In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: defer link RX stats percpu free to RCU sta_remove_link() frees a removed MLO link's RX stats percpu buffer right away, but defers only the link container to RCU: sta_info_free_link(&alloc->info); kfree_rcu(alloc, rcu_head); The RX fast path reads link_sta under rcu_read_lock and writes the percpu stats. A reader that resolved link_sta before the removal keeps the pointer. The container stays alive from the kfree_rcu, so the read still works. But the percpu block it points to is already freed. This needs uses_rss. That is when pcpu_rx_stats exists. The full STA teardown frees the deflink stats only after synchronize_net(). The link removal path had no such barrier. The race is hard to win in practice, but the free should still wait for RCU. Free the link together with its data from a single RCU callback, so the percpu block is reclaimed only after readers drain.

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-653340 advisory.

    - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244969] {CVE-2026-72098}
    - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244928] {CVE-2026-72129}
    - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-237706]     {CVE-2026-68409}
    - wifi: mt76: mt7925: drop TXRX_NOTIFY on non-mmio buses (Jose Ignacio Tornos Martinez) [RHEL-237681]     {CVE-2026-68193}
    - wifi: mt76: mt7925: fix crash in reset link replay (Jose Ignacio Tornos Martinez) [RHEL-237527]     {CVE-2026-68307}
    - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez)     [RHEL-232015] {CVE-2026-64255}
    - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez)     [RHEL-231685] {CVE-2026-64117}
    - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez)     [RHEL-231685] {CVE-2026-64117}
    - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez)     [RHEL-230977] {CVE-2026-64037}
    - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230604]     {CVE-2026-53182}
    - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez)     [RHEL-229725] {CVE-2026-52947}
    - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227617]     {CVE-2026-64515}
    - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515}
    - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232673]     {CVE-2026-53072}
    - accel/qaic: Add overflow check to remap_pfn_range during mmap (CKI Backport Bot) [RHEL-232178]     {CVE-2026-64051}
    - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231067]     {CVE-2026-63947}
    - Bluetooth: virtio_bt: validate rx pkt_type header length (CKI Backport Bot) [RHEL-230949]     {CVE-2026-46123}
    - Bluetooth: virtio_bt: clamp rx length before skb_put (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123}
    - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230076]     {CVE-2026-53209}
    - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230013] {CVE-2026-63944}
    - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228750]     {CVE-2026-63975}
    - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-227911]     {CVE-2026-63946}
    - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946}
    - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227889]     {CVE-2026-64113}
    - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport     Bot) [RHEL-227532] {CVE-2026-43334}
    - vfio/pci: Check BAR resources before exporting a DMABUF (CKI Backport Bot) [RHEL-227133]     {CVE-2026-64042}
    - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225690] {CVE-2026-64015}
    - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225653] {CVE-2026-53254}
    - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225574]     {CVE-2026-53256}
    - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225552] {CVE-2026-52918}
    - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188232] {CVE-2026-53091}
    - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091}
    - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188232] {CVE-2026-53091}
    - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232]     {CVE-2026-53091}
    - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091}
    - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188232] {CVE-2026-53091}
    - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188232] {CVE-2026-53091}
    - vfio/pci: Clean up DMABUFs before disabling function (CKI Backport Bot) [RHEL-189549] {CVE-2026-53322}
    - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189468]     {CVE-2026-43133}
    - fuse: fix race between interrupt and resend (Miklos Szeredi) [RHEL-218495] {CVE-2026-64265}
    - fuse: clear intr_entry in fuse_resend and fuse_remove_pending_req (Miklos Szeredi) [RHEL-218495]     {CVE-2026-64265}
    - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248457] {CVE-2026-64563}
    - udp: Fix wildcard bind conflict check when using hash2 (Felix Maurer) [RHEL-218016] {CVE-2026-31503}
    - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232246] {CVE-2026-46015}
    - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232629] {CVE-2026-46306}
    - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226125]     {CVE-2026-46266}
    - ipv6: anycast: insert aca into global hash under idev->lock (Felix Maurer) [RHEL-230763]     {CVE-2026-53259}
    - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226073]     {CVE-2026-53275}
    - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225606] {CVE-2026-43339}
    - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225864] {CVE-2026-53223}
    - net: add pskb_may_pull() to skb_gro_receive_list() (Felix Maurer) [RHEL-229309] {CVE-2026-53235}
    - can: bcm: extend bcm_tx_lock usage for data and timer updates (Abhishek Rawal) [RHEL-216700]     {CVE-2025-38004}
    - can: bcm: add locking when updating filter and timer values (Abhishek Rawal) [RHEL-216700]     {CVE-2025-38004}
    - can: bcm: fix locking for bcm_op runtime updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004}
    - can: bcm: add locking for bcm_op runtime updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004}
    - smb: client: fix double-free in SMB2_close() replay (Paulo Alcantara) [RHEL-240056] {CVE-2026-64597}
    - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-132852] {CVE-2026-43084}
    - ppp: require CAP_NET_ADMIN in target netns for unattached ioctls (Abhishek Rawal) [RHEL-228009]     {CVE-2026-53075}
    - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231711]     {CVE-2026-63993}
    - ipv6: sit: reload inner IPv6 header after GSO offloads (Abhishek Rawal) [RHEL-225920] {CVE-2026-53228}
    - ipv6: add NULL checks for idev in SRv6 paths (Abhishek Rawal) [RHEL-218012] {CVE-2026-23442}
    - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot)     [RHEL-234153] {CVE-2026-64319}
    - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (CKI Backport Bot) [RHEL-234204]     {CVE-2026-64287}
    - KVM: arm64: Take the SRCU lock for page table walks in fault injection and AT emulation (CKI Backport     Bot) [RHEL-229347] {CVE-2026-53277}
    - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot)     [RHEL-227269] {CVE-2026-64002}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:65334 advisory.

    * kernel: KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CVE-2026-43133)
      * kernel: Bluetooth: SMP: force responder MITM requirements before building the pairing response     (CVE-2026-43334)
      * kernel: Bluetooth: virtio_bt: clamp rx length before skb_put (CVE-2026-46123)
      * kernel: Bluetooth: serialize accept_q access (CVE-2026-52918)
      * kernel: net: pull headers in qdisc_pkt_len_segs_init() (CVE-2026-53091)
      * kernel: Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CVE-2026-53072)
      * kernel: net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (CVE-2026-52947)
      * kernel: Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CVE-2026-53256)
      * kernel: wifi: nl80211: reject oversized EMA RNR lists (CVE-2026-53182)
      * kernel: Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CVE-2026-53209)
      * kernel: Bluetooth: RFCOMM: validate skb length in MCC handlers (CVE-2026-53254)
      * kernel: vfio/pci: Clean up DMABUFs before disabling function (CVE-2026-53322)
      * kernel: Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CVE-2026-63975)
      * kernel: security/keys: fix missed RCU read section on lookup (CVE-2026-64015)
      * kernel: Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CVE-2026-63947)
      * kernel: Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CVE-2026-63944)
      * kernel: Bluetooth: ISO: fix UAF in iso_recv_frame (CVE-2026-63946)
      * kernel: wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (CVE-2026-64117)
      * kernel: wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (CVE-2026-64037)
      * kernel: ixgbevf: fix use-after-free in VEPA multicast source pruning (CVE-2026-64113)
      * kernel: vfio/pci: Check BAR resources before exporting a DMABUF (CVE-2026-64042)
      * kernel: accel/qaic: Add overflow check to remap_pfn_range during mmap (CVE-2026-64051)
      * kernel: wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (CVE-2026-64255)
      * kernel: wifi: mac80211: fix MLE defragmentation (CVE-2026-64515)
      * kernel: wifi: mac80211: defer link RX stats percpu free to RCU (CVE-2026-68409)
      * kernel: wifi: mt76: mt7925: fix crash in reset link replay (CVE-2026-68307)
      * kernel: wifi: mt76: mt7925: drop TXRX_NOTIFY on non-mmio buses (CVE-2026-68193)
      * kernel: dm-verity: fix buffer overflow in FEC calculation (CVE-2026-72098)
      * kernel: nvmet-rdma: handle inline data with a nonzero offset (CVE-2026-72129)


    Bug Fix(es) and Enhancement(s):

      * rtla-timerlat-top doesn't stop properly when threshold is reached on multiple CPUs at once     [almalinux-10.2.z] (JIRA:AlmaLinux-193027)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:65334 advisory.

    * kernel: KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CVE-2026-43133)

    * kernel: Bluetooth: SMP: force responder MITM requirements before building the pairing response     (CVE-2026-43334)

    * kernel: Bluetooth: virtio_bt: clamp rx length before skb_put (CVE-2026-46123)

    * kernel: Bluetooth: serialize accept_q access (CVE-2026-52918)

    * kernel: net: pull headers in qdisc_pkt_len_segs_init() (CVE-2026-53091)

    * kernel: Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CVE-2026-53072)

    * kernel: net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (CVE-2026-52947)

    * kernel: Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CVE-2026-53256)

    * kernel: wifi: nl80211: reject oversized EMA RNR lists (CVE-2026-53182)

    * kernel: Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CVE-2026-53209)

    * kernel: Bluetooth: RFCOMM: validate skb length in MCC handlers (CVE-2026-53254)

    * kernel: vfio/pci: Clean up DMABUFs before disabling function (CVE-2026-53322)

    * kernel: Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CVE-2026-63975)

    * kernel: security/keys: fix missed RCU read section on lookup (CVE-2026-64015)

    * kernel: Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CVE-2026-63947)

    * kernel: Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CVE-2026-63944)

    * kernel: Bluetooth: ISO: fix UAF in iso_recv_frame (CVE-2026-63946)

    * kernel: wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (CVE-2026-64117)

    * kernel: wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (CVE-2026-64037)

    * kernel: ixgbevf: fix use-after-free in VEPA multicast source pruning (CVE-2026-64113)

    * kernel: vfio/pci: Check BAR resources before exporting a DMABUF (CVE-2026-64042)

    * kernel: accel/qaic: Add overflow check to remap_pfn_range during mmap (CVE-2026-64051)

    * kernel: wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (CVE-2026-64255)

    * kernel: wifi: mac80211: fix MLE defragmentation (CVE-2026-64515)

    * kernel: wifi: mac80211: defer link RX stats percpu free to RCU (CVE-2026-68409)

    * kernel: wifi: mt76: mt7925: fix crash in reset link replay (CVE-2026-68307)

    * kernel: wifi: mt76: mt7925: drop TXRX_NOTIFY on non-mmio buses (CVE-2026-68193)

    * kernel: dm-verity: fix buffer overflow in FEC calculation (CVE-2026-72098)

    * kernel: nvmet-rdma: handle inline data with a nonzero offset (CVE-2026-72129)

    Bug Fix(es) and Enhancement(s):

    * rtla-timerlat-top doesn't stop properly when threshold is reached on multiple CPUs at once [rhel-10.2.z]     (JIRA:Rocky Linux-193027)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:65334 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CVE-2026-43133)

    * kernel: Bluetooth: SMP: force responder MITM requirements before building the pairing response     (CVE-2026-43334)

    * kernel: Bluetooth: virtio_bt: clamp rx length before skb_put (CVE-2026-46123)

    * kernel: Bluetooth: serialize accept_q access (CVE-2026-52918)

    * kernel: net: pull headers in qdisc_pkt_len_segs_init() (CVE-2026-53091)

    * kernel: Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CVE-2026-53072)

    * kernel: net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (CVE-2026-52947)

    * kernel: Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CVE-2026-53256)

    * kernel: wifi: nl80211: reject oversized EMA RNR lists (CVE-2026-53182)

    * kernel: Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CVE-2026-53209)

    * kernel: Bluetooth: RFCOMM: validate skb length in MCC handlers (CVE-2026-53254)

    * kernel: vfio/pci: Clean up DMABUFs before disabling function (CVE-2026-53322)

    * kernel: Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CVE-2026-63975)

    * kernel: security/keys: fix missed RCU read section on lookup (CVE-2026-64015)

    * kernel: Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CVE-2026-63947)

    * kernel: Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CVE-2026-63944)

    * kernel: Bluetooth: ISO: fix UAF in iso_recv_frame (CVE-2026-63946)

    * kernel: wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (CVE-2026-64117)

    * kernel: wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (CVE-2026-64037)

    * kernel: ixgbevf: fix use-after-free in VEPA multicast source pruning (CVE-2026-64113)

    * kernel: vfio/pci: Check BAR resources before exporting a DMABUF (CVE-2026-64042)

    * kernel: accel/qaic: Add overflow check to remap_pfn_range during mmap (CVE-2026-64051)

    * kernel: wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (CVE-2026-64255)

    * kernel: wifi: mac80211: fix MLE defragmentation (CVE-2026-64515)

    * kernel: wifi: mac80211: defer link RX stats percpu free to RCU (CVE-2026-68409)

    * kernel: wifi: mt76: mt7925: fix crash in reset link replay (CVE-2026-68307)

    * kernel: wifi: mt76: mt7925: drop TXRX_NOTIFY on non-mmio buses (CVE-2026-68193)

    * kernel: dm-verity: fix buffer overflow in FEC calculation (CVE-2026-72098)

    * kernel: nvmet-rdma: handle inline data with a nonzero offset (CVE-2026-72129)

    Bug Fix(es) and Enhancement(s):

    * rtla-timerlat-top doesn't stop properly when threshold is reached on multiple CPUs at once [rhel-10.2.z]     (JIRA:RHEL-193027)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - wifi: mac80211: defer link RX stats percpu free to RCU sta_remove_link() frees a removed MLO link's RX     stats percpu buffer right away, but defers only the link container to RCU:
    sta_info_free_link(&alloc->info); kfree_rcu(alloc, rcu_head); The RX fast path reads link_sta under     rcu_read_lock and writes the percpu stats. A reader that resolved link_sta before the removal keeps the     pointer. The container stays alive from the kfree_rcu, so the read still works. But the percpu block it     points to is already freed. This needs uses_rss. That is when pcpu_rx_stats exists. The full STA teardown     frees the deflink stats only after synchronize_net(). The link removal path had no such barrier. The race     is hard to win in practice, but the free should still wait for RCU. Free the link together with its data     from a single RCU callback, so the percpu block is reclaimed only after readers drain. (CVE-2026-68409)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
345898	Oracle Linux 10 : ELSA-2026-65334-0: / kernel (ELSA-2026-653340)	Nessus	Oracle Linux Local Security Checks	Local	critical
344851	AlmaLinux 10 : kernel (ALSA-2026:65334)	Nessus	Alma Linux Local Security Checks	Local	critical
344461	RockyLinux 10 : kernel (RLSA-2026:65334)	Nessus	Rocky Linux Local Security Checks	Local	critical
343886	RHEL 10 : kernel (RHSA-2026:65334)	Nessus	Red Hat Local Security Checks	Local	critical
334270	Linux Distros Unpatched Vulnerability : CVE-2026-68409	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2026-68409

high

Tenable Plugins

critical

critical

critical

critical

high