026-74601 CVE-2026-74603 CVE-2026-74604 CVE-2026-74607                      CVE-2026-74608 CVE-2026-74609 CVE-2026-74612 CVE-2026-74613                      CVE-2026-74614 CVE-2026-74615 CVE-2026-74616 CVE-2026-74620                      CVE-2026-74621 CVE-2026-74622 CVE-2026-74623 CVE-2026-74624                      CVE-2026-74625 CVE-2026-74626 CVE-2026-74628 CVE-2026-74630                      CVE-2026-74631 CVE-2026-74632 CVE-2026-74635 CVE-2026-74636                      CVE-2026-74637 CVE-2026-74641 CVE-2026-74647 CVE-2026-74648                      CVE-2026-74649 CVE-2026-74650 CVE-2026-74651 CVE-2026-74654                      CVE-2026-74656 CVE-2026-74657 CVE-2026-74658 CVE-2026-74659                      CVE-2026-74660 CVE-2026-74662 CVE-2026-74663 CVE-2026-74664                      CVE-2026-74666 CVE-2026-74667 CVE-2026-74668 CVE-2026-74669                      CVE-2026-74671 CVE-2026-74672 CVE-2026-74673 CVE-2026-74675                      CVE-2026-74676 CVE-2026-74678 CVE-2026-74679 CVE-2026-74680                      CVE-2026-74682 CVE-2026-74683 CVE-2026-74688 CVE-2026-74689                      CVE-2026-74691 CVE-2026-74692 CVE-2026-74693 CVE-2026-74694                      CVE-2026-74696 CVE-2026-74697 CVE-2026-74701 CVE-2026-74704                      CVE-2026-74705 CVE-2026-74714 CVE-2026-74717 CVE-2026-74719                      CVE-2026-74720 CVE-2026-74722 CVE-2026-74724 CVE-2026-74726                      CVE-2026-74730 CVE-2026-74737 CVE-2026-74739 CVE-2026-74743                      CVE-2026-74744 CVE-2026-74746 CVE-2026-74748 CVE-2026-80527                      CVE-2026-80528 CVE-2026-80529 CVE-2026-80534 CVE-2026-80536                      CVE-2026-80539 CVE-2026-80540 CVE-2026-80541 CVE-2026-80547                      CVE-2026-80548 CVE-2026-80549 CVE-2026-80550 CVE-2026-80552                      CVE-2026-80553 CVE-2026-80555 CVE-2026-80557 CVE-2026-80558                      CVE-2026-80559 CVE-2026-80560 CVE-2026-80561 CVE-2026-80562                      CVE-2026-80565 CVE-2026-80567 CVE-2026-80568 CVE-2026-80569                      CVE-2026-80570 CVE-2026-80572 CVE-2026-80573 CVE-2026-80574                      CVE-2026-80583 CVE-2026-80584 CVE-2026-80586 CVE-2026-80589                      CVE-2026-80590 CVE-2026-80678 CVE-2026-80679 CVE-2026-80680                      CVE-2026-80681 CVE-2026-80684 CVE-2026-80686 CVE-2026-80706                      CVE-2026-80707 CVE-2026-80708 CVE-2026-80709 CVE-2026-80714                      CVE-2026-80715 CVE-2026-80716 CVE-2026-80717 CVE-2026-80718                      CVE-2026-80722 CVE-2026-80725 CVE-2026-80726 CVE-2026-80730                      CVE-2026-80731 CVE-2026-80732 CVE-2026-80733 CVE-2026-80737                      CVE-2026-80742 CVE-2026-80743 CVE-2026-80744 CVE-2026-80752                      CVE-2026-80754 CVE-2026-80756 CVE-2026-80757 CVE-2026-80762                      CVE-2026-80763 CVE-2026-80764 CVE-2026-80765 CVE-2026-80766                      CVE-2026-80767 CVE-2026-80768 CVE-2026-80770 CVE-2026-80772                      CVE-2026-80781 CVE-2026-80782 CVE-2026-80783 CVE-2026-80784                      CVE-2026-80788 CVE-2026-80789 CVE-2026-80790 CVE-2026-80791                      CVE-2026-80792 CVE-2026-80793 CVE-2026-80794 CVE-2026-80795                      CVE-2026-80796 CVE-2026-80797 CVE-2026-80798 CVE-2026-80799                      CVE-2026-80800 CVE-2026-80801 CVE-2026-80802 CVE-2026-80803                      CVE-2026-80805 CVE-2026-80806 CVE-2026-80807 CVE-2026-80808                      CVE-2026-80809 CVE-2026-80812 CVE-2026-80814 CVE-2026-80819                      CVE-2026-80823 CVE-2026-80824 CVE-2026-80826 CVE-2026-80827                      CVE-2026-80828 CVE-2026-80829 CVE-2026-80830 CVE-2026-80831                      CVE-2026-80832 CVE-2026-80840 CVE-2026-80842 CVE-2026-80843                      CVE-2026-80844 CVE-2026-80846 CVE-2026-80848 CVE-2026-80852                      CVE-2026-80854 CVE-2026-80855 CVE-2026-80856 CVE-2026-80863                      CVE-2026-80888 CVE-2026-80890 CVE-2026-80891 CVE-2026-80892                      CVE-2026-80893 CVE-2026-80901 CVE-2026-80902 CVE-2026-80904                      CVE-2026-80906 CVE-2026-80908 CVE-2026-80909 CVE-2026-80910                      CVE-2026-80913

    Several vulnerabilities have been discovered in the Linux kernel that     may lead to a privilege escalation, denial of service or information     leaks.

    For Debian 12 bookworm, these problems have been fixed in version     6.1.187-1.

    We recommend that you upgrade your linux packages.

    For the detailed security status of linux please refer to its security     tracker page at:
    https://security-tracker.debian.org/tracker/linux

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4745 advisory.

    -------------------------------------------------------------------------     Debian LTS Advisory DLA-4745-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                        Ben Hutchings     August 18, 2026                               https://wiki.debian.org/LTS
    -------------------------------------------------------------------------

    Package        : linux-6.12     Version        : 6.12.101-1~deb12u1     CVE ID         : CVE-2025-40098 CVE-2026-45897 CVE-2026-45901 CVE-2026-53078                      CVE-2026-53090 CVE-2026-64205 CVE-2026-64280 CVE-2026-64290                      CVE-2026-64561 CVE-2026-64562 CVE-2026-64563 CVE-2026-64564                      CVE-2026-64565 CVE-2026-64567 CVE-2026-64568 CVE-2026-64569                      CVE-2026-64570 CVE-2026-64571 CVE-2026-64572 CVE-2026-64573                      CVE-2026-64574 CVE-2026-64576 CVE-2026-64577 CVE-2026-64578                      CVE-2026-64579 CVE-2026-64580 CVE-2026-64583 CVE-2026-64584                      CVE-2026-68093 CVE-2026-68096 CVE-2026-68097 CVE-2026-68098                      CVE-2026-68099 CVE-2026-68100 CVE-2026-68102 CVE-2026-68104                      CVE-2026-68106 CVE-2026-68107 CVE-2026-68108 CVE-2026-68110                      CVE-2026-68111 CVE-2026-68112 CVE-2026-68113 CVE-2026-68115                      CVE-2026-68116 CVE-2026-68117 CVE-2026-68119 CVE-2026-68120                      CVE-2026-68121 CVE-2026-68123 CVE-2026-68124 CVE-2026-68125                      CVE-2026-68126 CVE-2026-68127 CVE-2026-68128 CVE-2026-68129                      CVE-2026-68130 CVE-2026-68131 CVE-2026-68133 CVE-2026-68135                      CVE-2026-68136 CVE-2026-68137 CVE-2026-68139 CVE-2026-68140                      CVE-2026-68141 CVE-2026-68142 CVE-2026-68143 CVE-2026-68144                      CVE-2026-68145 CVE-2026-68146 CVE-2026-68147 CVE-2026-68148                      CVE-2026-68149 CVE-2026-68151 CVE-2026-68152 CVE-2026-68153                      CVE-2026-68154 CVE-2026-68155 CVE-2026-68156 CVE-2026-68157                      CVE-2026-68158 CVE-2026-68160 CVE-2026-68161 CVE-2026-68162                      CVE-2026-68164 CVE-2026-68165 CVE-2026-68175 CVE-2026-68176                      CVE-2026-68178 CVE-2026-68179 CVE-2026-68180 CVE-2026-68181                      CVE-2026-68182 CVE-2026-68183 CVE-2026-68184 CVE-2026-68185                      CVE-2026-68186 CVE-2026-68187 CVE-2026-68188 CVE-2026-68189                      CVE-2026-68190 CVE-2026-68192 CVE-2026-68193 CVE-2026-68194                      CVE-2026-68195 CVE-2026-68196 CVE-2026-68197 CVE-2026-68199                      CVE-2026-68200 CVE-2026-68201 CVE-2026-68202 CVE-2026-68203                      CVE-2026-68204 CVE-2026-68205 CVE-2026-68206 CVE-2026-68207                      CVE-2026-68209 CVE-2026-68210 CVE-2026-68212 CVE-2026-68213                      CVE-2026-68214 CVE-2026-68215 CVE-2026-68216 CVE-2026-68217                      CVE-2026-68218 CVE-2026-68219 CVE-2026-68220 CVE-2026-68221                      CVE-2026-68222 CVE-2026-68223 CVE-2026-68225 CVE-2026-68226                      CVE-2026-68227 CVE-2026-68228 CVE-2026-68229 CVE-2026-68231                      CVE-2026-68234 CVE-2026-68235 CVE-2026-68236 CVE-2026-68243                      CVE-2026-68244 CVE-2026-68245 CVE-2026-68246 CVE-2026-68247                      CVE-2026-68248 CVE-2026-68249 CVE-2026-68250 CVE-2026-68251                      CVE-2026-68252 CVE-2026-68255 CVE-2026-68256 CVE-2026-68257                      CVE-2026-68259 CVE-2026-68260 CVE-2026-68261 CVE-2026-68262                      CVE-2026-68263 CVE-2026-68269 CVE-2026-68271 CVE-2026-68272                      CVE-2026-68277 CVE-2026-68278 CVE-2026-68279 CVE-2026-68280                      CVE-2026-68281 CVE-2026-68284 CVE-2026-68290 CVE-2026-68293                      CVE-2026-68294 CVE-2026-68296 CVE-2026-68297 CVE-2026-68299                      CVE-2026-68300 CVE-2026-68301 CVE-2026-68302 CVE-2026-68304                      CVE-2026-68306 CVE-2026-68307 CVE-2026-68308 CVE-2026-68309                      CVE-2026-68310 CVE-2026-68311 CVE-2026-68313 CVE-2026-68314                      CVE-2026-68315 CVE-2026-68317 CVE-2026-68318 CVE-2026-68319                      CVE-2026-68320 CVE-2026-68321 CVE-2026-68324 CVE-2026-68325                      CVE-2026-68326 CVE-2026-68327 CVE-2026-68328 CVE-2026-68329                      CVE-2026-68331 CVE-2026-68333 CVE-2026-68335 CVE-2026-68336                      CVE-2026-68338 CVE-2026-68339 CVE-2026-68340 CVE-2026-68343                      CVE-2026-68344 CVE-2026-68346 CVE-2026-68348 CVE-2026-68349                      CVE-2026-68350 CVE-2026-68351 CVE-2026-68352 CVE-2026-68353                      CVE-2026-68354 CVE-2026-68355 CVE-2026-68357 CVE-2026-68358                      CVE-2026-68359 CVE-2026-68360 CVE-2026-68361 CVE-2026-68362                      CVE-2026-68363 CVE-2026-68365 CVE-2026-68366 CVE-2026-68368                      CVE-2026-68369 CVE-2026-68370 CVE-2026-68371 CVE-2026-68372                      CVE-2026-68373 CVE-2026-68374 CVE-2026-68376 CVE-2026-68377                      CVE-2026-68381 CVE-2026-68385 CVE-2026-68386 CVE-2026-68388                      CVE-2026-68389 CVE-2026-68391 CVE-2026-68392 CVE-2026-68394                      CVE-2026-68395 CVE-2026-68396 CVE-2026-68397 CVE-2026-68398                      CVE-2026-68402 CVE-2026-68403 CVE-2026-68405 CVE-2026-68406                      CVE-2026-68407 CVE-2026-68408 CVE-2026-68410 CVE-2026-68411                      CVE-2026-68413 CVE-2026-68414 CVE-2026-68416 CVE-2026-68417                      CVE-2026-68419 CVE-2026-68422 CVE-2026-68425 CVE-2026-68427                      CVE-2026-68428 CVE-2026-68429 CVE-2026-68430 CVE-2026-68432                      CVE-2026-68433 CVE-2026-68434 CVE-2026-68437 CVE-2026-68439                      CVE-2026-68442 CVE-2026-68443 CVE-2026-68444 CVE-2026-68445                      CVE-2026-68446 CVE-2026-68449 CVE-2026-68450 CVE-2026-72015                      CVE-2026-72017 CVE-2026-72023 CVE-2026-72030 CVE-2026-72032                      CVE-2026-72040 CVE-2026-72045 CVE-2026-72046 CVE-2026-72051                      CVE-2026-72062 CVE-2026-72065 CVE-2026-72069 CVE-2026-72070                      CVE-2026-72101 CVE-2026-72103 CVE-2026-72113 CVE-2026-72114                      CVE-2026-72115 CVE-2026-72116 CVE-2026-72117 CVE-2026-72118                      CVE-2026-72119 CVE-2026-72121 CVE-2026-72124 CVE-2026-72125                      CVE-2026-72130 CVE-2026-72137 CVE-2026-72142 CVE-2026-72146                      CVE-2026-72147 CVE-2026-72168 CVE-2026-72175 CVE-2026-72183                      CVE-2026-72213 CVE-2026-72244 CVE-2026-72253 CVE-2026-72254                      CVE-2026-72260 CVE-2026-72299 CVE-2026-72305 CVE-2026-72372                      CVE-2026-74436     Debian Bug     : 1143721

    Several vulnerabilities have been discovered in the Linux kernel that     may lead to a privilege escalation, denial of service or information     leaks.  This update additionally includes many more bug fixes from     stable update 6.12.101.

    For Debian 12 bookworm, these problems have been fixed in version     6.12.101-1~deb12u1.

    We recommend that you upgrade your linux-6.12 packages.

    For the detailed security status of linux-6.12 please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/linux-6.12

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS     Attachment:
    signature.asc     Description: PGP signature

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the linux package has been released.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - wifi: ath11k: fix NULL pointer dereference in ath11k_hal_srng_access_begin In ATH11K_QMI_EVENT_FW_READY,     ATH11K_FLAG_REGISTERED is set unconditionally even when ath11k_core_qmi_firmware_ready() fails. This     leaves the driver in an inconsistent state where initialization is considered complete although the     firmware ready handling did not finish successfully. During the subsequent SSR, the driver enters the     restart path based on this incorrect state and dereferences uninitialized srng members, resulting in a     NULL pointer dereference. Call trace: ath11k_hal_srng_access_begin+0xc/0x60 [ath11k] (P)     ath11k_ce_cleanup_pipes+0x17c/0x180 [ath11k] ath11k_core_restart+0x40/0x168 [ath11k] Fix this by: -     skipping firmware_ready if ATH11K_FLAG_REGISTERED is already set - setting ATH11K_FLAG_REGISTERED only     when firmware_ready succeeds - setting ATH11K_FLAG_QMI_FAIL and aborting the FW_READY handling on error     Tested-on: WCN6750 hw1.0 AHB WLAN.MSL.2.0.c2-00204-QCAMSLSWPLZ-1 (CVE-2026-68362)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
364688	AlmaLinux 9.2 [TuxCare] Security Update: bpftool / kernel / kernel-64k / kernel-64k-core / kernel-64k-debug / etc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1791741836)	Nessus	Alma Linux Local Security Checks	Local	critical
364137	Oracle Linux 10 / 9 : Unbreakable Enterprise kernel (ELSA-2026-500374)	Nessus	Oracle Linux Local Security Checks	Local	high
352548	AlmaLinux 9.6 [TuxCare] Security Update: kernel / kernel-abi-stablelists / kernel-core / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1789986443)	Nessus	Alma Linux Local Security Checks	Local	high
352273	Rocky Linux 9.6 [TuxCare] Security Update: kernel / kernel-abi-stablelists / kernel-core / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1789986443)	Nessus	Rocky Linux Local Security Checks	Local	high
350138	openSUSE 16: cluster-md-kmp-64kb / cluster-md-kmp-azure / cluster-md-kmp-default / etc (openSUSE-SU-2026:21910-1)	Nessus	SuSE Local Security Checks	Local	high
347900	SUSE SLED15 / SLES15 : Security update for the Linux Kernel (SUSE-SU-2026:4254-1)	Nessus	SuSE Local Security Checks	Local	high
343851	Debian dla-4777 : ata-modules-6.1.0-52-armmp-di - security update	Nessus	Debian Local Security Checks	Local	high
343049	Oracle Linux 10 / 9 : Unbreakable Enterprise kernel (ELSA-2026-500248)	Nessus	Oracle Linux Local Security Checks	Local	high
337079	Debian dla-4745 : ata-modules-6.12.100+deb12-armmp-di - security update	Nessus	Debian Local Security Checks	Local	medium
334784	Photon OS 5.0: Linux PHSA-2026-5.0-92-0952	Nessus	PhotonOS Local Security Checks	Local	high
334194	Linux Distros Unpatched Vulnerability : CVE-2026-68362	Nessus	Misc.	Local	medium

Detections

Analytics

CVE-2026-68362

medium

Tenable Plugins

Coming Soon

critical

high

high

high

high

high

high

high

medium

high

medium