In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix TOCTOU heap overflow in get_srq_wqe get_srq_wqe() reads wqe->dma.num_sge from the shared receive queue buffer, which is mapped into userspace. It validates num_sge against max_sge, but then re-reads the same field to calculate the memcpy size. A concurrent userspace thread can modify num_sge between validation and use, causing a heap buffer overflow when copying the WQE into qp->resp.srq_wqe. Read num_sge into a local variable and use it for both the bounds check and the size calculation.

suse_linux SUSE-SU-2026:4595-1: SUSE SLES15 : Security update for the Linux Kernel (Important) (SUSE-SU-2026:4595-1)

The remote Ubuntu 24.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-8886-1 advisory.

    Several security issues were discovered in the Linux kernel. An attacker could possibly use these to     compromise the system. This update corrects flaws in the following subsystems:

    - NVDIMM (Non-Volatile Memory Device) drivers;

    - Handshake API;

    - ARM32 architecture;

    - ARM64 architecture;

    - MIPS architecture;

    - OpenRISC architecture;

    - PowerPC architecture;

    - S390 architecture;

    - x86 architecture;

    - Block layer subsystem;

    - Cryptographic API;

    - Intel NPU Driver;

    - Android drivers;

    - Rados block device (RBD) driver;

    - Bluetooth drivers;

    - Hardware random number generator core;

    - TPM device driver;

    - CPU frequency scaling framework;

    - Hardware crypto device drivers;

    - DMA engine subsystem;

    - FireWire subsystem;

    - Arm Firmware Framework for ARMv8-A(FFA);

    - GPIO subsystem;

    - GPU drivers;

    - HID subsystem;

    - Hardware monitoring drivers;

    - CoreSight HW tracing drivers;

    - I2C subsystem;

    - IIO ADC drivers;

    - IIO subsystem;

    - InfiniBand drivers;

    - Input Device core drivers;

    - Input Device (Mouse) drivers;

    - IOMMU subsystem;

    - Multiple devices driver;

    - Media drivers;

    - Multifunction device drivers;

    - Fastrpc Driver;

    - Amazon Nitro Secure Module driver;

    - MMC subsystem;

    - MTD block device drivers;

    - Ethernet bonding driver;

    - Network drivers;

    - Mellanox network drivers;

    - Texas Instruments network drivers;

    - NTB driver;

    - NVME drivers;

    - NVMEM (Non Volatile Memory) drivers;

    - Parport drivers;

    - Pin controllers subsystem;

    - x86 platform drivers;

    - i.MX PM domains;

    - System reset/shutdown drivers;

    - PTP clock framework;

    - Voltage and Current Regulator drivers;

    - S/390 drivers;

    - SCSI subsystem;

    - SPI subsystem;

    - Realtek RTL8723BS SDIO drivers;

    - VME bus staging drivers;

    - Thermal drivers;

    - Thunderbolt and USB4 drivers;

    - TTY drivers;

    - DesignWare USB2 driver;

    - USB Gadget drivers;

    - USB Host Controller drivers;

    - USB Dual Role (OTG-ready) Controller drivers;

    - USB Serial drivers;

    - USB Type-C Port Controller Manager driver;

    - vDPA drivers;

    - Virtio Host (VHOST) subsystem;

    - Framebuffer layer;

    - Watchdog drivers;

    - 9P distributed file system;

    - AFS file system;

    - File systems infrastructure;

    - BTRFS file system;

    - Ceph distributed file system;

    - EROFS file system;

    - exFAT file system;

    - F2FS file system;

    - FUSE (File system in Userspace);

    - Journaling layer for block devices (JBD2);

    - Network file system (NFS) client;

    - Network file system (NFS) server daemon;

    - NTFS3 file system;

    - OCFS2 file system;

    - Proc file system;

    - SMB network file system;

    - Tracing file system;

    - UDF file system;

    - XFS file system;

    - Key management;

    - BPF subsystem;

    - Control group (cgroup);

    - Glob pattern matching library;

    - MAC80211 subsystem;

    - Mellanox drivers;

    - Networking core;

    - Network sockets;

    - IPv6 networking;

    - Bluetooth subsystem;

    - Wireless networking;

    - IPv4 networking;

    - Netfilter;

    - Network traffic control;

    - SCTP protocol;

    - TCP network protocol;

    - XFRM subsystem;

    - RDMA verbs API;

    - io_uring subsystem;

    - IPC subsystem;

    - Audit subsystem;

    - Kernel CPU control infrastructure;

    - Perf events;

    - Kernel exit() syscall;

    - Kernel fork() syscall;

    - Scheduler infrastructure;

    - Signal handling mechanism;

    - Timer subsystem;

    - Tracing infrastructure;

    - Resizable hashtable library;

    - Memory management;

    - 6LoWPAN network protocol;

    - Asynchronous Transfer Mode (ATM) subsystem;

    - B.A.T.M.A.N. meshing protocol;

    - Ethernet bridge;

    - CAN network layer;

    - Ceph Core library;

    - Ethtool driver;

    - HSR network protocol;

    - IEEE802154.4 network protocol;

    - IUCV driver;

    - KCM (Kernel Connection Multiplexor) sockets driver;

    - IEEE 802.15.4 subsystem;

    - Multipath TCP;

    - Open vSwitch;

    - Packet sockets;

    - Phonet protocol;

    - Qualcomm IPC Router (QRTR);

    - RDS protocol;

    - RxRPC session sockets;

    - SMC sockets;

    - Sun RPC protocol;

    - TIPC protocol;

    - TLS protocol;

    - Unix domain sockets;

    - VMware vSockets driver;

    - X.25 network layer;

    - eXpress Data Path;

    - AppArmor security module;

    - Integrity Measurement Architecture(IMA) framework;

    - SELinux security module;

    - ALSA framework;

    - HD-audio driver;

    - QCOM ASoC drivers;

    - Simple audio multiplexer codec driver;

    - Texas InstrumentS Audio (ASoC/HDA) drivers;

    - SoC Audio for Freescale CPUs drivers;

    - Amlogic Meson SoC drivers;

    - SOF drivers;

    - NVIDIA Tegra ASoC drivers;

    - USB sound devices;

    - Perf tools;

    - KVM subsystem; (CVE-2025-37807, CVE-2026-23265, CVE-2026-43022, CVE-2026-46321, CVE-2026-46322,     CVE-2026-52917, CVE-2026-52923, CVE-2026-52927, CVE-2026-52929, CVE-2026-52935, CVE-2026-52942,     CVE-2026-52943, CVE-2026-52947, CVE-2026-52994, CVE-2026-53136, CVE-2026-53137, CVE-2026-53138,     CVE-2026-53143, CVE-2026-53146, CVE-2026-53147, CVE-2026-53149, CVE-2026-53156, CVE-2026-53157,     CVE-2026-53160, CVE-2026-53161, CVE-2026-53184, CVE-2026-53189, CVE-2026-53194, CVE-2026-53195,     CVE-2026-53199, CVE-2026-53202, CVE-2026-53205, CVE-2026-53209, CVE-2026-53223, CVE-2026-53229,     CVE-2026-53253, CVE-2026-53255, CVE-2026-53267, CVE-2026-53268, CVE-2026-53272, CVE-2026-53329,     CVE-2026-53330, CVE-2026-53356, CVE-2026-53362, CVE-2026-53365, CVE-2026-53366, CVE-2026-53381,     CVE-2026-53383, CVE-2026-53387, CVE-2026-53388, CVE-2026-53389, CVE-2026-53390, CVE-2026-53391,     CVE-2026-53392, CVE-2026-53397, CVE-2026-53400, CVE-2026-53401, CVE-2026-53402, CVE-2026-63794,     CVE-2026-63802, CVE-2026-63803, CVE-2026-63805, CVE-2026-63806, CVE-2026-63809, CVE-2026-63812,     CVE-2026-63814, CVE-2026-63816, CVE-2026-63817, CVE-2026-63819, CVE-2026-63823, CVE-2026-63824,     CVE-2026-63827, CVE-2026-63833, CVE-2026-63867, CVE-2026-63869, CVE-2026-63870, CVE-2026-63875,     CVE-2026-63879, CVE-2026-63881, CVE-2026-63884, CVE-2026-63889, CVE-2026-63909, CVE-2026-63913,     CVE-2026-63920, CVE-2026-63925, CVE-2026-63927, CVE-2026-63930, CVE-2026-63942, CVE-2026-63954,     CVE-2026-63968, CVE-2026-63970, CVE-2026-63971, CVE-2026-63985, CVE-2026-64002, CVE-2026-64003,     CVE-2026-64004, CVE-2026-64005, CVE-2026-64009, CVE-2026-64017, CVE-2026-64023, CVE-2026-64026,     CVE-2026-64036, CVE-2026-64095, CVE-2026-64123, CVE-2026-64188, CVE-2026-64189, CVE-2026-64210,     CVE-2026-64222, CVE-2026-64239, CVE-2026-64242, CVE-2026-64243, CVE-2026-64245, CVE-2026-64246,     CVE-2026-64266, CVE-2026-64270, CVE-2026-64271, CVE-2026-64272, CVE-2026-64273, CVE-2026-64274,     CVE-2026-64276, CVE-2026-64277, CVE-2026-64279, CVE-2026-64283, CVE-2026-64286, CVE-2026-64287,     CVE-2026-64296, CVE-2026-64298, CVE-2026-64299, CVE-2026-64304, CVE-2026-64312, CVE-2026-64317,     CVE-2026-64318, CVE-2026-64322, CVE-2026-64323, CVE-2026-64324, CVE-2026-64333, CVE-2026-64368,     CVE-2026-64372, CVE-2026-64374, CVE-2026-64375, CVE-2026-64378, CVE-2026-64379, CVE-2026-64380,     CVE-2026-64388, CVE-2026-64389, CVE-2026-64395, CVE-2026-64398, CVE-2026-64401, CVE-2026-64402,     CVE-2026-64403, CVE-2026-64411, CVE-2026-64412, CVE-2026-64413, CVE-2026-64418, CVE-2026-64420,     CVE-2026-64422, CVE-2026-64423, CVE-2026-64430, CVE-2026-64432, CVE-2026-64435, CVE-2026-64436,     CVE-2026-64440, CVE-2026-64442, CVE-2026-64443, CVE-2026-64444, CVE-2026-64448, CVE-2026-64449,     CVE-2026-64452, CVE-2026-64456, CVE-2026-64463, CVE-2026-64468, CVE-2026-64469, CVE-2026-64481,     CVE-2026-64496, CVE-2026-64524, CVE-2026-64532, CVE-2026-64533, CVE-2026-64536, CVE-2026-64539,     CVE-2026-64540, CVE-2026-64543, CVE-2026-64545, CVE-2026-64546, CVE-2026-64547, CVE-2026-64550,     CVE-2026-64556, CVE-2026-64560, CVE-2026-64563, CVE-2026-64567, CVE-2026-64568, CVE-2026-64570,     CVE-2026-64574, CVE-2026-64576, CVE-2026-64577, CVE-2026-64578, CVE-2026-64580, CVE-2026-64581,     CVE-2026-64582, CVE-2026-64583, CVE-2026-64584, CVE-2026-64585, CVE-2026-64599, CVE-2026-64600,     CVE-2026-68091, CVE-2026-68096, CVE-2026-68097, CVE-2026-68098, CVE-2026-68100, CVE-2026-68104,     CVE-2026-68106, CVE-2026-68107, CVE-2026-68108, CVE-2026-68116, CVE-2026-68118, CVE-2026-68119,     CVE-2026-68121, CVE-2026-68125, CVE-2026-68129, CVE-2026-68131, CVE-2026-68140, CVE-2026-68141,     CVE-2026-68142, CVE-2026-68143, CVE-2026-68145, CVE-2026-68148, CVE-2026-68149, CVE-2026-68153,     CVE-2026-68155, CVE-2026-68157, CVE-2026-68178, CVE-2026-68179, CVE-2026-68189, CVE-2026-68192,     CVE-2026-68196, CVE-2026-68199, CVE-2026-68202, CVE-2026-68204, CVE-2026-68216, CVE-2026-68219,     CVE-2026-68222, CVE-2026-68236, CVE-2026-68245, CVE-2026-68253, CVE-2026-68255, CVE-2026-68258,     CVE-2026-68260, CVE-2026-68262, CVE-2026-68263, CVE-2026-68266, CVE-2026-68273, CVE-2026-68284,     CVE-2026-68287, CVE-2026-68290, CVE-2026-68293, CVE-2026-68294, CVE-2026-68297, CVE-2026-68299,     CVE-2026-68314, CVE-2026-68315, CVE-2026-68320, CVE-2026-68322, CVE-2026-68323, CVE-2026-68326,     CVE-2026-68329, CVE-2026-68335, CVE-2026-68338, CVE-2026-68340, CVE-2026-68348, CVE-2026-68352,     CVE-2026-68353, CVE-2026-68354, CVE-2026-68370, CVE-2026-68371, CVE-2026-68373, CVE-2026-68376,     CVE-2026-68377, CVE-2026-68383, CVE-2026-68389, CVE-2026-68391, CVE-2026-68392, CVE-2026-68397,     CVE-2026-68398, CVE-2026-68399, CVE-2026-68400, CVE-2026-68401, CVE-2026-68402, CVE-2026-68404,     CVE-2026-68408, CVE-2026-68409, CVE-2026-68414, CVE-2026-68417, CVE-2026-68419, CVE-2026-68425,     CVE-2026-68432, CVE-2026-68433, CVE-2026-68442, CVE-2026-68445, CVE-2026-68446, CVE-2026-68447,     CVE-2026-68451, CVE-2026-68452, CVE-2026-68453, CVE-2026-68454, CVE-2026-68466, CVE-2026-68467,     CVE-2026-68471, CVE-2026-68474, CVE-2026-68479, CVE-2026-72005, CVE-2026-72009, CVE-2026-72012,     CVE-2026-72019, CVE-2026-72021, CVE-2026-72024, CVE-2026-72029, CVE-2026-72035, CVE-2026-72036,     CVE-2026-72045, CVE-2026-72049, CVE-2026-72051, CVE-2026-72052, CVE-2026-72053, CVE-2026-72054,     CVE-2026-72055, CVE-2026-72057, CVE-2026-72061, CVE-2026-72066, CVE-2026-72067, CVE-2026-72072,     CVE-2026-72089, CVE-2026-72099, CVE-2026-72102, CVE-2026-72105, CVE-2026-72107, CVE-2026-72108,     CVE-2026-72109, CVE-2026-72110, CVE-2026-72113, CVE-2026-72114, CVE-2026-72115, CVE-2026-72116,     CVE-2026-72117, CVE-2026-72118, CVE-2026-72119, CVE-2026-72120, CVE-2026-72121, CVE-2026-72122,     CVE-2026-72123, CVE-2026-72133, CVE-2026-72135, CVE-2026-72136, CVE-2026-72144, CVE-2026-72146,     CVE-2026-72148, CVE-2026-72149, CVE-2026-72157, CVE-2026-72160, CVE-2026-72162, CVE-2026-72164,     CVE-2026-72165, CVE-2026-72170, CVE-2026-72171, CVE-2026-72172, CVE-2026-72175, CVE-2026-72181,     CVE-2026-72195, CVE-2026-72196, CVE-2026-72197, CVE-2026-72213, CVE-2026-72225, CVE-2026-72227,     CVE-2026-72231, CVE-2026-72232, CVE-2026-72233, CVE-2026-72235, CVE-2026-72242, CVE-2026-72243,     CVE-2026-72244, CVE-2026-72247, CVE-2026-72250, CVE-2026-72252, CVE-2026-72253, CVE-2026-72254,     CVE-2026-72261, CVE-2026-72262, CVE-2026-72282, CVE-2026-72284, CVE-2026-72297, CVE-2026-72298,     CVE-2026-72301, CVE-2026-72302, CVE-2026-72304, CVE-2026-72310, CVE-2026-72312, CVE-2026-72314,     CVE-2026-72330, CVE-2026-72334, CVE-2026-72335, CVE-2026-72338, CVE-2026-72340, CVE-2026-72342,     CVE-2026-72343, CVE-2026-72347, CVE-2026-72350, CVE-2026-72352, CVE-2026-72369, CVE-2026-72371,     CVE-2026-72373, CVE-2026-72374, CVE-2026-72375, CVE-2026-72378, CVE-2026-72382, CVE-2026-72389,     CVE-2026-72390, CVE-2026-72397, CVE-2026-72400, CVE-2026-72404, CVE-2026-72405, CVE-2026-72406,     CVE-2026-72409, CVE-2026-72410, CVE-2026-72416, CVE-2026-72418, CVE-2026-72419, CVE-2026-72420,     CVE-2026-72423, CVE-2026-72425, CVE-2026-72427, CVE-2026-72435, CVE-2026-72438, CVE-2026-72440,     CVE-2026-72444, CVE-2026-72449, CVE-2026-72450, CVE-2026-72459, CVE-2026-72460, CVE-2026-72464,     CVE-2026-72469, CVE-2026-72470, CVE-2026-72476, CVE-2026-72478, CVE-2026-72480, CVE-2026-72483,     CVE-2026-72485, CVE-2026-72492, CVE-2026-72502, CVE-2026-74256, CVE-2026-74257, CVE-2026-74258,     CVE-2026-74262, CVE-2026-74270, CVE-2026-74281, CVE-2026-74282, CVE-2026-74283, CVE-2026-74288,     CVE-2026-74289, CVE-2026-74292, CVE-2026-74293, CVE-2026-74294, CVE-2026-74295, CVE-2026-74296,     CVE-2026-74297, CVE-2026-74300, CVE-2026-74312, CVE-2026-74313, CVE-2026-74314, CVE-2026-74317,     CVE-2026-74321, CVE-2026-74330, CVE-2026-74334, CVE-2026-74338, CVE-2026-74340, CVE-2026-74341,     CVE-2026-74344, CVE-2026-74347, CVE-2026-74349, CVE-2026-74356, CVE-2026-74359, CVE-2026-74363,     CVE-2026-74365, CVE-2026-74374, CVE-2026-74375, CVE-2026-74377, CVE-2026-74378, CVE-2026-74380,     CVE-2026-74385, CVE-2026-74387, CVE-2026-74388, CVE-2026-74390, CVE-2026-74397, CVE-2026-74438,     CVE-2026-74443, CVE-2026-74444, CVE-2026-74446, CVE-2026-74450, CVE-2026-74453, CVE-2026-74454,     CVE-2026-74456, CVE-2026-74461, CVE-2026-74465, CVE-2026-74467, CVE-2026-74469, CVE-2026-74470,     CVE-2026-74471, CVE-2026-74479, CVE-2026-74481, CVE-2026-74482, CVE-2026-74485, CVE-2026-74488,     CVE-2026-74490, CVE-2026-74492, CVE-2026-74496, CVE-2026-74497, CVE-2026-74507, CVE-2026-74508,     CVE-2026-74509, CVE-2026-74510, CVE-2026-74512, CVE-2026-74515, CVE-2026-74516, CVE-2026-74518,     CVE-2026-74519, CVE-2026-74522, CVE-2026-74523, CVE-2026-74527, CVE-2026-74530, CVE-2026-74531,     CVE-2026-74533, CVE-2026-74534, CVE-2026-74535, CVE-2026-74536, CVE-2026-74537, CVE-2026-74540,     CVE-2026-74544, CVE-2026-74548, CVE-2026-74549, CVE-2026-74550, CVE-2026-74551, CVE-2026-74557,     CVE-2026-74563, CVE-2026-74564, CVE-2026-74565, CVE-2026-74567, CVE-2026-74572, CVE-2026-74574,     CVE-2026-74575, CVE-2026-74578, CVE-2026-74579, CVE-2026-74580, CVE-2026-74581, CVE-2026-74582,     CVE-2026-74583, CVE-2026-74584, CVE-2026-74586, CVE-2026-74587, CVE-2026-74588, CVE-2026-74589,     CVE-2026-74590, CVE-2026-74592, CVE-2026-74594, CVE-2026-74595, CVE-2026-74597, CVE-2026-74598,     CVE-2026-74601, CVE-2026-74603, CVE-2026-74604, CVE-2026-74605, CVE-2026-74606, CVE-2026-74607,     CVE-2026-74608, CVE-2026-74609, CVE-2026-74610, CVE-2026-74611, CVE-2026-74612, CVE-2026-74613,     CVE-2026-74614, CVE-2026-74615, CVE-2026-74616, CVE-2026-74621, CVE-2026-74624, CVE-2026-74625,     CVE-2026-74626, CVE-2026-74628, CVE-2026-74630, CVE-2026-74631, CVE-2026-74632, CVE-2026-74634,     CVE-2026-74635, CVE-2026-74637, CVE-2026-74641, CVE-2026-74646, CVE-2026-74647, CVE-2026-74648,     CVE-2026-74649, CVE-2026-74651, CVE-2026-74656, CVE-2026-74660, CVE-2026-74661, CVE-2026-74662,     CVE-2026-74663, CVE-2026-74666, CVE-2026-74667, CVE-2026-74668, CVE-2026-74669, CVE-2026-74670,     CVE-2026-74675, CVE-2026-74678, CVE-2026-74684, CVE-2026-74687, CVE-2026-74688, CVE-2026-74689,     CVE-2026-74690, CVE-2026-74691, CVE-2026-74692, CVE-2026-74695, CVE-2026-74696, CVE-2026-74697,     CVE-2026-74700, CVE-2026-74701, CVE-2026-74704, CVE-2026-74705, CVE-2026-74710, CVE-2026-74711,     CVE-2026-74713, CVE-2026-74714, CVE-2026-74715, CVE-2026-74717, CVE-2026-74720, CVE-2026-74723,     CVE-2026-74724, CVE-2026-74725, CVE-2026-74726, CVE-2026-74730, CVE-2026-74733, CVE-2026-74736,     CVE-2026-74737, CVE-2026-74739, CVE-2026-74743, CVE-2026-74744, CVE-2026-74746, CVE-2026-74747,     CVE-2026-74748, CVE-2026-74752, CVE-2026-80521, CVE-2026-80526, CVE-2026-80527, CVE-2026-80528,     CVE-2026-80536, CVE-2026-80540, CVE-2026-80541, CVE-2026-80547, CVE-2026-80548, CVE-2026-80549,     CVE-2026-80550, CVE-2026-80551, CVE-2026-80552, CVE-2026-80553, CVE-2026-80554, CVE-2026-80555,     CVE-2026-80556, CVE-2026-80557, CVE-2026-80558, CVE-2026-80559, CVE-2026-80560, CVE-2026-80561,     CVE-2026-80565, CVE-2026-80568, CVE-2026-80569, CVE-2026-80570, CVE-2026-80572, CVE-2026-80574,     CVE-2026-80576, CVE-2026-80578, CVE-2026-80579, CVE-2026-80580, CVE-2026-80583, CVE-2026-80584,     CVE-2026-80585, CVE-2026-80586, CVE-2026-80587, CVE-2026-80589, CVE-2026-80721, CVE-2026-80901,     CVE-2026-97509)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of kernel installed on the remote host is prior to 5.10.268-266.1092. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.10-2026-132 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    drm/virtio: use uninterruptible resv lock for plane updates (CVE-2026-64098)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf: Reject BPF_MAP_TYPE_INODE_STORAGE creation if BPF LSM is uninitialized

    When CONFIG_BPF_LSM=y is set, BPF inode storage maps(BPF_MAP_TYPE_INODE_STORAGE) are compiled into the     kernel. However,if the BPF LSM is not explicitly enabled at boot time (e.g. omittedfrom the lsm= boot     parameter), lsm_prepare() is never executed forthe BPF LSM.

    Consequently, the BPF inode security blob offset(bpf_lsm_blob_sizes.lbs_inode) is never initialized and     remains atits default compiled size of 8 bytes instead of being updated to avalid offset past the reserved     struct rcu_head (typically 16 bytesor more).

    When a privileged user creates and updates a BPF_MAP_TYPE_INODE_STORAGEmap, bpf_inode() evaluates     inode->i_security + 8. This erroneouslyaliases the struct rcu_head.func callback pointer at the     beginningof the inode->i_security blob. During subsequent map element cleanupor inode destruction, writing     NULL to owner_storage clears the queuedRCU callback pointer. When rcu_do_batch() later executes the     queuedcallback, it attempts an instruction fetch at address 0x0, triggeringan immediate kernel panic.

    Fix this by introducing a global bpf_lsm_initialized boolean flagmarked with __ro_after_init. Set this     flag to true inside bpf_lsm_init()when the LSM framework successfully registers the BPF LSM. Gate     mapallocation in inode_storage_map_alloc() on this flag, returning-EOPNOTSUPP if the BPF LSM is in turn     uninitialized.

    This fail-fast approach prevents userspace from allocating inodestorage maps when the supporting BPF LSM     infrastructure is absent,avoiding zombie map states. (CVE-2026-64192)

    In the Linux kernel, the following vulnerability has been resolved:

    i2c: core: fix adapter deregistration race (CVE-2026-64279)

    In the Linux kernel, the following vulnerability has been resolved:

    libceph: fix two unsafe bare decodes in decode_lockers() (CVE-2026-68082)

    In the Linux kernel, the following vulnerability has been resolved:

    audit: fix recursive locking deadlock in audit_dupe_exe() (CVE-2026-68096)

    In the Linux kernel, the following vulnerability has been resolved:

    super: fix emergency thaw deadlock on frozen block devices (CVE-2026-68132)

    In the Linux kernel, the following vulnerability has been resolved:

    net: gro: fix double aggregation of flush-marked skbs (CVE-2026-68136)

    In the Linux kernel, the following vulnerability has been resolved:

    ftrace: Add global mutex to serialize trace_parser access (CVE-2026-68146)

    In the Linux kernel, the following vulnerability has been resolved:

    libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CVE-2026-68159)

    In the Linux kernel, the following vulnerability has been resolved:

    sctp: avoid auth_enable sysctl UAF during netns teardown (CVE-2026-68162)

    In the Linux kernel, the following vulnerability has been resolved:

    drm/virtio: bound EDID block reads to the response buffer (CVE-2026-68255)

    In the Linux kernel, the following vulnerability has been resolved:

    drm/dp/mst: fix OOB reads on 2-byte fields in sideband reply parsers (CVE-2026-68277)

    In the Linux kernel, the following vulnerability has been resolved:

    drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CVE-2026-68278)

    In the Linux kernel, the following vulnerability has been resolved:

    drm/dp/mst: fix OOB reads in remote DPCD/I2C sideband reply parsers (CVE-2026-68279)

    In the Linux kernel, the following vulnerability has been resolved:

    mmc: vub300: fix use-after-free on probe failure (CVE-2026-72073)

    In the Linux kernel, the following vulnerability has been resolved:

    scsi: target: Bound PR-OUT TransportID parsing to the received buffer (CVE-2026-72084)

    In the Linux kernel, the following vulnerability has been resolved:

    scsi: lpfc: Fix memory leak in lpfc_sli4_driver_resource_setup() (CVE-2026-72087)

    In the Linux kernel, the following vulnerability has been resolved:

    dm-verity: make error counter atomic (CVE-2026-72096)

    In the Linux kernel, the following vulnerability has been resolved:

    dm-integrity: don't increment hash_offset twice (CVE-2026-72099)

    In the Linux kernel, the following vulnerability has been resolved:

    jbd2: fix integer underflow in jbd2_journal_initialize_fast_commit() (CVE-2026-72225)

    In the Linux kernel, the following vulnerability has been resolved:

    selinux: avoid sk_socket dereference in selinux_sctp_bind_connect() (CVE-2026-72242)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: nft_set_pipapo: don't leak bad clone into future transaction (CVE-2026-72252)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: nf_conntrack_sip: validate skb_dst() before accessing it (CVE-2026-72253)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CVE-2026-72255)

    In the Linux kernel, the following vulnerability has been resolved:

    KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (CVE-2026-72288)

    In the Linux kernel, the following vulnerability has been resolved:

    tipc: restrict socket queue dumps in enqueue tracepoints (CVE-2026-72299)

    In the Linux kernel, the following vulnerability has been resolved:

    mlxsw: fix refcount leak in mlxsw_sp_port_lag_join() (CVE-2026-72308)

    In the Linux kernel, the following vulnerability has been resolved:

    sctp: add INIT verification after cookie unpacking (CVE-2026-72398)

    In the Linux kernel, the following vulnerability has been resolved:

    sctp: fix err_chunk memory leaks in INIT handling (CVE-2026-72413)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: nft_compat: ebtables emulation must reject non-bridge targets (CVE-2026-72416)

    In the Linux kernel, the following vulnerability has been resolved:

    xprtrdma: Repost Receive buffers for malformed replies (CVE-2026-72464)

    In the Linux kernel, the following vulnerability has been resolved:

    RDMA/rxe: Fix TOCTOU heap overflow in get_srq_wqe (CVE-2026-74378)

    In the Linux kernel, the following vulnerability has been resolved:

    OPP: Fix race between OPP addition and lookup (CVE-2026-74405)

    In the Linux kernel, the following vulnerability has been resolved:

    scsi: scsi_debug: Fix REPORT ZONES alloc_len underflow OOB write (CVE-2026-74470)

    In the Linux kernel, the following vulnerability has been resolved:

    net: pktgen: fix proc entry use-after-free (CVE-2026-74479)

    In the Linux kernel, the following vulnerability has been resolved:

    binfmt_misc: restore write access when removing an entry (CVE-2026-74487)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: nf_tables: make nft_object rhltable per table (CVE-2026-74565)

    In the Linux kernel, the following vulnerability has been resolved:

    packet: use consistent hard_header_len in non-ring send paths (CVE-2026-74582)

    In the Linux kernel, the following vulnerability has been resolved:

    sched/psi: Shut down rtpoll_timer in psi_cgroup_free() (CVE-2026-74594)

    In the Linux kernel, the following vulnerability has been resolved:

    ring-buffer: Use current_context for safe per-CPU buffer swap (CVE-2026-74601)

    In the Linux kernel, the following vulnerability has been resolved:

    net/sched: act_gact, act_police: range check the fallback control action (CVE-2026-74620)

    In the Linux kernel, the following vulnerability has been resolved:

    mm/huge_memory: fix huge_zero_pfn race (CVE-2026-74632)

    In the Linux kernel, the following vulnerability has been resolved:

    perf/core: Fix group leader use-after-free after sibling detach (CVE-2026-74637)

    In the Linux kernel, the following vulnerability has been resolved:

    ipv4: Fix fib_nlmsg_size() for RTA_VIA nexthops (CVE-2026-74657)

    In the Linux kernel, the following vulnerability has been resolved:

    inet: frags: publish queues before arming timer (CVE-2026-74662)

    In the Linux kernel, the following vulnerability has been resolved:

    net/sched: reject overly deep qdisc hierarchies (CVE-2026-74663)

    In the Linux kernel, the following vulnerability has been resolved:

    packet: synchronize pressure clearing with ring reconfiguration (CVE-2026-74666)

    In the Linux kernel, the following vulnerability has been resolved:

    packet: use consistent hard_header_len in TX_RING send path (CVE-2026-74668)

    In the Linux kernel, the following vulnerability has been resolved:

    net: tap: set skb->dev before parsing virtio net header in tap_get_user_xdp() (CVE-2026-74684)

    In the Linux kernel, the following vulnerability has been resolved:

    net/sched: cls_api: Always acquire rtnl_lock when destroying locked classifiers (CVE-2026-74700)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: flowtable: publish GC-visible tuple last (CVE-2026-74746)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: ipset: fix refcount race between list:set GC and swap (CVE-2026-74748)

    In the Linux kernel, the following vulnerability has been resolved:

    ceph: fix hanging __ceph_get_caps() with stale mds_wanted (CVE-2026-80527)

    In the Linux kernel, the following vulnerability has been resolved:

    ceph: avoid fs reclaim while using current->journal_info (CVE-2026-80528)

    In the Linux kernel, the following vulnerability has been resolved:

    xfs: fix ilock leak on error in xfs_dq_get_next_id (CVE-2026-80534)

    In the Linux kernel, the following vulnerability has been resolved:

    xfs: bounds-check buffer log item's dirty bitmap (CVE-2026-80536)

    In the Linux kernel, the following vulnerability has been resolved:

    libceph: fix OOB read in decode_watchers() via missing bounds check (CVE-2026-80557)

    In the Linux kernel, the following vulnerability has been resolved:

    libceph: Avoid using invalid osd indices from primary_temp (CVE-2026-80558)

    In the Linux kernel, the following vulnerability has been resolved:

    libceph: fix multiple unsafe decodes in decode_locker() (CVE-2026-80561)

    In the Linux kernel, the following vulnerability has been resolved:

    mptcp: options: reset DSS fields in case of unexpected size (CVE-2026-80586)

    In the Linux kernel, the following vulnerability has been resolved:

    inet: frags: strip GSO state from fragments before reassembly (CVE-2026-80590)

    In the Linux kernel, the following vulnerability has been resolved:

    serial: amba-pl011: synchronize DMA teardown (CVE-2026-80737)

    In the Linux kernel, the following vulnerability has been resolved:

    af_packet: Don't send zero-byte data in tpacket_snd(). (CVE-2026-80742)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: nf_tables_offload: suppress WARN_ON_ONCE for ENOMEM in abort path (CVE-2026-80744)

    In the Linux kernel, the following vulnerability has been resolved:

    selinux: do not cancel a policy conversion that never started (CVE-2026-80756)

    In the Linux kernel, the following vulnerability has been resolved:

    selinux: reject a class permission count below its inherited common (CVE-2026-80757)

    In the Linux kernel, the following vulnerability has been resolved:

    HID: hyperv: validate initial device info bounds (CVE-2026-80765)

    In the Linux kernel, the following vulnerability has been resolved:

    HID: core: fix OOB read of field->usage in hid_set_field() (CVE-2026-80781)

    In the Linux kernel, the following vulnerability has been resolved:

    ipv6: fix use-after-free in ip6_finish_output2() (CVE-2026-80792)

    In the Linux kernel, the following vulnerability has been resolved:

    ipv4: reject undersized MTUs in ip_do_fragment() (CVE-2026-80793)

    In the Linux kernel, the following vulnerability has been resolved:

    xfs: validate attr entry pointer before field access (CVE-2026-80805)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: stop retrying saturated xattr cache entries (CVE-2026-80808)

    In the Linux kernel, the following vulnerability has been resolved:

    rndis_host: add overflow check in rndis_rx_fixup() (CVE-2026-80814)

    In the Linux kernel, the following vulnerability has been resolved:

    net: packet: fix wrong transport_header when sending VLAN-tagged frame (CVE-2026-80906)

    In the Linux kernel, the following vulnerability has been resolved:

    selinux: require every boolean value to be defined (CVE-2026-80913)

    In the Linux kernel, the following vulnerability has been resolved:

    HID: core: fix number/pointer type confusion on long items (CVE-2026-80918)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4369-1 advisory.

    The SUSE Linux Enterprise 15 SP6 kernel was updated to fix various security issues:

    The following security issues were fixed:

    - CVE-2024-57841,CVE-2026-53260: net: fix memory leak in tcp_conn_request() (bsc#1235944 bsc#1269731).
    - CVE-2025-68214: timers: Fix NULL function pointer race in timer_shutdown_sync() (bsc#1255225).
    - CVE-2026-23451: bonding: prevent potential infinite loop in bond_header_parse() (bsc#1261604).
    - CVE-2026-31502: team: fix header_ops type confusion with non-Ethernet ports (bsc#1263072).
    - CVE-2026-43147: Revert 'PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV'     (bsc#1264642).
    - CVE-2026-43456: bonding: fix type confusion in bond_setup_by_slave() (bsc#1264734).
    - CVE-2026-45968: cpuidle: Skip governor when only one idle state is available (bsc#1267023).
    - CVE-2026-52910: bpf: Free reuseport cBPF prog after RCU grace period (bsc#1268659).
    - CVE-2026-52912: netfilter: nf_queue: hold bridge skb->dev while queued (bsc#1269000).
    - CVE-2026-52929: sctp: stream: fully roll back denied add-stream state (bsc#1269004).
    - CVE-2026-52977: futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (bsc#1269242).
    - CVE-2026-52994: vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (bsc#1269126).
    - CVE-2026-53059: dm log: fix out-of-bounds write due to region_count overflow (bsc#1269655).
    - CVE-2026-53110: selftests/bpf: Add ASSERT_OK_FD macro (bsc#1269985).
    - CVE-2026-53163: locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (bsc#1269306).
    - CVE-2026-53264: net/sched: act_api: use RCU with deferred freeing for action lifecycle (bsc#1269238).
    - CVE-2026-53365: vsock/virtio: fix zerocopy completion for multi-skb sends (bsc#1271365).
    - CVE-2026-53381: virtiofs: fix UAF on submount umount (bsc#1271830).
    - CVE-2026-63801: tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (bsc#1272230).
    - CVE-2026-63823: keys: Pin request_key_auth payload in instantiate paths (bsc#1272182).
    - CVE-2026-63827: apparmor: fix use-after-free in rawdata dedup loop (bsc#1272179).
    - CVE-2026-63879: drm/amdgpu: fix amdgpu_hmm_range_get_pages (bsc#1272569).
    - CVE-2026-63881: drm/amdkfd: fix a vulnerability of integer overflow in kfd debugger (bsc#1272571).
    - CVE-2026-63887: scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (bsc#1272385).
    - CVE-2026-63888: scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd()     (bsc#1272390).
    - CVE-2026-63920: ipv6: validate extension header length before copying to cmsg (bsc#1272877).
    - CVE-2026-63944: Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (bsc#1272662).
    - CVE-2026-63970: vsock/virtio: bind uarg before filling zerocopy skb (bsc#1272673).
    - CVE-2026-63992: tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (bsc#1272868).
    - CVE-2026-64000: net: hsr: fix potential OOB access in supervision frame handling (bsc#1273030).
    - CVE-2026-64002: ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table()     (bsc#1273774).
    - CVE-2026-64007: netfilter: synproxy: refresh tcphdr after skb_ensure_writable (bsc#1273105).
    - CVE-2026-64010: nfc: llcp: Fix use-after-free race in nfc_llcp_recv_cc() (bsc#1273882).
    - CVE-2026-64011: nfc: llcp: Fix use-after-free in llcp_sock_release() (bsc#1273891).
    - CVE-2026-64015: security/keys: fix missed RCU read section on lookup (bsc#1273762).
    - CVE-2026-64029: ALSA: seq: Serialize UMP output teardown with event_input (bsc#1273766).
    - CVE-2026-64048: net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (bsc#1273484).
    - CVE-2026-64098: drm/virtio: use uninterruptible resv lock for plane updates (bsc#1273488).
    - CVE-2026-64109: af_unix: Peek the queue synchronized (bsc#1273748).
    - CVE-2026-64114: ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (bsc#1273742).
    - CVE-2026-64115: vsock/vmci: fix UAF when peer resets connection during handshake (bsc#1273745).
    - CVE-2026-64121: net: ifb: report ethtool stats over num_tx_queues (bsc#1273743).
    - CVE-2026-64217: netfs: Fix overrun check in netfs_extract_user_iter() (bsc#1272798).
    - CVE-2026-64268: RDMA/siw: bound Read Response placement to the RREAD length (bsc#1273276).
    - CVE-2026-64304: crypto: qat - validate RSA CRT component lengths (bsc#1273944).
    - CVE-2026-64312: crypto: pcrypt - restore callback for non-parallel fallback (bsc#1273968).
    - CVE-2026-64355: bpf: Reject fragmented frames in devmap (bsc#1273422).
    - CVE-2026-64383: smb: client: fix double-free in SMB2_flush() replay (bsc#1273426).
    - CVE-2026-64384: smb: client: fix change notify replay double-free (bsc#1274541).
    - CVE-2026-64385: smb: client: fix double-free in SMB2_ioctl() replay (bsc#1274539).
    - CVE-2026-64386: smb: client: fix query_info() replay double-free (bsc#1274543).
    - CVE-2026-64387: smb: client: fix query directory replay double-free (bsc#1274545).
    - CVE-2026-64423: ipv4: igmp: remove multicast group from hash table on device destruction (bsc#1274274).
    - CVE-2026-64450: tipc: fix out-of-bounds read in broadcast Gap ACK blocks (bsc#1273523).
    - CVE-2026-64481: ALSA: hda/cs35l41: Fix firmware load work teardown (bsc#1274547).
    - CVE-2026-64541: net/smc: fix UAF in smc_cdc_rx_handler() by pinning the socket (bsc#1273303).
    - CVE-2026-64543: tipc: fix use-after-free of the discoverer in tipc_disc_rcv() (bsc#1273311).
    - CVE-2026-64562: KVM: nVMX: Hide shadow VMCS right after VMCLEAR (bsc#1273930).
    - CVE-2026-64563: rhashtable: clear stale iter->p on table restart (bsc#1273995).
    - CVE-2026-64572: ipv4: fib: free fib_alias with kfree_rcu() on insert error path (bsc#1274014).
    - CVE-2026-64577: gtp: check skb_pull_data() return in gtp1u_send_echo_resp() (bsc#1274031).
    - CVE-2026-64581: xfrm: fix sk_dst_cache double-free in xfrm_user_policy() (bsc#1274041).
    - CVE-2026-64593: btrfs: do not trim a device which is not writeable (bsc#1274497).
    - CVE-2026-68121: pppoe: reload header pointer after dev_hard_header() (bsc#1274888).
    - CVE-2026-68136: net: gro: fix double aggregation of flush-marked skbs (bsc#1275474).
    - CVE-2026-68138: net/sched: serialize qdisc_rtab_list against concurrent get/put (bsc#1274941).
    - CVE-2026-68155: libceph: Reject monmaps advertising zero monitors (bsc#1275304).
    - CVE-2026-68158: libceph: Fix multiplication overflow in decode_new_up_state_weight() (bsc#1275307).
    - CVE-2026-68159: libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (bsc#1275470).
    - CVE-2026-68160: ceph: fix pre-auth out-of-bounds read on snaptrace in ceph_handle_caps() (bsc#1275472).
    - CVE-2026-68202: ALSA: seq: close a re-opened queue timer in the destructor (bsc#1275161).
    - CVE-2026-68397: net/iucv: take a reference on the socket found in afiucv_hs_rcv() (bsc#1274898).
    - CVE-2026-68398: ppp: defer channel free to an RCU grace period to fix pppol2tp RX UAF (bsc#1274908).
    - CVE-2026-68417: RDMA/siw: publish QP after initialization (bsc#1274696).
    - CVE-2026-68426: xfrm: fix stale skb->prev after async crypto steals a GSO segment (bsc#1274705).
    - CVE-2026-68480: x86/bugs: Make Safe-RET robust against interrupt injection (bsc#1274208).
    - CVE-2026-72020: ipvs: reset full ip_vs_seq structs in ip_vs_conn_new (bsc#1275506).
    - CVE-2026-72069: locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (bsc#1275528).
    - CVE-2026-72072: net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (bsc#1277155).
    - CVE-2026-72083: scsi: target: core: Fix iSCSI ISID use-after-free in REGISTER AND MOVE (bsc#1275535).
    - CVE-2026-72084: scsi: target: Bound PR-OUT TransportID parsing to the received buffer (bsc#1275540).
    - CVE-2026-72123: can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (bsc#1277523).
    - CVE-2026-72135: tpm: Make the TPM character devices non-seekable (bsc#1277571).
    - CVE-2026-72221: sunrpc: wait for in-flight TLS handshake callback when cancel loses race (bsc#1275665).
    - CVE-2026-72222: sunrpc: pin svc_xprt across the asynchronous TLS handshake callback (bsc#1275669).
    - CVE-2026-72251: netfilter: nf_nat_sip: reload possible stale data pointer (bsc#1275827).
    - CVE-2026-72262: ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (bsc#1277678).
    - CVE-2026-72288: KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling     (bsc#1275886).
    - CVE-2026-72289: KVM: arm64: vgic: Check the interrupt is still ours before migrating it (bsc#1275905).
    - CVE-2026-72317: SUNRPC: pin upper rpc_clnt across the TLS connect_worker (bsc#1275925).
    - CVE-2026-72339: qede: fix off-by-one in BD ring consumption on build_skb failure (bsc#1276006).
    - CVE-2026-72389: bridge: stp: Fix a potential use-after-free when deleting a bridge (bsc#1273869).
    - CVE-2026-74345: RDMA/siw: Fix endpoint/socket association handling (bsc#1277285).
    - CVE-2026-74377: RDMA/rxe: Copy WQE to local buffer in non-SRQ receive path (bsc#1278236).
    - CVE-2026-74378: RDMA/rxe: Fix TOCTOU heap overflow in get_srq_wqe (bsc#1278233).
    - CVE-2026-74390: RDMA/irdma: Fix out-of-bounds write in irdma_copy_user_pgaddrs (bsc#1278088).
    - CVE-2026-74394: RDMA/srpt: fix integer overflow in immediate data length check (bsc#1277408).
    - CVE-2026-74454: drm/vc4: Supply the overflow slot size in BPOS, not the whole bin BO (bsc#1277073).
    - CVE-2026-74488: wifi: mwifiex: use the subframe length when parsing A-MSDU TDLS frames (bsc#1276350).
    - CVE-2026-74496: fou: Fix use-after-free in fou_create() (bsc#1275867).
    - CVE-2026-74516: KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active     (bsc#1275797).
    - CVE-2026-74518: mm/hugetlb: fix list corruption in allocate_file_region_entries() (bsc#1275798).
    - CVE-2026-74537: Bluetooth: ISO: hold sk properly in iso_conn_ready (bsc#1275687).
    - CVE-2026-74556: scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer     (bsc#1275696).
    - CVE-2026-74581: net: ipv6: clear suppressed fib6 rule result (bsc#1275782).
    - CVE-2026-74582: packet: use consistent hard_header_len in non-ring send paths (bsc#1275784).
    - CVE-2026-74612: veth: fix skb length accounting after XDP frag adjustment (bsc#1277505).
    - CVE-2026-74669: ipvs: clear IPv4 options after rebasing tunnel ICMP errors (bsc#1277391).
    - CVE-2026-74695: netfilter: nf_flow_table: drop existing skb dst before skb_dst_set_noref()     (bsc#1276931).
    - CVE-2026-80722: wifi: mac80211: validate individual TWT params before driver setup (bsc#1277860).

    The following non security issues were fixed:

    - ibmvnic: Only record tx completed bytes once per handler (bsc#1274620).
    - KVM: arm64: vgic: Fix IIDR revision field extracted from wrong value (git-fixes).
    - KVM: x86/mmu: WARN and clear role.invalid when creating a child shadow page (git-fixes).
    - mkspec-dtb: Move DTS prefix into package list.
    - mkspec-dtb: Move provides-obsoletes to package list.
    - mkspec-dtb: Put per-architecture package lists into a hash.
    - mkspec-dtb: re-indent.
    - net: mana: Add debug knob to skip TX timeout recovery reset (git-fixes).
    - net: mana: Add handler for sriov configure (bsc#1272756).
    - net: mana: Cap MSI-X vectors to the device MSI-X table size (git-fixes).
    - net: mana: Extend RX CQE coalescing up to 8 packets (git-fixes).
    - net: mana: Fall back to scattered pages for GDMA queues (git-fixes).
    - net: mana: force full-page RX buffers via ethtool private flag (bsc#1269792).
    - net: mana: refactor mana_get_strings() and mana_get_sset_count() to use switch (bsc#1269792).
    - net: mana: Route ring-buffer access through offset-based helpers (git-fixes).
    - net: tap: set skb->dev before parsing virtio net header in tap_get_user_xdp() (git-fixes bsc#1274550).
    - PCI: hv: Set irq_retrigger callback for the Hyper-V PCI MSI irqchip (git-fixes).
    - powerpc/pseries: lparcfg - fix kbuf[] underflow (bsc#1274753 ltc#221289 bsc#1274754 ltc#221288     bsc#1274752       ltc#221290).
    - RDMA/mana_ib: drain QP references after partial table insertion (git-fixes).
    - RDMA/mana_ib: unify QP lookup table (git-fixes).
    - scsi: storvsc: Support manual scans for all Hyper-V targets (git-fixes).
    - smb/client: handle overlapping allocated ranges in fallocate (bsc#1274902).
    - x86/bugs: Clarify that syscall hardening isn't a BHI mitigation (git-fixes).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4284-1 advisory.

    The SUSE Linux Enterprise 15 SP4 kernel was updated to fix various security issues:

    The following security issues were fixed:

    - CVE-2023-53109: net: tunnels: annotate lockless accesses to dev->needed_headroom (bsc#1242405     bsc#1275784).
    - CVE-2024-57841: net: fix memory leak in tcp_conn_request() (bsc#1235944).
    - CVE-2026-53260: tcp: Add preempt_{disable,enable}_nested() in reqsk_queue_hash_req() (bsc#1269731).
    - CVE-2026-23451: bonding: prevent potential infinite loop in bond_header_parse() (bsc#1261604).
    - CVE-2026-31502: team: fix header_ops type confusion with non-Ethernet ports (bsc#1263072).
    - CVE-2026-43456: bonding: fix type confusion in bond_setup_by_slave() (bsc#1264734).
    - CVE-2026-43502: net/rds: handle zerocopy send cleanup before the message is queued (bsc#1266008).
    - CVE-2026-45968: cpuidle: Skip governor when only one idle state is available (bsc#1267023).
    - CVE-2026-52910: bpf: Free reuseport cBPF prog after RCU grace period (bsc#1268659).
    - CVE-2026-52912: netfilter: nf_queue: hold bridge skb->dev while queued (bsc#1269000).
    - CVE-2026-52929: sctp: stream: fully roll back denied add-stream state (bsc#1269004).
    - CVE-2026-52977: futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (bsc#1269242).
    - CVE-2026-53059: dm log: fix out-of-bounds write due to region_count overflow (bsc#1269655).
    - CVE-2026-53163: locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (bsc#1269306).
    - CVE-2026-53264: net/sched: act_api: use RCU with deferred freeing for action lifecycle (bsc#1269238).
    - CVE-2026-53381: virtiofs: fix UAF on submount umount (bsc#1271830).
    - CVE-2026-63801: tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (bsc#1272230).
    - CVE-2026-63823: keys: Pin request_key_auth payload in instantiate paths (bsc#1272182).
    - CVE-2026-63827: apparmor: fix use-after-free in rawdata dedup loop (bsc#1272179).
    - CVE-2026-63887: scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (bsc#1272385).
    - CVE-2026-63888: scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd()     (bsc#1272390).
    - CVE-2026-63920: ipv6: validate extension header length before copying to cmsg (bsc#1272877).
    - CVE-2026-63992: tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (bsc#1272868).
    - CVE-2026-64002: ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table()     (bsc#1273774).
    - CVE-2026-64007: netfilter: synproxy: refresh tcphdr after skb_ensure_writable (bsc#1273105).
    - CVE-2026-64010: nfc: llcp: Fix use-after-free race in nfc_llcp_recv_cc() (bsc#1273882).
    - CVE-2026-64011: nfc: llcp: Fix use-after-free in llcp_sock_release() (bsc#1273891).
    - CVE-2026-64015: security/keys: fix missed RCU read section on lookup (bsc#1273762).
    - CVE-2026-64047: net: tls: fix off-by-one in sg_chain entry count for wrapped sk_msg ring (bsc#1273060).
    - CVE-2026-64048: net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (bsc#1273484).
    - CVE-2026-64098: drm/virtio: use uninterruptible resv lock for plane updates (bsc#1273488).
    - CVE-2026-64109: af_unix: Peek the queue synchronized (bsc#1273748).
    - CVE-2026-64114: ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (bsc#1273742).
    - CVE-2026-64115: vsock/vmci: fix UAF when peer resets connection during handshake (bsc#1273745).
    - CVE-2026-64268: RDMA/siw: bound Read Response placement to the RREAD length (bsc#1273276).
    - CVE-2026-64304: crypto: qat - validate RSA CRT component lengths (bsc#1273944).
    - CVE-2026-64355: bpf: Reject fragmented frames in devmap (bsc#1273422).
    - CVE-2026-64423: ipv4: igmp: remove multicast group from hash table on device destruction (bsc#1274274).
    - CVE-2026-64450: tipc: fix out-of-bounds read in broadcast Gap ACK blocks (bsc#1273523).
    - CVE-2026-64481: ALSA: hda/cs35l41: Fix firmware load work teardown (bsc#1274547).
    - CVE-2026-64541: net/smc: fix UAF in smc_cdc_rx_handler() by pinning the socket (bsc#1273303).
    - CVE-2026-64543: tipc: fix use-after-free of the discoverer in tipc_disc_rcv() (bsc#1273311).
    - CVE-2026-64556: perf/core: Detach event groups during remove_on_exec (bsc#1273251).
    - CVE-2026-64562: KVM: nVMX: Hide shadow VMCS right after VMCLEAR (bsc#1273930).
    - CVE-2026-64563: rhashtable: clear stale iter->p on table restart (bsc#1273995).
    - CVE-2026-64572: ipv4: fib: free fib_alias with kfree_rcu() on insert error path (bsc#1274014).
    - CVE-2026-64581: xfrm: fix sk_dst_cache double-free in xfrm_user_policy() (bsc#1274041).
    - CVE-2026-64593: btrfs: do not trim a device which is not writeable (bsc#1274497).
    - CVE-2026-68121: pppoe: reload header pointer after dev_hard_header() (bsc#1274888).
    - CVE-2026-68136: net: gro: fix double aggregation of flush-marked skbs (bsc#1275474).
    - CVE-2026-68138: net/sched: serialize qdisc_rtab_list against concurrent get/put (bsc#1274941).
    - CVE-2026-68155: libceph: Reject monmaps advertising zero monitors (bsc#1275304).
    - CVE-2026-68158: libceph: Fix multiplication overflow in decode_new_up_state_weight() (bsc#1275307).
    - CVE-2026-68159: libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (bsc#1275470).
    - CVE-2026-68160: ceph: fix pre-auth out-of-bounds read on snaptrace in ceph_handle_caps() (bsc#1275472).
    - CVE-2026-68202: ALSA: seq: close a re-opened queue timer in the destructor (bsc#1275161).
    - CVE-2026-68397: net/iucv: take a reference on the socket found in afiucv_hs_rcv() (bsc#1274898).
    - CVE-2026-68398: ppp: defer channel free to an RCU grace period to fix pppol2tp RX UAF (bsc#1274908).
    - CVE-2026-68417: RDMA/siw: publish QP after initialization (bsc#1274696).
    - CVE-2026-68426: xfrm: fix stale skb->prev after async crypto steals a GSO segment (bsc#1274705).
    - CVE-2026-68480: x86/bugs: Make Safe-RET robust against interrupt injection (bsc#1274208).
    - CVE-2026-72020: ipvs: reset full ip_vs_seq structs in ip_vs_conn_new (bsc#1275506).
    - CVE-2026-72069: locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (bsc#1275528).
    - CVE-2026-72083: scsi: target: core: Fix iSCSI ISID use-after-free in REGISTER AND MOVE (bsc#1275535).
    - CVE-2026-72084: scsi: target: core: Generate correct identifiers for PR OUT transport IDs (bsc#1275540).
    - CVE-2026-72123: can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (bsc#1277523).
    - CVE-2026-72135: tpm: Make the TPM character devices non-seekable (bsc#1277571).
    - CVE-2026-72164: ocfs2: avoid moving extents to occupied clusters (bsc#1277553).
    - CVE-2026-72251: netfilter: nf_nat_sip: reload possible stale data pointer (bsc#1275827).
    - CVE-2026-72288: KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling     (bsc#1275886).
    - CVE-2026-72289: KVM: arm64: vgic: Check the interrupt is still ours before migrating it (bsc#1275905).
    - CVE-2026-72323: ipv4: igmp: Fix potential UAF in igmp_gq_start_timer() (bsc#1275985).
    - CVE-2026-72339: qede: fix off-by-one in BD ring consumption on build_skb failure (bsc#1276006).
    - CVE-2026-72389: bridge: stp: Fix a potential use-after-free when deleting a bridge (bsc#1273869).
    - CVE-2026-74345: RDMA/siw: Fix endpoint/socket association handling (bsc#1277285).
    - CVE-2026-74377: RDMA/rxe: Copy WQE to local buffer in non-SRQ receive path (bsc#1278236).
    - CVE-2026-74378: RDMA/rxe: Fix TOCTOU heap overflow in get_srq_wqe (bsc#1278233).
    - CVE-2026-74388: ALSA: seq: oss: Fix UAF at handling events with embedded SysEx data (bsc#1278253).
    - CVE-2026-74390: RDMA/irdma: Fix out-of-bounds write in irdma_copy_user_pgaddrs (bsc#1278088).
    - CVE-2026-74394: RDMA/srpt: fix integer overflow in immediate data length check (bsc#1277408).
    - CVE-2026-74406: vxlan: Fix potential null-ptr-deref in vxlan_gro_prepare_receive() (bsc#1276395).
    - CVE-2026-74454: drm/vc4: Supply the overflow slot size in BPOS, not the whole bin BO (bsc#1277073).
    - CVE-2026-74488: wifi: mwifiex: use the subframe length when parsing A-MSDU TDLS frames (bsc#1276350).
    - CVE-2026-74496: fou: Fix use-after-free in fou_create() (bsc#1275867).
    - CVE-2026-74518: mm/hugetlb: fix list corruption in allocate_file_region_entries() (bsc#1275798).
    - CVE-2026-74537: Bluetooth: ISO: hold sk properly in iso_conn_ready (bsc#1275687).
    - CVE-2026-74556: scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer     (bsc#1275696).
    - CVE-2026-74582: packet: use consistent hard_header_len in non-ring send paths (bsc#1275784).
    - CVE-2026-74615: vxlan: do not arm the ageing timer on a device that is down (bsc#1277901).
    - CVE-2026-74616: xdp: reject clones that overrun skb_shared_info tailroom (bsc#1277813).
    - CVE-2026-74669: ipvs: clear IPv4 options after rebasing tunnel ICMP errors (bsc#1277391).
    - CVE-2026-74695: netfilter: nf_flow_table: drop existing skb dst before skb_dst_set_noref()     (bsc#1276931).
    - CVE-2026-74743: macvlan: inherit needed_headroom and needed_tailroom from lowerdev (bsc#1277908).
    - CVE-2026-80580: fbdev: bound mode sysfs output to the sysfs buffer (bsc#1278294).
    - CVE-2026-80714: ipvs: do not propagate one-packet flag to synced conns (bsc#1277561).
    - CVE-2026-80716: ALSA: pcm: wake linked drain waiters on unlink (bsc#1277837).
    - CVE-2026-80737: serial: amba-pl011: synchronize DMA teardown (bsc#1279487).
    - CVE-2026-80909: drm/amdgpu: Reject UVD message with invalid number of h265 refs (bsc#1279422).

    The following non security issues were fixed:

    - mkspec-dtb: Move DTS prefix into package list.
    - mkspec-dtb: Move provides-obsoletes to package list.
    - mkspec-dtb: Put per-architecture package lists into a hash.
    - mkspec-dtb: re-indent.
    - net: tap: set skb->dev before parsing virtio net header in tap_get_user_xdp() (git-fixes bsc#1274550).
    - perf: Reject exited events as group leaders (git-fixes).
    - powerpc/pseries: lparcfg - fix kbuf[] underflow (bsc#1274753 ltc#221289 bsc#1274754 ltc#221288     bsc#1274752       ltc#221290).
    - RDMA/siw: Introduce siw_cep_set_free_and_put (git-fixes).
    - RDMA/siw: Introduce siw_destroy_cep_sock (git-fixes).
    - RDMA/siw: Introduce siw_free_cm_id (git-fixes).
    - RDMA/siw: Only check attrs->cap.max_send_wr in siw_create_qp (git-fixes).
    - smb/client: handle overlapping allocated ranges in fallocate (bsc#1274902).
    - smb: client: require net admin for CIFS SWN netlink (bsc#1273966).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-500329 advisory.

    - net: tun: bound receive headroom (Asim Viladi Oglu Manizada)  [Orabug: 40035523]  {CVE-2026-81000}
    - xfrm: ah6: validate routing header segments_left (Asim Viladi Oglu Manizada)  [Orabug: 40035522]     {CVE-2026-80844}
    - tcp: clear sock_ops cb flags before force-closing a child socket (Sechang Lim)  [Orabug: 40035388]     {CVE-2026-74268}
    - RDMA/rxe: Fix TOCTOU heap overflow in get_srq_wqe (Bjoern Doebel)  [Orabug: 40035390]  {CVE-2026-74378}
    - tcp: fix potential race in tcp_v6_syn_recv_sock() (Eric Dumazet)  [Orabug: 40035386]  {CVE-2026-43198}
    - net: af_key: zero aligned sockaddr tail in PF_KEY exports (Zhengchuan Liang)  [Orabug: 40035384]     {CVE-2026-43088}
    - inet: frags: strip GSO state from fragments before reassembly (Xinyang Ge)  [Orabug: 39974835]     {CVE-2026-80590}
    - KVM: x86/mmu: Stop needlessly making MMU pages available for TDP MMU faults (David Matlack) [Orabug:
    39830590] {CVE-2026-64561}
    - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Sean Christopherson)     [Orabug: 39830590,39832946] {CVE-2026-64561}
    - KVM: x86/mmu: Rename __direct_map() to direct_map() (David Matlack) [Orabug: 39830590] {CVE-2026-64561}
    - KVM: x86/mmu: Split out TDP MMU page fault handling (David Matlack) [Orabug: 39830590] {CVE-2026-64561}
    - KVM: Rename mmu_notifier_* to mmu_invalidate_* (Chao Peng) [Orabug: 39830590] {CVE-2026-64561}
    - KVM: x86/mmu: Document the 'rules' for using host_pfn_mapping_level() (Sean Christopherson) [Orabug:
    39830590] {CVE-2026-64561}
    - KVM: x86/mmu: Rename pte_list_{destroy,remove}() to show they zap SPTEs (Sean Christopherson) [Orabug:
    39830590] {CVE-2026-64561}
    - KVM: x86/mmu: Directly 'destroy' PTE list when recycling rmaps (Sean Christopherson) [Orabug: 39830590]     {CVE-2026-64561}
    - x86/bugs: Make Safe-RET robust against interrupt injection (Borislav Petkov) [Orabug: 39784615,39853775]     {CVE-2026-68480}
    - x86/alternatives: Disable interrupts and sync when optimizing NOPs in place (Thomas Gleixner) [Orabug:
    39784615] {CVE-2026-68480}
    - x86/alternative: Support relocations in alternatives (Peter Zijlstra) [Orabug: 39784615]     {CVE-2026-68480}
    - x86/alternative: Make debug-alternative selective (Peter Zijlstra) [Orabug: 39784615] {CVE-2026-68480}
    - x86/alternatives: Add alt_instr.flags (Borislav Petkov) [Orabug: 39784615] {CVE-2026-68480}
    - x86/asm: Provide ALTERNATIVE_3 (Peter Zijlstra) [Orabug: 39784615] {CVE-2026-68480}
    - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Thomas Gleixner) [Orabug: 39807438]     {CVE-2026-64560}
    - ALSA: seq: Fix uninitialised heap leak in snd_seq_event_dup() (Hyeongjun An) [Orabug: 39853280]     {CVE-2026-64479}
    - crypto: qat - validate RSA CRT component lengths (Giovanni Cabiddu) [Orabug: 39785885] {CVE-2026-64304}
    - btrfs: do not trim a device which is not writeable (Qu Wenruo) [Orabug: 39843586] {CVE-2026-64593}
    - bpf: Allow LPM map access from sleepable BPF programs (Vlad Poenaru) [Orabug: 39786046] {CVE-2026-64352}
    - bpf: Reject fragmented frames in devmap (Zhao Zhang) [Orabug: 39786052] {CVE-2026-64355}
    - HID: appleir: fix UAF on pending key_up_timer in remove() (Manish Khadka) [Orabug: 39786074]     {CVE-2026-64363}
    - proc: protect ptrace_may_access() with exec_update_lock (part 1) (Jann Horn) [Orabug: 39786095]     {CVE-2026-64371}
    - HID: multitouch: fix out-of-bounds bit access on mt_io_flags (Trung Nguyen) [Orabug: 39786078]     {CVE-2026-64364}
    - proc: protect ptrace_may_access() with exec_update_lock (FD links) (Jann Horn) [Orabug: 39786112]     {CVE-2026-64375}
    - smb: client: harden POSIX SID length parsing (Zihan Xi) [Orabug: 39786128] {CVE-2026-64380}
    - smb: client: mask server-provided mode to 07777 in modefromsid (Norbert Manthey) [Orabug: 39786124]     {CVE-2026-64379}
    - smb: client: resolve SWN tcon from live registrations (Michael Bommarito) [Orabug: 39786200]     {CVE-2026-64401}
    - smb: client: Fix next buffer leak in receive_encrypted_standard() (Haoxiang Li) [Orabug: 39786131]     {CVE-2026-64381}
    - Bluetooth: L2CAP: cancel pending_rx_work before taking conn->lock (Runyu Xiao) [Orabug: 39760901]     {CVE-2026-64206}
    - netfilter: ebtables: zero chainstack array (Florian Westphal) [Orabug: 39786232] {CVE-2026-64413}
    - staging: rtl8723bs: fix OOB reads in rtw_get_sec_ie(), rtw_get_wapi_ie(), and rtw_get_wps_attr()     (Alexandru Hossu) [Orabug: 39786307] {CVE-2026-64441}
    - PCI: mediatek: Fix IRQ domain leak when port fails to enable (Manivannan Sadhasivam) [Orabug: 39786366]     {CVE-2026-64461}
    - staging: rtl8723bs: fix heap buffer overflow in rtw_cfg80211_set_wpa_ie() (Alexandru Hossu) [Orabug:
    39786327] {CVE-2026-64446}
    - smb: client: restrict implied bcc[0] exemption to responses without data area (Shoichiro Miyamoto)     [Orabug: 39786332] {CVE-2026-64448}
    - vfio/pci: Release the VGA arbiter client on register_device() failure (Alex Williamson) [Orabug:
    39786409] {CVE-2026-64475}
    - ACPI: NFIT: core: Fix acpi_nfit_init() error cleanup (Rafael J. Wysocki) [Orabug: 39786502]     {CVE-2026-64510}
    - ACPI: CPPC: Suppress UBSAN warning caused by field misuse (Jeremy Linton) [Orabug: 39786508]     {CVE-2026-64512}
    - net: openvswitch: reject oversized nested action attrs (Asim Viladi Oglu Manizada) [Orabug:
    39789564,39816016,39819143] {CVE-2026-64531}
    - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (Shivam Kumar) [Orabug:
    39789573] {CVE-2026-64534}
    - sctp: validate STALE_COOKIE cause length before reading staleness (Weiming Shi) [Orabug: 39794431]     {CVE-2026-64551}
    - netfilter: bridge: fix stale prevhdr pointer in br_ip6_fragment() (Xiang Mei) [Orabug: 39794442]     {CVE-2026-64554}
    - Bluetooth: bpa10x: avoid OOB read of revision string in bpa10x_setup() (Weiming Shi) [Orabug: 39794421]     {CVE-2026-64549}
    - net: usb: net1080: validate packet_len before pad-byte access in rx_fixup (Xiang Mei) [Orabug: 39794412]     {CVE-2026-64547}
    - usbnet: gl620a: fix out-of-bounds read in genelink_rx_fixup() (Xiang Mei) [Orabug: 39794387]     {CVE-2026-64540}
    - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (Jamal Hadi Salim) [Orabug: 39787017]     {CVE-2026-64530}
    - net, bpf: check master for NULL in xdp_master_redirect() (Xiang Mei) [Orabug: 39794405] {CVE-2026-64545}
    - ipv6: Fix null-ptr-deref in fib6_nh_mtu_change(). (Xiang Mei) [Orabug: 39794379] {CVE-2026-64538}
    - drm/edid: fix OOB read in drm_parse_tiled_block() (Xiang Mei) [Orabug: 39794408] {CVE-2026-64546}
    - net: psample: fix info leak in PSAMPLE_ATTR_DATA (Jakub Kicinski) [Orabug: 39794438] {CVE-2026-64553}
    - bpf, sockmap: reject overflowing copy + len in bpf_msg_push_data() (Weiming Shi) [Orabug: 39794417]     {CVE-2026-64548}
    - crypto: asymmetric_keys - fix OOB read in pefile_digest_pe_contents (Weiming Shi) [Orabug: 39794401]     {CVE-2026-64544}
    - xfs: fail recovery on a committed log item with no regions (Weiming Shi) [Orabug: 39760871]     {CVE-2026-64187}
    - fuse: re-lock request before returning from fuse_ref_folio() (Joanne Koong) [Orabug: 39785786]     {CVE-2026-64266}
    - Input: touchwin - reset the packet index on every complete packet (Bryam Vargas) [Orabug: 39785802]     {CVE-2026-64271}
    - Input: elan_i2c - prevent division by zero and arithmetic underflow (Ranjan Kumar) [Orabug: 39785819]     {CVE-2026-64275}
    - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (Bryam Vargas) [Orabug: 39785823]     {CVE-2026-64276}
    - i2c: core: fix adapter deregistration race (Johan Hovold) [Orabug: 39785831] {CVE-2026-64279}
    - KVM: VMX: Grab vmcs12 on CR8 interception update iff vCPU is in guest mode (Sean Christopherson)     [Orabug: 39843616] {CVE-2026-64604}
    - exfat: bound uniname advance in exfat_find_dir_entry() (Bryam Vargas) [Orabug: 39785863]     {CVE-2026-64296}
    - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (Benjamin Coddington) [Orabug: 39785868]     {CVE-2026-64298}
    - tracing: Prevent out-of-bounds read in glob matching (Huihui Huang) [Orabug: 39785872] {CVE-2026-64299}
    - crypto: drbg - Fix returning success on failure in CTR_DRBG (Eric Biggers) [Orabug: 39785893]     {CVE-2026-64306}
    - crypto: pcrypt - restore callback for non-parallel fallback (Ruijie Li) [Orabug: 39785906]     {CVE-2026-64312}
    - crypto: ecc - Fix carry overflow in vli multiplication (Anastasia Tishchenko) [Orabug: 39785910]     {CVE-2026-64313}
    - isofs: bound Rock Ridge symlink components to the SL record (Bryam Vargas) [Orabug: 39785923]     {CVE-2026-64317}
    - udf: validate sparing table length as an entry count, not a byte count (Bryam Vargas) [Orabug: 39785940]     {CVE-2026-64322}
    - udf: validate VAT header length against the VAT inode size (Bryam Vargas) [Orabug: 39785944]     {CVE-2026-64323}
    - udf: validate free block extents against the partition length (Michael Bommarito) [Orabug: 39785948]     {CVE-2026-64324}
    - usb: typec: tcpm: Validate SVID index in svdm_consume_modes() (Badhri Jagan Sridharan) [Orabug:
    39785963] {CVE-2026-64330}
    - usbip: vudc: fix NULL deref in vep_dequeue() (Sam Day) [Orabug: 39785967] {CVE-2026-64331}
    - USB: ulpi: fix memory leak on registration failure (Johan Hovold) [Orabug: 39785971] {CVE-2026-64332}
    - USB: serial: digi_acceleport: fix write buffer corruption (Johan Hovold) [Orabug: 39785975]     {CVE-2026-64333}
    - USB: serial: digi_acceleport: fix hard lockup on disconnect (Johan Hovold) [Orabug: 39785979]     {CVE-2026-64334}
    - USB: serial: digi_acceleport: fix broken rx after throttle (Johan Hovold) [Orabug: 39785983]     {CVE-2026-64335}
    - USB: serial: keyspan_pda: fix information leak (Johan Hovold) [Orabug: 39785987] {CVE-2026-64336}
    - USB: misc: uss720: unregister parport on probe failure (Myeonghun Pak) [Orabug: 39785994]     {CVE-2026-64338}
    - USB: legousbtower: fix use-after-free on disconnect race (Johan Hovold) [Orabug: 39785999]     {CVE-2026-64340}
    - USB: iowarrior: fix use-after-free on disconnect (Johan Hovold) [Orabug: 39786007] {CVE-2026-64342}
    - USB: ldusb: fix use-after-free on disconnect race (Johan Hovold) [Orabug: 39786012] {CVE-2026-64343}
    - USB: idmouse: fix use-after-free on disconnect race (Johan Hovold) [Orabug: 39786017] {CVE-2026-64344}
    - usb: gadget: udc: Fix use-after-free in gadget_match_driver (Jimmy Hu) [Orabug: 39786026]     {CVE-2026-64346}
    - usb: gadget: composite: fix dead empty check in the USB_DT_OTG handler (Maoyi Xie) [Orabug: 39786030]     {CVE-2026-64347}
    - net: usb: kalmia: bound RX frame length in kalmia_rx_fixup() (Maoyi Xie) [Orabug: 39786042]     {CVE-2026-64351}
    - HID: lg-g15: cancel pending work on remove to fix a use-after-free (Maoyi Xie) [Orabug: 39786071]     {CVE-2026-64362}
    - HID: wacom: stop hardware after post-start probe failures (Myeonghun Pak) [Orabug: 39859299]     {CVE-2026-68091}
    - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Xu Wang) [Orabug: 39786091]     {CVE-2026-64370}
    - cpufreq: pcc: fix use-after-free and double free in _OSC evaluation (Yuho Choi) [Orabug: 39786100]     {CVE-2026-64372}
    - cpufreq: Fix hotplug-suspend race during reboot (Tianxiang Chen) [Orabug: 39786104] {CVE-2026-64373}
    - sched/rt: Have RT_PUSH_IPI be default off for non PREEMPT_RT (Steven Rostedt) [Orabug: 39786108]     {CVE-2026-64374}
    - net: Drop the lock in skb_may_tx_timestamp() (Sebastian Andrzej Siewior) [Orabug: 39331701]     {CVE-2026-43216}
    - Bluetooth: L2CAP: validate option length before reading conf opt value (Muhammad Bilal) [Orabug:
    39786205] {CVE-2026-64403}
    - Bluetooth: fix UAF in bt_accept_dequeue() (Yousef Alhouseen) [Orabug: 39786578] {CVE-2026-64406}
    - Bluetooth: bnep: pin L2CAP connection during netdev registration (Yousef Alhouseen) [Orabug: 39786217]     {CVE-2026-64408}
    - netfilter: ebtables: terminate table name before find_table_lock() (Xiang Mei) [Orabug: 39786224]     {CVE-2026-64411}
    - netfilter: ebtables: module names must be null-terminated (Florian Westphal) [Orabug: 39786228]     {CVE-2026-64412}
    - mfd: cros_ec: Delay dev_set_drvdata() until probe success (Andrei Kuchynski) [Orabug: 39786248]     {CVE-2026-64420}
    - net: ipv4: bound TCP reordering sysctl writes and MTU probe sizes (Wyatt Feng) [Orabug: 39786254]     {CVE-2026-64422}
    - ipv4: igmp: remove multicast group from hash table on device destruction (Yuyang Huang) [Orabug:
    39786259] {CVE-2026-64423}
    - io_uring/io-wq: re-check IO_WQ_BIT_EXIT for each linked work item (Runyu Xiao) [Orabug: 39786574]     {CVE-2026-64425}
    - audit: Fix data races of skb_queue_len() readers on audit_queue (Chi Wang) [Orabug: 39786289]     {CVE-2026-64435}
    - net: af_key: initialize alg_key_len for IPComp states (Zijing Yin) [Orabug: 39786293] {CVE-2026-64436}
    - crypto: amlogic - avoid double cleanup in meson_crypto_probe() (Dawei Feng) [Orabug: 39843604]     {CVE-2026-64599}
    - staging: rtl8723bs: fix OOB write in HT_caps_handler() (Alexandru Hossu) [Orabug: 39786303]     {CVE-2026-64440}
    - staging: rtl8723bs: fix OOB reads in is_ap_in_tkip() IE loop (Alexandru Hossu) [Orabug: 39789581]     {CVE-2026-64536}
    - staging: rtl8723bs: fix OOB reads in IE loops in issue_assocreq() and join_cmd_hdl() (Alexandru Hossu)     [Orabug: 39786311] {CVE-2026-64442}
    - staging: rtl8723bs: fix OOB read in update_beacon_info() IE loop (Alexandru Hossu) [Orabug: 39786315]     {CVE-2026-64443}
    - staging: rtl8723bs: fix OOB read in OnAssocRsp() IE loop (Alexandru Hossu) [Orabug: 39786319]     {CVE-2026-64444}
    - staging: rtl8723bs: fix WEP length underflow and OOB read in OnAuth() (Alexandru Hossu) [Orabug:
    39786323] {CVE-2026-64445}
    - tipc: fix out-of-bounds read in broadcast Gap ACK blocks (Samuel Page) [Orabug: 39786340]     {CVE-2026-64450}
    - 6lowpan: fix NHC entry use-after-free on error path (Yizhou Zhao) [Orabug: 39786344] {CVE-2026-64452}
    - usb: dwc3: run gadget disconnect from sleepable suspend context (Runyu Xiao) [Orabug: 39786349]     {CVE-2026-64454}
    - USB: chaoskey: Fix slab-use-after-free in chaoskey_release() (Alan Stern) [Orabug: 39786352]     {CVE-2026-64455}
    - hwrng: virtio: clamp device-reported used.len at copy_data() (Michael Bommarito) [Orabug: 39786356]     {CVE-2026-64456}
    - netfilter: ipset: fix race between dump and ip_set_list resize (Xiang Mei) [Orabug: 39760883]     {CVE-2026-64189}
    - usb: xhci: Fix sleep in atomic context in xhci_free_streams() (Lianqin Hu) [Orabug: 39786379]     {CVE-2026-64465}
    - Bluetooth: btusb: fix use-after-free on marvell probe failure (Johan Hovold) [Orabug: 39786393]     {CVE-2026-64470}
    - Bluetooth: btusb: fix use-after-free on registration failure (Johan Hovold) [Orabug: 39786397]     {CVE-2026-64471}
    - ALSA: usb-audio: avoid kobject path lookup in DualSense match (Darvell Long) [Orabug: 39786416]     {CVE-2026-64478}
    - ALSA: firewire: isight: bound the sample count to the packet payload (Maoyi Xie) [Orabug: 39786428]     {CVE-2026-64483}
    - ALSA: es1938: check snd_ctl_new1() return value (Zhao Dongdong) [Orabug: 39786432] {CVE-2026-64484}
    - ALSA: caiaq: fix out-of-bounds read in the Traktor Kontrol S4 input parser (Maoyi Xie) [Orabug:
    39786439] {CVE-2026-64487}
    - iio: event: Fix event FIFO reset race (Lars-Peter Clausen) [Orabug: 39786462] {CVE-2026-64496}
    - iio: accel: kxsd9: fix runtime PM imbalance on write_raw() error (Biren Pandya) [Orabug: 39786478]     {CVE-2026-64503}
    - iio: accel: bmc150: clamp the device-reported FIFO frame count (Bryam Vargas) [Orabug: 39786482]     {CVE-2026-64504}
    - NFSv4/flexfiles: reject zero filehandle version count (Michael Bommarito) [Orabug: 39753894]     {CVE-2026-53392}
    - fbdev: fbcon: fix out-of-bounds read in err_out of fbcon_do_set_font() (Mingyu Wang) [Orabug: 39753924]     {CVE-2026-53402}
    - i2c: core: fix adapter registration race (Johan Hovold) [Orabug: 39753916] {CVE-2026-53400}
    - block: Avoid mounting the bdev pseudo-filesystem in userspace (Denis Arefev) [Orabug: 39753985]     {CVE-2026-63810}
    - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Maoyi Xie) [Orabug: 39754045]     {CVE-2026-63829}
    - net: skmsg: preserve sg.copy across SG transforms (Yiming Qian) [Orabug: 39754049] {CVE-2026-63830}
    - netfilter: nf_tables: restore set elements when delete set fails (Pablo Neira Ayuso) [Orabug: 36598010]     {CVE-2024-27012}
    - KVM: Replace guest-triggerable BUG_ON() in ioeventfd datamatch with get_unaligned() (Sean     Christopherson) [Orabug: 39753972] {CVE-2026-63806}
    - userfaultfd: gate must_wait writability check on pte_present() (Kiryl Shutsemau) [Orabug: 39786515]     {CVE-2026-64514}
    - nfsd: reset write verifier on deferred writeback errors (Jeff Layton) [Orabug: 39753898]     {CVE-2026-53393}
    - nfsd: release layout stid on setlease failure (Chris Mason) [Orabug: 39753912] {CVE-2026-53399}
    - nvmet-tcp: fix race between ICReq handling and queue teardown (Chaitanya Kulkarni) [Orabug: 39460310]     {CVE-2026-46135}
    - net: tap: set skb->dev before parsing virtio net header in tap_get_user_xdp() (Dongli Zhang) [Orabug:
    39558744] {CVE-2026-74684}
    - net/rds: zero per-item info buffer before handing it to visitors (Michael Bommarito) [Orabug:
    39621715,39638197] {CVE-2026-52995}
    - x86/sev: Evict cache lines during SNP memory validation (Tom Lendacky) [Orabug: 38334919]     {CVE-2025-38560}
    - xfs: resample the data fork mapping after cycling ILOCK (Darrick Wong) [Orabug: 39776791]     {CVE-2026-64600}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - RDMA/rxe: Fix TOCTOU heap overflow in get_srq_wqe get_srq_wqe() reads wqe->dma.num_sge from the shared     receive queue buffer, which is mapped into userspace. It validates num_sge against max_sge, but then re-     reads the same field to calculate the memcpy size. A concurrent userspace thread can modify num_sge     between validation and use, causing a heap buffer overflow when copying the WQE into qp->resp.srq_wqe.
    Read num_sge into a local variable and use it for both the bounds check and the size calculation.
    (CVE-2026-74378)

Note that Nessus relies on the presence of the package as reported by the vendor.

An update of the linux package has been released.

ID	Name	Product	Family	Type	Severity
366742	SUSE SLED15: cluster-md-kmp-default / dlm-kmp-default / gfs2-kmp-default / etc (SUSE-SU-2026:4706-1)	Nessus	SuSE Local Security Checks	Local	high
365768	Ubuntu 26.04 LTS : Linux kernel (Azure) vulnerabilities (USN-8888-1)	Nessus	Ubuntu Local Security Checks	Local	medium
365767	Ubuntu 26.04 LTS : Linux kernel vulnerabilities (USN-8887-1)	Nessus	Ubuntu Local Security Checks	Local	medium
365525	Ubuntu 24.04 LTS : Linux kernel (Azure) vulnerabilities (USN-8918-1)	Nessus	Ubuntu Local Security Checks	Local	medium
365522	Ubuntu 24.04 LTS : Linux kernel vulnerabilities (USN-8917-1)	Nessus	Ubuntu Local Security Checks	Local	medium
365463	Ubuntu 26.04 LTS : Linux kernel (OEM) vulnerabilities (USN-8889-1)	Nessus	Ubuntu Local Security Checks	Local	medium
365457	Ubuntu 24.04 LTS : Linux kernel (NVIDIA Tegra) vulnerabilities (USN-8886-1)	Nessus	Ubuntu Local Security Checks	Local	high
363954	Oracle Linux 8 / 9 : Unbreakable Enterprise kernel (ELSA-2026-500377)	Nessus	Oracle Linux Local Security Checks	Local	high
351061	Amazon Linux 2 : kernel (ALASKERNEL-5.10-2026-132)	Nessus	Amazon Linux Local Security Checks	Local	medium
350940	SUSE SLES15: cluster-md-kmp-default / dlm-kmp-default / gfs2-kmp-default / etc (SUSE-SU-2026:4369-1)	Nessus	SuSE Local Security Checks	Local	high
350138	openSUSE 16: cluster-md-kmp-64kb / cluster-md-kmp-azure / cluster-md-kmp-default / etc (openSUSE-SU-2026:21910-1)	Nessus	SuSE Local Security Checks	Local	high
349185	SUSE SLES12: cluster-md-kmp-default / dlm-kmp-default / gfs2-kmp-default / etc (SUSE-SU-2026:4282-1)	Nessus	SuSE Local Security Checks	Local	high
349184	SUSE SLES15: cluster-md-kmp-default / dlm-kmp-default / gfs2-kmp-default / etc (SUSE-SU-2026:4284-1)	Nessus	SuSE Local Security Checks	Local	high
347008	Oracle Linux 8 / 9 : Unbreakable Enterprise kernel (ELSA-2026-500329)	Nessus	Oracle Linux Local Security Checks	Local	medium
343049	Oracle Linux 10 / 9 : Unbreakable Enterprise kernel (ELSA-2026-500248)	Nessus	Oracle Linux Local Security Checks	Local	high
335669	Linux Distros Unpatched Vulnerability : CVE-2026-74378	Nessus	Misc.	Local	high
334784	Photon OS 5.0: Linux PHSA-2026-5.0-92-0952	Nessus	PhotonOS Local Security Checks	Local	high

Detections

Analytics

CVE-2026-74378

high

Tenable Plugins

Coming Soon

high

medium

medium

medium

medium

medium

high

high

medium

high

high

high

high

medium

high

high

high