In the Linux kernel, the following vulnerability has been resolved: af_unix: Unlink scc_entry in unix_del_edge(). Kyle Zeng reported that GC could free a dead SCC partially. The scenario is as follows: 1) Create two SCCs: X -. A <-> B ^--' 2) Run the following concurrently: 2-1) send() sk-B to sk-B from sk-X 2-2) close() both A and B At 2-1), there is a small window where unix_add_edges() publishes a new edge (B <-> B) to GC but its skb is not queued by skb_queue_tail(). If 2-2) completes before skb_queue_tail() and GC is triggered, it judges A <-> B as dead, but B is not freed because GC cannot collect the not-yet-queued skb holding the B <-> B edge. X -. A <-> B -. This edge is visible ^--' ^..' but skb is not This itself is not a problem since the next GC run will judge B as dead as well and free it finally. X -. A <.> B -. ^--' ^--' However, X's SCC forces the next GC to call unix_walk_scc_fast(), and it iterates over A through B's scc_entry. Let's unlink scc_entry before freeing the vertex in unix_del_edge().

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:81406 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: thermal: core: Fix thermal zone device registration error path (CVE-2026-43332)

    * kernel: macsec: fix replay protection at XPN lower-PN wrap (CVE-2026-63925)

    * kernel: i2c: stub: Reject I2C block transfers with invalid length (CVE-2026-64191)

    * kernel: Kernel SMB client: Double-free vulnerability allows remote denial of service or privilege     escalation (CVE-2026-64385)

    * kernel: bpf: Support for hardening against JIT spraying (CVE-2026-64508)

    * kernel: x86/bugs: Enable IBPB flush on BPF JIT allocation (CVE-2026-64507)

    * kernel: openvswitch: fix GSO userspace truncation underflow (CVE-2026-68123)

    * kernel: cifs: validate DFS referral string offsets (CVE-2026-72318)

    * kernel: KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CVE-2026-72289)

    * kernel: af_unix: Unlink scc_entry in unix_del_edge() (CVE-2026-80521)

    * kernel: nvmet-auth: Synchronize timeout work during SQ teardown (CVE-2026-89970)

    Bug Fix(es) and Enhancement(s):

    * net/tls backports for 10.2 (JIRA:RHEL-275027)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:81406 advisory.

    * kernel: thermal: core: Fix thermal zone device registration error path (CVE-2026-43332)
      * kernel: macsec: fix replay protection at XPN lower-PN wrap (CVE-2026-63925)
      * kernel: i2c: stub: Reject I2C block transfers with invalid length (CVE-2026-64191)
      * kernel: Kernel SMB client: Double-free vulnerability allows remote denial of service or privilege     escalation (CVE-2026-64385)
      * kernel: bpf: Support for hardening against JIT spraying (CVE-2026-64508)
      * kernel: x86/bugs: Enable IBPB flush on BPF JIT allocation (CVE-2026-64507)
      * kernel: openvswitch: fix GSO userspace truncation underflow (CVE-2026-68123)
      * kernel: cifs: validate DFS referral string offsets (CVE-2026-72318)
      * kernel: KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CVE-2026-72289)
      * kernel: af_unix: Unlink scc_entry in unix_del_edge() (CVE-2026-80521)
      * kernel: nvmet-auth: Synchronize timeout work during SQ teardown (CVE-2026-89970)


    Bug Fix(es) and Enhancement(s):

      * net/tls backports for 10.2 (JIRA:AlmaLinux-275027)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - In the Linux kernel, the following vulnerability has been resolved: af_unix: Unlink scc_entry in
    unix_del_edge(). Kyle Zeng reported that GC could free a dead SCC partially. The scenario is as follows:
    1) Create two SCCs: X -. A <-> B ^--' 2) Run the following concurrently: 2-1) send() sk-B to sk-B from
    sk-X 2-2) close() both A and B At 2-1), there is a small window where unix_add_edges() publishes a new
    edge (B <-> B) to GC but its skb is not queued by skb_queue_tail(). If 2-2) completes before
    skb_queue_tail() and GC is triggered, it judges A <-> B as dead, but B is not freed because GC cannot
    collect the not-yet-queued skb holding the B <-> B edge. X -. A <-> B -. This edge is visible ^--' ^..'
    but skb is not This itself is not a problem since the next GC run will judge B as dead as well and free it
    finally. X -. A <.> B -. ^--' ^--' However, X's SCC forces the next GC to call unix_walk_scc_fast(), and
    it iterates over A through B's scc_entry. Let's unlink scc_entry before freeing the vertex in
    unix_del_edge(). (CVE-2026-80521)

The Rocky Linux 10.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-2026_81406 advisory.

    * kernel: thermal: core: Fix thermal zone device registration error path (CVE-2026-43332)

    * kernel: macsec: fix replay protection at XPN lower-PN wrap (CVE-2026-63925)

    * kernel: i2c: stub: Reject I2C block transfers with invalid length (CVE-2026-64191)

    * kernel: Kernel SMB client: Double-free vulnerability allows remote denial of service or privilege     escalation (CVE-2026-64385)

    * kernel: bpf: Support for hardening against JIT spraying (CVE-2026-64508)

    * kernel: x86/bugs: Enable IBPB flush on BPF JIT allocation (CVE-2026-64507)

    * kernel: openvswitch: fix GSO userspace truncation underflow (CVE-2026-68123)

    * kernel: cifs: validate DFS referral string offsets (CVE-2026-72318)

    * kernel: KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CVE-2026-72289)

    * kernel: af_unix: Unlink scc_entry in unix_del_edge() (CVE-2026-80521)

    * kernel: nvmet-auth: Synchronize timeout work during SQ teardown (CVE-2026-89970)

    Bug Fix(es) and Enhancement(s):

    * net/tls backports for 10.2 (JIRA:Rocky Linux-275027)

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:81406 advisory.

    * kernel: thermal: core: Fix thermal zone device registration error path (CVE-2026-43332)

    * kernel: macsec: fix replay protection at XPN lower-PN wrap (CVE-2026-63925)

    * kernel: i2c: stub: Reject I2C block transfers with invalid length (CVE-2026-64191)

    * kernel: Kernel SMB client: Double-free vulnerability allows remote denial of service or privilege     escalation (CVE-2026-64385)

    * kernel: bpf: Support for hardening against JIT spraying (CVE-2026-64508)

    * kernel: x86/bugs: Enable IBPB flush on BPF JIT allocation (CVE-2026-64507)

    * kernel: openvswitch: fix GSO userspace truncation underflow (CVE-2026-68123)

    * kernel: cifs: validate DFS referral string offsets (CVE-2026-72318)

    * kernel: KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CVE-2026-72289)

    * kernel: af_unix: Unlink scc_entry in unix_del_edge() (CVE-2026-80521)

    * kernel: nvmet-auth: Synchronize timeout work during SQ teardown (CVE-2026-89970)

    Bug Fix(es) and Enhancement(s):

    * net/tls backports for 10.2 (JIRA:Rocky Linux-275027)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-81406 advisory.

    - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276363]     {CVE-2026-89970}
    - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226827]     {CVE-2026-43332}
    - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273875] {CVE-2026-64508}
    - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273900] {CVE-2026-64507}
    - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273875] {CVE-2026-64508}
    - af_unix: Unlink scc_entry in unix_del_edge(). (CKI Backport Bot) [RHEL-270654] {CVE-2026-80521}
    - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263802] {CVE-2026-68123}
    - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226678] {CVE-2026-63925}
    - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261989] {CVE-2026-72318}
    - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259796] {CVE-2026-64385}
    - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252479]     {CVE-2026-72289}
    - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232114]     {CVE-2026-64191}
    - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268127] {CVE-2026-74705}
    - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264930]     {CVE-2026-89690}
    - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas)     [RHEL-187745] {CVE-2026-89530}
    - nfsd: fix stale s2s_cp_stateids IDR entry for async COPY (Roberto Bergantinos Corpas) [RHEL-264798]     {CVE-2026-89676}
    - nfsd: fix UAF in async copy cancel and shutdown (Roberto Bergantinos Corpas) [RHEL-264749]     {CVE-2026-89675}
    - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264168]     {CVE-2026-89669}
    - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas)     [RHEL-264134] {CVE-2026-89663}
    - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259243]     {CVE-2026-53398}
    - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261492]     {CVE-2026-72317}
    - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254268]     {CVE-2026-74744}
    - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246118] {CVE-2026-23103}
    - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229037] {CVE-2026-63970}
    - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232860] {CVE-2026-53365}
    - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232860] {CVE-2026-53365}
    - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192289]     {CVE-2026-53360}
    - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192289]     {CVE-2026-53360}
    - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192289]     {CVE-2026-53360}
    - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192289]     {CVE-2026-53360}
    - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192289]     {CVE-2026-53360}
    - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar)     [RHEL-192289] {CVE-2026-53360}
    - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192289] {CVE-2026-53360}
    - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192289]     {CVE-2026-53360}
    - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192289] {CVE-2026-53360}
    - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192289]     {CVE-2026-53360}
    - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192289] {CVE-2026-53360}
    - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192289]     {CVE-2026-53360}
    - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192289]     {CVE-2026-53360}
    - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232273]     {CVE-2026-64115}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 24.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-8886-1 advisory.

    Several security issues were discovered in the Linux kernel. An attacker could possibly use these to     compromise the system. This update corrects flaws in the following subsystems:

    - NVDIMM (Non-Volatile Memory Device) drivers;

    - Handshake API;

    - ARM32 architecture;

    - ARM64 architecture;

    - MIPS architecture;

    - OpenRISC architecture;

    - PowerPC architecture;

    - S390 architecture;

    - x86 architecture;

    - Block layer subsystem;

    - Cryptographic API;

    - Intel NPU Driver;

    - Android drivers;

    - Rados block device (RBD) driver;

    - Bluetooth drivers;

    - Hardware random number generator core;

    - TPM device driver;

    - CPU frequency scaling framework;

    - Hardware crypto device drivers;

    - DMA engine subsystem;

    - FireWire subsystem;

    - Arm Firmware Framework for ARMv8-A(FFA);

    - GPIO subsystem;

    - GPU drivers;

    - HID subsystem;

    - Hardware monitoring drivers;

    - CoreSight HW tracing drivers;

    - I2C subsystem;

    - IIO ADC drivers;

    - IIO subsystem;

    - InfiniBand drivers;

    - Input Device core drivers;

    - Input Device (Mouse) drivers;

    - IOMMU subsystem;

    - Multiple devices driver;

    - Media drivers;

    - Multifunction device drivers;

    - Fastrpc Driver;

    - Amazon Nitro Secure Module driver;

    - MMC subsystem;

    - MTD block device drivers;

    - Ethernet bonding driver;

    - Network drivers;

    - Mellanox network drivers;

    - Texas Instruments network drivers;

    - NTB driver;

    - NVME drivers;

    - NVMEM (Non Volatile Memory) drivers;

    - Parport drivers;

    - Pin controllers subsystem;

    - x86 platform drivers;

    - i.MX PM domains;

    - System reset/shutdown drivers;

    - PTP clock framework;

    - Voltage and Current Regulator drivers;

    - S/390 drivers;

    - SCSI subsystem;

    - SPI subsystem;

    - Realtek RTL8723BS SDIO drivers;

    - VME bus staging drivers;

    - Thermal drivers;

    - Thunderbolt and USB4 drivers;

    - TTY drivers;

    - DesignWare USB2 driver;

    - USB Gadget drivers;

    - USB Host Controller drivers;

    - USB Dual Role (OTG-ready) Controller drivers;

    - USB Serial drivers;

    - USB Type-C Port Controller Manager driver;

    - vDPA drivers;

    - Virtio Host (VHOST) subsystem;

    - Framebuffer layer;

    - Watchdog drivers;

    - 9P distributed file system;

    - AFS file system;

    - File systems infrastructure;

    - BTRFS file system;

    - Ceph distributed file system;

    - EROFS file system;

    - exFAT file system;

    - F2FS file system;

    - FUSE (File system in Userspace);

    - Journaling layer for block devices (JBD2);

    - Network file system (NFS) client;

    - Network file system (NFS) server daemon;

    - NTFS3 file system;

    - OCFS2 file system;

    - Proc file system;

    - SMB network file system;

    - Tracing file system;

    - UDF file system;

    - XFS file system;

    - Key management;

    - BPF subsystem;

    - Control group (cgroup);

    - Glob pattern matching library;

    - MAC80211 subsystem;

    - Mellanox drivers;

    - Networking core;

    - Network sockets;

    - IPv6 networking;

    - Bluetooth subsystem;

    - Wireless networking;

    - IPv4 networking;

    - Netfilter;

    - Network traffic control;

    - SCTP protocol;

    - TCP network protocol;

    - XFRM subsystem;

    - RDMA verbs API;

    - io_uring subsystem;

    - IPC subsystem;

    - Audit subsystem;

    - Kernel CPU control infrastructure;

    - Perf events;

    - Kernel exit() syscall;

    - Kernel fork() syscall;

    - Scheduler infrastructure;

    - Signal handling mechanism;

    - Timer subsystem;

    - Tracing infrastructure;

    - Resizable hashtable library;

    - Memory management;

    - 6LoWPAN network protocol;

    - Asynchronous Transfer Mode (ATM) subsystem;

    - B.A.T.M.A.N. meshing protocol;

    - Ethernet bridge;

    - CAN network layer;

    - Ceph Core library;

    - Ethtool driver;

    - HSR network protocol;

    - IEEE802154.4 network protocol;

    - IUCV driver;

    - KCM (Kernel Connection Multiplexor) sockets driver;

    - IEEE 802.15.4 subsystem;

    - Multipath TCP;

    - Open vSwitch;

    - Packet sockets;

    - Phonet protocol;

    - Qualcomm IPC Router (QRTR);

    - RDS protocol;

    - RxRPC session sockets;

    - SMC sockets;

    - Sun RPC protocol;

    - TIPC protocol;

    - TLS protocol;

    - Unix domain sockets;

    - VMware vSockets driver;

    - X.25 network layer;

    - eXpress Data Path;

    - AppArmor security module;

    - Integrity Measurement Architecture(IMA) framework;

    - SELinux security module;

    - ALSA framework;

    - HD-audio driver;

    - QCOM ASoC drivers;

    - Simple audio multiplexer codec driver;

    - Texas InstrumentS Audio (ASoC/HDA) drivers;

    - SoC Audio for Freescale CPUs drivers;

    - Amlogic Meson SoC drivers;

    - SOF drivers;

    - NVIDIA Tegra ASoC drivers;

    - USB sound devices;

    - Perf tools;

    - KVM subsystem; (CVE-2025-37807, CVE-2026-23265, CVE-2026-43022, CVE-2026-46321, CVE-2026-46322,     CVE-2026-52917, CVE-2026-52923, CVE-2026-52927, CVE-2026-52929, CVE-2026-52935, CVE-2026-52942,     CVE-2026-52943, CVE-2026-52947, CVE-2026-52994, CVE-2026-53136, CVE-2026-53137, CVE-2026-53138,     CVE-2026-53143, CVE-2026-53146, CVE-2026-53147, CVE-2026-53149, CVE-2026-53156, CVE-2026-53157,     CVE-2026-53160, CVE-2026-53161, CVE-2026-53184, CVE-2026-53189, CVE-2026-53194, CVE-2026-53195,     CVE-2026-53199, CVE-2026-53202, CVE-2026-53205, CVE-2026-53209, CVE-2026-53223, CVE-2026-53229,     CVE-2026-53253, CVE-2026-53255, CVE-2026-53267, CVE-2026-53268, CVE-2026-53272, CVE-2026-53329,     CVE-2026-53330, CVE-2026-53356, CVE-2026-53362, CVE-2026-53365, CVE-2026-53366, CVE-2026-53381,     CVE-2026-53383, CVE-2026-53387, CVE-2026-53388, CVE-2026-53389, CVE-2026-53390, CVE-2026-53391,     CVE-2026-53392, CVE-2026-53397, CVE-2026-53400, CVE-2026-53401, CVE-2026-53402, CVE-2026-63794,     CVE-2026-63802, CVE-2026-63803, CVE-2026-63805, CVE-2026-63806, CVE-2026-63809, CVE-2026-63812,     CVE-2026-63814, CVE-2026-63816, CVE-2026-63817, CVE-2026-63819, CVE-2026-63823, CVE-2026-63824,     CVE-2026-63827, CVE-2026-63833, CVE-2026-63867, CVE-2026-63869, CVE-2026-63870, CVE-2026-63875,     CVE-2026-63879, CVE-2026-63881, CVE-2026-63884, CVE-2026-63889, CVE-2026-63909, CVE-2026-63913,     CVE-2026-63920, CVE-2026-63925, CVE-2026-63927, CVE-2026-63930, CVE-2026-63942, CVE-2026-63954,     CVE-2026-63968, CVE-2026-63970, CVE-2026-63971, CVE-2026-63985, CVE-2026-64002, CVE-2026-64003,     CVE-2026-64004, CVE-2026-64005, CVE-2026-64009, CVE-2026-64017, CVE-2026-64023, CVE-2026-64026,     CVE-2026-64036, CVE-2026-64095, CVE-2026-64123, CVE-2026-64188, CVE-2026-64189, CVE-2026-64210,     CVE-2026-64222, CVE-2026-64239, CVE-2026-64242, CVE-2026-64243, CVE-2026-64245, CVE-2026-64246,     CVE-2026-64266, CVE-2026-64270, CVE-2026-64271, CVE-2026-64272, CVE-2026-64273, CVE-2026-64274,     CVE-2026-64276, CVE-2026-64277, CVE-2026-64279, CVE-2026-64283, CVE-2026-64286, CVE-2026-64287,     CVE-2026-64296, CVE-2026-64298, CVE-2026-64299, CVE-2026-64304, CVE-2026-64312, CVE-2026-64317,     CVE-2026-64318, CVE-2026-64322, CVE-2026-64323, CVE-2026-64324, CVE-2026-64333, CVE-2026-64368,     CVE-2026-64372, CVE-2026-64374, CVE-2026-64375, CVE-2026-64378, CVE-2026-64379, CVE-2026-64380,     CVE-2026-64388, CVE-2026-64389, CVE-2026-64395, CVE-2026-64398, CVE-2026-64401, CVE-2026-64402,     CVE-2026-64403, CVE-2026-64411, CVE-2026-64412, CVE-2026-64413, CVE-2026-64418, CVE-2026-64420,     CVE-2026-64422, CVE-2026-64423, CVE-2026-64430, CVE-2026-64432, CVE-2026-64435, CVE-2026-64436,     CVE-2026-64440, CVE-2026-64442, CVE-2026-64443, CVE-2026-64444, CVE-2026-64448, CVE-2026-64449,     CVE-2026-64452, CVE-2026-64456, CVE-2026-64463, CVE-2026-64468, CVE-2026-64469, CVE-2026-64481,     CVE-2026-64496, CVE-2026-64524, CVE-2026-64532, CVE-2026-64533, CVE-2026-64536, CVE-2026-64539,     CVE-2026-64540, CVE-2026-64543, CVE-2026-64545, CVE-2026-64546, CVE-2026-64547, CVE-2026-64550,     CVE-2026-64556, CVE-2026-64560, CVE-2026-64563, CVE-2026-64567, CVE-2026-64568, CVE-2026-64570,     CVE-2026-64574, CVE-2026-64576, CVE-2026-64577, CVE-2026-64578, CVE-2026-64580, CVE-2026-64581,     CVE-2026-64582, CVE-2026-64583, CVE-2026-64584, CVE-2026-64585, CVE-2026-64599, CVE-2026-64600,     CVE-2026-68091, CVE-2026-68096, CVE-2026-68097, CVE-2026-68098, CVE-2026-68100, CVE-2026-68104,     CVE-2026-68106, CVE-2026-68107, CVE-2026-68108, CVE-2026-68116, CVE-2026-68118, CVE-2026-68119,     CVE-2026-68121, CVE-2026-68125, CVE-2026-68129, CVE-2026-68131, CVE-2026-68140, CVE-2026-68141,     CVE-2026-68142, CVE-2026-68143, CVE-2026-68145, CVE-2026-68148, CVE-2026-68149, CVE-2026-68153,     CVE-2026-68155, CVE-2026-68157, CVE-2026-68178, CVE-2026-68179, CVE-2026-68189, CVE-2026-68192,     CVE-2026-68196, CVE-2026-68199, CVE-2026-68202, CVE-2026-68204, CVE-2026-68216, CVE-2026-68219,     CVE-2026-68222, CVE-2026-68236, CVE-2026-68245, CVE-2026-68253, CVE-2026-68255, CVE-2026-68258,     CVE-2026-68260, CVE-2026-68262, CVE-2026-68263, CVE-2026-68266, CVE-2026-68273, CVE-2026-68284,     CVE-2026-68287, CVE-2026-68290, CVE-2026-68293, CVE-2026-68294, CVE-2026-68297, CVE-2026-68299,     CVE-2026-68314, CVE-2026-68315, CVE-2026-68320, CVE-2026-68322, CVE-2026-68323, CVE-2026-68326,     CVE-2026-68329, CVE-2026-68335, CVE-2026-68338, CVE-2026-68340, CVE-2026-68348, CVE-2026-68352,     CVE-2026-68353, CVE-2026-68354, CVE-2026-68370, CVE-2026-68371, CVE-2026-68373, CVE-2026-68376,     CVE-2026-68377, CVE-2026-68383, CVE-2026-68389, CVE-2026-68391, CVE-2026-68392, CVE-2026-68397,     CVE-2026-68398, CVE-2026-68399, CVE-2026-68400, CVE-2026-68401, CVE-2026-68402, CVE-2026-68404,     CVE-2026-68408, CVE-2026-68409, CVE-2026-68414, CVE-2026-68417, CVE-2026-68419, CVE-2026-68425,     CVE-2026-68432, CVE-2026-68433, CVE-2026-68442, CVE-2026-68445, CVE-2026-68446, CVE-2026-68447,     CVE-2026-68451, CVE-2026-68452, CVE-2026-68453, CVE-2026-68454, CVE-2026-68466, CVE-2026-68467,     CVE-2026-68471, CVE-2026-68474, CVE-2026-68479, CVE-2026-72005, CVE-2026-72009, CVE-2026-72012,     CVE-2026-72019, CVE-2026-72021, CVE-2026-72024, CVE-2026-72029, CVE-2026-72035, CVE-2026-72036,     CVE-2026-72045, CVE-2026-72049, CVE-2026-72051, CVE-2026-72052, CVE-2026-72053, CVE-2026-72054,     CVE-2026-72055, CVE-2026-72057, CVE-2026-72061, CVE-2026-72066, CVE-2026-72067, CVE-2026-72072,     CVE-2026-72089, CVE-2026-72099, CVE-2026-72102, CVE-2026-72105, CVE-2026-72107, CVE-2026-72108,     CVE-2026-72109, CVE-2026-72110, CVE-2026-72113, CVE-2026-72114, CVE-2026-72115, CVE-2026-72116,     CVE-2026-72117, CVE-2026-72118, CVE-2026-72119, CVE-2026-72120, CVE-2026-72121, CVE-2026-72122,     CVE-2026-72123, CVE-2026-72133, CVE-2026-72135, CVE-2026-72136, CVE-2026-72144, CVE-2026-72146,     CVE-2026-72148, CVE-2026-72149, CVE-2026-72157, CVE-2026-72160, CVE-2026-72162, CVE-2026-72164,     CVE-2026-72165, CVE-2026-72170, CVE-2026-72171, CVE-2026-72172, CVE-2026-72175, CVE-2026-72181,     CVE-2026-72195, CVE-2026-72196, CVE-2026-72197, CVE-2026-72213, CVE-2026-72225, CVE-2026-72227,     CVE-2026-72231, CVE-2026-72232, CVE-2026-72233, CVE-2026-72235, CVE-2026-72242, CVE-2026-72243,     CVE-2026-72244, CVE-2026-72247, CVE-2026-72250, CVE-2026-72252, CVE-2026-72253, CVE-2026-72254,     CVE-2026-72261, CVE-2026-72262, CVE-2026-72282, CVE-2026-72284, CVE-2026-72297, CVE-2026-72298,     CVE-2026-72301, CVE-2026-72302, CVE-2026-72304, CVE-2026-72310, CVE-2026-72312, CVE-2026-72314,     CVE-2026-72330, CVE-2026-72334, CVE-2026-72335, CVE-2026-72338, CVE-2026-72340, CVE-2026-72342,     CVE-2026-72343, CVE-2026-72347, CVE-2026-72350, CVE-2026-72352, CVE-2026-72369, CVE-2026-72371,     CVE-2026-72373, CVE-2026-72374, CVE-2026-72375, CVE-2026-72378, CVE-2026-72382, CVE-2026-72389,     CVE-2026-72390, CVE-2026-72397, CVE-2026-72400, CVE-2026-72404, CVE-2026-72405, CVE-2026-72406,     CVE-2026-72409, CVE-2026-72410, CVE-2026-72416, CVE-2026-72418, CVE-2026-72419, CVE-2026-72420,     CVE-2026-72423, CVE-2026-72425, CVE-2026-72427, CVE-2026-72435, CVE-2026-72438, CVE-2026-72440,     CVE-2026-72444, CVE-2026-72449, CVE-2026-72450, CVE-2026-72459, CVE-2026-72460, CVE-2026-72464,     CVE-2026-72469, CVE-2026-72470, CVE-2026-72476, CVE-2026-72478, CVE-2026-72480, CVE-2026-72483,     CVE-2026-72485, CVE-2026-72492, CVE-2026-72502, CVE-2026-74256, CVE-2026-74257, CVE-2026-74258,     CVE-2026-74262, CVE-2026-74270, CVE-2026-74281, CVE-2026-74282, CVE-2026-74283, CVE-2026-74288,     CVE-2026-74289, CVE-2026-74292, CVE-2026-74293, CVE-2026-74294, CVE-2026-74295, CVE-2026-74296,     CVE-2026-74297, CVE-2026-74300, CVE-2026-74312, CVE-2026-74313, CVE-2026-74314, CVE-2026-74317,     CVE-2026-74321, CVE-2026-74330, CVE-2026-74334, CVE-2026-74338, CVE-2026-74340, CVE-2026-74341,     CVE-2026-74344, CVE-2026-74347, CVE-2026-74349, CVE-2026-74356, CVE-2026-74359, CVE-2026-74363,     CVE-2026-74365, CVE-2026-74374, CVE-2026-74375, CVE-2026-74377, CVE-2026-74378, CVE-2026-74380,     CVE-2026-74385, CVE-2026-74387, CVE-2026-74388, CVE-2026-74390, CVE-2026-74397, CVE-2026-74438,     CVE-2026-74443, CVE-2026-74444, CVE-2026-74446, CVE-2026-74450, CVE-2026-74453, CVE-2026-74454,     CVE-2026-74456, CVE-2026-74461, CVE-2026-74465, CVE-2026-74467, CVE-2026-74469, CVE-2026-74470,     CVE-2026-74471, CVE-2026-74479, CVE-2026-74481, CVE-2026-74482, CVE-2026-74485, CVE-2026-74488,     CVE-2026-74490, CVE-2026-74492, CVE-2026-74496, CVE-2026-74497, CVE-2026-74507, CVE-2026-74508,     CVE-2026-74509, CVE-2026-74510, CVE-2026-74512, CVE-2026-74515, CVE-2026-74516, CVE-2026-74518,     CVE-2026-74519, CVE-2026-74522, CVE-2026-74523, CVE-2026-74527, CVE-2026-74530, CVE-2026-74531,     CVE-2026-74533, CVE-2026-74534, CVE-2026-74535, CVE-2026-74536, CVE-2026-74537, CVE-2026-74540,     CVE-2026-74544, CVE-2026-74548, CVE-2026-74549, CVE-2026-74550, CVE-2026-74551, CVE-2026-74557,     CVE-2026-74563, CVE-2026-74564, CVE-2026-74565, CVE-2026-74567, CVE-2026-74572, CVE-2026-74574,     CVE-2026-74575, CVE-2026-74578, CVE-2026-74579, CVE-2026-74580, CVE-2026-74581, CVE-2026-74582,     CVE-2026-74583, CVE-2026-74584, CVE-2026-74586, CVE-2026-74587, CVE-2026-74588, CVE-2026-74589,     CVE-2026-74590, CVE-2026-74592, CVE-2026-74594, CVE-2026-74595, CVE-2026-74597, CVE-2026-74598,     CVE-2026-74601, CVE-2026-74603, CVE-2026-74604, CVE-2026-74605, CVE-2026-74606, CVE-2026-74607,     CVE-2026-74608, CVE-2026-74609, CVE-2026-74610, CVE-2026-74611, CVE-2026-74612, CVE-2026-74613,     CVE-2026-74614, CVE-2026-74615, CVE-2026-74616, CVE-2026-74621, CVE-2026-74624, CVE-2026-74625,     CVE-2026-74626, CVE-2026-74628, CVE-2026-74630, CVE-2026-74631, CVE-2026-74632, CVE-2026-74634,     CVE-2026-74635, CVE-2026-74637, CVE-2026-74641, CVE-2026-74646, CVE-2026-74647, CVE-2026-74648,     CVE-2026-74649, CVE-2026-74651, CVE-2026-74656, CVE-2026-74660, CVE-2026-74661, CVE-2026-74662,     CVE-2026-74663, CVE-2026-74666, CVE-2026-74667, CVE-2026-74668, CVE-2026-74669, CVE-2026-74670,     CVE-2026-74675, CVE-2026-74678, CVE-2026-74684, CVE-2026-74687, CVE-2026-74688, CVE-2026-74689,     CVE-2026-74690, CVE-2026-74691, CVE-2026-74692, CVE-2026-74695, CVE-2026-74696, CVE-2026-74697,     CVE-2026-74700, CVE-2026-74701, CVE-2026-74704, CVE-2026-74705, CVE-2026-74710, CVE-2026-74711,     CVE-2026-74713, CVE-2026-74714, CVE-2026-74715, CVE-2026-74717, CVE-2026-74720, CVE-2026-74723,     CVE-2026-74724, CVE-2026-74725, CVE-2026-74726, CVE-2026-74730, CVE-2026-74733, CVE-2026-74736,     CVE-2026-74737, CVE-2026-74739, CVE-2026-74743, CVE-2026-74744, CVE-2026-74746, CVE-2026-74747,     CVE-2026-74748, CVE-2026-74752, CVE-2026-80521, CVE-2026-80526, CVE-2026-80527, CVE-2026-80528,     CVE-2026-80536, CVE-2026-80540, CVE-2026-80541, CVE-2026-80547, CVE-2026-80548, CVE-2026-80549,     CVE-2026-80550, CVE-2026-80551, CVE-2026-80552, CVE-2026-80553, CVE-2026-80554, CVE-2026-80555,     CVE-2026-80556, CVE-2026-80557, CVE-2026-80558, CVE-2026-80559, CVE-2026-80560, CVE-2026-80561,     CVE-2026-80565, CVE-2026-80568, CVE-2026-80569, CVE-2026-80570, CVE-2026-80572, CVE-2026-80574,     CVE-2026-80576, CVE-2026-80578, CVE-2026-80579, CVE-2026-80580, CVE-2026-80583, CVE-2026-80584,     CVE-2026-80585, CVE-2026-80586, CVE-2026-80587, CVE-2026-80589, CVE-2026-80721, CVE-2026-80901,     CVE-2026-97509)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:77634 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: fs/notify: call exportfs_encode_fid with s_umount (CVE-2025-40237)

    * kernel: ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (CVE-2026-43186)

    * kernel: udf: fix partition descriptor append bookkeeping (CVE-2026-45991)

    * kernel: sctp: purge outqueue on stale COOKIE-ECHO handling (CVE-2026-52924)

    * kernel: netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CVE-2026-64007)

    * kernel: Kernel SMB client: Double-free vulnerability allows remote denial of service or privilege     escalation (CVE-2026-64385)

    * kernel: smb: client: fix double-free in SMB2_flush() replay (CVE-2026-64383)

    * kernel: smb: client: fix query_info() replay double-free (CVE-2026-64386)

    * kernel: udp: fix potential use-after-free in tunnel segmentation (CVE-2026-74705)

    * kernel: af_unix: Unlink scc_entry in unix_del_edge() (CVE-2026-80521)

    Bug Fix(es) and Enhancement(s):

    * kernel: fs/notify: call exportfs_encode_fid with s_umount [rhel-10.0.z] (JIRA:RHEL-169186)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-3146 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    af_unix: Unlink scc_entry in unix_del_edge(). (CVE-2026-80521)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-3147 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    af_unix: Unlink scc_entry in unix_del_edge(). (CVE-2026-80521)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-3148 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    af_unix: Unlink scc_entry in unix_del_edge(). (CVE-2026-80521)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - af_unix: Unlink scc_entry in unix_del_edge(). Kyle Zeng reported that GC could free a dead SCC partially.
    The scenario is as follows: 1) Create two SCCs: X -. A <-> B ^--' 2) Run the following concurrently: 2-1)     send() sk-B to sk-B from sk-X 2-2) close() both A and B At 2-1), there is a small window where     unix_add_edges() publishes a new edge (B <-> B) to GC but its skb is not queued by skb_queue_tail(). If     2-2) completes before skb_queue_tail() and GC is triggered, it judges A <-> B as dead, but B is not freed     because GC cannot collect the not-yet-queued skb holding the B <-> B edge. X -. A <-> B -. This edge is     visible ^--' ^..' but skb is not This itself is not a problem since the next GC run will judge B as dead     as well and free it finally. X -. A <.> B -. ^--' ^--' However, X's SCC forces the next GC to call     unix_walk_scc_fast(), and it iterates over A through B's scc_entry. Let's unlink scc_entry before freeing     the vertex in unix_del_edge(). (CVE-2026-80521)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
369242	RHEL 10 : kernel (RHSA-2026:81406)	Nessus	Red Hat Local Security Checks	Local	critical
367942	AlmaLinux 10 : kernel (ALSA-2026:81406)	Nessus	Alma Linux Local Security Checks	Local	critical
366919	Debian dla-4841 : ata-modules-6.1.0-53-armmp-di - security update	Nessus	Debian Local Security Checks	Local	high
474917	Google: sys-kernel/cchost-kernel-6_12, sys-kernel/csql-kernel-6_12, sys-kernel/lakitu-kernel-6_12, sys-kernel/lakitu-nc-kernel-6_12: security update to 19216.739.5	Tenable Cloud Security	Google COS Security Checks	Local	high
474917	Google: sys-kernel/cchost-kernel-6_12, sys-kernel/csql-kernel-6_12, sys-kernel/lakitu-kernel-6_12, sys-kernel/lakitu-nc-kernel-6_12: security update to 19216.739.5	Tenable Self-Hosted Container Security	Google COS Security Checks	Local	high
366074	Rocky Linux 10.2 [CIQ] Security Update: kernel / kernel-64k / kernel-64k-core / kernel-64k-debug / etc Multiple Vulnerabilities (crlsa-2026_81406)	Nessus	Rocky Linux Local Security Checks	Local	critical
365632	RockyLinux 10 : kernel (RLSA-2026:81406)	Nessus	Rocky Linux Local Security Checks	Local	critical
365563	Oracle Linux 10 : kernel (ELSA-2026-81406)	Nessus	Oracle Linux Local Security Checks	Local	critical
365457	Ubuntu 24.04 LTS : Linux kernel (NVIDIA Tegra) vulnerabilities (USN-8886-1)	Nessus	Ubuntu Local Security Checks	Local	high
364158	RHEL 10 : kernel (RHSA-2026:77634)	Nessus	Red Hat Local Security Checks	Local	critical
364137	Oracle Linux 10 / 9 : Unbreakable Enterprise kernel (ELSA-2026-500374)	Nessus	Oracle Linux Local Security Checks	Local	high
362907	Debian dla-4817 : ata-modules-6.12.107+deb12-armmp-di - security update	Nessus	Debian Local Security Checks	Local	high
353443	Amazon Linux 2023 : bpftool, kernel, kernel-devel (ALAS2023-2026-3146)	Nessus	Amazon Linux Local Security Checks	Local	high
353442	Amazon Linux 2023 : bpftool6.12, kernel6.12, kernel6.12-devel (ALAS2023-2026-3147)	Nessus	Amazon Linux Local Security Checks	Local	high
353441	Amazon Linux 2023 : bpftool6.18, kernel6.18, kernel6.18-devel (ALAS2023-2026-3148)	Nessus	Amazon Linux Local Security Checks	Local	high
351155	Debian dsa-6528 : ata-modules-6.12.111+deb13-armmp-di - security update	Nessus	Debian Local Security Checks	Local	high
340754	Linux Distros Unpatched Vulnerability : CVE-2026-80521	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2026-80521

high

Tenable Plugins

critical

critical

high

high

high

critical

critical

critical

high

critical

high

high

high

high

high

high

high