In the Linux kernel, the following vulnerability has been resolved: of/address: Fix NULL bus dereference in of_pci_range_parser_one() The bus matching rework made of_match_bus() return NULL for nodes with ranges/dma-ranges but no local #address-cells. parser_init() stored that NULL bus, and the range iterator later dereferenced it. Reject such nodes in parser_init(), leaving an explicit empty iterator for callers that ignore the init return, and make of_dma_get_max_cpu_address() honour the init failure so a rejected node cannot clamp the DMA limit.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - In the Linux kernel, the following vulnerability has been resolved: of/address: Fix NULL bus dereference
    in of_pci_range_parser_one() The bus matching rework made of_match_bus() return NULL for nodes with
    ranges/dma-ranges but no local #address-cells. parser_init() stored that NULL bus, and the range iterator
    later dereferenced it. Reject such nodes in parser_init(), leaving an explicit empty iterator for callers
    that ignore the init return, and make of_dma_get_max_cpu_address() honour the init failure so a rejected
    node cannot clamp the DMA limit. (CVE-2026-74491)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - of/address: Fix NULL bus dereference in of_pci_range_parser_one() The bus matching rework made     of_match_bus() return NULL for nodes with ranges/dma-ranges but no local #address-cells. parser_init()     stored that NULL bus, and the range iterator later dereferenced it. Reject such nodes in parser_init(),     leaving an explicit empty iterator for callers that ignore the init return, and make     of_dma_get_max_cpu_address() honour the init failure so a rejected node cannot clamp the DMA limit.
    (CVE-2026-74491)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
471114	Google: sys-kernel/cchost-kernel-6_18, sys-kernel/csql-kernel-6_18, sys-kernel/lakitu-kernel-6_18, sys-kernel/lakitu-nc-kernel-6_18: security update to 19999.44.21	Tenable Cloud Security	Google COS Security Checks	Local	medium
471114	Google: sys-kernel/cchost-kernel-6_18, sys-kernel/csql-kernel-6_18, sys-kernel/lakitu-kernel-6_18, sys-kernel/lakitu-nc-kernel-6_18: security update to 19999.44.21	Tenable Self-Hosted Container Security	Google COS Security Checks	Local	medium
470962	Google: sys-kernel/cchost-kernel-6_18, sys-kernel/csql-kernel-6_18, sys-kernel/lakitu-kernel-6_18, sys-kernel/lakitu-nc-kernel-6_18: security update to 20085.0.0	Tenable Cloud Security	Google COS Security Checks	Local	medium
470962	Google: sys-kernel/cchost-kernel-6_18, sys-kernel/csql-kernel-6_18, sys-kernel/lakitu-kernel-6_18, sys-kernel/lakitu-nc-kernel-6_18: security update to 20085.0.0	Tenable Self-Hosted Container Security	Google COS Security Checks	Local	medium
341888	Amazon Linux 2023 : bpftool6.18, kernel6.18, kernel6.18-devel (ALAS2023-2026-2106)	Nessus	Amazon Linux Local Security Checks	Local	high
335755	Linux Distros Unpatched Vulnerability : CVE-2026-74491	Nessus	Misc.	Local	medium

Detections

Analytics

CVE-2026-74491

medium

Tenable Plugins

medium

medium

medium

medium

high

medium