In the Linux kernel, the following vulnerability has been resolved: lockd: Plug nlm_file refcount leak on cached nlm_do_fopen() failure The cached-file path in nlm_lookup_file() reaches the found: label unconditionally, even when nlm_do_fopen() fails. At that label *result and file->f_count are updated before the error is returned. The wrappers nlm3svc_lookup_file() and nlm4svc_lookup_file() then bail out of their switch without copying *result back to their caller, so the proc handler's local nlm_file pointer remains NULL and the cleanup path skips nlm_release_file(). The f_count increment is never released, and nlm_traverse_files() can no longer reap the file because its refcount never returns to zero between requests. Short-circuit the cached path so neither *result nor f_count is touched when nlm_do_fopen() fails on a hashed nlm_file.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - lockd: Plug nlm_file refcount leak on cached nlm_do_fopen() failure The cached-file path in     nlm_lookup_file() reaches the found: label unconditionally, even when nlm_do_fopen() fails. At that label
    *result and file->f_count are updated before the error is returned. The wrappers nlm3svc_lookup_file() and     nlm4svc_lookup_file() then bail out of their switch without copying *result back to their caller, so the     proc handler's local nlm_file pointer remains NULL and the cleanup path skips nlm_release_file(). The     f_count increment is never released, and nlm_traverse_files() can no longer reap the file because its     refcount never returns to zero between requests. Short-circuit the cached path so neither *result nor     f_count is touched when nlm_do_fopen() fails on a hashed nlm_file. (CVE-2026-72218)

Note that Nessus relies on the presence of the package as reported by the vendor.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2058 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    NFSv4/flexfiles: reject zero filehandle version count (CVE-2026-53392)

    In the Linux kernel, the following vulnerability has been resolved:

    nfsd: reset write verifier on deferred writeback errors (CVE-2026-53393)

    In the Linux kernel, the following vulnerability has been resolved:

    i2c: core: fix adapter registration race

    Adapters can be looked up based on their id using i2c_get_adapter()which takes a reference to the embedded     struct device.

    Make sure that the adapter (including its struct device) has beeninitialised before adding it to the IDR     to avoid accessing uninitialiseddata which could, for example, lead to NULL-pointer dereferences oruse-     after-free.

    Note that the i2c-dev chardev, which is registered from a bus notifier,currently uses i2c_get_adapter() so     the adapter needs to be added to theIDR before registration. (CVE-2026-53400)

    In the Linux kernel, the following vulnerability has been resolved:

    fbdev: fbcon: fix out-of-bounds read in err_out of fbcon_do_set_font()

    When fbcon_do_set_font() fails (e.g., due to a memory allocation failureinside vc_resize() under heavy     memory pressure), it jumps to the `err_out`label to roll back the console state. However, the current     rollback logicforgets to restore the `hi_font` state, leading to a severe state machinecorruption.

    Earlier in the function, `set_vc_hi_font()` might be called to change`vc->vc_hi_font_mask` and mutate the     screen buffer. If `vc_resize()`subsequently fails, the `err_out` path restores `vc_font.charcount`but     entirely skips rolling back the `vc_hi_font_mask` and the screenbuffer.

    This mismatch leaves the terminal in a desynchronized state. Because`vc_hi_font_mask` remains set, the VT     subsystem will still acceptcharacter indices greater than 255 from userspace and write them to thescreen     buffer. Subsequent rendering calls (e.g., `fbcon_putcs()`) willthen use these inflated indices to access     the reverted, 256-characterfont array, leading to a deterministic out-of-bounds read and potentialkernel     memory disclosure.

    Fix this by adding the missing rollback logic for the `hi_font` maskand screen buffer in the error path.
    (CVE-2026-53402)

    In the Linux kernel, the following vulnerability has been resolved:

    KVM: Replace guest-triggerable BUG_ON() in ioeventfd datamatch with get_unaligned() (CVE-2026-63806)

    In the Linux kernel, the following vulnerability has been resolved:

    block: Avoid mounting the bdev pseudo-filesystem in userspace (CVE-2026-63810)

    In the Linux kernel, the following vulnerability has been resolved:

    fbdev: fix use-after-free in store_modes() (CVE-2026-63826)

    In the Linux kernel, the following vulnerability has been resolved:

    net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (CVE-2026-63829)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: ebtables: move to two-stage removal scheme (CVE-2026-64077)

    In the Linux kernel, the following vulnerability has been resolved:

    xfs: fail recovery on a committed log item with no regions

    If the first op of a transaction is a bare transaction header(len == sizeof(struct xfs_trans_header)),     xlog_recover_add_to_trans()adds an item but no region, leaving it on r_itemq with ri_cnt == 0 andri_buf ==     NULL.

    The header can be split across op records, so later ops may still addregions; the item is only invalid if     the transaction commits with none.The runtime commit path never emits such a transaction, so this     onlyhappens on a crafted log.  It came from an AI-assisted code audit of therecovery parser.

    xlog_recover_reorder_trans() calls ITEM_TYPE() on the item, which reads*(unsigned short
    *)item->ri_buf[0].iov_base and faults on the NULLri_buf.  Reject it there, before the commit handlers that     also readri_buf[0].

    KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]RIP: 0010:xlog_recover_reorder_trans     (fs/xfs/xfs_log_recover.c:1836)xlog_recover_commit_trans     (fs/xfs/xfs_log_recover.c:2043)xlog_recover_process_data     (fs/xfs/xfs_log_recover.c:2501)xlog_do_recovery_pass (fs/xfs/xfs_log_recover.c:3244)xlog_recover     (fs/xfs/xfs_log_recover.c:3493)xfs_log_mount (fs/xfs/xfs_log.c:618)xfs_mountfs     (fs/xfs/xfs_mount.c:1034)xfs_fs_fill_super (fs/xfs/xfs_super.c:1938)vfs_get_tree     (fs/super.c:1695)path_mount (fs/namespace.c:4161)__x64_sys_mount (fs/namespace.c:4367) (CVE-2026-64187)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: ipset: fix race between dump and ip_set_list resize (CVE-2026-64189)

    In the Linux kernel, the following vulnerability has been resolved:

    fuse: re-lock request before returning from fuse_ref_folio() (CVE-2026-64266)

    In the Linux kernel, the following vulnerability has been resolved:

    i2c: core: fix adapter deregistration race (CVE-2026-64279)

    In the Linux kernel, the following vulnerability has been resolved:

    exfat: bound uniname advance in exfat_find_dir_entry() (CVE-2026-64296)

    In the Linux kernel, the following vulnerability has been resolved:

    NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CVE-2026-64298)

    In the Linux kernel, the following vulnerability has been resolved:

    tracing: Prevent out-of-bounds read in glob matching (CVE-2026-64299)

    In the Linux kernel, the following vulnerability has been resolved:

    crypto: drbg - Fix returning success on failure in CTR_DRBG (CVE-2026-64306)

    In the Linux kernel, the following vulnerability has been resolved:

    crypto: pcrypt - restore callback for non-parallel fallback (CVE-2026-64312)

    In the Linux kernel, the following vulnerability has been resolved:

    crypto: ecc - Fix carry overflow in vli multiplication (CVE-2026-64313)

    In the Linux kernel, the following vulnerability has been resolved:

    isofs: bound Rock Ridge symlink components to the SL record (CVE-2026-64317)

    In the Linux kernel, the following vulnerability has been resolved:

    udf: validate sparing table length as an entry count, not a byte count (CVE-2026-64322)

    In the Linux kernel, the following vulnerability has been resolved:

    udf: validate VAT header length against the VAT inode size (CVE-2026-64323)

    In the Linux kernel, the following vulnerability has been resolved:

    udf: validate free block extents against the partition length (CVE-2026-64324)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf: Allow LPM map access from sleepable BPF programs (CVE-2026-64352)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf: Reject fragmented frames in devmap (CVE-2026-64355)

    In the Linux kernel, the following vulnerability has been resolved:

    HID: multitouch: fix out-of-bounds bit access on mt_io_flags (CVE-2026-64364)

    In the Linux kernel, the following vulnerability has been resolved:

    posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (CVE-2026-64370)

    In the Linux kernel, the following vulnerability has been resolved:

    proc: protect ptrace_may_access() with exec_update_lock (part 1) (CVE-2026-64371)

    In the Linux kernel, the following vulnerability has been resolved:

    cpufreq: pcc: fix use-after-free and double free in _OSC evaluation (CVE-2026-64372)

    In the Linux kernel, the following vulnerability has been resolved:

    cpufreq: Fix hotplug-suspend race during reboot (CVE-2026-64373)

    In the Linux kernel, the following vulnerability has been resolved:

    sched/rt: Have RT_PUSH_IPI be default off for non PREEMPT_RT (CVE-2026-64374)

    In the Linux kernel, the following vulnerability has been resolved:

    proc: protect ptrace_may_access() with exec_update_lock (FD links) (CVE-2026-64375)

    In the Linux kernel, the following vulnerability has been resolved:

    writeback: fix race between cgroup_writeback_umount() and inode_switch_wbs() (CVE-2026-64378)

    In the Linux kernel, the following vulnerability has been resolved:

    smb: client: harden POSIX SID length parsing (CVE-2026-64380)

    In the Linux kernel, the following vulnerability has been resolved:

    smb: client: Fix next buffer leak in receive_encrypted_standard() (CVE-2026-64381)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: ebtables: terminate table name before find_table_lock() (CVE-2026-64411)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: ebtables: module names must be null-terminated (CVE-2026-64412)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: ebtables: zero chainstack array (CVE-2026-64413)

    In the Linux kernel, the following vulnerability has been resolved:

    net: ipv4: bound TCP reordering sysctl writes and MTU probe sizes (CVE-2026-64422)

    In the Linux kernel, the following vulnerability has been resolved:

    ipv4: igmp: remove multicast group from hash table on device destruction (CVE-2026-64423)

    In the Linux kernel, the following vulnerability has been resolved:

    io_uring/io-wq: re-check IO_WQ_BIT_EXIT for each linked work item (CVE-2026-64425)

    In the Linux kernel, the following vulnerability has been resolved:

    fs/ntfs3: validate Dirty Page Table capacity in log_replay copy_lcns (CVE-2026-64432)

    In the Linux kernel, the following vulnerability has been resolved:

    audit: Fix data races of skb_queue_len() readers on audit_queue (CVE-2026-64435)

    In the Linux kernel, the following vulnerability has been resolved:

    net: af_key: initialize alg_key_len for IPComp states (CVE-2026-64436)

    In the Linux kernel, the following vulnerability has been resolved:

    smb: client: restrict implied bcc[0] exemption to responses without data area (CVE-2026-64448)

    In the Linux kernel, the following vulnerability has been resolved:

    tipc: fix out-of-bounds read in broadcast Gap ACK blocks (CVE-2026-64450)

    In the Linux kernel, the following vulnerability has been resolved:

    hwrng: virtio: clamp device-reported used.len at copy_data() (CVE-2026-64456)

    In the Linux kernel, the following vulnerability has been resolved:

    mm/damon/ops-common: handle extreme intervals in damon_hot_score() (CVE-2026-64458)

    In the Linux kernel, the following vulnerability has been resolved:

    usb: xhci: Fix sleep in atomic context in xhci_free_streams() (CVE-2026-64465)

    In the Linux kernel, the following vulnerability has been resolved:

    vfio/mlx5: Fix racy bitfields and tighten struct layout (CVE-2026-64472)

    In the Linux kernel, the following vulnerability has been resolved:

    vfio/pci: Release the VGA arbiter client on register_device() failure (CVE-2026-64475)

    In the Linux kernel, the following vulnerability has been resolved:

    vfio/pci: Latch disable_idle_d3 per device (CVE-2026-64476)

    In the Linux kernel, the following vulnerability has been resolved:

    ACPI: CPPC: Suppress UBSAN warning caused by field misuse (CVE-2026-64512)

    In the Linux kernel, the following vulnerability has been resolved:

    userfaultfd: gate must_wait writability check on pte_present() (CVE-2026-64514)

    In the Linux kernel, the following vulnerability has been resolved:

    net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CVE-2026-64530)

    In the Linux kernel, the following vulnerability has been resolved:

    fs/ntfs3: bound NTFS_DE view.data_off in UpdateRecordData{Root,Allocation} (CVE-2026-64532)

    In the Linux kernel, the following vulnerability has been resolved:

    fs/ntfs3: validate lcns_follow in log_replay conversion (CVE-2026-64533)

    In the Linux kernel, the following vulnerability has been resolved:

    ipv6: Fix null-ptr-deref in fib6_nh_mtu_change(). (CVE-2026-64538)

    In the Linux kernel, the following vulnerability has been resolved:

    crypto: asymmetric_keys - fix OOB read in pefile_digest_pe_contents (CVE-2026-64544)

    In the Linux kernel, the following vulnerability has been resolved:

    net, bpf: check master for NULL in xdp_master_redirect() (CVE-2026-64545)

    In the Linux kernel, the following vulnerability has been resolved:

    drm/edid: fix OOB read in drm_parse_tiled_block() (CVE-2026-64546)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf, sockmap: reject overflowing copy + len in bpf_msg_push_data() (CVE-2026-64548)

    In the Linux kernel, the following vulnerability has been resolved:

    sctp: validate STALE_COOKIE cause length before reading staleness (CVE-2026-64551)

    In the Linux kernel, the following vulnerability has been resolved:

    virtio-net: fix len check in receive_big() (CVE-2026-64552)

    In the Linux kernel, the following vulnerability has been resolved:

    net: psample: fix info leak in PSAMPLE_ATTR_DATA (CVE-2026-64553)

    In the Linux kernel, the following vulnerability has been resolved:

    posix-cpu-timers: Prevent UAF caused by non-leader exec() race (CVE-2026-64560)

    In the Linux kernel, the following vulnerability has been resolved:

    KVM: x86: Check for invalid/obsolete root *after* making MMU pages available

    Check for a stale page fault, i.e. for an invalid and/or obsolete root,after making MMU pages available     for the shadow MMU.  If reclaiming shadowpages zaps an in-use root, i.e. marks it invalid, then KVM will     attempt tomap memory into an invalid root.  On its own, populating an invalid root isfine, but because     child shadow pages inherit their parent's role, anychildren created during the map/fetch will be created     as invalid pages,thus violating KVM's invariant that invalid pages are never on the list ofactive MMU     pages.

    Note, the underlying flaw has existed since KVM first started trackinginvalid roots in 2008 (commit     2e53d63acba7, KVM: MMU: ignore zapped rootpagetables), but the true badness only came along in 2020     (Linux 5.9)with the invariant that invalid shadow pages can't be on the list ofactive pages.

    Note #2, inheriting role.invalid when creating child shadow pages is alsofar from ideal; that flaw will be     addressed separately. (CVE-2026-64561)

    In the Linux kernel, the following vulnerability has been resolved:

    btrfs: do not trim a device which is not writeable (CVE-2026-64593)

    In the Linux kernel, the following vulnerability has been resolved:

    KVM: VMX: Grab vmcs12 on CR8 interception update iff vCPU is in guest mode (CVE-2026-64604)

    In the Linux kernel, the following vulnerability has been resolved:

    ntfs3: cap RESTART_TABLE free-chain walker at rt->used (CVE-2026-72193)

    In the Linux kernel, the following vulnerability has been resolved:

    fs/ntfs3: bound DeleteIndexEntryAllocation memmove length (CVE-2026-72197)

    In the Linux kernel, the following vulnerability has been resolved:

    lockd: Plug nlm_file refcount leak on cached nlm_do_fopen() failure (CVE-2026-72218)

    In the Linux kernel, the following vulnerability has been resolved:

    fbdev: metronomefb: fix potential memory leak in metronomefb_probe() (CVE-2026-72276)

    In the Linux kernel, the following vulnerability has been resolved:

    KVM: s390: pci: Fix GISC refcount leak on AIF enable failure (CVE-2026-72290)

    In the Linux kernel, the following vulnerability has been resolved:

    net/mlx5e: Fix HV VHCA stats zero-sized buffer allocation (CVE-2026-72343)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: nf_nat: avoid invalid nat_net pointer use on failed nf_nat_init() (CVE-2026-72419)

    In the Linux kernel, the following vulnerability has been resolved:

    md/raid1: free r1_bio when REQ_NOWAIT is set and read would block on retry (CVE-2026-72437)

    In the Linux kernel, the following vulnerability has been resolved:

    kcm: use WRITE_ONCE() when changing lower socket callbacks (CVE-2026-74262)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf: Tighten cgroup storage cookie checks for prog arrays (CVE-2026-74305)

    In the Linux kernel, the following vulnerability has been resolved:

    vmalloc: fix NULL pointer dereference in is_vm_area_hugepages() (CVE-2026-74327)

    In the Linux kernel, the following vulnerability has been resolved:

    watchdog: unregister PM notifier on watchdog unregister (CVE-2026-74329)

    In the Linux kernel, the following vulnerability has been resolved:

    gpu: host1x: Fix iommu_map_sgtable() return value check (CVE-2026-74380)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of kernel installed on the remote host is prior to 5.10.262-262.1063. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.10-2026-129 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    net: Drop the lock in skb_may_tx_timestamp() (CVE-2026-43216)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: flowtable: strictly check for maximum number of actions (CVE-2026-43329)

    In the Linux kernel, the following vulnerability has been resolved:

    nvmet-tcp: fix race between ICReq handling and queue teardown (CVE-2026-46135)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: nf_log: validate MAC header was set before dumping it (CVE-2026-52942)

    In the Linux kernel, the following vulnerability has been resolved:

    fuse: re-lock request before replacing page cache folio

    fuse_try_move_folio() unlocks the request on entry but does notre-lock it on the success path. This means     fuse_chan_abort() can end therequest and free the fuse_io_args (eg fuse_readpages_end()) while     thesubsequent copy chain logic after fuse_try_move_folio() accesses thefuse_io_args, leading to use-after-     free issues.

    Fix this by calling lock_request() before replace_page_cache_folio().This ensures the request is locked on     the success path which willprevent the fuse_io_args from being freed while the later copying logicruns,     and also ensures that the ap->folios[i]->mapping is never nullsince ap->folios[i] will always point to the     newfolio afterreplace_page_cache_folio(). (CVE-2026-53388)

    In the Linux kernel, the following vulnerability has been resolved:

    NFSv4/flexfiles: reject zero filehandle version count (CVE-2026-53392)

    In the Linux kernel, the following vulnerability has been resolved:

    nfsd: reset write verifier on deferred writeback errors (CVE-2026-53393)

    In the Linux kernel, the following vulnerability has been resolved:

    nfsd: release layout stid on setlease failure (CVE-2026-53399)

    In the Linux kernel, the following vulnerability has been resolved:

    i2c: core: fix adapter registration race

    Adapters can be looked up based on their id using i2c_get_adapter()which takes a reference to the embedded     struct device.

    Make sure that the adapter (including its struct device) has beeninitialised before adding it to the IDR     to avoid accessing uninitialiseddata which could, for example, lead to NULL-pointer dereferences oruse-     after-free.

    Note that the i2c-dev chardev, which is registered from a bus notifier,currently uses i2c_get_adapter() so     the adapter needs to be added to theIDR before registration. (CVE-2026-53400)

    In the Linux kernel, the following vulnerability has been resolved:

    fbdev: fbcon: fix out-of-bounds read in err_out of fbcon_do_set_font()

    When fbcon_do_set_font() fails (e.g., due to a memory allocation failureinside vc_resize() under heavy     memory pressure), it jumps to the `err_out`label to roll back the console state. However, the current     rollback logicforgets to restore the `hi_font` state, leading to a severe state machinecorruption.

    Earlier in the function, `set_vc_hi_font()` might be called to change`vc->vc_hi_font_mask` and mutate the     screen buffer. If `vc_resize()`subsequently fails, the `err_out` path restores `vc_font.charcount`but     entirely skips rolling back the `vc_hi_font_mask` and the screenbuffer.

    This mismatch leaves the terminal in a desynchronized state. Because`vc_hi_font_mask` remains set, the VT     subsystem will still acceptcharacter indices greater than 255 from userspace and write them to thescreen     buffer. Subsequent rendering calls (e.g., `fbcon_putcs()`) willthen use these inflated indices to access     the reverted, 256-characterfont array, leading to a deterministic out-of-bounds read and potentialkernel     memory disclosure.

    Fix this by adding the missing rollback logic for the `hi_font` maskand screen buffer in the error path.
    (CVE-2026-53402)

    In the Linux kernel, the following vulnerability has been resolved:

    hdlc_ppp: sync per-proto timers before freeing hdlc state (CVE-2026-63803)

    In the Linux kernel, the following vulnerability has been resolved:

    KVM: Replace guest-triggerable BUG_ON() in ioeventfd datamatch with get_unaligned() (CVE-2026-63806)

    In the Linux kernel, the following vulnerability has been resolved:

    fbdev: fix use-after-free in store_modes() (CVE-2026-63826)

    In the Linux kernel, the following vulnerability has been resolved:

    net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (CVE-2026-63829)

    In the Linux kernel, the following vulnerability has been resolved:

    net: skmsg: preserve sg.copy across SG transforms (CVE-2026-63830)

    In the Linux kernel, the following vulnerability has been resolved:

    security/keys: fix missed RCU read section on lookup

    Nicholas Carlini reports that the keyring code calls assoc_array_find()in find_key_to_update() without     holding the RCU read lock, while theassoc_array_gc() code really is designed around removing the node     fromthe tree and then freeing it after an RCU grace-period.

    The regular key handling doesn't see this because holding the keyringsemaphore hides any lifetime issues,     but the persistent key handlinguses a different model.

    Instead of extending the keyring locking, just do the simple RCU lockingthat the assoc_array was designed     for. (CVE-2026-64015)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: ipset: fix race between dump and ip_set_list resize (CVE-2026-64189)

    In the Linux kernel, the following vulnerability has been resolved:

    fuse: re-lock request before returning from fuse_ref_folio() (CVE-2026-64266)

    In the Linux kernel, the following vulnerability has been resolved:

    Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CVE-2026-64276)

    In the Linux kernel, the following vulnerability has been resolved:

    exfat: bound uniname advance in exfat_find_dir_entry() (CVE-2026-64296)

    In the Linux kernel, the following vulnerability has been resolved:

    NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CVE-2026-64298)

    In the Linux kernel, the following vulnerability has been resolved:

    tracing: Prevent out-of-bounds read in glob matching (CVE-2026-64299)

    In the Linux kernel, the following vulnerability has been resolved:

    crypto: drbg - Fix returning success on failure in CTR_DRBG (CVE-2026-64306)

    In the Linux kernel, the following vulnerability has been resolved:

    crypto: pcrypt - restore callback for non-parallel fallback (CVE-2026-64312)

    In the Linux kernel, the following vulnerability has been resolved:

    crypto: ecc - Fix carry overflow in vli multiplication (CVE-2026-64313)

    In the Linux kernel, the following vulnerability has been resolved:

    isofs: bound Rock Ridge symlink components to the SL record (CVE-2026-64317)

    In the Linux kernel, the following vulnerability has been resolved:

    udf: validate sparing table length as an entry count, not a byte count (CVE-2026-64322)

    In the Linux kernel, the following vulnerability has been resolved:

    udf: validate VAT header length against the VAT inode size (CVE-2026-64323)

    In the Linux kernel, the following vulnerability has been resolved:

    udf: validate free block extents against the partition length (CVE-2026-64324)

    In the Linux kernel, the following vulnerability has been resolved:

    USB: ulpi: fix memory leak on registration failure (CVE-2026-64332)

    In the Linux kernel, the following vulnerability has been resolved:

    USB: serial: digi_acceleport: fix write buffer corruption (CVE-2026-64333)

    In the Linux kernel, the following vulnerability has been resolved:

    USB: serial: digi_acceleport: fix hard lockup on disconnect (CVE-2026-64334)

    In the Linux kernel, the following vulnerability has been resolved:

    USB: serial: digi_acceleport: fix broken rx after throttle (CVE-2026-64335)

    In the Linux kernel, the following vulnerability has been resolved:

    USB: legousbtower: fix use-after-free on disconnect race (CVE-2026-64340)

    In the Linux kernel, the following vulnerability has been resolved:

    USB: iowarrior: fix use-after-free on disconnect (CVE-2026-64342)

    In the Linux kernel, the following vulnerability has been resolved:

    USB: ldusb: fix use-after-free on disconnect race (CVE-2026-64343)

    In the Linux kernel, the following vulnerability has been resolved:

    USB: idmouse: fix use-after-free on disconnect race (CVE-2026-64344)

    In the Linux kernel, the following vulnerability has been resolved:

    usb: free iso schedules on failed submit (CVE-2026-64348)

    In the Linux kernel, the following vulnerability has been resolved:

    net: usb: kalmia: bound RX frame length in kalmia_rx_fixup() (CVE-2026-64351)

    In the Linux kernel, the following vulnerability has been resolved:

    nilfs2: reject CLEAN_SEGMENTS ioctl with out-of-range segment numbers (CVE-2026-64359)

    In the Linux kernel, the following vulnerability has been resolved:

    hfs/hfsplus: zero-initialize buffer in hfs_bnode_read (CVE-2026-64360)

    In the Linux kernel, the following vulnerability has been resolved:

    hfs/hfsplus: fix u32 overflow in check_and_correct_requested_length (CVE-2026-64361)

    In the Linux kernel, the following vulnerability has been resolved:

    HID: lg-g15: cancel pending work on remove to fix a use-after-free (CVE-2026-64362)

    In the Linux kernel, the following vulnerability has been resolved:

    HID: appleir: fix UAF on pending key_up_timer in remove() (CVE-2026-64363)

    In the Linux kernel, the following vulnerability has been resolved:

    HID: multitouch: fix out-of-bounds bit access on mt_io_flags (CVE-2026-64364)

    In the Linux kernel, the following vulnerability has been resolved:

    posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (CVE-2026-64370)

    In the Linux kernel, the following vulnerability has been resolved:

    proc: protect ptrace_may_access() with exec_update_lock (part 1) (CVE-2026-64371)

    In the Linux kernel, the following vulnerability has been resolved:

    cpufreq: pcc: fix use-after-free and double free in _OSC evaluation (CVE-2026-64372)

    In the Linux kernel, the following vulnerability has been resolved:

    cpufreq: Fix hotplug-suspend race during reboot (CVE-2026-64373)

    In the Linux kernel, the following vulnerability has been resolved:

    sched/rt: Have RT_PUSH_IPI be default off for non PREEMPT_RT (CVE-2026-64374)

    In the Linux kernel, the following vulnerability has been resolved:

    proc: protect ptrace_may_access() with exec_update_lock (FD links) (CVE-2026-64375)

    In the Linux kernel, the following vulnerability has been resolved:

    writeback: fix race between cgroup_writeback_umount() and inode_switch_wbs() (CVE-2026-64378)

    In the Linux kernel, the following vulnerability has been resolved:

    smb: client: harden POSIX SID length parsing (CVE-2026-64380)

    In the Linux kernel, the following vulnerability has been resolved:

    smb: client: Fix next buffer leak in receive_encrypted_standard() (CVE-2026-64381)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: ebtables: terminate table name before find_table_lock() (CVE-2026-64411)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: ebtables: module names must be null-terminated (CVE-2026-64412)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: ebtables: zero chainstack array (CVE-2026-64413)

    In the Linux kernel, the following vulnerability has been resolved:

    net: ipv4: bound TCP reordering sysctl writes and MTU probe sizes (CVE-2026-64422)

    In the Linux kernel, the following vulnerability has been resolved:

    ipv4: igmp: remove multicast group from hash table on device destruction (CVE-2026-64423)

    In the Linux kernel, the following vulnerability has been resolved:

    io_uring/io-wq: re-check IO_WQ_BIT_EXIT for each linked work item (CVE-2026-64425)

    In the Linux kernel, the following vulnerability has been resolved:

    audit: Fix data races of skb_queue_len() readers on audit_queue (CVE-2026-64435)

    In the Linux kernel, the following vulnerability has been resolved:

    net: af_key: initialize alg_key_len for IPComp states (CVE-2026-64436)

    In the Linux kernel, the following vulnerability has been resolved:

    smb: client: restrict implied bcc[0] exemption to responses without data area (CVE-2026-64448)

    In the Linux kernel, the following vulnerability has been resolved:

    tipc: fix out-of-bounds read in broadcast Gap ACK blocks (CVE-2026-64450)

    In the Linux kernel, the following vulnerability has been resolved:

    USB: chaoskey: Fix slab-use-after-free in chaoskey_release() (CVE-2026-64455)

    In the Linux kernel, the following vulnerability has been resolved:

    hwrng: virtio: clamp device-reported used.len at copy_data() (CVE-2026-64456)

    In the Linux kernel, the following vulnerability has been resolved:

    usb: xhci: Fix sleep in atomic context in xhci_free_streams() (CVE-2026-64465)

    In the Linux kernel, the following vulnerability has been resolved:

    vfio/pci: Release the VGA arbiter client on register_device() failure (CVE-2026-64475)

    In the Linux kernel, the following vulnerability has been resolved:

    userfaultfd: gate must_wait writability check on pte_present() (CVE-2026-64514)

    In the Linux kernel, the following vulnerability has been resolved:

    nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CVE-2026-64534)

    In the Linux kernel, the following vulnerability has been resolved:

    ipv6: Fix null-ptr-deref in fib6_nh_mtu_change(). (CVE-2026-64538)

    In the Linux kernel, the following vulnerability has been resolved:

    usbnet: gl620a: fix out-of-bounds read in genelink_rx_fixup() (CVE-2026-64540)

    In the Linux kernel, the following vulnerability has been resolved:

    crypto: asymmetric_keys - fix OOB read in pefile_digest_pe_contents (CVE-2026-64544)

    In the Linux kernel, the following vulnerability has been resolved:

    drm/edid: fix OOB read in drm_parse_tiled_block() (CVE-2026-64546)

    In the Linux kernel, the following vulnerability has been resolved:

    net: usb: net1080: validate packet_len before pad-byte access in rx_fixup (CVE-2026-64547)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf, sockmap: reject overflowing copy + len in bpf_msg_push_data() (CVE-2026-64548)

    In the Linux kernel, the following vulnerability has been resolved:

    sctp: validate STALE_COOKIE cause length before reading staleness (CVE-2026-64551)

    In the Linux kernel, the following vulnerability has been resolved:

    net: psample: fix info leak in PSAMPLE_ATTR_DATA (CVE-2026-64553)

    In the Linux kernel, the following vulnerability has been resolved:

    posix-cpu-timers: Prevent UAF caused by non-leader exec() race (CVE-2026-64560)

    In the Linux kernel, the following vulnerability has been resolved:

    KVM: x86: Check for invalid/obsolete root *after* making MMU pages available

    Check for a stale page fault, i.e. for an invalid and/or obsolete root,after making MMU pages available     for the shadow MMU.  If reclaiming shadowpages zaps an in-use root, i.e. marks it invalid, then KVM will     attempt tomap memory into an invalid root.  On its own, populating an invalid root isfine, but because     child shadow pages inherit their parent's role, anychildren created during the map/fetch will be created     as invalid pages,thus violating KVM's invariant that invalid pages are never on the list ofactive MMU     pages.

    Note, the underlying flaw has existed since KVM first started trackinginvalid roots in 2008 (commit     2e53d63acba7, KVM: MMU: ignore zapped rootpagetables), but the true badness only came along in 2020     (Linux 5.9)with the invariant that invalid shadow pages can't be on the list ofactive pages.

    Note #2, inheriting role.invalid when creating child shadow pages is alsofar from ideal; that flaw will be     addressed separately. (CVE-2026-64561)

    In the Linux kernel, the following vulnerability has been resolved:

    btrfs: do not trim a device which is not writeable (CVE-2026-64593)

    In the Linux kernel, the following vulnerability has been resolved:

    KVM: VMX: Grab vmcs12 on CR8 interception update iff vCPU is in guest mode (CVE-2026-64604)

    In the Linux kernel, the following vulnerability has been resolved:

    HID: wacom: stop hardware after post-start probe failures (CVE-2026-68091)

    In the Linux kernel, the following vulnerability has been resolved:

    lockd: Plug nlm_file refcount leak on cached nlm_do_fopen() failure (CVE-2026-72218)

    In the Linux kernel, the following vulnerability has been resolved:

    kcm: use WRITE_ONCE() when changing lower socket callbacks (CVE-2026-74262)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
337532	Linux Distros Unpatched Vulnerability : CVE-2026-72218	Nessus	Misc.	Local	medium
337239	Amazon Linux 2023 : bpftool6.12, kernel6.12, kernel6.12-devel (ALAS2023-2026-2057)	Nessus	Amazon Linux Local Security Checks	Local	medium
337226	Amazon Linux 2023 : bpftool, kernel, kernel-devel (ALAS2023-2026-2058)	Nessus	Amazon Linux Local Security Checks	Local	medium
337224	Amazon Linux 2 : kernel, --advisory ALAS2KERNEL-5.10-2026-129 (ALASKERNEL-5.10-2026-129)	Nessus	Amazon Linux Local Security Checks	Local	medium

Detections

Analytics

CVE-2026-72218

medium

Tenable Plugins

medium

medium

medium

medium