In the Linux kernel, the following vulnerability has been resolved: RDMA/nldev: Fix locking when accessing mr->pd Sashiko points out that, due to rereg_mr, the PD is actually variable and all the touches in nldev are racy. Use mr->device instead of mr->pd->device. Getting the PD restrack ID is more tricky. To avoid disturbing all the happy paths, add an rdma_restrack_sync() operation which is sort of like flush_workqueue() or synchronize_irq(): after it returns, all the old nldev touches to the mr are gone and everything sees the new PD. This makes it safe to reach into the PD pointer.

The remote Oracle Linux 10 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-500328 advisory.

    - net: tun: bound receive headroom (Asim Viladi Oglu Manizada)  [Orabug: 40035126]  {CVE-2026-81000}
    - xfrm: ah6: validate routing header segments_left (Asim Viladi Oglu Manizada)  [Orabug: 40035125]     {CVE-2026-80844}
    - RDMA/nldev: Fix locking when accessing mr->pd (Jason Gunthorpe)  [Orabug: 40028950]  {CVE-2026-74334}
    - tcp: clear sock_ops cb flags before force-closing a child socket (Sechang Lim)  [Orabug: 40028948]     {CVE-2026-74268}
    - xsk: cache csum_start/csum_offset to fix TOCTOU in xsk_skb_metadata() (Jason Xing)  [Orabug: 40028941]     {CVE-2026-53250}
    - tcp: fix potential race in tcp_v6_syn_recv_sock() (Eric Dumazet)  [Orabug: 40028939]  {CVE-2026-43198}
    - ipv4: start using dst_dev_rcu() (Eric Dumazet)  [Orabug: 40022810]  {CVE-2025-40074}
    - NTB: ntb_netdev: Preserve RX queue depth on allocation failure (Koichiro Den)  [Orabug: 40022771]     {CVE-2026-74626}
    - inet: frags: publish queues before arming timer (Zhiling Zou)  [Orabug: 40022764]  {CVE-2026-74662}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - RDMA/nldev: Fix locking when accessing mr->pd Sashiko points out that, due to rereg_mr, the PD is actually     variable and all the touches in nldev are racy. Use mr->device instead of mr->pd->device. Getting the PD     restrack ID is more tricky. To avoid disturbing all the happy paths, add an rdma_restrack_sync() operation     which is sort of like flush_workqueue() or synchronize_irq(): after it returns, all the old nldev touches     to the mr are gone and everything sees the new PD. This makes it safe to reach into the PD pointer.
    (CVE-2026-74334)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
351155	Debian dsa-6528 : ata-modules-6.12.111+deb13-armmp-di - security update	Nessus	Debian Local Security Checks	Local	high
350138	openSUSE 16: cluster-md-kmp-64kb / cluster-md-kmp-azure / cluster-md-kmp-default / etc (openSUSE-SU-2026:21910-1)	Nessus	SuSE Local Security Checks	Local	high
349185	SUSE SLES12: cluster-md-kmp-default / dlm-kmp-default / gfs2-kmp-default / etc (SUSE-SU-2026:4282-1)	Nessus	SuSE Local Security Checks	Local	high
347900	SUSE SLED15 / SLES15 : Security update for the Linux Kernel (SUSE-SU-2026:4254-1)	Nessus	SuSE Local Security Checks	Local	high
346911	Oracle Linux 10 / 9 : Unbreakable Enterprise kernel (ELSA-2026-500328)	Nessus	Oracle Linux Local Security Checks	Local	critical
335603	Linux Distros Unpatched Vulnerability : CVE-2026-74334	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2026-74334

high

Tenable Plugins

high

high

high

high

critical

high