In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: use kvzalloc to allocate struct dc struct dc has grown large over time (most of it the two inlined dc_scratch_space copies) and now sits close to the page allocator's 4 MiB contiguous allocation limit. Its actual size is not fixed by the source alone, it also depends on the compiler and the .config, so it can easily cross 4 MiB, e.g. with a newer GCC or a config change. dc_create() allocates it with kzalloc(). Once struct dc exceeds 4 MiB the request is rounded up to order 11 (8 MiB), which is above MAX_PAGE_ORDER, so the page allocator warns and returns NULL. dc_create() then fails, DM init fails and amdgpu probe aborts with -EINVAL: WARNING: mm/page_alloc.c:5197 at __alloc_frozen_pages_noprof+0x2f9/0x380 dc_create+0x38/0x660 [amdgpu] amdgpu_dm_init+0x2d9/0x510 [amdgpu] dm_hw_init+0x1b/0x90 [amdgpu] amdgpu_device_init.cold+0x150d/0x1e13 [amdgpu] amdgpu_driver_load_kms+0x19/0x80 [amdgpu] amdgpu_pci_probe+0x1e2/0x4c0 [amdgpu] dc_create() then returns NULL and DM init fails, which aborts the whole GPU init and makes amdgpu probe fail with -EINVAL ("hw_init of IP block <dm> failed -22"), leaving the display unusable. The subsequent amdgpu_irq_put() warnings during teardown are just fallout of unwinding a half-initialized device. struct dc is a software-only bookkeeping structure that is never handed to hardware DMA and is only ever kept as an opaque pointer, so it does not require physically contiguous memory. Allocate it with kvzalloc() (and free it with kvfree()) so that the allocator can fall back to vmalloc() when a contiguous allocation of that size is not available, which also avoids the MAX_PAGE_ORDER warning entirely. v2: - Rebase to amd-staging-drm-next. (cherry picked from commit 991e0516a8072f2292681c6ae98a924ab0e32575)

The CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS7:CLSA-2026:1792976962 advisory.

  - In the Linux kernel, the following vulnerability has been resolved: wifi: ath9k: avoid uninit memory read     in ath9k_htc_rx_msg() syzbot is reporting uninit value at ath9k_htc_rx_msg() [1], for     ioctl(USB_RAW_IOCTL_EP_WRITE) can call ath9k_hif_usb_rx_stream() with pkt_len = 0 but     ath9k_hif_usb_rx_stream() uses __dev_alloc_skb(pkt_len + 32, GFP_ATOMIC) based on an assumption that     pkt_len is valid. As a result, ath9k_hif_usb_rx_stream() allocates skb with uninitialized memory and     ath9k_htc_rx_msg() is reading from uninitialized memory. Since bytes accessed by ath9k_htc_rx_msg() is not     known until ath9k_htc_rx_msg() is called, it would be difficult to check minimal valid pkt_len at if     (pkt_len > 2 * MAX_RX_BUF_SIZE) { line in ath9k_hif_usb_rx_stream(). We have two choices. One is to     workaround by adding __GFP_ZERO so that ath9k_htc_rx_msg() sees 0 if pkt_len is invalid. The other is to     let ath9k_htc_rx_msg() validate pkt_len before accessing. This patch chose the latter. Note that I'm not     sure threshold condition is correct, for I can't find details on possible packet length used by this     protocol. (CVE-2022-50709)

  - In the Linux kernel, the following vulnerability has been resolved: configfs: fix possible memory leak in     configfs_create_dir() kmemleak reported memory leaks in configfs_create_dir(): unreferenced object     0xffff888009f6af00 (size 192): comm modprobe, pid 3777, jiffies 4295537735 (age 233.784s) backtrace:
    kmem_cache_alloc (mm/slub.c:3250 mm/slub.c:3256 mm/slub.c:3263 mm/slub.c:3273) new_fragment     (./include/linux/slab.h:600 fs/configfs/dir.c:163) configfs_register_subsystem (fs/configfs/dir.c:1857)     basic_write (drivers/hwtracing/stm/p_basic.c:14) stm_p_basic do_one_initcall (init/main.c:1296)     do_init_module (kernel/module/main.c:2455) ... unreferenced object 0xffff888003ba7180 (size 96): comm     modprobe, pid 3777, jiffies 4295537735 (age 233.784s) backtrace: kmem_cache_alloc (mm/slub.c:3250     mm/slub.c:3256 mm/slub.c:3263 mm/slub.c:3273) configfs_new_dirent (./include/linux/slab.h:723     fs/configfs/dir.c:194) configfs_make_dirent (fs/configfs/dir.c:248) configfs_create_dir     (fs/configfs/dir.c:296) configfs_attach_group.isra.28 (fs/configfs/dir.c:816 fs/configfs/dir.c:852)     configfs_register_subsystem (fs/configfs/dir.c:1881) basic_write (drivers/hwtracing/stm/p_basic.c:14)     stm_p_basic do_one_initcall (init/main.c:1296) do_init_module (kernel/module/main.c:2455) ... This is     because the refcount is not correct in configfs_make_dirent(). For normal stage, the refcount is changing     as: configfs_register_subsystem() configfs_create_dir() configfs_make_dirent() configfs_new_dirent() # set     s_count = 1 dentry->d_fsdata = configfs_get(sd); # s_count = 2 ... configfs_unregister_subsystem()     configfs_remove_dir() remove_dir() configfs_remove_dirent() # s_count = 1 dput() ...
    *dentry_unlink_inode()* configfs_d_iput() # s_count = 0, release However, if we failed in     configfs_create(): configfs_register_subsystem() configfs_create_dir() configfs_make_dirent() # s_count =     2 ... configfs_create() # fail ->out_remove: configfs_remove_dirent(dentry) configfs_put(sd) # s_count = 1     return PTR_ERR(inode); There is no inode in the error path, so the configfs_d_iput() is lost and makes sd     and fragment memory leaked. To fix this, when we failed in configfs_create(), manually call     configfs_put(sd) to keep the refcount correct. (CVE-2022-50751)

  - In the Linux kernel, the following vulnerability has been resolved: pstore: Avoid kcore oops by vmap()ing     with VM_IOREMAP An oops can be induced by running 'cat /proc/kcore > /dev/null' on devices using pstore     with the ram backend because kmap_atomic() assumes lowmem pages are accessible with __va(). Unable to     handle kernel paging request at virtual address ffffff807ff2b000 Mem abort info: ESR = 0x96000006 EC =     0x25: DABT (current EL), IL = 32 bits SET = 0, FnV = 0 EA = 0, S1PTW = 0 FSC = 0x06: level 2 translation     fault Data abort info: ISV = 0, ISS = 0x00000006 CM = 0, WnR = 0 swapper pgtable: 4k pages, 39-bit VAs,     pgdp=0000000081d87000 [ffffff807ff2b000] pgd=180000017fe18003, p4d=180000017fe18003, pud=180000017fe18003,     pmd=0000000000000000 Internal error: Oops: 96000006 [#1] PREEMPT SMP Modules linked in: dm_integrity CPU:
    7 PID: 21179 Comm: perf Not tainted 5.15.67-10882-ge4eb2eb988cd #1     baa443fb8e8477896a370b31a821eb2009f9bfba Hardware name: Google Lazor (rev3 - 8) (DT) pstate: a0400009     (NzCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : __memcpy+0x110/0x260 lr : vread+0x194/0x294 sp :
    ffffffc013ee39d0 x29: ffffffc013ee39f0 x28: 0000000000001000 x27: ffffff807ff2b000 x26: 0000000000001000     x25: ffffffc0085a2000 x24: ffffff802d4b3000 x23: ffffff80f8a60000 x22: ffffff802d4b3000 x21:
    ffffffc0085a2000 x20: ffffff8080b7bc68 x19: 0000000000001000 x18: 0000000000000000 x17: 0000000000000000     x16: 0000000000000000 x15: ffffffd3073f2e60 x14: ffffffffad588000 x13: 0000000000000000 x12:
    0000000000000001 x11: 00000000000001a2 x10: 00680000fff2bf0b x9 : 03fffffff807ff2b x8 : 0000000000000001     x7 : 0000000000000000 x6 : 0000000000000000 x5 : ffffff802d4b4000 x4 : ffffff807ff2c000 x3 :
    ffffffc013ee3a78 x2 : 0000000000001000 x1 : ffffff807ff2b000 x0 : ffffff802d4b3000 Call trace:
    __memcpy+0x110/0x260 read_kcore+0x584/0x778 proc_reg_read+0xb4/0xe4 During early boot, memblock reserves     the pages for the ramoops reserved memory node in DT that would otherwise be part of the direct lowmem     mapping. Pstore's ram backend reuses those reserved pages to change the memory type (writeback or non-     cached) by passing the pages to vmap() (see pfn_to_page() usage in persistent_ram_vmap() for more details)     with specific flags. When read_kcore() starts iterating over the vmalloc region, it runs over the virtual     address that vmap() returned for ramoops. In aligned_vread() the virtual address is passed to     vmalloc_to_page() which returns the page struct for the reserved lowmem area. That lowmem page is passed     to kmap_atomic(), which effectively calls page_to_virt() that assumes a lowmem page struct must be     directly accessible with __va() and friends. These pages are mapped via vmap() though, and the lowmem     mapping was never made, so accessing them via the lowmem virtual address oopses like above. Let's side-     step this problem by passing VM_IOREMAP to vmap(). This will tell vread() to not include the ramoops     region in the kcore. Instead the area will look like a bunch of zeros. The alternative is to teach kmap()     about vmalloc areas that intersect with lowmem. Presumably such a change isn't a one-liner, and there     isn't much interest in inspecting the ramoops region in kcore files anyway, so the most expedient route is     taken for now. (CVE-2022-50849)

  - In the Linux kernel, the following vulnerability has been resolved: hwrng: amd - Fix PCI device refcount     leak for_each_pci_dev() is implemented by pci_get_device(). The comment of pci_get_device() says that it     will increase the reference count for the returned pci_dev and also decrease the reference count for the     input pci_dev @from if it is not NULL. If we break for_each_pci_dev() loop with pdev not NULL, we need to     call pci_dev_put() to decrease the reference count. Add the missing pci_dev_put() for the normal and error     path. (CVE-2022-50868)

  - In the Linux kernel, the following vulnerability has been resolved: RDMA/srp: Do not call scsi_done() from     srp_abort() After scmd_eh_abort_handler() has called the SCSI LLD eh_abort_handler callback, it performs     one of the following actions: * Call scsi_queue_insert(). * Call scsi_finish_command(). * Call     scsi_eh_scmd_add(). Hence, SCSI abort handlers must not call scsi_done(). Otherwise all the above actions     would trigger a use-after-free. Hence remove the scsi_done() call from srp_abort(). Keep the     srp_free_req() call before returning SUCCESS because we may not see the command again if SUCCESS is     returned. (CVE-2023-52515)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1791741836 advisory.

  - In the Linux kernel, the following vulnerability has been resolved: vhost: fix hung thread due to     erroneous iotlb entries In vhost_iotlb_add_range_ctx(), range size can overflow to 0 when start is 0 and     last is ULONG_MAX. One instance where it can happen is when userspace sends an IOTLB message with     iova=size=uaddr=0 (vhost_process_iotlb_msg). So, an entry with size = 0, start = 0, last = ULONG_MAX ends     up in the iotlb. Next time a packet is sent, iotlb_access_ok() loops indefinitely due to that erroneous     entry. Call Trace: <TASK> iotlb_access_ok+0x21b/0x3e0 drivers/vhost/vhost.c:1340     vq_meta_prefetch+0xbc/0x280 drivers/vhost/vhost.c:1366 vhost_transport_do_send_pkt+0xe0/0xfd0     drivers/vhost/vsock.c:104 vhost_worker+0x23d/0x3d0 drivers/vhost/vhost.c:372 kthread+0x2e9/0x3a0     kernel/kthread.c:377 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295 </TASK> Reported by syzbot at:
    https://syzkaller.appspot.com/bug?extid=0abd373e2e50d704db87 To fix this, do two things: 1. Return -EINVAL     in vhost_chr_write_iter() when userspace asks to map a range with size 0. 2. Fix     vhost_iotlb_add_range_ctx() to handle the range [0, ULONG_MAX] by splitting it into two entries.
    (CVE-2022-48862)

  - In the Linux kernel, the following vulnerability has been resolved: net: hns3: add vlan list lock to     protect vlan list When adding port base VLAN, vf VLAN need to remove from HW and modify the vlan state in     vf VLAN list as false. If the periodicity task is freeing the same node, it may cause use after free     error. This patch adds a vlan list lock to protect the vlan list. (CVE-2022-49182)

  - In the Linux kernel, the following vulnerability has been resolved: perf/x86/amd: Fix crash due to race     between amd_pmu_enable_all, perf NMI and throttling amd_pmu_enable_all() does: if (!test_bit(idx,     cpuc->active_mask)) continue; amd_pmu_enable_event(cpuc->events[idx]); A perf NMI of another event can     come between these two steps. Perf NMI handler internally disables and enables _all_ events, including the     one which nmi-intercepted amd_pmu_enable_all() was in process of enabling. If that unintentionally enabled     event has very low sampling period and causes immediate successive NMI, causing the event to be throttled,     cpuc->events[idx] and cpuc->active_mask gets cleared by x86_pmu_stop(). This will result in     amd_pmu_enable_event() getting called with event=NULL when amd_pmu_enable_all() resumes after handling the     NMIs. This causes a kernel crash: BUG: kernel NULL pointer dereference, address: 0000000000000198 #PF:
    supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page [...] Call Trace: <TASK>     amd_pmu_enable_all+0x68/0xb0 ctx_resched+0xd9/0x150 event_function+0xb8/0x130 ?     hrtimer_start_range_ns+0x141/0x4a0 ? perf_duration_warn+0x30/0x30 remote_function+0x4d/0x60
    __flush_smp_call_function_queue+0xc4/0x500 flush_smp_call_function_queue+0x11d/0x1b0 do_idle+0x18f/0x2d0     cpu_startup_entry+0x19/0x20 start_secondary+0x121/0x160 secondary_startup_64_no_verify+0xe5/0xeb </TASK>     amd_pmu_disable_all()/amd_pmu_enable_all() calls inside perf NMI handler were recently added as part of     BRS enablement but I'm not sure whether we really need them. We can just disable BRS in the beginning and     enable it back while returning from NMI. This will solve the issue by not enabling those events whose     active_masks are set but are not yet enabled in hw pmu. (CVE-2022-49781)

  - In the Linux kernel, the following vulnerability has been resolved: blk-iolatency: Fix memory leak on     add_disk() failures When a gendisk is successfully initialized but add_disk() fails such as when a loop     device has invalid number of minor device numbers specified, blkcg_init_disk() is called during init and     then blkcg_exit_disk() during error handling. Unfortunately, iolatency gets initialized in the former but     doesn't get cleaned up in the latter. This is because, in non-error cases, the cleanup is performed by     del_gendisk() calling rq_qos_exit(), the assumption being that rq_qos policies, iolatency being one of     them, can only be activated once the disk is fully registered and visible. That assumption is true for wbt     and iocost, but not so for iolatency as it gets initialized before add_disk() is called. It is desirable     to lazy-init rq_qos policies because they are optional features and add to hot path overhead once     initialized - each IO has to walk all the registered rq_qos policies. So, we want to switch iolatency to     lazy init too. However, that's a bigger change. As a fix for the immediate problem, let's just add an     extra call to rq_qos_exit() in blkcg_exit_disk(). This is safe because duplicate calls to rq_qos_exit()     become noop's. (CVE-2022-50550)

  - In the Linux kernel, the following vulnerability has been resolved: i40e: Do not allow untrusted VF to     remove administratively set MAC Currently when PF administratively sets VF's MAC address and the VF is put     down (VF tries to delete all MACs) then the MAC is removed from MAC filters and primary VF MAC is zeroed.
    Do not allow untrusted VF to remove primary MAC when it was set administratively by PF. Reproducer: 1)     Create VF 2) Set VF interface up 3) Administratively set the VF's MAC 4) Put VF interface down [root@host     ~]# echo 1 > /sys/class/net/enp2s0f0/device/sriov_numvfs [root@host ~]# ip link set enp2s0f0v0 up     [root@host ~]# ip link set enp2s0f0 vf 0 mac fe:6c:b5:da:c7:7d [root@host ~]# ip link show enp2s0f0 23:
    enp2s0f0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP mode DEFAULT group default qlen     1000 link/ether 3c:ec:ef:b7:dd:04 brd ff:ff:ff:ff:ff:ff vf 0 link/ether fe:6c:b5:da:c7:7d brd     ff:ff:ff:ff:ff:ff, spoof checking on, link-state auto, trust off [root@host ~]# ip link set enp2s0f0v0     down [root@host ~]# ip link show enp2s0f0 23: enp2s0f0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc     mq state UP mode DEFAULT group default qlen 1000 link/ether 3c:ec:ef:b7:dd:04 brd ff:ff:ff:ff:ff:ff vf 0     link/ether 00:00:00:00:00:00 brd ff:ff:ff:ff:ff:ff, spoof checking on, link-state auto, trust off     (CVE-2024-26830)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The AlmaLinux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1789986443 advisory.

  - In the Linux kernel, the following vulnerability has been resolved: net: hns3: add vlan list lock to     protect vlan list When adding port base VLAN, vf VLAN need to remove from HW and modify the vlan state in     vf VLAN list as false. If the periodicity task is freeing the same node, it may cause use after free     error. This patch adds a vlan list lock to protect the vlan list. (CVE-2022-49182)

  - In the Linux kernel, the following vulnerability has been resolved: tracing: Fix reading strings from     synthetic events The follow commands caused a crash: # cd /sys/kernel/tracing # echo 's:open char file[]'     > dynamic_events # echo 'hist:keys=common_pid:file=filename:onchange($file).trace(open,$file)' >     events/syscalls/sys_enter_openat/trigger' # echo 1 > events/synthetic/open/enable BOOM! The problem is     that the synthetic event field char file[] will read the value given to it as a string without any     memory checks to make sure the address is valid. The above example will pass in the user space address and     the sythetic event code will happily call strlen() on it and then strscpy() where either one will cause an     oops when accessing user space addresses. Use the helper functions from trace_kprobe and trace_eprobe that     can read strings safely (and actually succeed when the address is from user space and the memory is mapped     in). Now the above can show: packagekitd-1721 [000] ...2. 104.597170: open:
    file=/usr/lib/rpm/fileattrs/cmake.attr in:imjournal-978 [006] ...2. 104.599642: open:
    file=/var/lib/rsyslog/imjournal.state.tmp packagekitd-1721 [000] ...2. 104.626308: open:
    file=/usr/lib/rpm/fileattrs/debuginfo.attr (CVE-2022-50255)

  - In the Linux kernel, the following vulnerability has been resolved: ipc: fix memleak if msg_init_ns failed     in create_ipc_ns Percpu memory allocation may failed during create_ipc_ns however this fail is not handled     properly since ipc sysctls and mq sysctls is not released properly. Fix this by release these two resource     when failure. Here is the kmemleak stack when percpu failed: unreferenced object 0xffff88819de2a600 (size     512): comm shmem_2nstest, pid 120711, jiffies 4300542254 hex dump (first 32 bytes): 60 aa 9d 84 ff ff ff     ff fc 18 48 b2 84 88 ff ff `.........H..... 04 00 00 00 a4 01 00 00 20 e4 56 81 ff ff ff ff ........
    .V..... backtrace (crc be7cba35): [<ffffffff81b43f83>] __kmalloc_node_track_caller_noprof+0x333/0x420     [<ffffffff81a52e56>] kmemdup_noprof+0x26/0x50 [<ffffffff821b2f37>] setup_mq_sysctls+0x57/0x1d0     [<ffffffff821b29cc>] copy_ipcs+0x29c/0x3b0 [<ffffffff815d6a10>] create_new_namespaces+0x1d0/0x920     [<ffffffff815d7449>] copy_namespaces+0x2e9/0x3e0 [<ffffffff815458f3>] copy_process+0x29f3/0x7ff0     [<ffffffff8154b080>] kernel_clone+0xc0/0x650 [<ffffffff8154b6b1>] __do_sys_clone+0xa1/0xe0     [<ffffffff843df8ff>] do_syscall_64+0xbf/0x1c0 [<ffffffff846000b0>]     entry_SYSCALL_64_after_hwframe+0x4b/0x53 (CVE-2024-53175)

  - In the Linux kernel, the following vulnerability has been resolved: net/mlx5: HWS, change error flow on     matcher disconnect Currently, when firmware failure occurs during matcher disconnect flow, the error flow     of the function reconnects the matcher back and returns an error, which continues running the calling     function and eventually frees the matcher that is being disconnected. This leads to a case where we have a     freed matcher on the matchers list, which in turn leads to use-after-free and eventual crash. This patch     fixes that by not trying to reconnect the matcher back when some FW command fails during disconnect. Note     that we're dealing here with FW error. We can't overcome this problem. This might lead to bad steering     state (e.g. wrong connection between matchers), and will also lead to resource leakage, as it is the case     with any other error handling during resource destruction. However, the goal here is to allow the driver     to continue and not crash the machine with use-after-free error. (CVE-2025-21751)

  - In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: Avoid memory leak while     enabling statistics Driver uses monitor destination rings for extended statistics mode and standalone     monitor mode. In extended statistics mode, TLVs are parsed from the buffer received from the monitor     destination ring and assigned to the ppdu_info structure to update per-packet statistics. In standalone     monitor mode, along with per-packet statistics, the packet data (payload) is captured, and the driver     updates per MSDU to mac80211. When the AP interface is enabled, only extended statistics mode is     activated. As part of enabling monitor rings for collecting statistics, the driver subscribes to     HAL_RX_MPDU_START TLV in the filter configuration. This TLV is received from the monitor destination ring,     and kzalloc for the mon_mpdu object occurs, which is not freed, leading to a memory leak. The kzalloc for     the mon_mpdu object is only required while enabling the standalone monitor interface. This causes a memory     leak while enabling extended statistics mode in the driver. Fix this memory leak by removing the kzalloc     for the mon_mpdu object in the HAL_RX_MPDU_START TLV handling. Additionally, remove the standalone monitor     mode handlings in the HAL_MON_BUF_ADDR and HAL_RX_MSDU_END TLVs. These TLV tags will be handled properly     when enabling standalone monitor mode in the future. Tested-on: QCN9274 hw2.0 PCI     WLAN.WBE.1.3.1-00173-QCAHKSWPL_SILICONZ-1 Tested-on: WCN7850 hw2.0 PCI     WLAN.HMT.1.0.c5-00481-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3 (CVE-2025-37743)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1789986443 advisory.

  - In the Linux kernel, the following vulnerability has been resolved: net: hns3: add vlan list lock to     protect vlan list When adding port base VLAN, vf VLAN need to remove from HW and modify the vlan state in     vf VLAN list as false. If the periodicity task is freeing the same node, it may cause use after free     error. This patch adds a vlan list lock to protect the vlan list. (CVE-2022-49182)

  - In the Linux kernel, the following vulnerability has been resolved: tracing: Fix reading strings from     synthetic events The follow commands caused a crash: # cd /sys/kernel/tracing # echo 's:open char file[]'     > dynamic_events # echo 'hist:keys=common_pid:file=filename:onchange($file).trace(open,$file)' >     events/syscalls/sys_enter_openat/trigger' # echo 1 > events/synthetic/open/enable BOOM! The problem is     that the synthetic event field char file[] will read the value given to it as a string without any     memory checks to make sure the address is valid. The above example will pass in the user space address and     the sythetic event code will happily call strlen() on it and then strscpy() where either one will cause an     oops when accessing user space addresses. Use the helper functions from trace_kprobe and trace_eprobe that     can read strings safely (and actually succeed when the address is from user space and the memory is mapped     in). Now the above can show: packagekitd-1721 [000] ...2. 104.597170: open:
    file=/usr/lib/rpm/fileattrs/cmake.attr in:imjournal-978 [006] ...2. 104.599642: open:
    file=/var/lib/rsyslog/imjournal.state.tmp packagekitd-1721 [000] ...2. 104.626308: open:
    file=/usr/lib/rpm/fileattrs/debuginfo.attr (CVE-2022-50255)

  - In the Linux kernel, the following vulnerability has been resolved: ipc: fix memleak if msg_init_ns failed     in create_ipc_ns Percpu memory allocation may failed during create_ipc_ns however this fail is not handled     properly since ipc sysctls and mq sysctls is not released properly. Fix this by release these two resource     when failure. Here is the kmemleak stack when percpu failed: unreferenced object 0xffff88819de2a600 (size     512): comm shmem_2nstest, pid 120711, jiffies 4300542254 hex dump (first 32 bytes): 60 aa 9d 84 ff ff ff     ff fc 18 48 b2 84 88 ff ff `.........H..... 04 00 00 00 a4 01 00 00 20 e4 56 81 ff ff ff ff ........
    .V..... backtrace (crc be7cba35): [<ffffffff81b43f83>] __kmalloc_node_track_caller_noprof+0x333/0x420     [<ffffffff81a52e56>] kmemdup_noprof+0x26/0x50 [<ffffffff821b2f37>] setup_mq_sysctls+0x57/0x1d0     [<ffffffff821b29cc>] copy_ipcs+0x29c/0x3b0 [<ffffffff815d6a10>] create_new_namespaces+0x1d0/0x920     [<ffffffff815d7449>] copy_namespaces+0x2e9/0x3e0 [<ffffffff815458f3>] copy_process+0x29f3/0x7ff0     [<ffffffff8154b080>] kernel_clone+0xc0/0x650 [<ffffffff8154b6b1>] __do_sys_clone+0xa1/0xe0     [<ffffffff843df8ff>] do_syscall_64+0xbf/0x1c0 [<ffffffff846000b0>]     entry_SYSCALL_64_after_hwframe+0x4b/0x53 (CVE-2024-53175)

  - In the Linux kernel, the following vulnerability has been resolved: net/mlx5: HWS, change error flow on     matcher disconnect Currently, when firmware failure occurs during matcher disconnect flow, the error flow     of the function reconnects the matcher back and returns an error, which continues running the calling     function and eventually frees the matcher that is being disconnected. This leads to a case where we have a     freed matcher on the matchers list, which in turn leads to use-after-free and eventual crash. This patch     fixes that by not trying to reconnect the matcher back when some FW command fails during disconnect. Note     that we're dealing here with FW error. We can't overcome this problem. This might lead to bad steering     state (e.g. wrong connection between matchers), and will also lead to resource leakage, as it is the case     with any other error handling during resource destruction. However, the goal here is to allow the driver     to continue and not crash the machine with use-after-free error. (CVE-2025-21751)

  - In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: Avoid memory leak while     enabling statistics Driver uses monitor destination rings for extended statistics mode and standalone     monitor mode. In extended statistics mode, TLVs are parsed from the buffer received from the monitor     destination ring and assigned to the ppdu_info structure to update per-packet statistics. In standalone     monitor mode, along with per-packet statistics, the packet data (payload) is captured, and the driver     updates per MSDU to mac80211. When the AP interface is enabled, only extended statistics mode is     activated. As part of enabling monitor rings for collecting statistics, the driver subscribes to     HAL_RX_MPDU_START TLV in the filter configuration. This TLV is received from the monitor destination ring,     and kzalloc for the mon_mpdu object occurs, which is not freed, leading to a memory leak. The kzalloc for     the mon_mpdu object is only required while enabling the standalone monitor interface. This causes a memory     leak while enabling extended statistics mode in the driver. Fix this memory leak by removing the kzalloc     for the mon_mpdu object in the HAL_RX_MPDU_START TLV handling. Additionally, remove the standalone monitor     mode handlings in the HAL_MON_BUF_ADDR and HAL_RX_MSDU_END TLVs. These TLV tags will be handled properly     when enabling standalone monitor mode in the future. Tested-on: QCN9274 hw2.0 PCI     WLAN.WBE.1.3.1-00173-QCAHKSWPL_SILICONZ-1 Tested-on: WCN7850 hw2.0 PCI     WLAN.HMT.1.0.c5-00481-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3 (CVE-2025-37743)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - drm/amd/display: use kvzalloc to allocate struct dc struct dc has grown large over time (most of it the     two inlined dc_scratch_space copies) and now sits close to the page allocator's 4 MiB contiguous     allocation limit. Its actual size is not fixed by the source alone, it also depends on the compiler and     the .config, so it can easily cross 4 MiB, e.g. with a newer GCC or a config change. dc_create() allocates     it with kzalloc(). Once struct dc exceeds 4 MiB the request is rounded up to order 11 (8 MiB), which is     above MAX_PAGE_ORDER, so the page allocator warns and returns NULL. dc_create() then fails, DM init fails     and amdgpu probe aborts with -EINVAL: WARNING: mm/page_alloc.c:5197 at
    __alloc_frozen_pages_noprof+0x2f9/0x380 dc_create+0x38/0x660 [amdgpu] amdgpu_dm_init+0x2d9/0x510 [amdgpu]     dm_hw_init+0x1b/0x90 [amdgpu] amdgpu_device_init.cold+0x150d/0x1e13 [amdgpu]     amdgpu_driver_load_kms+0x19/0x80 [amdgpu] amdgpu_pci_probe+0x1e2/0x4c0 [amdgpu] dc_create() then returns     NULL and DM init fails, which aborts the whole GPU init and makes amdgpu probe fail with -EINVAL (hw_init     of IP block <dm> failed -22), leaving the display unusable. The subsequent amdgpu_irq_put() warnings     during teardown are just fallout of unwinding a half-initialized device. struct dc is a software-only     bookkeeping structure that is never handed to hardware DMA and is only ever kept as an opaque pointer, so     it does not require physically contiguous memory. Allocate it with kvzalloc() (and free it with kvfree())     so that the allocator can fall back to vmalloc() when a contiguous allocation of that size is not     available, which also avoids the MAX_PAGE_ORDER warning entirely. v2: - Rebase to amd-staging-drm-next.
    (cherry picked from commit 991e0516a8072f2292681c6ae98a924ab0e32575) (CVE-2026-68436)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
374124	CentOS Linux 7 [TuxCare] Security Update: bpftool / kernel / kernel-debug / kernel-debug-devel / kernel-devel / etc Multiple Vulnerabilities (CENTOS7:CLSA-2026:1792976962)	Nessus	CentOS Local Security Checks	Local	high
365768	Ubuntu 26.04 LTS : Linux kernel (Azure) vulnerabilities (USN-8888-1)	Nessus	Ubuntu Local Security Checks	Local	medium
365767	Ubuntu 26.04 LTS : Linux kernel vulnerabilities (USN-8887-1)	Nessus	Ubuntu Local Security Checks	Local	medium
365463	Ubuntu 26.04 LTS : Linux kernel (OEM) vulnerabilities (USN-8889-1)	Nessus	Ubuntu Local Security Checks	Local	medium
364688	AlmaLinux 9.2 [TuxCare] Security Update: bpftool / kernel / kernel-64k / kernel-64k-core / kernel-64k-debug / etc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1791741836)	Nessus	Alma Linux Local Security Checks	Local	critical
352548	AlmaLinux 9.6 [TuxCare] Security Update: kernel / kernel-abi-stablelists / kernel-core / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1789986443)	Nessus	Alma Linux Local Security Checks	Local	high
352273	Rocky Linux 9.6 [TuxCare] Security Update: kernel / kernel-abi-stablelists / kernel-core / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1789986443)	Nessus	Rocky Linux Local Security Checks	Local	high
334884	Linux Distros Unpatched Vulnerability : CVE-2026-68436	Nessus	Misc.	Local	medium

Detections

Analytics

CVE-2026-68436

high

Tenable Plugins

high

medium

medium

medium

critical

high

high

medium