In the Linux kernel, the following vulnerability has been resolved: xfrm: fix stale skb->prev after async crypto steals a GSO segment skb_gso_segment() leaves the segment list head with ->prev pointing at the last segment, an invariant validate_xmit_skb_list() relies on when it sets its tail pointer (tail = skb->prev). When validate_xmit_xfrm() walks a GSO list and some segments are stolen by async crypto (->xmit() returns -EINPROGRESS), those segments are unlinked from the list but the head ->prev is never updated. If the last segment is the one stolen, the returned head still has ->prev pointing at it, even though it is now owned by the crypto engine and may be freed. validate_xmit_skb_list() later does tail->next = skb, writing through that stale pointer -- a use-after-free. Repoint skb->prev at the last retained segment before returning.

ubuntu_linux USN-8781-1: Ubuntu 24.04 LTS : Linux kernel (NVIDIA Tegra) vulnerabilities (USN-8781-1)

rocky_linux RLSA-2026:68570: RLSA-2026:68570: kernel security, bug fix, and enhancement update (Important)

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:68532 advisory.

    * kernel: ipvlan: Make the addrs_lock be per port (CVE-2026-23103)

    * kernel: xfrm: hold dev ref until after transport_finish NF_HOOK (CVE-2026-31663)

    * kernel: netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CVE-2026-43233)

    * kernel: ipv6: prevent possible UaF in addrconf_permanent_addr() (CVE-2026-43339)

    * kernel: inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (CVE-2026-46266)

    * kernel: flow_dissector: do not dissect PPPoE PFC frames (CVE-2026-46306)

    * kernel: netfilter: xt_policy: fix strict mode inbound policy matching (CVE-2026-52920)

    * kernel: ppp: require CAP_NET_ADMIN in target netns for unattached ioctls (CVE-2026-53075)

    * kernel: ipv6: sit: reload inner IPv6 header after GSO offloads (CVE-2026-53228)

    * kernel: IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CVE-2026-53176)

    * kernel: netfilter: require Ethernet MAC header before using eth_hdr() (CVE-2026-53131)

    * kernel: netfilter: conntrack_irc: fix possible out-of-bounds read (CVE-2026-53268)

    * kernel: xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (CVE-2026-53239)

    * kernel: ALSA: timer: Fix UAF at snd_timer_user_params() (CVE-2026-53192)

    * kernel: net: guard timestamp cmsgs to real error queue skbs (CVE-2026-53223)

    * kernel: ipv6: mcast: Fix use-after-free when processing MLD queries (CVE-2026-53275)

    * kernel: ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table()     (CVE-2026-64002)

    * kernel: ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate() (CVE-2026-63921)

    * kernel: xfrm: input: hold netns during deferred transport reinjection (CVE-2026-63919)

    * kernel: ip6: vti: Use ip6_tnl.net in vti6_changelink() (CVE-2026-63917)

    * kernel: Linux kernel SLIP: Out-of-bounds write due to race condition during MTU change (CVE-2026-68143)

    * kernel: xfrm: fix stale skb->prev after async crypto steals a GSO segment (CVE-2026-68426)

    * kernel: net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (CVE-2026-72298)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:68531 advisory.

    * kernel: ipvlan: Make the addrs_lock be per port (CVE-2026-23103)

    * kernel: xfrm: hold dev ref until after transport_finish NF_HOOK (CVE-2026-31663)

    * kernel: netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CVE-2026-43233)

    * kernel: ipv6: prevent possible UaF in addrconf_permanent_addr() (CVE-2026-43339)

    * kernel: inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (CVE-2026-46266)

    * kernel: flow_dissector: do not dissect PPPoE PFC frames (CVE-2026-46306)

    * kernel: netfilter: xt_policy: fix strict mode inbound policy matching (CVE-2026-52920)

    * kernel: ppp: require CAP_NET_ADMIN in target netns for unattached ioctls (CVE-2026-53075)

    * kernel: ipv6: sit: reload inner IPv6 header after GSO offloads (CVE-2026-53228)

    * kernel: IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CVE-2026-53176)

    * kernel: netfilter: require Ethernet MAC header before using eth_hdr() (CVE-2026-53131)

    * kernel: netfilter: conntrack_irc: fix possible out-of-bounds read (CVE-2026-53268)

    * kernel: xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (CVE-2026-53239)

    * kernel: ALSA: timer: Fix UAF at snd_timer_user_params() (CVE-2026-53192)

    * kernel: net: guard timestamp cmsgs to real error queue skbs (CVE-2026-53223)

    * kernel: ipv6: mcast: Fix use-after-free when processing MLD queries (CVE-2026-53275)

    * kernel: ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table()     (CVE-2026-64002)

    * kernel: ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate() (CVE-2026-63921)

    * kernel: xfrm: input: hold netns during deferred transport reinjection (CVE-2026-63919)

    * kernel: ip6: vti: Use ip6_tnl.net in vti6_changelink() (CVE-2026-63917)

    * kernel: Linux kernel SLIP: Out-of-bounds write due to race condition during MTU change (CVE-2026-68143)

    * kernel: xfrm: fix stale skb->prev after async crypto steals a GSO segment (CVE-2026-68426)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-68531 advisory.

    - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244096]     {CVE-2026-72298}
    - ipv6: sit: reload inner IPv6 header after GSO offloads (Jamie Bainbridge) [RHEL-225905] {CVE-2026-53228}
    - ipvlan: Make the addrs_lock be per port (Jamie Bainbridge) [RHEL-229962] {CVE-2026-23103}
    - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232949] {CVE-2026-31663}
    - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232949] {CVE-2026-31663}
    - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232949] {CVE-2026-31663}
    - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227504]     {CVE-2026-63919}
    - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236099]     {CVE-2026-68426}
    - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236099] {CVE-2026-68426}
    - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca)     [RHEL-227976] {CVE-2026-53239}
    - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231741] {CVE-2026-63917}
    - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228934] {CVE-2026-63921}
    - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Jamie Bainbridge) [RHEL-226122]     {CVE-2026-46266}
    - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (Jamie Bainbridge)     [RHEL-227265] {CVE-2026-64002}
    - ppp: require CAP_NET_ADMIN in target netns for unattached ioctls (Jamie Bainbridge) [RHEL-227981]     {CVE-2026-53075}
    - ipv6: mcast: Fix use-after-free when processing MLD queries (Jamie Bainbridge) [RHEL-226057]     {CVE-2026-53275}
    - net: guard timestamp cmsgs to real error queue skbs (Jamie Bainbridge) [RHEL-225848] {CVE-2026-53223}
    - flow_dissector: do not dissect PPPoE PFC frames (Jamie Bainbridge) [RHEL-232609] {CVE-2026-46306}
    - ipv6: prevent possible UaF in addrconf_permanent_addr() (Jamie Bainbridge) [RHEL-225595]     {CVE-2026-43339}
    - net: slip: serialize receive against buffer reallocation (Michal Schmidt) [RHEL-237390] {CVE-2026-68143}
    - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230663]     {CVE-2026-53131}
    - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230607]     {CVE-2026-43233}
    - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228683] {CVE-2026-53192}
    - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228832]     {CVE-2026-52920}
    - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225240]     {CVE-2026-53268}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-68570 advisory.

    - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014]     {CVE-2026-72243}
    - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari)     [RHEL-246399] {CVE-2026-63869}
    - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350]     {CVE-2026-64174}
    - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723]     {CVE-2026-72003}
    - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100]     {CVE-2026-72298}
    - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari)     [RHEL-241012] {CVE-2026-68363}
    - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175}
    - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366]     {CVE-2026-64176}
    - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512]     {CVE-2026-23172}
    - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156]     {CVE-2026-68159}
    - libceph: Amend checking to fix make W=1 build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159}
    - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663}
    - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663}
    - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663}
    - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508]     {CVE-2026-63919}
    - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120]     {CVE-2026-68426}
    - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426}
    - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca)     [RHEL-228016] {CVE-2026-53239}
    - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917}
    - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921}
    - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932]     {CVE-2026-72102}
    - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028]     {CVE-2026-68200}
    - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325]     {CVE-2026-68128}
    - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582}
    - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133}
    - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910}
    - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182]     {CVE-2026-46043}
    - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114}
    - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627]     {CVE-2026-52971}
    - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192}
    - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713]     {CVE-2026-64029}
    - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087]     {CVE-2026-53193}
    - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193}
    - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport     Bot) [RHEL-226406] {CVE-2026-63913}
    - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605]     {CVE-2026-53176}
    - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035]     {CVE-2026-53195}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:68531 advisory.

    * kernel: ipvlan: Make the addrs_lock be per port (CVE-2026-23103)
      * kernel: xfrm: hold dev ref until after transport_finish NF_HOOK (CVE-2026-31663)
      * kernel: netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CVE-2026-43233)
      * kernel: ipv6: prevent possible UaF in addrconf_permanent_addr() (CVE-2026-43339)
      * kernel: inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (CVE-2026-46266)
      * kernel: flow_dissector: do not dissect PPPoE PFC frames (CVE-2026-46306)
      * kernel: netfilter: xt_policy: fix strict mode inbound policy matching (CVE-2026-52920)
      * kernel: ppp: require CAP_NET_ADMIN in target netns for unattached ioctls (CVE-2026-53075)
      * kernel: ipv6: sit: reload inner IPv6 header after GSO offloads (CVE-2026-53228)
      * kernel: IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CVE-2026-53176)
      * kernel: netfilter: require Ethernet MAC header before using eth_hdr() (CVE-2026-53131)
      * kernel: netfilter: conntrack_irc: fix possible out-of-bounds read (CVE-2026-53268)
      * kernel: xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (CVE-2026-53239)
      * kernel: ALSA: timer: Fix UAF at snd_timer_user_params() (CVE-2026-53192)
      * kernel: net: guard timestamp cmsgs to real error queue skbs (CVE-2026-53223)
      * kernel: ipv6: mcast: Fix use-after-free when processing MLD queries (CVE-2026-53275)
      * kernel: ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table()     (CVE-2026-64002)
      * kernel: ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate() (CVE-2026-63921)
      * kernel: xfrm: input: hold netns during deferred transport reinjection (CVE-2026-63919)
      * kernel: ip6: vti: Use ip6_tnl.net in vti6_changelink() (CVE-2026-63917)
      * kernel: Linux kernel SLIP: Out-of-bounds write due to race condition during MTU change     (CVE-2026-68143)
      * kernel: xfrm: fix stale skb->prev after async crypto steals a GSO segment (CVE-2026-68426)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:68531 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: ipvlan: Make the addrs_lock be per port (CVE-2026-23103)

    * kernel: xfrm: hold dev ref until after transport_finish NF_HOOK (CVE-2026-31663)

    * kernel: netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CVE-2026-43233)

    * kernel: ipv6: prevent possible UaF in addrconf_permanent_addr() (CVE-2026-43339)

    * kernel: inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (CVE-2026-46266)

    * kernel: flow_dissector: do not dissect PPPoE PFC frames (CVE-2026-46306)

    * kernel: netfilter: xt_policy: fix strict mode inbound policy matching (CVE-2026-52920)

    * kernel: ppp: require CAP_NET_ADMIN in target netns for unattached ioctls (CVE-2026-53075)

    * kernel: ipv6: sit: reload inner IPv6 header after GSO offloads (CVE-2026-53228)

    * kernel: IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CVE-2026-53176)

    * kernel: netfilter: require Ethernet MAC header before using eth_hdr() (CVE-2026-53131)

    * kernel: netfilter: conntrack_irc: fix possible out-of-bounds read (CVE-2026-53268)

    * kernel: xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (CVE-2026-53239)

    * kernel: ALSA: timer: Fix UAF at snd_timer_user_params() (CVE-2026-53192)

    * kernel: net: guard timestamp cmsgs to real error queue skbs (CVE-2026-53223)

    * kernel: ipv6: mcast: Fix use-after-free when processing MLD queries (CVE-2026-53275)

    * kernel: ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table()     (CVE-2026-64002)

    * kernel: ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate() (CVE-2026-63921)

    * kernel: xfrm: input: hold netns during deferred transport reinjection (CVE-2026-63919)

    * kernel: ip6: vti: Use ip6_tnl.net in vti6_changelink() (CVE-2026-63917)

    * kernel: Linux kernel SLIP: Out-of-bounds write due to race condition during MTU change (CVE-2026-68143)

    * kernel: xfrm: fix stale skb->prev after async crypto steals a GSO segment (CVE-2026-68426)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:68570 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: Linux kernel t7xx WWAN driver: Denial of Service via buffer overflow (CVE-2026-23172)

    * kernel: xfrm: hold dev ref until after transport_finish NF_HOOK (CVE-2026-31663)

    * kernel: RDMA/rxe: Fix race condition in QP timer handlers (CVE-2026-45910)

    * kernel: RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (CVE-2026-46043)

    * kernel: RDMA/rxe: Reject unknown opcodes before ICRC processing (CVE-2026-46133)

    * kernel: RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (CVE-2026-46114)

    * kernel: net: ena: PHC: Fix potential use-after-free in get_timestamp (CVE-2026-52971)

    * kernel: IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CVE-2026-53176)

    * kernel: ALSA: timer: Forcibly close timer instances at closing (CVE-2026-53193)

    * kernel: USB: serial: io_ti: fix heap overflow in get_manuf_info() (CVE-2026-53196)

    * kernel: xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (CVE-2026-53239)

    * kernel: ALSA: timer: Fix UAF at snd_timer_user_params() (CVE-2026-53192)

    * kernel: wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (CVE-2026-63869)

    * kernel: ALSA: seq: Serialize UMP output teardown with event_input (CVE-2026-64029)

    * kernel: ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate() (CVE-2026-63921)

    * kernel: xfrm: input: hold netns during deferred transport reinjection (CVE-2026-63919)

    * kernel: ip6: vti: Use ip6_tnl.net in vti6_changelink() (CVE-2026-63917)

    * kernel: netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check     (CVE-2026-63913)

    * kernel: wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (CVE-2026-64176)

    * kernel: wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (CVE-2026-64174)

    * kernel: wifi: iwlwifi: mld: stop TX during firmware restart (CVE-2026-64175)

    * kernel: RDMA/rxe: Fix a use-after-free problem in rxe_mmap (CVE-2026-64582)

    * kernel: Linux kernel: libceph stack out-of-bounds write via crafted OSDMap (CVE-2026-68159)

    * kernel: Linux kernel: ALSA timer use-after-free vulnerability allows privilege escalation     (CVE-2026-68200)

    * kernel: Linux kernel (ice): Denial of Service via out-of-range ptype in VIRTCHNL (CVE-2026-68128)

    * kernel: Linux kernel: ath9k Wi-Fi driver use-after-free vulnerability leading to system crash     (CVE-2026-68363)

    * kernel: xfrm: fix stale skb->prev after async crypto steals a GSO segment (CVE-2026-68426)

    * kernel: dm_early_create: fix freeing used table on dm_resume failure (CVE-2026-72102)

    * kernel: net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (CVE-2026-72298)

    * kernel: wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (CVE-2026-72003)

    * kernel: selinux: check connect-related permissions on TCP Fast Open (CVE-2026-72243)

    Bug Fix(es) and Enhancement(s):

    * gfs2: filesystem withdrawal rework [rhel-9.8.z] (JIRA:RHEL-252540)

    * The slab cache entries for gfs2 and dlm grow very large for gfs2 filesystems [rhel-9.8.z]     (JIRA:RHEL-252544)

    * gfs2: Get rid of sd_async_glock_wait [rhel-9.8.z] (JIRA:RHEL-253986)

    * [RHEL9.8z] watchdog: System panics during reboot when pretimeout is disabled (0) (JIRA:RHEL-255217)

    * [usb/xhci] kdump on Arrow Lake systems hangs system with dracut-initqueue Timed out errors [rhel-9.8.z]     (JIRA:RHEL-256733)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:67471 advisory.

    * kernel: tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock() (CVE-2025-40149)
      * kernel: Linux kernel: Denial of Service in qla2xxx SCSI driver due to improper command handling after     chip reset (CVE-2025-68745)
      * kernel: drm/xe: Open-code GGTT MMIO access protection (CVE-2026-23466)
      * kernel: drm/xe: always keep track of remap prev/next (CVE-2026-31479)
      * kernel: drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CVE-2026-31566)
      * kernel: xfrm: hold dev ref until after transport_finish NF_HOOK (CVE-2026-31663)
      * kernel: drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CVE-2026-31656)
      * kernel: smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (CVE-2026-31539)
      * kernel: vhost: move vdpa group bound check to vhost_vdpa (CVE-2026-43248)
      * kernel: drm/i915: Fix potential overflow of shmem scatterlist length (CVE-2026-43368)
      * kernel: drm/amdgpu: Fix use-after-free race in VM acquire (CVE-2026-43370)
      * kernel: scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CVE-2026-46149)
      * kernel: sctp: purge outqueue on stale COOKIE-ECHO handling (CVE-2026-52924)
      * kernel: netfilter: require Ethernet MAC header before using eth_hdr() (CVE-2026-53131)
      * kernel: sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (CVE-2026-53246)
      * kernel: xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (CVE-2026-53239)
      * kernel: af_unix: Set gc_in_progress to true in unix_gc() (CVE-2026-53361)
      * kernel: scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CVE-2026-63889)
      * kernel: ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate() (CVE-2026-63921)
      * kernel: xfrm: input: hold netns during deferred transport reinjection (CVE-2026-63919)
      * kernel: ip6: vti: Use ip6_tnl.net in vti6_changelink() (CVE-2026-63917)
      * kernel: lsm: hold cred_guard_mutex for lsm_set_self_attr() (CVE-2026-64111)
      * kernel: drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (CVE-2026-68264)
      * kernel: xfrm: fix stale skb->prev after async crypto steals a GSO segment (CVE-2026-68426)
      * kernel: scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CVE-2026-74556)


    Bug Fix(es) and Enhancement(s):

      * [almalinux-10.2.z]- Backport MSHV patches for hypervisor OOM handling (JIRA:AlmaLinux-245035)
      * RHIVOS - [backport] S32G Driver Enablement - ADC (JIRA:AlmaLinux-255233)
      * [AlmaLinux10.2z] watchdog: System can panic during reboot when pretimeout is disabled (0)     (JIRA:AlmaLinux-255348)
      * [usb/xhci] kdump on Arrow Lake systems hangs system with dracut-initqueue Timed out errors     [AlmaLinux-10.2.z] (JIRA:AlmaLinux-256731)
      * RHIVOS - [backport] S32G Driver Update - ADC, I2C, and eDMA (JIRA:AlmaLinux-256890)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:68532 advisory.

    * kernel: ipvlan: Make the addrs_lock be per port (CVE-2026-23103)
      * kernel: xfrm: hold dev ref until after transport_finish NF_HOOK (CVE-2026-31663)
      * kernel: netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CVE-2026-43233)
      * kernel: ipv6: prevent possible UaF in addrconf_permanent_addr() (CVE-2026-43339)
      * kernel: inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (CVE-2026-46266)
      * kernel: flow_dissector: do not dissect PPPoE PFC frames (CVE-2026-46306)
      * kernel: netfilter: xt_policy: fix strict mode inbound policy matching (CVE-2026-52920)
      * kernel: ppp: require CAP_NET_ADMIN in target netns for unattached ioctls (CVE-2026-53075)
      * kernel: ipv6: sit: reload inner IPv6 header after GSO offloads (CVE-2026-53228)
      * kernel: IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CVE-2026-53176)
      * kernel: netfilter: require Ethernet MAC header before using eth_hdr() (CVE-2026-53131)
      * kernel: netfilter: conntrack_irc: fix possible out-of-bounds read (CVE-2026-53268)
      * kernel: xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (CVE-2026-53239)
      * kernel: ALSA: timer: Fix UAF at snd_timer_user_params() (CVE-2026-53192)
      * kernel: net: guard timestamp cmsgs to real error queue skbs (CVE-2026-53223)
      * kernel: ipv6: mcast: Fix use-after-free when processing MLD queries (CVE-2026-53275)
      * kernel: ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table()     (CVE-2026-64002)
      * kernel: ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate() (CVE-2026-63921)
      * kernel: xfrm: input: hold netns during deferred transport reinjection (CVE-2026-63919)
      * kernel: ip6: vti: Use ip6_tnl.net in vti6_changelink() (CVE-2026-63917)
      * kernel: Linux kernel SLIP: Out-of-bounds write due to race condition during MTU change     (CVE-2026-68143)
      * kernel: xfrm: fix stale skb->prev after async crypto steals a GSO segment (CVE-2026-68426)
      * kernel: net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (CVE-2026-72298)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:68532 advisory.

    The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with     extremely high determinism requirements.

    Security Fix(es):

    * kernel: ipvlan: Make the addrs_lock be per port (CVE-2026-23103)

    * kernel: xfrm: hold dev ref until after transport_finish NF_HOOK (CVE-2026-31663)

    * kernel: netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CVE-2026-43233)

    * kernel: ipv6: prevent possible UaF in addrconf_permanent_addr() (CVE-2026-43339)

    * kernel: inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (CVE-2026-46266)

    * kernel: flow_dissector: do not dissect PPPoE PFC frames (CVE-2026-46306)

    * kernel: netfilter: xt_policy: fix strict mode inbound policy matching (CVE-2026-52920)

    * kernel: ppp: require CAP_NET_ADMIN in target netns for unattached ioctls (CVE-2026-53075)

    * kernel: ipv6: sit: reload inner IPv6 header after GSO offloads (CVE-2026-53228)

    * kernel: IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CVE-2026-53176)

    * kernel: netfilter: require Ethernet MAC header before using eth_hdr() (CVE-2026-53131)

    * kernel: netfilter: conntrack_irc: fix possible out-of-bounds read (CVE-2026-53268)

    * kernel: xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (CVE-2026-53239)

    * kernel: ALSA: timer: Fix UAF at snd_timer_user_params() (CVE-2026-53192)

    * kernel: net: guard timestamp cmsgs to real error queue skbs (CVE-2026-53223)

    * kernel: ipv6: mcast: Fix use-after-free when processing MLD queries (CVE-2026-53275)

    * kernel: ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table()     (CVE-2026-64002)

    * kernel: ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate() (CVE-2026-63921)

    * kernel: xfrm: input: hold netns during deferred transport reinjection (CVE-2026-63919)

    * kernel: ip6: vti: Use ip6_tnl.net in vti6_changelink() (CVE-2026-63917)

    * kernel: Linux kernel SLIP: Out-of-bounds write due to race condition during MTU change (CVE-2026-68143)

    * kernel: xfrm: fix stale skb->prev after async crypto steals a GSO segment (CVE-2026-68426)

    * kernel: net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (CVE-2026-72298)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-674710 advisory.

    - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559]     {CVE-2026-31539}
    - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot)     [RHEL-254596] {CVE-2026-74556}
    - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (Mika Penttila) [RHEL-222461]     {CVE-2026-23466}
    - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222401] {CVE-2026-43370}
    - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222474]     {CVE-2026-43368}
    - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222424]     {CVE-2026-31656}
    - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221279]     {CVE-2026-31566}
    - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222307] {CVE-2026-31479}
    - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222461] {CVE-2026-23466}
    - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (Mika Penttila) [RHEL-236579] {CVE-2026-68264}
    - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663}
    - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663}
    - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663}
    - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227502]     {CVE-2026-63919}
    - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236113]     {CVE-2026-68426}
    - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426}
    - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca)     [RHEL-228006] {CVE-2026-53239}
    - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231756] {CVE-2026-63917}
    - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228943] {CVE-2026-63921}
    - af_unix: Set gc_in_progress to true in unix_gc(). (Davide Caratti) [RHEL-227544] {CVE-2026-53361}
    - af_unix: Give up GC if MSG_PEEK intervened. (Davide Caratti) [RHEL-227544] {CVE-2026-23394}
    - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190194]     {CVE-2026-53246}
    - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235912] {CVE-2025-68745}
    - lsm: hold cred_guard_mutex for lsm_set_self_attr() (Ricardo Robaina) [RHEL-226807] {CVE-2026-64111}
    - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-231909]     {CVE-2025-40149}
    - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230672]     {CVE-2026-53131}
    - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228717]     {CVE-2026-63889}
    - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot)     [RHEL-225792] {CVE-2026-46149}
    - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188199] {CVE-2026-52924}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:67471 advisory.

    * kernel: tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock() (CVE-2025-40149)

    * kernel: Linux kernel: Denial of Service in qla2xxx SCSI driver due to improper command handling after     chip reset (CVE-2025-68745)

    * kernel: drm/xe: Open-code GGTT MMIO access protection (CVE-2026-23466)

    * kernel: drm/xe: always keep track of remap prev/next (CVE-2026-31479)

    * kernel: drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CVE-2026-31566)

    * kernel: xfrm: hold dev ref until after transport_finish NF_HOOK (CVE-2026-31663)

    * kernel: drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CVE-2026-31656)

    * kernel: smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (CVE-2026-31539)

    * kernel: vhost: move vdpa group bound check to vhost_vdpa (CVE-2026-43248)

    * kernel: drm/i915: Fix potential overflow of shmem scatterlist length (CVE-2026-43368)

    * kernel: drm/amdgpu: Fix use-after-free race in VM acquire (CVE-2026-43370)

    * kernel: scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CVE-2026-46149)

    * kernel: sctp: purge outqueue on stale COOKIE-ECHO handling (CVE-2026-52924)

    * kernel: netfilter: require Ethernet MAC header before using eth_hdr() (CVE-2026-53131)

    * kernel: sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (CVE-2026-53246)

    * kernel: xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (CVE-2026-53239)

    * kernel: af_unix: Set gc_in_progress to true in unix_gc() (CVE-2026-53361)

    * kernel: scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CVE-2026-63889)

    * kernel: ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate() (CVE-2026-63921)

    * kernel: xfrm: input: hold netns during deferred transport reinjection (CVE-2026-63919)

    * kernel: ip6: vti: Use ip6_tnl.net in vti6_changelink() (CVE-2026-63917)

    * kernel: lsm: hold cred_guard_mutex for lsm_set_self_attr() (CVE-2026-64111)

    * kernel: drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (CVE-2026-68264)

    * kernel: xfrm: fix stale skb->prev after async crypto steals a GSO segment (CVE-2026-68426)

    * kernel: scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CVE-2026-74556)

    Bug Fix(es) and Enhancement(s):

    * [rhel-10.2.z]- Backport MSHV patches for hypervisor OOM handling  (JIRA:Rocky Linux-245035)

    * RHIVOS - [backport] S32G Driver Enablement - ADC (JIRA:Rocky Linux-255233)

    * [Rocky Linux10.2z] watchdog: System can panic during reboot when pretimeout is disabled (0) (JIRA:Rocky     Linux-255348)

    * [usb/xhci] kdump on Arrow Lake systems hangs system with dracut-initqueue Timed out errors [Rocky     Linux-10.2.z] (JIRA:Rocky Linux-256731)

    * RHIVOS - [backport] S32G Driver Update - ADC, I2C, and eDMA (JIRA:Rocky Linux-256890)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:67471 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock() (CVE-2025-40149)

    * kernel: Linux kernel: Denial of Service in qla2xxx SCSI driver due to improper command handling after     chip reset (CVE-2025-68745)

    * kernel: drm/xe: Open-code GGTT MMIO access protection (CVE-2026-23466)

    * kernel: drm/xe: always keep track of remap prev/next (CVE-2026-31479)

    * kernel: drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CVE-2026-31566)

    * kernel: xfrm: hold dev ref until after transport_finish NF_HOOK (CVE-2026-31663)

    * kernel: drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CVE-2026-31656)

    * kernel: smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (CVE-2026-31539)

    * kernel: vhost: move vdpa group bound check to vhost_vdpa (CVE-2026-43248)

    * kernel: drm/i915: Fix potential overflow of shmem scatterlist length (CVE-2026-43368)

    * kernel: drm/amdgpu: Fix use-after-free race in VM acquire (CVE-2026-43370)

    * kernel: scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CVE-2026-46149)

    * kernel: sctp: purge outqueue on stale COOKIE-ECHO handling (CVE-2026-52924)

    * kernel: netfilter: require Ethernet MAC header before using eth_hdr() (CVE-2026-53131)

    * kernel: sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (CVE-2026-53246)

    * kernel: xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (CVE-2026-53239)

    * kernel: af_unix: Set gc_in_progress to true in unix_gc() (CVE-2026-53361)

    * kernel: scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CVE-2026-63889)

    * kernel: ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate() (CVE-2026-63921)

    * kernel: xfrm: input: hold netns during deferred transport reinjection (CVE-2026-63919)

    * kernel: ip6: vti: Use ip6_tnl.net in vti6_changelink() (CVE-2026-63917)

    * kernel: lsm: hold cred_guard_mutex for lsm_set_self_attr() (CVE-2026-64111)

    * kernel: drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (CVE-2026-68264)

    * kernel: xfrm: fix stale skb->prev after async crypto steals a GSO segment (CVE-2026-68426)

    * kernel: scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CVE-2026-74556)

    Bug Fix(es) and Enhancement(s):

    * [rhel-10.2.z]- Backport MSHV patches for hypervisor OOM handling  (JIRA:RHEL-245035)

    * RHIVOS - [backport] S32G Driver Enablement - ADC (JIRA:RHEL-255233)

    * [RHEL10.2z] watchdog: System can panic during reboot when pretimeout is disabled (0) (JIRA:RHEL-255348)

    * [usb/xhci] kdump on Arrow Lake systems hangs system with dracut-initqueue Timed out errors [RHEL-10.2.z]     (JIRA:RHEL-256731)

    * RHIVOS - [backport] S32G Driver Update - ADC, I2C, and eDMA (JIRA:RHEL-256890)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - xfrm: fix stale skb->prev after async crypto steals a GSO segment skb_gso_segment() leaves the segment     list head with ->prev pointing at the last segment, an invariant validate_xmit_skb_list() relies on when     it sets its tail pointer (tail = skb->prev). When validate_xmit_xfrm() walks a GSO list and some segments     are stolen by async crypto (->xmit() returns -EINPROGRESS), those segments are unlinked from the list but     the head ->prev is never updated. If the last segment is the one stolen, the returned head still has
    ->prev pointing at it, even though it is now owned by the crypto engine and may be freed.
    validate_xmit_skb_list() later does tail->next = skb, writing through that stale pointer -- a use-after-     free. Repoint skb->prev at the last retained segment before returning. (CVE-2026-68426)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
348284	RockyLinux 8 : kernel-rt (RLSA-2026:68532)	Nessus	Rocky Linux Local Security Checks	Local	medium
348283	RockyLinux 8 : kernel (RLSA-2026:68531)	Nessus	Rocky Linux Local Security Checks	Local	medium
348246	Oracle Linux 8 : kernel (ELSA-2026-68531)	Nessus	Oracle Linux Local Security Checks	Local	medium
348237	Oracle Linux 9 : kernel (ELSA-2026-68570)	Nessus	Oracle Linux Local Security Checks	Local	medium
347976	AlmaLinux 8 : kernel (ALSA-2026:68531)	Nessus	Alma Linux Local Security Checks	Local	medium
347900	SUSE SLED15: cluster-md-kmp-default / dlm-kmp-default / gfs2-kmp-default / etc (SUSE-SU-2026:4254-1)	Nessus	SuSE Local Security Checks	Local	high
346926	RHEL 8 : kernel (RHSA-2026:68531)	Nessus	Red Hat Local Security Checks	Local	medium
346915	RHEL 9 : kernel (RHSA-2026:68570)	Nessus	Red Hat Local Security Checks	Local	medium
346879	AlmaLinux 10 : kernel (ALSA-2026:67471)	Nessus	Alma Linux Local Security Checks	Local	high
346875	AlmaLinux 8 : kernel-rt (ALSA-2026:68532)	Nessus	Alma Linux Local Security Checks	Local	medium
346857	RHEL 8 : kernel-rt (RHSA-2026:68532)	Nessus	Red Hat Local Security Checks	Local	medium
346426	Oracle Linux 10 : ELSA-2026-67471-0: / kernel (ELSA-2026-674710)	Nessus	Oracle Linux Local Security Checks	Local	high
346311	RockyLinux 10 : kernel (RLSA-2026:67471)	Nessus	Rocky Linux Local Security Checks	Local	high
345863	RHEL 10 : kernel (RHSA-2026:67471)	Nessus	Red Hat Local Security Checks	Local	high
341888	Amazon Linux 2023 : bpftool6.18, kernel6.18, kernel6.18-devel (ALAS2023-2026-2106)	Nessus	Amazon Linux Local Security Checks	Local	high
334354	Linux Distros Unpatched Vulnerability : CVE-2026-68426	Nessus	Misc.	Local	critical

Detections

Analytics

CVE-2026-68426

critical

Tenable Plugins

Coming Soon

medium

medium

medium

medium

medium

high

medium

medium

high

medium

medium

high

high

high

high

critical