In the Linux kernel, the following vulnerability has been resolved: net: ipip: require CAP_NET_ADMIN in the device netns for changelink ipip_changelink() operates on at most two netns, dev_net(dev) and the tunnel link netns t->net. They differ once the device is created in or moved to a netns other than the one the request runs in. The rtnl changelink path checks CAP_NET_ADMIN only against dev_net(dev), so a caller privileged there but not in t->net can rewrite a tunnel that lives in t->net. Gate ipip_changelink() on rtnl_dev_link_net_capable() at its top, before any attribute is parsed.

The remote Oracle Linux 8 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-500249 advisory.

    - inet: frags: strip GSO state from fragments before reassembly (Xinyang Ge)  [Orabug: 39974835]     {CVE-2026-80590}
    - KVM: x86/mmu: Stop needlessly making MMU pages available for TDP MMU faults (David Matlack) [Orabug:
    39830590] {CVE-2026-64561}
    - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Sean Christopherson)     [Orabug: 39830590,39832946] {CVE-2026-64561}
    - KVM: x86/mmu: Rename __direct_map() to direct_map() (David Matlack) [Orabug: 39830590] {CVE-2026-64561}
    - KVM: x86/mmu: Split out TDP MMU page fault handling (David Matlack) [Orabug: 39830590] {CVE-2026-64561}
    - KVM: Rename mmu_notifier_* to mmu_invalidate_* (Chao Peng) [Orabug: 39830590] {CVE-2026-64561}
    - KVM: x86/mmu: Document the 'rules' for using host_pfn_mapping_level() (Sean Christopherson) [Orabug:
    39830590] {CVE-2026-64561}
    - KVM: x86/mmu: Rename pte_list_{destroy,remove}() to show they zap SPTEs (Sean Christopherson) [Orabug:
    39830590] {CVE-2026-64561}
    - KVM: x86/mmu: Directly 'destroy' PTE list when recycling rmaps (Sean Christopherson) [Orabug: 39830590]     {CVE-2026-64561}
    - x86/bugs: Make Safe-RET robust against interrupt injection (Borislav Petkov) [Orabug: 39784615,39853775]     {CVE-2026-68480}
    - x86/alternatives: Disable interrupts and sync when optimizing NOPs in place (Thomas Gleixner) [Orabug:
    39784615] {CVE-2026-68480}
    - x86/alternative: Support relocations in alternatives (Peter Zijlstra) [Orabug: 39784615]     {CVE-2026-68480}
    - x86/alternative: Make debug-alternative selective (Peter Zijlstra) [Orabug: 39784615] {CVE-2026-68480}
    - x86/alternatives: Add alt_instr.flags (Borislav Petkov) [Orabug: 39784615] {CVE-2026-68480}
    - x86/asm: Provide ALTERNATIVE_3 (Peter Zijlstra) [Orabug: 39784615] {CVE-2026-68480}
    - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Thomas Gleixner) [Orabug: 39807438]     {CVE-2026-64560}
    - ALSA: seq: Fix uninitialised heap leak in snd_seq_event_dup() (Hyeongjun An) [Orabug: 39853280]     {CVE-2026-64479}
    - crypto: qat - validate RSA CRT component lengths (Giovanni Cabiddu) [Orabug: 39785885] {CVE-2026-64304}
    - btrfs: do not trim a device which is not writeable (Qu Wenruo) [Orabug: 39843586] {CVE-2026-64593}
    - bpf: Allow LPM map access from sleepable BPF programs (Vlad Poenaru) [Orabug: 39786046] {CVE-2026-64352}
    - bpf: Reject fragmented frames in devmap (Zhao Zhang) [Orabug: 39786052] {CVE-2026-64355}
    - HID: appleir: fix UAF on pending key_up_timer in remove() (Manish Khadka) [Orabug: 39786074]     {CVE-2026-64363}
    - proc: protect ptrace_may_access() with exec_update_lock (part 1) (Jann Horn) [Orabug: 39786095]     {CVE-2026-64371}
    - HID: multitouch: fix out-of-bounds bit access on mt_io_flags (Trung Nguyen) [Orabug: 39786078]     {CVE-2026-64364}
    - proc: protect ptrace_may_access() with exec_update_lock (FD links) (Jann Horn) [Orabug: 39786112]     {CVE-2026-64375}
    - smb: client: harden POSIX SID length parsing (Zihan Xi) [Orabug: 39786128] {CVE-2026-64380}
    - smb: client: mask server-provided mode to 07777 in modefromsid (Norbert Manthey) [Orabug: 39786124]     {CVE-2026-64379}
    - smb: client: resolve SWN tcon from live registrations (Michael Bommarito) [Orabug: 39786200]     {CVE-2026-64401}
    - smb: client: Fix next buffer leak in receive_encrypted_standard() (Haoxiang Li) [Orabug: 39786131]     {CVE-2026-64381}
    - Bluetooth: L2CAP: cancel pending_rx_work before taking conn->lock (Runyu Xiao) [Orabug: 39760901]     {CVE-2026-64206}
    - netfilter: ebtables: zero chainstack array (Florian Westphal) [Orabug: 39786232] {CVE-2026-64413}
    - staging: rtl8723bs: fix OOB reads in rtw_get_sec_ie(), rtw_get_wapi_ie(), and rtw_get_wps_attr()     (Alexandru Hossu) [Orabug: 39786307] {CVE-2026-64441}
    - PCI: mediatek: Fix IRQ domain leak when port fails to enable (Manivannan Sadhasivam) [Orabug: 39786366]     {CVE-2026-64461}
    - staging: rtl8723bs: fix heap buffer overflow in rtw_cfg80211_set_wpa_ie() (Alexandru Hossu) [Orabug:
    39786327] {CVE-2026-64446}
    - smb: client: restrict implied bcc[0] exemption to responses without data area (Shoichiro Miyamoto)     [Orabug: 39786332] {CVE-2026-64448}
    - vfio/pci: Release the VGA arbiter client on register_device() failure (Alex Williamson) [Orabug:
    39786409] {CVE-2026-64475}
    - ACPI: NFIT: core: Fix acpi_nfit_init() error cleanup (Rafael J. Wysocki) [Orabug: 39786502]     {CVE-2026-64510}
    - ACPI: CPPC: Suppress UBSAN warning caused by field misuse (Jeremy Linton) [Orabug: 39786508]     {CVE-2026-64512}
    - net: openvswitch: reject oversized nested action attrs (Asim Viladi Oglu Manizada) [Orabug:
    39789564,39816016,39819143] {CVE-2026-64531}
    - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (Shivam Kumar) [Orabug:
    39789573] {CVE-2026-64534}
    - sctp: validate STALE_COOKIE cause length before reading staleness (Weiming Shi) [Orabug: 39794431]     {CVE-2026-64551}
    - netfilter: bridge: fix stale prevhdr pointer in br_ip6_fragment() (Xiang Mei) [Orabug: 39794442]     {CVE-2026-64554}
    - Bluetooth: bpa10x: avoid OOB read of revision string in bpa10x_setup() (Weiming Shi) [Orabug: 39794421]     {CVE-2026-64549}
    - net: usb: net1080: validate packet_len before pad-byte access in rx_fixup (Xiang Mei) [Orabug: 39794412]     {CVE-2026-64547}
    - usbnet: gl620a: fix out-of-bounds read in genelink_rx_fixup() (Xiang Mei) [Orabug: 39794387]     {CVE-2026-64540}
    - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (Jamal Hadi Salim) [Orabug: 39787017]     {CVE-2026-64530}
    - net, bpf: check master for NULL in xdp_master_redirect() (Xiang Mei) [Orabug: 39794405] {CVE-2026-64545}
    - ipv6: Fix null-ptr-deref in fib6_nh_mtu_change(). (Xiang Mei) [Orabug: 39794379] {CVE-2026-64538}
    - drm/edid: fix OOB read in drm_parse_tiled_block() (Xiang Mei) [Orabug: 39794408] {CVE-2026-64546}
    - net: psample: fix info leak in PSAMPLE_ATTR_DATA (Jakub Kicinski) [Orabug: 39794438] {CVE-2026-64553}
    - bpf, sockmap: reject overflowing copy + len in bpf_msg_push_data() (Weiming Shi) [Orabug: 39794417]     {CVE-2026-64548}
    - crypto: asymmetric_keys - fix OOB read in pefile_digest_pe_contents (Weiming Shi) [Orabug: 39794401]     {CVE-2026-64544}
    - xfs: fail recovery on a committed log item with no regions (Weiming Shi) [Orabug: 39760871]     {CVE-2026-64187}
    - fuse: re-lock request before returning from fuse_ref_folio() (Joanne Koong) [Orabug: 39785786]     {CVE-2026-64266}
    - Input: touchwin - reset the packet index on every complete packet (Bryam Vargas) [Orabug: 39785802]     {CVE-2026-64271}
    - Input: elan_i2c - prevent division by zero and arithmetic underflow (Ranjan Kumar) [Orabug: 39785819]     {CVE-2026-64275}
    - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (Bryam Vargas) [Orabug: 39785823]     {CVE-2026-64276}
    - i2c: core: fix adapter deregistration race (Johan Hovold) [Orabug: 39785831] {CVE-2026-64279}
    - KVM: VMX: Grab vmcs12 on CR8 interception update iff vCPU is in guest mode (Sean Christopherson)     [Orabug: 39843616] {CVE-2026-64604}
    - exfat: bound uniname advance in exfat_find_dir_entry() (Bryam Vargas) [Orabug: 39785863]     {CVE-2026-64296}
    - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (Benjamin Coddington) [Orabug: 39785868]     {CVE-2026-64298}
    - tracing: Prevent out-of-bounds read in glob matching (Huihui Huang) [Orabug: 39785872] {CVE-2026-64299}
    - crypto: drbg - Fix returning success on failure in CTR_DRBG (Eric Biggers) [Orabug: 39785893]     {CVE-2026-64306}
    - crypto: pcrypt - restore callback for non-parallel fallback (Ruijie Li) [Orabug: 39785906]     {CVE-2026-64312}
    - crypto: ecc - Fix carry overflow in vli multiplication (Anastasia Tishchenko) [Orabug: 39785910]     {CVE-2026-64313}
    - isofs: bound Rock Ridge symlink components to the SL record (Bryam Vargas) [Orabug: 39785923]     {CVE-2026-64317}
    - udf: validate sparing table length as an entry count, not a byte count (Bryam Vargas) [Orabug: 39785940]     {CVE-2026-64322}
    - udf: validate VAT header length against the VAT inode size (Bryam Vargas) [Orabug: 39785944]     {CVE-2026-64323}
    - udf: validate free block extents against the partition length (Michael Bommarito) [Orabug: 39785948]     {CVE-2026-64324}
    - usb: typec: tcpm: Validate SVID index in svdm_consume_modes() (Badhri Jagan Sridharan) [Orabug:
    39785963] {CVE-2026-64330}
    - usbip: vudc: fix NULL deref in vep_dequeue() (Sam Day) [Orabug: 39785967] {CVE-2026-64331}
    - USB: ulpi: fix memory leak on registration failure (Johan Hovold) [Orabug: 39785971] {CVE-2026-64332}
    - USB: serial: digi_acceleport: fix write buffer corruption (Johan Hovold) [Orabug: 39785975]     {CVE-2026-64333}
    - USB: serial: digi_acceleport: fix hard lockup on disconnect (Johan Hovold) [Orabug: 39785979]     {CVE-2026-64334}
    - USB: serial: digi_acceleport: fix broken rx after throttle (Johan Hovold) [Orabug: 39785983]     {CVE-2026-64335}
    - USB: serial: keyspan_pda: fix information leak (Johan Hovold) [Orabug: 39785987] {CVE-2026-64336}
    - USB: misc: uss720: unregister parport on probe failure (Myeonghun Pak) [Orabug: 39785994]     {CVE-2026-64338}
    - USB: legousbtower: fix use-after-free on disconnect race (Johan Hovold) [Orabug: 39785999]     {CVE-2026-64340}
    - USB: iowarrior: fix use-after-free on disconnect (Johan Hovold) [Orabug: 39786007] {CVE-2026-64342}
    - USB: ldusb: fix use-after-free on disconnect race (Johan Hovold) [Orabug: 39786012] {CVE-2026-64343}
    - USB: idmouse: fix use-after-free on disconnect race (Johan Hovold) [Orabug: 39786017] {CVE-2026-64344}
    - usb: gadget: udc: Fix use-after-free in gadget_match_driver (Jimmy Hu) [Orabug: 39786026]     {CVE-2026-64346}
    - usb: gadget: composite: fix dead empty check in the USB_DT_OTG handler (Maoyi Xie) [Orabug: 39786030]     {CVE-2026-64347}
    - net: usb: kalmia: bound RX frame length in kalmia_rx_fixup() (Maoyi Xie) [Orabug: 39786042]     {CVE-2026-64351}
    - HID: lg-g15: cancel pending work on remove to fix a use-after-free (Maoyi Xie) [Orabug: 39786071]     {CVE-2026-64362}
    - HID: wacom: stop hardware after post-start probe failures (Myeonghun Pak) [Orabug: 39859299]     {CVE-2026-68091}
    - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Xu Wang) [Orabug: 39786091]     {CVE-2026-64370}
    - cpufreq: pcc: fix use-after-free and double free in _OSC evaluation (Yuho Choi) [Orabug: 39786100]     {CVE-2026-64372}
    - cpufreq: Fix hotplug-suspend race during reboot (Tianxiang Chen) [Orabug: 39786104] {CVE-2026-64373}
    - sched/rt: Have RT_PUSH_IPI be default off for non PREEMPT_RT (Steven Rostedt) [Orabug: 39786108]     {CVE-2026-64374}
    - net: Drop the lock in skb_may_tx_timestamp() (Sebastian Andrzej Siewior) [Orabug: 39331701]     {CVE-2026-43216}
    - Bluetooth: L2CAP: validate option length before reading conf opt value (Muhammad Bilal) [Orabug:
    39786205] {CVE-2026-64403}
    - Bluetooth: fix UAF in bt_accept_dequeue() (Yousef Alhouseen) [Orabug: 39786578] {CVE-2026-64406}
    - Bluetooth: bnep: pin L2CAP connection during netdev registration (Yousef Alhouseen) [Orabug: 39786217]     {CVE-2026-64408}
    - netfilter: ebtables: terminate table name before find_table_lock() (Xiang Mei) [Orabug: 39786224]     {CVE-2026-64411}
    - netfilter: ebtables: module names must be null-terminated (Florian Westphal) [Orabug: 39786228]     {CVE-2026-64412}
    - mfd: cros_ec: Delay dev_set_drvdata() until probe success (Andrei Kuchynski) [Orabug: 39786248]     {CVE-2026-64420}
    - net: ipv4: bound TCP reordering sysctl writes and MTU probe sizes (Wyatt Feng) [Orabug: 39786254]     {CVE-2026-64422}
    - ipv4: igmp: remove multicast group from hash table on device destruction (Yuyang Huang) [Orabug:
    39786259] {CVE-2026-64423}
    - io_uring/io-wq: re-check IO_WQ_BIT_EXIT for each linked work item (Runyu Xiao) [Orabug: 39786574]     {CVE-2026-64425}
    - audit: Fix data races of skb_queue_len() readers on audit_queue (Chi Wang) [Orabug: 39786289]     {CVE-2026-64435}
    - net: af_key: initialize alg_key_len for IPComp states (Zijing Yin) [Orabug: 39786293] {CVE-2026-64436}
    - crypto: amlogic - avoid double cleanup in meson_crypto_probe() (Dawei Feng) [Orabug: 39843604]     {CVE-2026-64599}
    - staging: rtl8723bs: fix OOB write in HT_caps_handler() (Alexandru Hossu) [Orabug: 39786303]     {CVE-2026-64440}
    - staging: rtl8723bs: fix OOB reads in is_ap_in_tkip() IE loop (Alexandru Hossu) [Orabug: 39789581]     {CVE-2026-64536}
    - staging: rtl8723bs: fix OOB reads in IE loops in issue_assocreq() and join_cmd_hdl() (Alexandru Hossu)     [Orabug: 39786311] {CVE-2026-64442}
    - staging: rtl8723bs: fix OOB read in update_beacon_info() IE loop (Alexandru Hossu) [Orabug: 39786315]     {CVE-2026-64443}
    - staging: rtl8723bs: fix OOB read in OnAssocRsp() IE loop (Alexandru Hossu) [Orabug: 39786319]     {CVE-2026-64444}
    - staging: rtl8723bs: fix WEP length underflow and OOB read in OnAuth() (Alexandru Hossu) [Orabug:
    39786323] {CVE-2026-64445}
    - tipc: fix out-of-bounds read in broadcast Gap ACK blocks (Samuel Page) [Orabug: 39786340]     {CVE-2026-64450}
    - 6lowpan: fix NHC entry use-after-free on error path (Yizhou Zhao) [Orabug: 39786344] {CVE-2026-64452}
    - usb: dwc3: run gadget disconnect from sleepable suspend context (Runyu Xiao) [Orabug: 39786349]     {CVE-2026-64454}
    - USB: chaoskey: Fix slab-use-after-free in chaoskey_release() (Alan Stern) [Orabug: 39786352]     {CVE-2026-64455}
    - hwrng: virtio: clamp device-reported used.len at copy_data() (Michael Bommarito) [Orabug: 39786356]     {CVE-2026-64456}
    - netfilter: ipset: fix race between dump and ip_set_list resize (Xiang Mei) [Orabug: 39760883]     {CVE-2026-64189}
    - usb: xhci: Fix sleep in atomic context in xhci_free_streams() (Lianqin Hu) [Orabug: 39786379]     {CVE-2026-64465}
    - Bluetooth: btusb: fix use-after-free on marvell probe failure (Johan Hovold) [Orabug: 39786393]     {CVE-2026-64470}
    - Bluetooth: btusb: fix use-after-free on registration failure (Johan Hovold) [Orabug: 39786397]     {CVE-2026-64471}
    - ALSA: usb-audio: avoid kobject path lookup in DualSense match (Darvell Long) [Orabug: 39786416]     {CVE-2026-64478}
    - ALSA: firewire: isight: bound the sample count to the packet payload (Maoyi Xie) [Orabug: 39786428]     {CVE-2026-64483}
    - ALSA: es1938: check snd_ctl_new1() return value (Zhao Dongdong) [Orabug: 39786432] {CVE-2026-64484}
    - ALSA: caiaq: fix out-of-bounds read in the Traktor Kontrol S4 input parser (Maoyi Xie) [Orabug:
    39786439] {CVE-2026-64487}
    - iio: event: Fix event FIFO reset race (Lars-Peter Clausen) [Orabug: 39786462] {CVE-2026-64496}
    - iio: accel: kxsd9: fix runtime PM imbalance on write_raw() error (Biren Pandya) [Orabug: 39786478]     {CVE-2026-64503}
    - iio: accel: bmc150: clamp the device-reported FIFO frame count (Bryam Vargas) [Orabug: 39786482]     {CVE-2026-64504}
    - NFSv4/flexfiles: reject zero filehandle version count (Michael Bommarito) [Orabug: 39753894]     {CVE-2026-53392}
    - fbdev: fbcon: fix out-of-bounds read in err_out of fbcon_do_set_font() (Mingyu Wang) [Orabug: 39753924]     {CVE-2026-53402}
    - i2c: core: fix adapter registration race (Johan Hovold) [Orabug: 39753916] {CVE-2026-53400}
    - block: Avoid mounting the bdev pseudo-filesystem in userspace (Denis Arefev) [Orabug: 39753985]     {CVE-2026-63810}
    - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Maoyi Xie) [Orabug: 39754045]     {CVE-2026-63829}
    - net: skmsg: preserve sg.copy across SG transforms (Yiming Qian) [Orabug: 39754049] {CVE-2026-63830}
    - netfilter: nf_tables: restore set elements when delete set fails (Pablo Neira Ayuso) [Orabug: 36598010]     {CVE-2024-27012}
    - KVM: Replace guest-triggerable BUG_ON() in ioeventfd datamatch with get_unaligned() (Sean     Christopherson) [Orabug: 39753972] {CVE-2026-63806}
    - userfaultfd: gate must_wait writability check on pte_present() (Kiryl Shutsemau) [Orabug: 39786515]     {CVE-2026-64514}
    - nfsd: reset write verifier on deferred writeback errors (Jeff Layton) [Orabug: 39753898]     {CVE-2026-53393}
    - nfsd: release layout stid on setlease failure (Chris Mason) [Orabug: 39753912] {CVE-2026-53399}
    - nvmet-tcp: fix race between ICReq handling and queue teardown (Chaitanya Kulkarni) [Orabug: 39460310]     {CVE-2026-46135}
    - net: tap: set skb->dev before parsing virtio net header in tap_get_user_xdp() (Dongli Zhang) [Orabug:
    39558744] {CVE-2026-74684}
    - net/rds: zero per-item info buffer before handing it to visitors (Michael Bommarito) [Orabug:
    39621715,39638197] {CVE-2026-52995}
    - x86/sev: Evict cache lines during SNP memory validation (Tom Lendacky) [Orabug: 38334919]     {CVE-2025-38560}
    - xfs: resample the data fork mapping after cycling ILOCK (Darrick Wong) [Orabug: 39776791]     {CVE-2026-64600}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of kernel installed on the remote host is prior to 5.10.265-265.1078. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.10-2026-130 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    tls: separate no-async decryption request handling from async (CVE-2024-58240)

    In the Linux kernel, the following vulnerability has been resolved:

    xsk: Fix race condition in AF_XDP generic RX path (CVE-2025-37920)

    In the Linux kernel, the following vulnerability has been resolved:

    libceph: Fix slab-out-of-bounds access in auth message processing (CVE-2026-46119)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf: Fix ld_{abs,ind} failure path analysis in subprogs (CVE-2026-53090)

    In the Linux kernel, the following vulnerability has been resolved:

    nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CVE-2026-64320)

    In the Linux kernel, the following vulnerability has been resolved:

    tipc: fix use-after-free of the discoverer in tipc_disc_rcv() (CVE-2026-64543)

    In the Linux kernel, the following vulnerability has been resolved:

    KVM: nVMX: Hide shadow VMCS right after VMCLEAR (CVE-2026-64562)

    In the Linux kernel, the following vulnerability has been resolved:

    rhashtable: clear stale iter->p on table restart (CVE-2026-64563)

    In the Linux kernel, the following vulnerability has been resolved:

    sctp: don't free the ASCONF's own transport in DEL-IP processing (CVE-2026-64564)

    In the Linux kernel, the following vulnerability has been resolved:

    btrfs: reject free space cache with more entries than pages (CVE-2026-64567)

    In the Linux kernel, the following vulnerability has been resolved:

    ipv4: fib: free fib_alias with kfree_rcu() on insert error path (CVE-2026-64572)

    In the Linux kernel, the following vulnerability has been resolved:

    xfrm: policy: preallocate inexact bins before xfrm_hash_rebuild reinsert (CVE-2026-64579)

    In the Linux kernel, the following vulnerability has been resolved:

    xfrm: fix sk_dst_cache double-free in xfrm_user_policy() (CVE-2026-64581)

    In the Linux kernel, the following vulnerability has been resolved:

    RDMA/rxe: Fix a use-after-free problem in rxe_mmap (CVE-2026-64582)

    In the Linux kernel, the following vulnerability has been resolved:

    tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (CVE-2026-68117)

    In the Linux kernel, the following vulnerability has been resolved:

    pppoe: reload header pointer after dev_hard_header() (CVE-2026-68121)

    In the Linux kernel, the following vulnerability has been resolved:

    openvswitch: fix GSO userspace truncation underflow (CVE-2026-68123)

    In the Linux kernel, the following vulnerability has been resolved:

    ila: reload IPv6 header after pskb_may_pull in checksum adjust (CVE-2026-68127)

    In the Linux kernel, the following vulnerability has been resolved:

    rbd: Reset positive result codes to zero in object map update path (CVE-2026-68131)

    In the Linux kernel, the following vulnerability has been resolved:

    net/sched: serialize qdisc_rtab_list against concurrent get/put (CVE-2026-68138)

    In the Linux kernel, the following vulnerability has been resolved:

    geneve: require CAP_NET_ADMIN in the device netns for changelink (CVE-2026-68142)

    In the Linux kernel, the following vulnerability has been resolved:

    net: slip: serialize receive against buffer reallocation (CVE-2026-68143)

    In the Linux kernel, the following vulnerability has been resolved:

    libceph: remove debugfs files before client teardown (CVE-2026-68153)

    In the Linux kernel, the following vulnerability has been resolved:

    libceph: reject zero bucket types in crush_decode (CVE-2026-68154)

    In the Linux kernel, the following vulnerability has been resolved:

    libceph: Reject monmaps advertising zero monitors (CVE-2026-68155)

    In the Linux kernel, the following vulnerability has been resolved:

    libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CVE-2026-68156)

    In the Linux kernel, the following vulnerability has been resolved:

    libceph: guard missing CRUSH type name lookup (CVE-2026-68157)

    In the Linux kernel, the following vulnerability has been resolved:

    libceph: Fix multiplication overflow in decode_new_up_state_weight() (CVE-2026-68158)

    In the Linux kernel, the following vulnerability has been resolved:

    ceph: fix pre-auth out-of-bounds read on snaptrace in ceph_handle_caps() (CVE-2026-68160)

    In the Linux kernel, the following vulnerability has been resolved:

    cdrom: fix stack out-of-bounds read in CDROMVOLCTRL (CVE-2026-68184)

    In the Linux kernel, the following vulnerability has been resolved:

    binfmt_misc: set have_execfd only once the interpreter is opened (CVE-2026-68186)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf, sockmap: Fix cork use-after-free in tcp_bpf_sendmsg() (CVE-2026-68284)

    In the Linux kernel, the following vulnerability has been resolved:

    tipc: fix u16 MTU truncation in media and bearer MTU validation (CVE-2026-68297)

    In the Linux kernel, the following vulnerability has been resolved:

    vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CVE-2026-68299)

    In the Linux kernel, the following vulnerability has been resolved:

    sctp: auth: verify auth requirement when auth_chunk is NULL (CVE-2026-68300)

    In the Linux kernel, the following vulnerability has been resolved:

    tipc: fix infinite loop in __tipc_nl_compat_dumpit (CVE-2026-68313)

    In the Linux kernel, the following vulnerability has been resolved:

    sctp: validate stream count in sctp_process_strreset_inreq() (CVE-2026-68315)

    In the Linux kernel, the following vulnerability has been resolved:

    sctp: fix auth_chunk_list capacity check in sctp_auth_ep_add_chunkid (CVE-2026-68320)

    In the Linux kernel, the following vulnerability has been resolved:

    rds: Fix inet6_addr_lst NULL dereference when IPv6 is disabled (CVE-2026-68322)

    In the Linux kernel, the following vulnerability has been resolved:

    iommu/amd: Bound the early ACPI HID map (CVE-2026-68325)

    In the Linux kernel, the following vulnerability has been resolved:

    rds: drop incoming messages that cross network namespace boundaries (CVE-2026-68335)

    In the Linux kernel, the following vulnerability has been resolved:

    net/packet: avoid fanout hook re-registration after unregister (CVE-2026-68338)

    In the Linux kernel, the following vulnerability has been resolved:

    USB: serial: io_edgeport: cap received transmit credits (CVE-2026-68365)

    In the Linux kernel, the following vulnerability has been resolved:

    sctp: fix auth_hmacs array size in struct sctp_cookie (CVE-2026-68376)

    In the Linux kernel, the following vulnerability has been resolved:

    net/sched: act_tunnel_key: Defer dst_release to RCU callback (CVE-2026-68377)

    In the Linux kernel, the following vulnerability has been resolved:

    smb/client: handle overlapping allocated ranges in fallocate (CVE-2026-68388)

    In the Linux kernel, the following vulnerability has been resolved:

    ppp: defer channel free to an RCU grace period to fix pppol2tp RX UAF (CVE-2026-68398)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf: Fix UAF in sock clone early bailouts (CVE-2026-68399)

    In the Linux kernel, the following vulnerability has been resolved:

    IB/mad: Drop unmatched RMPP responses before reassembly (CVE-2026-68425)

    In the Linux kernel, the following vulnerability has been resolved:

    KVM: x86/mmu: Fix use-after-free on vendor module reload (CVE-2026-68428)

    In the Linux kernel, the following vulnerability has been resolved:

    vxlan: require CAP_NET_ADMIN in the device netns for changelink (CVE-2026-68432)

    In the Linux kernel, the following vulnerability has been resolved:

    libceph: bound get_version reply decode to front len (CVE-2026-68433)

    In the Linux kernel, the following vulnerability has been resolved:

    x86/bugs: Make Safe-RET robust against interrupt injection (CVE-2026-68480)

    In the Linux kernel, the following vulnerability has been resolved:

    macsec: don't read an unset MAC header in macsec_encrypt() (CVE-2026-72019)

    In the Linux kernel, the following vulnerability has been resolved:

    net: ip6_tunnel: require CAP_NET_ADMIN in the device netns for changelink (CVE-2026-72051)

    In the Linux kernel, the following vulnerability has been resolved:

    net: ipip: require CAP_NET_ADMIN in the device netns for changelink (CVE-2026-72053)

    In the Linux kernel, the following vulnerability has been resolved:

    cpu: hotplug: Bound hotplug states sysfs output (CVE-2026-72066)

    In the Linux kernel, the following vulnerability has been resolved:

    can: bcm: add missing device refcount for CAN filter removal (CVE-2026-72113)

    In the Linux kernel, the following vulnerability has been resolved:

    can: bcm: validate frame length in bcm_rx_setup() for RTR replies (CVE-2026-72114)

    In the Linux kernel, the following vulnerability has been resolved:

    can: bcm: track a single source interface for ANYDEV timeout/throttle ops (CVE-2026-72115)

    In the Linux kernel, the following vulnerability has been resolved:

    can: bcm: fix stale rx/tx ops after device removal (CVE-2026-72116)

    In the Linux kernel, the following vulnerability has been resolved:

    can: bcm: fix data race on rx_stamp/rx_ifindex in bcm_rx_handler() (CVE-2026-72117)

    In the Linux kernel, the following vulnerability has been resolved:

    can: bcm: fix CAN frame rx/tx statistics (CVE-2026-72118)

    In the Linux kernel, the following vulnerability has been resolved:

    can: bcm: extend bcm_tx_lock usage for data and timer updates (CVE-2026-72119)

    In the Linux kernel, the following vulnerability has been resolved:

    can: bcm: add locking when updating filter and timer values (CVE-2026-72121)

    In the Linux kernel, the following vulnerability has been resolved:

    can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CVE-2026-72123)

    In the Linux kernel, the following vulnerability has been resolved:

    ipv6: fib6: fix NULL deref in fib6_walk_continue() on multi-batch dump (CVE-2026-72392)

    In the Linux kernel, the following vulnerability has been resolved:

    tipc: reject inverted service ranges from peer bindings (CVE-2026-74281)

    In the Linux kernel, the following vulnerability has been resolved:

    net: openvswitch: fix skb leak on flow key update failure during ct (CVE-2026-74464)

    In the Linux kernel, the following vulnerability has been resolved:

    net: openvswitch: fix potential UAF on meter attach failure (CVE-2026-74465)

    In the Linux kernel, the following vulnerability has been resolved:

    sctp: prevent peer transport count overflow (CVE-2026-74469)

    In the Linux kernel, the following vulnerability has been resolved:

    tracing: Check return value of __register_event() in trace_module_add_events() (CVE-2026-74471)

    In the Linux kernel, the following vulnerability has been resolved:

    vxlan: use pskb_network_may_pull() in route_shortcircuit() (CVE-2026-74473)

    In the Linux kernel, the following vulnerability has been resolved:

    vxlan: use neigh_ha_snapshot() in route_shortcircuit() (CVE-2026-74475)

    In the Linux kernel, the following vulnerability has been resolved:

    net: bridge: stop fast-leave after deleting a port group (CVE-2026-74480)

    In the Linux kernel, the following vulnerability has been resolved:

    mm/page_reporting: use system_freezable_wq to fix UAF during suspend (CVE-2026-74481)

    In the Linux kernel, the following vulnerability has been resolved:

    mm/huge_memory: unlock i_mmap_rwsem before releasing after-split folios (CVE-2026-74482)

    In the Linux kernel, the following vulnerability has been resolved:

    binfmt_misc: reject a flag character as the field delimiter (CVE-2026-74485)

    In the Linux kernel, the following vulnerability has been resolved:

    tipc: avoid use-after-free in poll trace queue dumps (CVE-2026-74490)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: ipset: do not update comments from kernel-side hash adds (CVE-2026-74492)

    In the Linux kernel, the following vulnerability has been resolved:

    igbvf: Fix leak in TX DMA error cleanup (CVE-2026-74495)

    In the Linux kernel, the following vulnerability has been resolved:

    audit: fix potential use-after-free in audit_del_rule() (CVE-2026-74512)

    In the Linux kernel, the following vulnerability has been resolved:

    mm/hugetlb: fix list corruption in allocate_file_region_entries() (CVE-2026-74518)

    In the Linux kernel, the following vulnerability has been resolved:

    pinctrl: devicetree: don't free uninitialized dev_name on error path (CVE-2026-74519)

    In the Linux kernel, the following vulnerability has been resolved:

    qede: sync udp_tunnel ports outside qede_lock in the recovery path (CVE-2026-74523)

    In the Linux kernel, the following vulnerability has been resolved:

    hwmon: (adt7470) Fix busy-loop and I2C flooding in update thread (CVE-2026-74547)

    In the Linux kernel, the following vulnerability has been resolved:

    hwmon: (nct6775-core) Prevent access to unsupported weight registers (CVE-2026-74549)

    In the Linux kernel, the following vulnerability has been resolved:

    scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CVE-2026-74556)

    In the Linux kernel, the following vulnerability has been resolved:

    scsi: libiscsi: Fix stale-data leak into the SCSI sense buffer (CVE-2026-74557)

    In the Linux kernel, the following vulnerability has been resolved:

    rds: tcp: hold the RCU lock across ipv6_chk_addr() in rds_tcp_laddr_check() (CVE-2026-74563)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: xt_hashlimit: validate hashtable supports XT_HASHLIMIT_RATE_MATCH (CVE-2026-74564)

    In the Linux kernel, the following vulnerability has been resolved:

    keys: make keyring key-chunk byte order agree with keyring_diff_objects() (CVE-2026-74566)

    In the Linux kernel, the following vulnerability has been resolved:

    keys: fix out-of-bounds read in keyring_get_key_chunk() (CVE-2026-74567)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CVE-2026-74569)

    In the Linux kernel, the following vulnerability has been resolved:

    net: mpls: initialize rtm_tos in mpls_getroute() (CVE-2026-74577)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: nft_payload: fix mask build for partial field offload (CVE-2026-74579)

    In the Linux kernel, the following vulnerability has been resolved:

    vhost: reset the vring metadata cache on vring reconfiguration (CVE-2026-74580)

    In the Linux kernel, the following vulnerability has been resolved:

    net: ipv6: clear suppressed fib6 rule result (CVE-2026-74581)

    In the Linux kernel, the following vulnerability has been resolved:

    net/sched: cls_route: fix fastmap use-after-free on filter (CVE-2026-74583)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: bridge: release template ct on non-IP path (CVE-2026-74625)

    In the Linux kernel, the following vulnerability has been resolved:

    serial: 8250_dma: Clear stale RX state on shutdown (CVE-2026-74654)

    In the Linux kernel, the following vulnerability has been resolved:

    futex: Prevent robust futex exit race some more (CVE-2026-74658)

    In the Linux kernel, the following vulnerability has been resolved:

    net: openvswitch: reallocate update replies for mismatched IDs (CVE-2026-74664)

    In the Linux kernel, the following vulnerability has been resolved:

    bnxt_en: Disable EOP for TPA on all chips to prevent data corruption (CVE-2026-74697)

    In the Linux kernel, the following vulnerability has been resolved:

    udp: fix potential use-after-free in tunnel segmentation (CVE-2026-74705)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf: Preserve pointer state for commuted arithmetic (CVE-2026-74720)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - net: ipip: require CAP_NET_ADMIN in the device netns for changelink ipip_changelink() operates on at most     two netns, dev_net(dev) and the tunnel link netns t->net. They differ once the device is created in or     moved to a netns other than the one the request runs in. The rtnl changelink path checks CAP_NET_ADMIN     only against dev_net(dev), so a caller privileged there but not in t->net can rewrite a tunnel that lives     in t->net. Gate ipip_changelink() on rtnl_dev_link_net_capable() at its top, before any attribute is     parsed. (CVE-2026-72053)

Note that Nessus relies on the presence of the package as reported by the vendor.

An update of the linux package has been released.

ID	Name	Product	Family	Type	Severity
343049	Oracle Linux 10 / 9 : Unbreakable Enterprise kernel (ELSA-2026-500248)	Nessus	Oracle Linux Local Security Checks	Local	high
343048	Oracle Linux 8 / 9 : Unbreakable Enterprise kernel (ELSA-2026-500249)	Nessus	Oracle Linux Local Security Checks	Local	high
341880	Amazon Linux 2023 : bpftool6.18, kernel6.18, kernel6.18-devel (ALAS2023-2026-2071)	Nessus	Amazon Linux Local Security Checks	Local	medium
341859	Amazon Linux 2 : kernel, --advisory ALAS2KERNEL-5.10-2026-130 (ALASKERNEL-5.10-2026-130)	Nessus	Amazon Linux Local Security Checks	Local	high
337239	Amazon Linux 2023 : bpftool6.12, kernel6.12, kernel6.12-devel (ALAS2023-2026-2057)	Nessus	Amazon Linux Local Security Checks	Local	medium
337226	Amazon Linux 2023 : bpftool, kernel, kernel-devel (ALAS2023-2026-2058)	Nessus	Amazon Linux Local Security Checks	Local	medium
335584	Linux Distros Unpatched Vulnerability : CVE-2026-72053	Nessus	Misc.	Local	high
334784	Photon OS 5.0: Linux PHSA-2026-5.0-92-0952	Nessus	PhotonOS Local Security Checks	Local	high

Detections

Analytics

CVE-2026-72053

high

Tenable Plugins

high

high

medium

high

medium

medium

high

high