In the Linux kernel, the following vulnerability has been resolved: fs/resctrl: Fix use-after-free during unmount During unmount or failure teardown all mon_data structures that contain monitoring event file private data are freed after which kernfs nodes are removed. However, the RDT_DELETED flag is never set for the statically allocated default resource group. A concurrent reader of an event file associated with the default resource group may, after dropping kernfs active protection, block on rdtgroup_mutex while unmount proceeds to free the file private data and destroy the kernfs node without waiting for the reader. When the mutex is released, the reader wakes up, observes that RDT_DELETED is not set for the default group, and dereferences the already-freed file private data. The scenario can be depicted as follows: CPU0 CPU1 /* * Default resource group's * monitoring data accessible via * kernfs file with kernfs_node::priv * pointing to a struct mon_data. * User opens the file for reading. */ rdtgroup_mondata_show() /* arch encounters fatal error */ rdtgroup_kn_lock_live() resctrl_exit() atomic_inc(&rdtgroup_default.waitcount) cpus_read_lock() kernfs_break_active_protection(kn) mutex_lock(&rdtgroup_mutex) cpus_read_lock() resctrl_fs_teardown() mutex_lock(&rdtgroup_mutex) rmdir_all_sub() mon_put_kn_priv() /* Delete all mon_data structures */ rdtgroup_destroy_root() kernfs_destroy_root() rdtgroup_default.kn = NULL mutex_unlock(&rdtgroup_mutex) /* * rdtgroup_default.flags is empty so * rdtgroup_kn_lock_live() returns * &rdtgroup_default */ md = of->kn->priv; /* md points to freed mon_data */ Set RDT_DELETED for the default group unconditionally since the flag does not lead to the freeing of this statically allocated group. Do not allow a new resctrl mount if there are any waiters on default group of previous mount. A new mount will re-initialize the default group that would appear to waiters from previous mount as though the default group is accessible causing them to access the mon_data structures from the previous mount that have been removed.

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-2026_95370 advisory.

    * kernel: net/smc: fix UAF in smc_cdc_rx_handler() by pinning the socket (CVE-2026-64541)

    * kernel: sctp: avoid auth_enable sysctl UAF during netns teardown (CVE-2026-68162)

    * kernel: s390/zcrypt: Validate length for CCA AES cipher key requests (CVE-2026-68452)

    * kernel: s390/zcrypt: Validate length for CCA ECC private key requests (CVE-2026-68451)

    * kernel: sunrpc: pin svc_xprt across the asynchronous TLS handshake callback (CVE-2026-72222)

    * kernel: sunrpc: wait for in-flight TLS handshake callback when cancel loses race (CVE-2026-72221)

    * kernel: fs/resctrl: Fix use-after-free during unmount (CVE-2026-72080)

    * kernel: sctp: keep chunk->transport in step with the list it is queued on (CVE-2026-74588)

    * kernel: sctp: clear new_transport when removing a peer (CVE-2026-74586)

    * kernel: sctp: validate cookie AUTH state before use (CVE-2026-74752)

    * kernel: s390/vfio_ccw: Cancel existing workqueues (CVE-2026-80553)

    * kernel: powerpc/pseries: papr-phy-attest - validate cmd.length, plug mem leak (CVE-2026-80571)

    * kernel: s390/qeth: validate user buffer length in SNMP and ARP query ioctls (CVE-2026-80584)

    * kernel: sctp: stop processing a packet once its association is deleted (CVE-2026-89479)

    * kernel: openvswitch: Fix CT limit teardown use-after-free (CVE-2026-89488)

    * kernel: s390/boot: Avoid IPL parameter append past command line (CVE-2026-98403)

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Rocky Linux 10.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-2026_95367 advisory.

    * kernel: writeback: fix race between cgroup_writeback_umount() and inode_switch_wbs() (CVE-2026-64378)

    * kernel: sunrpc: pin svc_xprt across the asynchronous TLS handshake callback (CVE-2026-72222)

    * kernel: sunrpc: wait for in-flight TLS handshake callback when cancel loses race (CVE-2026-72221)

    * kernel: fs/resctrl: Fix use-after-free during unmount (CVE-2026-72080)

    * kernel: sctp: clear new_transport when removing a peer (CVE-2026-74586)

    * kernel: openvswitch: Fix CT limit teardown use-after-free (CVE-2026-89488)

    * kernel: PCI/sysfs: Add lockdown checks to legacy I/O and memory handlers (CVE-2026-90315)

    * kernel: kernel: xfs: Unauthorized data modification via improper file size exchange handling     (CVE-2026-98974)

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:95367 advisory.

    * kernel: writeback: fix race between cgroup_writeback_umount() and inode_switch_wbs() (CVE-2026-64378)

    * kernel: sunrpc: pin svc_xprt across the asynchronous TLS handshake callback (CVE-2026-72222)

    * kernel: sunrpc: wait for in-flight TLS handshake callback when cancel loses race (CVE-2026-72221)

    * kernel: fs/resctrl: Fix use-after-free during unmount (CVE-2026-72080)

    * kernel: sctp: clear new_transport when removing a peer (CVE-2026-74586)

    * kernel: openvswitch: Fix CT limit teardown use-after-free (CVE-2026-89488)

    * kernel: PCI/sysfs: Add lockdown checks to legacy I/O and memory handlers (CVE-2026-90315)

    * kernel: kernel: xfs: Unauthorized data modification via improper file size exchange handling     (CVE-2026-98974)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:95370 advisory.

    * kernel: net/smc: fix UAF in smc_cdc_rx_handler() by pinning the socket (CVE-2026-64541)

    * kernel: sctp: avoid auth_enable sysctl UAF during netns teardown (CVE-2026-68162)

    * kernel: s390/zcrypt: Validate length for CCA AES cipher key requests (CVE-2026-68452)

    * kernel: s390/zcrypt: Validate length for CCA ECC private key requests (CVE-2026-68451)

    * kernel: sunrpc: pin svc_xprt across the asynchronous TLS handshake callback (CVE-2026-72222)

    * kernel: sunrpc: wait for in-flight TLS handshake callback when cancel loses race (CVE-2026-72221)

    * kernel: fs/resctrl: Fix use-after-free during unmount (CVE-2026-72080)

    * kernel: sctp: keep chunk->transport in step with the list it is queued on (CVE-2026-74588)

    * kernel: sctp: clear new_transport when removing a peer (CVE-2026-74586)

    * kernel: sctp: validate cookie AUTH state before use (CVE-2026-74752)

    * kernel: s390/vfio_ccw: Cancel existing workqueues (CVE-2026-80553)

    * kernel: powerpc/pseries: papr-phy-attest - validate cmd.length, plug mem leak (CVE-2026-80571)

    * kernel: s390/qeth: validate user buffer length in SNMP and ARP query ioctls (CVE-2026-80584)

    * kernel: sctp: stop processing a packet once its association is deleted (CVE-2026-89479)

    * kernel: openvswitch: Fix CT limit teardown use-after-free (CVE-2026-89488)

    * kernel: s390/boot: Avoid IPL parameter append past command line (CVE-2026-98403)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:95367 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: writeback: fix race between cgroup_writeback_umount() and inode_switch_wbs() (CVE-2026-64378)

    * kernel: sunrpc: pin svc_xprt across the asynchronous TLS handshake callback (CVE-2026-72222)

    * kernel: sunrpc: wait for in-flight TLS handshake callback when cancel loses race (CVE-2026-72221)

    * kernel: fs/resctrl: Fix use-after-free during unmount (CVE-2026-72080)

    * kernel: sctp: clear new_transport when removing a peer (CVE-2026-74586)

    * kernel: openvswitch: Fix CT limit teardown use-after-free (CVE-2026-89488)

    * kernel: PCI/sysfs: Add lockdown checks to legacy I/O and memory handlers (CVE-2026-90315)

    * kernel: kernel: xfs: Unauthorized data modification via improper file size exchange handling     (CVE-2026-98974)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:95370 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: net/smc: fix UAF in smc_cdc_rx_handler() by pinning the socket (CVE-2026-64541)

    * kernel: sctp: avoid auth_enable sysctl UAF during netns teardown (CVE-2026-68162)

    * kernel: s390/zcrypt: Validate length for CCA AES cipher key requests (CVE-2026-68452)

    * kernel: s390/zcrypt: Validate length for CCA ECC private key requests (CVE-2026-68451)

    * kernel: sunrpc: pin svc_xprt across the asynchronous TLS handshake callback (CVE-2026-72222)

    * kernel: sunrpc: wait for in-flight TLS handshake callback when cancel loses race (CVE-2026-72221)

    * kernel: fs/resctrl: Fix use-after-free during unmount (CVE-2026-72080)

    * kernel: sctp: keep chunk->transport in step with the list it is queued on (CVE-2026-74588)

    * kernel: sctp: clear new_transport when removing a peer (CVE-2026-74586)

    * kernel: sctp: validate cookie AUTH state before use (CVE-2026-74752)

    * kernel: s390/vfio_ccw: Cancel existing workqueues (CVE-2026-80553)

    * kernel: powerpc/pseries: papr-phy-attest - validate cmd.length, plug mem leak (CVE-2026-80571)

    * kernel: s390/qeth: validate user buffer length in SNMP and ARP query ioctls (CVE-2026-80584)

    * kernel: sctp: stop processing a packet once its association is deleted (CVE-2026-89479)

    * kernel: openvswitch: Fix CT limit teardown use-after-free (CVE-2026-89488)

    * kernel: s390/boot: Avoid IPL parameter append past command line (CVE-2026-98403)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-95370 advisory.

    - s390/qeth: validate user buffer length in SNMP and ARP query ioctls (Jan Polensky) [RHEL-295101]     {CVE-2026-80584}
    - s390/vfio_ccw: Cancel existing workqueues (Jan Polensky) [RHEL-295162] {CVE-2026-80553}
    - s390/zcrypt: Validate length for CCA AES cipher key requests (Jan Polensky) [RHEL-297856]     {CVE-2026-68452}
    - s390/zcrypt: Validate length for CCA ECC private key requests (Jan Polensky) [RHEL-297864]     {CVE-2026-68451}
    - net/smc: fix UAF in smc_cdc_rx_handler() by pinning the socket (Jan Polensky) [RHEL-298271]     {CVE-2026-64541}
    - sunrpc: wait for in-flight TLS handshake callback when cancel loses race (Olga Kornievskaia)     [RHEL-283645] {CVE-2026-72221}
    - sunrpc: pin svc_xprt across the asynchronous TLS handshake callback (Olga Kornievskaia) [RHEL-283259]     {CVE-2026-72222}
    - fs/resctrl: Fix use-after-free during unmount (Dennis Chen) [RHEL-296700] {CVE-2026-72080}
    - powerpc/pseries: papr-phy-attest - validate cmd.length, plug mem leak (Mamatha Inamdar) [RHEL-295113]     {CVE-2026-80571}
    - s390/boot: Avoid IPL parameter append past command line (Jan Polensky) [RHEL-292349] {CVE-2026-98403}
    - s390/boot: Add sized_strscpy() to enable strscpy() usage (Jan Polensky) [RHEL-292349] {CVE-2026-98403}
    - sctp: clear new_transport when removing a peer (CKI Backport Bot) [RHEL-275363] {CVE-2026-74586}
    - openvswitch: Fix CT limit teardown use-after-free (Timothy Redaelli) [RHEL-263551] {CVE-2026-89488}
    - sctp: validate cookie AUTH state before use (Xin Long) [RHEL-254284] {CVE-2026-74752}
    - sctp: stop processing a packet once its association is deleted (Xin Long) [RHEL-263317] {CVE-2026-89479}
    - sctp: avoid auth_enable sysctl UAF during netns teardown (Xin Long) [RHEL-258776] {CVE-2026-68162}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-95367 advisory.

    - sunrpc: wait for in-flight TLS handshake callback when cancel loses race (Olga Kornievskaia)     [RHEL-283649] {CVE-2026-72221}
    - sunrpc: pin svc_xprt across the asynchronous TLS handshake callback (Olga Kornievskaia) [RHEL-283263]     {CVE-2026-72222}
    - fs/resctrl: Fix use-after-free during unmount (Dennis Chen) [RHEL-296708] {CVE-2026-72080}
    - xfs: fix exchange-range-to-eof file size exchange (Carlos Maiolino) [RHEL-292986] {CVE-2026-98974}
    - xfs: stop exchanging reflink flags when exchanging mappings (Carlos Maiolino) [RHEL-292986]     {CVE-2026-98974}
    - sctp: clear new_transport when removing a peer (CKI Backport Bot) [RHEL-275369] {CVE-2026-74586}
    - writeback: fix race between cgroup_writeback_umount() and inode_switch_wbs() (Ian Kent) [RHEL-260509]     {CVE-2026-64378}
    - openvswitch: Fix CT limit teardown use-after-free (Timothy Redaelli) [RHEL-263515] {CVE-2026-89488}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - In the Linux kernel, the following vulnerability has been resolved: fs/resctrl: Fix use-after-free during     unmount During unmount or failure teardown all mon_data structures that contain monitoring event file     private data are freed after which kernfs nodes are removed. However, the RDT_DELETED flag is never set     for the statically allocated default resource group. A concurrent reader of an event file associated with     the default resource group may, after dropping kernfs active protection, block on rdtgroup_mutex while     unmount proceeds to free the file private data and destroy the kernfs node without waiting for the reader.
    When the mutex is released, the reader wakes up, observes that RDT_DELETED is not set for the default     group, and dereferences the already-freed file private data. The scenario can be depicted as follows: CPU0     CPU1 /* * Default resource group's * monitoring data accessible via * kernfs file with kernfs_node::priv *     pointing to a struct mon_data. * User opens the file for reading. */ rdtgroup_mondata_show() /* arch     encounters fatal error */ rdtgroup_kn_lock_live() resctrl_exit() atomic_inc(&rdtgroup_default.waitcount)     cpus_read_lock() kernfs_break_active_protection(kn) mutex_lock(&rdtgroup_mutex) cpus_read_lock()     resctrl_fs_teardown() mutex_lock(&rdtgroup_mutex) rmdir_all_sub() mon_put_kn_priv() /* Delete all mon_data     structures */ rdtgroup_destroy_root() kernfs_destroy_root() rdtgroup_default.kn = NULL     mutex_unlock(&rdtgroup_mutex) /* * rdtgroup_default.flags is empty so * rdtgroup_kn_lock_live() returns *     &rdtgroup_default */ md = of->kn->priv; /* md points to freed mon_data */ Set RDT_DELETED for the default     group unconditionally since the flag does not lead to the freeing of this statically allocated group. Do     not allow a new resctrl mount if there are any waiters on default group of previous mount. A new mount     will re-initialize the default group that would appear to waiters from previous mount as though the     default group is accessible causing them to access the mon_data structures from the previous mount that     have been removed. (CVE-2026-72080)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
377578	Ubuntu 24.04 LTS / 26.04 LTS : Linux kernel (NVIDIA) vulnerabilities (USN-9003-1)	Nessus	Ubuntu Local Security Checks	Local	medium
377513	Rocky Linux 9 [CIQ] Security Update: kernel / kernel-64k / kernel-64k-core / kernel-64k-debug / etc Multiple Vulnerabilities (crlsa-2026_95370)	Nessus	Rocky Linux Local Security Checks	Local	critical
377500	Rocky Linux 10.2 [CIQ] Security Update: kernel / kernel-64k / kernel-64k-core / kernel-64k-debug / etc Multiple Vulnerabilities (crlsa-2026_95367)	Nessus	Rocky Linux Local Security Checks	Local	critical
377032	RockyLinux 10 : kernel (RLSA-2026:95367)	Nessus	Rocky Linux Local Security Checks	Local	critical
377031	RockyLinux 9 : kernel (RLSA-2026:95370)	Nessus	Rocky Linux Local Security Checks	Local	critical
376934	RHEL 10 : kernel (RHSA-2026:95367)	Nessus	Red Hat Local Security Checks	Local	critical
376895	RHEL 9 : kernel (RHSA-2026:95370)	Nessus	Red Hat Local Security Checks	Local	critical
376654	Oracle Linux 9 : kernel (ELSA-2026-95370)	Nessus	Oracle Linux Local Security Checks	Local	critical
376521	Oracle Linux 10 : kernel (ELSA-2026-95367)	Nessus	Oracle Linux Local Security Checks	Local	critical
365768	Ubuntu 26.04 LTS : Linux kernel (Azure) vulnerabilities (USN-8888-1)	Nessus	Ubuntu Local Security Checks	Local	medium
365767	Ubuntu 26.04 LTS : Linux kernel vulnerabilities (USN-8887-1)	Nessus	Ubuntu Local Security Checks	Local	medium
365463	Ubuntu 26.04 LTS : Linux kernel (OEM) vulnerabilities (USN-8889-1)	Nessus	Ubuntu Local Security Checks	Local	medium
337185	Linux Distros Unpatched Vulnerability : CVE-2026-72080	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2026-72080

high

Tenable Plugins

medium

critical

critical

critical

critical

critical

critical

critical

critical

medium

medium

medium

high