In the Linux kernel, the following vulnerability has been resolved: HID: picolcd: prevent NULL pointer dereference in picolcd_send_and_wait() In picolcd_send_and_wait(), an integer overflow of the signed loop counter 'k' can theoretically lead to a NULL pointer dereference of 'raw_data'. If the loop executes more than INT_MAX times, 'k' becomes negative, making the condition 'k < size' true even when 'size' is 0. Change the type of 'k' to 'unsigned int' to prevent the overflow and eliminate the out-of-bounds access. Found by Linux Verification Center (linuxtesting.org) with the Svace static analysis tool. [jkosina@suse.com: extended hash length]

An update of the linux package has been released.

The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1793370479 advisory.

  - In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: Fix buffer overflow in     debugfs If the user tries to write more than 32 bytes then it results in memory corruption. Fortunately,     this is debugfs so it's limited to root users. (CVE-2025-38317)

  - In the Linux kernel, the following vulnerability has been resolved: drm/xe/pf: Clear all LMTT pages on     alloc Our LMEM buffer objects are not cleared by default on alloc and during VF provisioning we only setup     LMTT PTEs for the actually provisioned LMEM range. But beyond that valid range we might leave some stale     data that could either point to some other VFs allocations or even to the PF pages. Explicitly clear all     new LMTT page to avoid the risk that a malicious VF would try to exploit that gap. While around add     asserts to catch any undesired PTE overwrites and low-level debug traces to track LMTT PT life-cycle.
    (cherry picked from commit 3fae6918a3e27cce20ded2551f863fb05d4bef8d) (CVE-2025-38511)

  - In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: fix memory leak in     ath12k_service_ready_ext_event Currently, in ath12k_service_ready_ext_event(), svc_rdy_ext.mac_phy_caps is     not freed in the failure case, causing a memory leak. The following trace is observed in kmemleak:
    unreferenced object 0xffff8b3eb5789c00 (size 1024): comm softirq, pid 0, jiffies 4294942577 hex dump     (first 32 bytes): 00 00 00 00 01 00 00 00 00 00 00 00 7b 00 00 10 ............{... 01 00 00 00 00 00 00 00     01 00 00 00 1f 38 00 00 .............8.. backtrace (crc 44e1c357): __kmalloc_noprof+0x30b/0x410     ath12k_wmi_mac_phy_caps_parse+0x84/0x100 [ath12k] ath12k_wmi_tlv_iter+0x5e/0x140 [ath12k]     ath12k_wmi_svc_rdy_ext_parse+0x308/0x4c0 [ath12k] ath12k_wmi_tlv_iter+0x5e/0x140 [ath12k]     ath12k_service_ready_ext_event.isra.0+0x44/0xd0 [ath12k] ath12k_wmi_op_rx+0x2eb/0xd70 [ath12k]     ath12k_htc_rx_completion_handler+0x1f4/0x330 [ath12k] ath12k_ce_recv_process_cb+0x218/0x300 [ath12k]     ath12k_pci_ce_workqueue+0x1b/0x30 [ath12k] process_one_work+0x219/0x680 bh_worker+0x198/0x1f0     tasklet_action+0x13/0x30 handle_softirqs+0xca/0x460 __irq_exit_rcu+0xbe/0x110 irq_exit_rcu+0x9/0x30 Free     svc_rdy_ext.mac_phy_caps in the error case to fix this memory leak. Tested-on: QCN9274 hw2.0 PCI     WLAN.WBE.1.4.1-00199-QCAHKSWPL_SILICONZ-1 (CVE-2025-39890)

  - In the Linux kernel, the following vulnerability has been resolved: bpf: Fix metadata_dst leak
    __bpf_redirect_neigh_v{4,6} Cilium has a BPF egress gateway feature which forces outgoing K8s Pod traffic     to pass through dedicated egress gateways which then SNAT the traffic in order to interact with stable IPs     outside the cluster. The traffic is directed to the gateway via vxlan tunnel in collect md mode. A recent     BPF change utilized the bpf_redirect_neigh() helper to forward packets after the arrival and decap on     vxlan, which turned out over time that the kmalloc-256 slab usage in kernel was ever-increasing. The issue     was that vxlan allocates the metadata_dst object and attaches it through a fake dst entry to the skb. The     latter was never released though given bpf_redirect_neigh() was merely setting the new dst entry via     skb_dst_set() without dropping an existing one first. (CVE-2025-40183)

  - In the Linux kernel, the following vulnerability has been resolved: mlxsw: spectrum_router: Fix neighbour     use-after-free We sometimes observe use-after-free when dereferencing a neighbour [1]. The problem seems     to be that the driver stores a pointer to the neighbour, but without holding a reference on it. A     reference is only taken when the neighbour is used by a nexthop. Fix by simplifying the reference counting     scheme. Always take a reference when storing a neighbour pointer in a neighbour entry. Avoid taking a     referencing when the neighbour is used by a nexthop as the neighbour entry associated with the nexthop     already holds a reference. Tested by running the test that uncovered the problem over 300 times. Without     this patch the problem was reproduced after a handful of iterations. [1] BUG: KASAN: slab-use-after-free     in mlxsw_sp_neigh_entry_update+0x2d4/0x310 Read of size 8 at addr ffff88817f8e3420 by task ip/3929 CPU: 3     UID: 0 PID: 3929 Comm: ip Not tainted 6.18.0-rc4-virtme-g36b21a067510 #3 PREEMPT(full) Hardware name:
    Nvidia SN5600/VMOD0013, BIOS 5.13 05/31/2023 Call Trace: <TASK> dump_stack_lvl+0x6f/0xa0     print_address_description.constprop.0+0x6e/0x300 print_report+0xfc/0x1fb kasan_report+0xe4/0x110     mlxsw_sp_neigh_entry_update+0x2d4/0x310 mlxsw_sp_router_rif_gone_sync+0x35f/0x510     mlxsw_sp_rif_destroy+0x1ea/0x730 mlxsw_sp_inetaddr_port_vlan_event+0xa1/0x1b0
    __mlxsw_sp_inetaddr_lag_event+0xcc/0x130 __mlxsw_sp_inetaddr_event+0xf5/0x3c0     mlxsw_sp_router_netdevice_event+0x1015/0x1580 notifier_call_chain+0xcc/0x150     call_netdevice_notifiers_info+0x7e/0x100 __netdev_upper_dev_unlink+0x10b/0x210     netdev_upper_dev_unlink+0x79/0xa0 vrf_del_slave+0x18/0x50 do_set_master+0x146/0x7d0     do_setlink.isra.0+0x9a0/0x2880 rtnl_newlink+0x637/0xb20 rtnetlink_rcv_msg+0x6fe/0xb90     netlink_rcv_skb+0x123/0x380 netlink_unicast+0x4a3/0x770 netlink_sendmsg+0x75b/0xc90
    __sock_sendmsg+0xbe/0x160 ____sys_sendmsg+0x5b2/0x7d0 ___sys_sendmsg+0xfd/0x180 __sys_sendmsg+0x124/0x1c0     do_syscall_64+0xbb/0xfd0 entry_SYSCALL_64_after_hwframe+0x4b/0x53 [...] Allocated by task 109:
    kasan_save_stack+0x30/0x50 kasan_save_track+0x14/0x30 __kasan_kmalloc+0x7b/0x90
    __kmalloc_noprof+0x2c1/0x790 neigh_alloc+0x6af/0x8f0 ___neigh_create+0x63/0xe90     mlxsw_sp_nexthop_neigh_init+0x430/0x7e0 mlxsw_sp_nexthop_type_init+0x212/0x960     mlxsw_sp_nexthop6_group_info_init.constprop.0+0x81f/0x1280 mlxsw_sp_nexthop6_group_get+0x392/0x6a0     mlxsw_sp_fib6_entry_create+0x46a/0xfd0 mlxsw_sp_router_fib6_replace+0x1ed/0x5f0     mlxsw_sp_router_fib6_event_work+0x10a/0x2a0 process_one_work+0xd57/0x1390 worker_thread+0x4d6/0xd40     kthread+0x355/0x5b0 ret_from_fork+0x1d4/0x270 ret_from_fork_asm+0x11/0x20 Freed by task 154:
    kasan_save_stack+0x30/0x50 kasan_save_track+0x14/0x30 __kasan_save_free_info+0x3b/0x60
    __kasan_slab_free+0x43/0x70 kmem_cache_free_bulk.part.0+0x1eb/0x5e0 kvfree_rcu_bulk+0x1f2/0x260     kfree_rcu_work+0x130/0x1b0 process_one_work+0xd57/0x1390 worker_thread+0x4d6/0xd40 kthread+0x355/0x5b0     ret_from_fork+0x1d4/0x270 ret_from_fork_asm+0x11/0x20 Last potentially related work creation:
    kasan_save_stack+0x30/0x50 kasan_record_aux_stack+0x8c/0xa0 kvfree_call_rcu+0x93/0x5b0     mlxsw_sp_router_neigh_event_work+0x67d/0x860 process_one_work+0xd57/0x1390 worker_thread+0x4d6/0xd40     kthread+0x355/0x5b0 ret_from_fork+0x1d4/0x270 ret_from_fork_asm+0x11/0x20 (CVE-2025-68801)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The AlmaLinux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1793370479 advisory.

  - In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: Fix buffer overflow in     debugfs If the user tries to write more than 32 bytes then it results in memory corruption. Fortunately,     this is debugfs so it's limited to root users. (CVE-2025-38317)

  - In the Linux kernel, the following vulnerability has been resolved: drm/xe/pf: Clear all LMTT pages on     alloc Our LMEM buffer objects are not cleared by default on alloc and during VF provisioning we only setup     LMTT PTEs for the actually provisioned LMEM range. But beyond that valid range we might leave some stale     data that could either point to some other VFs allocations or even to the PF pages. Explicitly clear all     new LMTT page to avoid the risk that a malicious VF would try to exploit that gap. While around add     asserts to catch any undesired PTE overwrites and low-level debug traces to track LMTT PT life-cycle.
    (cherry picked from commit 3fae6918a3e27cce20ded2551f863fb05d4bef8d) (CVE-2025-38511)

  - In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: fix memory leak in     ath12k_service_ready_ext_event Currently, in ath12k_service_ready_ext_event(), svc_rdy_ext.mac_phy_caps is     not freed in the failure case, causing a memory leak. The following trace is observed in kmemleak:
    unreferenced object 0xffff8b3eb5789c00 (size 1024): comm softirq, pid 0, jiffies 4294942577 hex dump     (first 32 bytes): 00 00 00 00 01 00 00 00 00 00 00 00 7b 00 00 10 ............{... 01 00 00 00 00 00 00 00     01 00 00 00 1f 38 00 00 .............8.. backtrace (crc 44e1c357): __kmalloc_noprof+0x30b/0x410     ath12k_wmi_mac_phy_caps_parse+0x84/0x100 [ath12k] ath12k_wmi_tlv_iter+0x5e/0x140 [ath12k]     ath12k_wmi_svc_rdy_ext_parse+0x308/0x4c0 [ath12k] ath12k_wmi_tlv_iter+0x5e/0x140 [ath12k]     ath12k_service_ready_ext_event.isra.0+0x44/0xd0 [ath12k] ath12k_wmi_op_rx+0x2eb/0xd70 [ath12k]     ath12k_htc_rx_completion_handler+0x1f4/0x330 [ath12k] ath12k_ce_recv_process_cb+0x218/0x300 [ath12k]     ath12k_pci_ce_workqueue+0x1b/0x30 [ath12k] process_one_work+0x219/0x680 bh_worker+0x198/0x1f0     tasklet_action+0x13/0x30 handle_softirqs+0xca/0x460 __irq_exit_rcu+0xbe/0x110 irq_exit_rcu+0x9/0x30 Free     svc_rdy_ext.mac_phy_caps in the error case to fix this memory leak. Tested-on: QCN9274 hw2.0 PCI     WLAN.WBE.1.4.1-00199-QCAHKSWPL_SILICONZ-1 (CVE-2025-39890)

  - In the Linux kernel, the following vulnerability has been resolved: bpf: Fix metadata_dst leak
    __bpf_redirect_neigh_v{4,6} Cilium has a BPF egress gateway feature which forces outgoing K8s Pod traffic     to pass through dedicated egress gateways which then SNAT the traffic in order to interact with stable IPs     outside the cluster. The traffic is directed to the gateway via vxlan tunnel in collect md mode. A recent     BPF change utilized the bpf_redirect_neigh() helper to forward packets after the arrival and decap on     vxlan, which turned out over time that the kmalloc-256 slab usage in kernel was ever-increasing. The issue     was that vxlan allocates the metadata_dst object and attaches it through a fake dst entry to the skb. The     latter was never released though given bpf_redirect_neigh() was merely setting the new dst entry via     skb_dst_set() without dropping an existing one first. (CVE-2025-40183)

  - In the Linux kernel, the following vulnerability has been resolved: mlxsw: spectrum_router: Fix neighbour     use-after-free We sometimes observe use-after-free when dereferencing a neighbour [1]. The problem seems     to be that the driver stores a pointer to the neighbour, but without holding a reference on it. A     reference is only taken when the neighbour is used by a nexthop. Fix by simplifying the reference counting     scheme. Always take a reference when storing a neighbour pointer in a neighbour entry. Avoid taking a     referencing when the neighbour is used by a nexthop as the neighbour entry associated with the nexthop     already holds a reference. Tested by running the test that uncovered the problem over 300 times. Without     this patch the problem was reproduced after a handful of iterations. [1] BUG: KASAN: slab-use-after-free     in mlxsw_sp_neigh_entry_update+0x2d4/0x310 Read of size 8 at addr ffff88817f8e3420 by task ip/3929 CPU: 3     UID: 0 PID: 3929 Comm: ip Not tainted 6.18.0-rc4-virtme-g36b21a067510 #3 PREEMPT(full) Hardware name:
    Nvidia SN5600/VMOD0013, BIOS 5.13 05/31/2023 Call Trace: <TASK> dump_stack_lvl+0x6f/0xa0     print_address_description.constprop.0+0x6e/0x300 print_report+0xfc/0x1fb kasan_report+0xe4/0x110     mlxsw_sp_neigh_entry_update+0x2d4/0x310 mlxsw_sp_router_rif_gone_sync+0x35f/0x510     mlxsw_sp_rif_destroy+0x1ea/0x730 mlxsw_sp_inetaddr_port_vlan_event+0xa1/0x1b0
    __mlxsw_sp_inetaddr_lag_event+0xcc/0x130 __mlxsw_sp_inetaddr_event+0xf5/0x3c0     mlxsw_sp_router_netdevice_event+0x1015/0x1580 notifier_call_chain+0xcc/0x150     call_netdevice_notifiers_info+0x7e/0x100 __netdev_upper_dev_unlink+0x10b/0x210     netdev_upper_dev_unlink+0x79/0xa0 vrf_del_slave+0x18/0x50 do_set_master+0x146/0x7d0     do_setlink.isra.0+0x9a0/0x2880 rtnl_newlink+0x637/0xb20 rtnetlink_rcv_msg+0x6fe/0xb90     netlink_rcv_skb+0x123/0x380 netlink_unicast+0x4a3/0x770 netlink_sendmsg+0x75b/0xc90
    __sock_sendmsg+0xbe/0x160 ____sys_sendmsg+0x5b2/0x7d0 ___sys_sendmsg+0xfd/0x180 __sys_sendmsg+0x124/0x1c0     do_syscall_64+0xbb/0xfd0 entry_SYSCALL_64_after_hwframe+0x4b/0x53 [...] Allocated by task 109:
    kasan_save_stack+0x30/0x50 kasan_save_track+0x14/0x30 __kasan_kmalloc+0x7b/0x90
    __kmalloc_noprof+0x2c1/0x790 neigh_alloc+0x6af/0x8f0 ___neigh_create+0x63/0xe90     mlxsw_sp_nexthop_neigh_init+0x430/0x7e0 mlxsw_sp_nexthop_type_init+0x212/0x960     mlxsw_sp_nexthop6_group_info_init.constprop.0+0x81f/0x1280 mlxsw_sp_nexthop6_group_get+0x392/0x6a0     mlxsw_sp_fib6_entry_create+0x46a/0xfd0 mlxsw_sp_router_fib6_replace+0x1ed/0x5f0     mlxsw_sp_router_fib6_event_work+0x10a/0x2a0 process_one_work+0xd57/0x1390 worker_thread+0x4d6/0xd40     kthread+0x355/0x5b0 ret_from_fork+0x1d4/0x270 ret_from_fork_asm+0x11/0x20 Freed by task 154:
    kasan_save_stack+0x30/0x50 kasan_save_track+0x14/0x30 __kasan_save_free_info+0x3b/0x60
    __kasan_slab_free+0x43/0x70 kmem_cache_free_bulk.part.0+0x1eb/0x5e0 kvfree_rcu_bulk+0x1f2/0x260     kfree_rcu_work+0x130/0x1b0 process_one_work+0xd57/0x1390 worker_thread+0x4d6/0xd40 kthread+0x355/0x5b0     ret_from_fork+0x1d4/0x270 ret_from_fork_asm+0x11/0x20 Last potentially related work creation:
    kasan_save_stack+0x30/0x50 kasan_record_aux_stack+0x8c/0xa0 kvfree_call_rcu+0x93/0x5b0     mlxsw_sp_router_neigh_event_work+0x67d/0x860 process_one_work+0xd57/0x1390 worker_thread+0x4d6/0xd40     kthread+0x355/0x5b0 ret_from_fork+0x1d4/0x270 ret_from_fork_asm+0x11/0x20 (CVE-2025-68801)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-500249 advisory.

    - inet: frags: strip GSO state from fragments before reassembly (Xinyang Ge)  [Orabug: 39974835]     {CVE-2026-80590}
    - KVM: x86/mmu: Stop needlessly making MMU pages available for TDP MMU faults (David Matlack) [Orabug:
    39830590] {CVE-2026-64561}
    - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Sean Christopherson)     [Orabug: 39830590,39832946] {CVE-2026-64561}
    - KVM: x86/mmu: Rename __direct_map() to direct_map() (David Matlack) [Orabug: 39830590] {CVE-2026-64561}
    - KVM: x86/mmu: Split out TDP MMU page fault handling (David Matlack) [Orabug: 39830590] {CVE-2026-64561}
    - KVM: Rename mmu_notifier_* to mmu_invalidate_* (Chao Peng) [Orabug: 39830590] {CVE-2026-64561}
    - KVM: x86/mmu: Document the 'rules' for using host_pfn_mapping_level() (Sean Christopherson) [Orabug:
    39830590] {CVE-2026-64561}
    - KVM: x86/mmu: Rename pte_list_{destroy,remove}() to show they zap SPTEs (Sean Christopherson) [Orabug:
    39830590] {CVE-2026-64561}
    - KVM: x86/mmu: Directly 'destroy' PTE list when recycling rmaps (Sean Christopherson) [Orabug: 39830590]     {CVE-2026-64561}
    - x86/bugs: Make Safe-RET robust against interrupt injection (Borislav Petkov) [Orabug: 39784615,39853775]     {CVE-2026-68480}
    - x86/alternatives: Disable interrupts and sync when optimizing NOPs in place (Thomas Gleixner) [Orabug:
    39784615] {CVE-2026-68480}
    - x86/alternative: Support relocations in alternatives (Peter Zijlstra) [Orabug: 39784615]     {CVE-2026-68480}
    - x86/alternative: Make debug-alternative selective (Peter Zijlstra) [Orabug: 39784615] {CVE-2026-68480}
    - x86/alternatives: Add alt_instr.flags (Borislav Petkov) [Orabug: 39784615] {CVE-2026-68480}
    - x86/asm: Provide ALTERNATIVE_3 (Peter Zijlstra) [Orabug: 39784615] {CVE-2026-68480}
    - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Thomas Gleixner) [Orabug: 39807438]     {CVE-2026-64560}
    - ALSA: seq: Fix uninitialised heap leak in snd_seq_event_dup() (Hyeongjun An) [Orabug: 39853280]     {CVE-2026-64479}
    - crypto: qat - validate RSA CRT component lengths (Giovanni Cabiddu) [Orabug: 39785885] {CVE-2026-64304}
    - btrfs: do not trim a device which is not writeable (Qu Wenruo) [Orabug: 39843586] {CVE-2026-64593}
    - bpf: Allow LPM map access from sleepable BPF programs (Vlad Poenaru) [Orabug: 39786046] {CVE-2026-64352}
    - bpf: Reject fragmented frames in devmap (Zhao Zhang) [Orabug: 39786052] {CVE-2026-64355}
    - HID: appleir: fix UAF on pending key_up_timer in remove() (Manish Khadka) [Orabug: 39786074]     {CVE-2026-64363}
    - proc: protect ptrace_may_access() with exec_update_lock (part 1) (Jann Horn) [Orabug: 39786095]     {CVE-2026-64371}
    - HID: multitouch: fix out-of-bounds bit access on mt_io_flags (Trung Nguyen) [Orabug: 39786078]     {CVE-2026-64364}
    - proc: protect ptrace_may_access() with exec_update_lock (FD links) (Jann Horn) [Orabug: 39786112]     {CVE-2026-64375}
    - smb: client: harden POSIX SID length parsing (Zihan Xi) [Orabug: 39786128] {CVE-2026-64380}
    - smb: client: mask server-provided mode to 07777 in modefromsid (Norbert Manthey) [Orabug: 39786124]     {CVE-2026-64379}
    - smb: client: resolve SWN tcon from live registrations (Michael Bommarito) [Orabug: 39786200]     {CVE-2026-64401}
    - smb: client: Fix next buffer leak in receive_encrypted_standard() (Haoxiang Li) [Orabug: 39786131]     {CVE-2026-64381}
    - Bluetooth: L2CAP: cancel pending_rx_work before taking conn->lock (Runyu Xiao) [Orabug: 39760901]     {CVE-2026-64206}
    - netfilter: ebtables: zero chainstack array (Florian Westphal) [Orabug: 39786232] {CVE-2026-64413}
    - staging: rtl8723bs: fix OOB reads in rtw_get_sec_ie(), rtw_get_wapi_ie(), and rtw_get_wps_attr()     (Alexandru Hossu) [Orabug: 39786307] {CVE-2026-64441}
    - PCI: mediatek: Fix IRQ domain leak when port fails to enable (Manivannan Sadhasivam) [Orabug: 39786366]     {CVE-2026-64461}
    - staging: rtl8723bs: fix heap buffer overflow in rtw_cfg80211_set_wpa_ie() (Alexandru Hossu) [Orabug:
    39786327] {CVE-2026-64446}
    - smb: client: restrict implied bcc[0] exemption to responses without data area (Shoichiro Miyamoto)     [Orabug: 39786332] {CVE-2026-64448}
    - vfio/pci: Release the VGA arbiter client on register_device() failure (Alex Williamson) [Orabug:
    39786409] {CVE-2026-64475}
    - ACPI: NFIT: core: Fix acpi_nfit_init() error cleanup (Rafael J. Wysocki) [Orabug: 39786502]     {CVE-2026-64510}
    - ACPI: CPPC: Suppress UBSAN warning caused by field misuse (Jeremy Linton) [Orabug: 39786508]     {CVE-2026-64512}
    - net: openvswitch: reject oversized nested action attrs (Asim Viladi Oglu Manizada) [Orabug:
    39789564,39816016,39819143] {CVE-2026-64531}
    - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (Shivam Kumar) [Orabug:
    39789573] {CVE-2026-64534}
    - sctp: validate STALE_COOKIE cause length before reading staleness (Weiming Shi) [Orabug: 39794431]     {CVE-2026-64551}
    - netfilter: bridge: fix stale prevhdr pointer in br_ip6_fragment() (Xiang Mei) [Orabug: 39794442]     {CVE-2026-64554}
    - Bluetooth: bpa10x: avoid OOB read of revision string in bpa10x_setup() (Weiming Shi) [Orabug: 39794421]     {CVE-2026-64549}
    - net: usb: net1080: validate packet_len before pad-byte access in rx_fixup (Xiang Mei) [Orabug: 39794412]     {CVE-2026-64547}
    - usbnet: gl620a: fix out-of-bounds read in genelink_rx_fixup() (Xiang Mei) [Orabug: 39794387]     {CVE-2026-64540}
    - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (Jamal Hadi Salim) [Orabug: 39787017]     {CVE-2026-64530}
    - net, bpf: check master for NULL in xdp_master_redirect() (Xiang Mei) [Orabug: 39794405] {CVE-2026-64545}
    - ipv6: Fix null-ptr-deref in fib6_nh_mtu_change(). (Xiang Mei) [Orabug: 39794379] {CVE-2026-64538}
    - drm/edid: fix OOB read in drm_parse_tiled_block() (Xiang Mei) [Orabug: 39794408] {CVE-2026-64546}
    - net: psample: fix info leak in PSAMPLE_ATTR_DATA (Jakub Kicinski) [Orabug: 39794438] {CVE-2026-64553}
    - bpf, sockmap: reject overflowing copy + len in bpf_msg_push_data() (Weiming Shi) [Orabug: 39794417]     {CVE-2026-64548}
    - crypto: asymmetric_keys - fix OOB read in pefile_digest_pe_contents (Weiming Shi) [Orabug: 39794401]     {CVE-2026-64544}
    - xfs: fail recovery on a committed log item with no regions (Weiming Shi) [Orabug: 39760871]     {CVE-2026-64187}
    - fuse: re-lock request before returning from fuse_ref_folio() (Joanne Koong) [Orabug: 39785786]     {CVE-2026-64266}
    - Input: touchwin - reset the packet index on every complete packet (Bryam Vargas) [Orabug: 39785802]     {CVE-2026-64271}
    - Input: elan_i2c - prevent division by zero and arithmetic underflow (Ranjan Kumar) [Orabug: 39785819]     {CVE-2026-64275}
    - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (Bryam Vargas) [Orabug: 39785823]     {CVE-2026-64276}
    - i2c: core: fix adapter deregistration race (Johan Hovold) [Orabug: 39785831] {CVE-2026-64279}
    - KVM: VMX: Grab vmcs12 on CR8 interception update iff vCPU is in guest mode (Sean Christopherson)     [Orabug: 39843616] {CVE-2026-64604}
    - exfat: bound uniname advance in exfat_find_dir_entry() (Bryam Vargas) [Orabug: 39785863]     {CVE-2026-64296}
    - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (Benjamin Coddington) [Orabug: 39785868]     {CVE-2026-64298}
    - tracing: Prevent out-of-bounds read in glob matching (Huihui Huang) [Orabug: 39785872] {CVE-2026-64299}
    - crypto: drbg - Fix returning success on failure in CTR_DRBG (Eric Biggers) [Orabug: 39785893]     {CVE-2026-64306}
    - crypto: pcrypt - restore callback for non-parallel fallback (Ruijie Li) [Orabug: 39785906]     {CVE-2026-64312}
    - crypto: ecc - Fix carry overflow in vli multiplication (Anastasia Tishchenko) [Orabug: 39785910]     {CVE-2026-64313}
    - isofs: bound Rock Ridge symlink components to the SL record (Bryam Vargas) [Orabug: 39785923]     {CVE-2026-64317}
    - udf: validate sparing table length as an entry count, not a byte count (Bryam Vargas) [Orabug: 39785940]     {CVE-2026-64322}
    - udf: validate VAT header length against the VAT inode size (Bryam Vargas) [Orabug: 39785944]     {CVE-2026-64323}
    - udf: validate free block extents against the partition length (Michael Bommarito) [Orabug: 39785948]     {CVE-2026-64324}
    - usb: typec: tcpm: Validate SVID index in svdm_consume_modes() (Badhri Jagan Sridharan) [Orabug:
    39785963] {CVE-2026-64330}
    - usbip: vudc: fix NULL deref in vep_dequeue() (Sam Day) [Orabug: 39785967] {CVE-2026-64331}
    - USB: ulpi: fix memory leak on registration failure (Johan Hovold) [Orabug: 39785971] {CVE-2026-64332}
    - USB: serial: digi_acceleport: fix write buffer corruption (Johan Hovold) [Orabug: 39785975]     {CVE-2026-64333}
    - USB: serial: digi_acceleport: fix hard lockup on disconnect (Johan Hovold) [Orabug: 39785979]     {CVE-2026-64334}
    - USB: serial: digi_acceleport: fix broken rx after throttle (Johan Hovold) [Orabug: 39785983]     {CVE-2026-64335}
    - USB: serial: keyspan_pda: fix information leak (Johan Hovold) [Orabug: 39785987] {CVE-2026-64336}
    - USB: misc: uss720: unregister parport on probe failure (Myeonghun Pak) [Orabug: 39785994]     {CVE-2026-64338}
    - USB: legousbtower: fix use-after-free on disconnect race (Johan Hovold) [Orabug: 39785999]     {CVE-2026-64340}
    - USB: iowarrior: fix use-after-free on disconnect (Johan Hovold) [Orabug: 39786007] {CVE-2026-64342}
    - USB: ldusb: fix use-after-free on disconnect race (Johan Hovold) [Orabug: 39786012] {CVE-2026-64343}
    - USB: idmouse: fix use-after-free on disconnect race (Johan Hovold) [Orabug: 39786017] {CVE-2026-64344}
    - usb: gadget: udc: Fix use-after-free in gadget_match_driver (Jimmy Hu) [Orabug: 39786026]     {CVE-2026-64346}
    - usb: gadget: composite: fix dead empty check in the USB_DT_OTG handler (Maoyi Xie) [Orabug: 39786030]     {CVE-2026-64347}
    - net: usb: kalmia: bound RX frame length in kalmia_rx_fixup() (Maoyi Xie) [Orabug: 39786042]     {CVE-2026-64351}
    - HID: lg-g15: cancel pending work on remove to fix a use-after-free (Maoyi Xie) [Orabug: 39786071]     {CVE-2026-64362}
    - HID: wacom: stop hardware after post-start probe failures (Myeonghun Pak) [Orabug: 39859299]     {CVE-2026-68091}
    - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Xu Wang) [Orabug: 39786091]     {CVE-2026-64370}
    - cpufreq: pcc: fix use-after-free and double free in _OSC evaluation (Yuho Choi) [Orabug: 39786100]     {CVE-2026-64372}
    - cpufreq: Fix hotplug-suspend race during reboot (Tianxiang Chen) [Orabug: 39786104] {CVE-2026-64373}
    - sched/rt: Have RT_PUSH_IPI be default off for non PREEMPT_RT (Steven Rostedt) [Orabug: 39786108]     {CVE-2026-64374}
    - net: Drop the lock in skb_may_tx_timestamp() (Sebastian Andrzej Siewior) [Orabug: 39331701]     {CVE-2026-43216}
    - Bluetooth: L2CAP: validate option length before reading conf opt value (Muhammad Bilal) [Orabug:
    39786205] {CVE-2026-64403}
    - Bluetooth: fix UAF in bt_accept_dequeue() (Yousef Alhouseen) [Orabug: 39786578] {CVE-2026-64406}
    - Bluetooth: bnep: pin L2CAP connection during netdev registration (Yousef Alhouseen) [Orabug: 39786217]     {CVE-2026-64408}
    - netfilter: ebtables: terminate table name before find_table_lock() (Xiang Mei) [Orabug: 39786224]     {CVE-2026-64411}
    - netfilter: ebtables: module names must be null-terminated (Florian Westphal) [Orabug: 39786228]     {CVE-2026-64412}
    - mfd: cros_ec: Delay dev_set_drvdata() until probe success (Andrei Kuchynski) [Orabug: 39786248]     {CVE-2026-64420}
    - net: ipv4: bound TCP reordering sysctl writes and MTU probe sizes (Wyatt Feng) [Orabug: 39786254]     {CVE-2026-64422}
    - ipv4: igmp: remove multicast group from hash table on device destruction (Yuyang Huang) [Orabug:
    39786259] {CVE-2026-64423}
    - io_uring/io-wq: re-check IO_WQ_BIT_EXIT for each linked work item (Runyu Xiao) [Orabug: 39786574]     {CVE-2026-64425}
    - audit: Fix data races of skb_queue_len() readers on audit_queue (Chi Wang) [Orabug: 39786289]     {CVE-2026-64435}
    - net: af_key: initialize alg_key_len for IPComp states (Zijing Yin) [Orabug: 39786293] {CVE-2026-64436}
    - crypto: amlogic - avoid double cleanup in meson_crypto_probe() (Dawei Feng) [Orabug: 39843604]     {CVE-2026-64599}
    - staging: rtl8723bs: fix OOB write in HT_caps_handler() (Alexandru Hossu) [Orabug: 39786303]     {CVE-2026-64440}
    - staging: rtl8723bs: fix OOB reads in is_ap_in_tkip() IE loop (Alexandru Hossu) [Orabug: 39789581]     {CVE-2026-64536}
    - staging: rtl8723bs: fix OOB reads in IE loops in issue_assocreq() and join_cmd_hdl() (Alexandru Hossu)     [Orabug: 39786311] {CVE-2026-64442}
    - staging: rtl8723bs: fix OOB read in update_beacon_info() IE loop (Alexandru Hossu) [Orabug: 39786315]     {CVE-2026-64443}
    - staging: rtl8723bs: fix OOB read in OnAssocRsp() IE loop (Alexandru Hossu) [Orabug: 39786319]     {CVE-2026-64444}
    - staging: rtl8723bs: fix WEP length underflow and OOB read in OnAuth() (Alexandru Hossu) [Orabug:
    39786323] {CVE-2026-64445}
    - tipc: fix out-of-bounds read in broadcast Gap ACK blocks (Samuel Page) [Orabug: 39786340]     {CVE-2026-64450}
    - 6lowpan: fix NHC entry use-after-free on error path (Yizhou Zhao) [Orabug: 39786344] {CVE-2026-64452}
    - usb: dwc3: run gadget disconnect from sleepable suspend context (Runyu Xiao) [Orabug: 39786349]     {CVE-2026-64454}
    - USB: chaoskey: Fix slab-use-after-free in chaoskey_release() (Alan Stern) [Orabug: 39786352]     {CVE-2026-64455}
    - hwrng: virtio: clamp device-reported used.len at copy_data() (Michael Bommarito) [Orabug: 39786356]     {CVE-2026-64456}
    - netfilter: ipset: fix race between dump and ip_set_list resize (Xiang Mei) [Orabug: 39760883]     {CVE-2026-64189}
    - usb: xhci: Fix sleep in atomic context in xhci_free_streams() (Lianqin Hu) [Orabug: 39786379]     {CVE-2026-64465}
    - Bluetooth: btusb: fix use-after-free on marvell probe failure (Johan Hovold) [Orabug: 39786393]     {CVE-2026-64470}
    - Bluetooth: btusb: fix use-after-free on registration failure (Johan Hovold) [Orabug: 39786397]     {CVE-2026-64471}
    - ALSA: usb-audio: avoid kobject path lookup in DualSense match (Darvell Long) [Orabug: 39786416]     {CVE-2026-64478}
    - ALSA: firewire: isight: bound the sample count to the packet payload (Maoyi Xie) [Orabug: 39786428]     {CVE-2026-64483}
    - ALSA: es1938: check snd_ctl_new1() return value (Zhao Dongdong) [Orabug: 39786432] {CVE-2026-64484}
    - ALSA: caiaq: fix out-of-bounds read in the Traktor Kontrol S4 input parser (Maoyi Xie) [Orabug:
    39786439] {CVE-2026-64487}
    - iio: event: Fix event FIFO reset race (Lars-Peter Clausen) [Orabug: 39786462] {CVE-2026-64496}
    - iio: accel: kxsd9: fix runtime PM imbalance on write_raw() error (Biren Pandya) [Orabug: 39786478]     {CVE-2026-64503}
    - iio: accel: bmc150: clamp the device-reported FIFO frame count (Bryam Vargas) [Orabug: 39786482]     {CVE-2026-64504}
    - NFSv4/flexfiles: reject zero filehandle version count (Michael Bommarito) [Orabug: 39753894]     {CVE-2026-53392}
    - fbdev: fbcon: fix out-of-bounds read in err_out of fbcon_do_set_font() (Mingyu Wang) [Orabug: 39753924]     {CVE-2026-53402}
    - i2c: core: fix adapter registration race (Johan Hovold) [Orabug: 39753916] {CVE-2026-53400}
    - block: Avoid mounting the bdev pseudo-filesystem in userspace (Denis Arefev) [Orabug: 39753985]     {CVE-2026-63810}
    - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Maoyi Xie) [Orabug: 39754045]     {CVE-2026-63829}
    - net: skmsg: preserve sg.copy across SG transforms (Yiming Qian) [Orabug: 39754049] {CVE-2026-63830}
    - netfilter: nf_tables: restore set elements when delete set fails (Pablo Neira Ayuso) [Orabug: 36598010]     {CVE-2024-27012}
    - KVM: Replace guest-triggerable BUG_ON() in ioeventfd datamatch with get_unaligned() (Sean     Christopherson) [Orabug: 39753972] {CVE-2026-63806}
    - userfaultfd: gate must_wait writability check on pte_present() (Kiryl Shutsemau) [Orabug: 39786515]     {CVE-2026-64514}
    - nfsd: reset write verifier on deferred writeback errors (Jeff Layton) [Orabug: 39753898]     {CVE-2026-53393}
    - nfsd: release layout stid on setlease failure (Chris Mason) [Orabug: 39753912] {CVE-2026-53399}
    - nvmet-tcp: fix race between ICReq handling and queue teardown (Chaitanya Kulkarni) [Orabug: 39460310]     {CVE-2026-46135}
    - net: tap: set skb->dev before parsing virtio net header in tap_get_user_xdp() (Dongli Zhang) [Orabug:
    39558744] {CVE-2026-74684}
    - net/rds: zero per-item info buffer before handing it to visitors (Michael Bommarito) [Orabug:
    39621715,39638197] {CVE-2026-52995}
    - x86/sev: Evict cache lines during SNP memory validation (Tom Lendacky) [Orabug: 38334919]     {CVE-2025-38560}
    - xfs: resample the data fork mapping after cycling ILOCK (Darrick Wong) [Orabug: 39776791]     {CVE-2026-64600}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - HID: picolcd: prevent NULL pointer dereference in picolcd_send_and_wait() In picolcd_send_and_wait(), an     integer overflow of the signed loop counter 'k' can theoretically lead to a NULL pointer dereference of     'raw_data'. If the loop executes more than INT_MAX times, 'k' becomes negative, making the condition 'k <     size' true even when 'size' is 0. Change the type of 'k' to 'unsigned int' to prevent the overflow and     eliminate the out-of-bounds access. Found by Linux Verification Center (linuxtesting.org) with the Svace     static analysis tool. [jkosina@suse.com: extended hash length] (CVE-2026-80605)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
375639	Photon OS 5.0: Linux PHSA-2026-5.0-91-0960	Nessus	PhotonOS Local Security Checks	Local	high
374300	Rocky Linux 9.6 [TuxCare] Security Update: kernel / kernel-64k / kernel-64k-core / kernel-64k-debug / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1793370479)	Nessus	Rocky Linux Local Security Checks	Local	high
374299	AlmaLinux 9.6 [TuxCare] Security Update: kernel / kernel-64k / kernel-64k-core / kernel-64k-debug / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1793370479)	Nessus	Alma Linux Local Security Checks	Local	high
365768	Ubuntu 26.04 LTS : Linux kernel (Azure) vulnerabilities (USN-8888-1)	Nessus	Ubuntu Local Security Checks	Local	medium
365767	Ubuntu 26.04 LTS : Linux kernel vulnerabilities (USN-8887-1)	Nessus	Ubuntu Local Security Checks	Local	medium
365525	Ubuntu 24.04 LTS : Linux kernel (Azure) vulnerabilities (USN-8918-1)	Nessus	Ubuntu Local Security Checks	Local	medium
365522	Ubuntu 24.04 LTS : Linux kernel vulnerabilities (USN-8917-1)	Nessus	Ubuntu Local Security Checks	Local	medium
365463	Ubuntu 26.04 LTS : Linux kernel (OEM) vulnerabilities (USN-8889-1)	Nessus	Ubuntu Local Security Checks	Local	medium
365382	Ubuntu 20.04 LTS / 22.04 LTS : Linux kernel vulnerabilities (USN-8875-1)	Nessus	Ubuntu Local Security Checks	Local	high
365381	Ubuntu 22.04 LTS : Linux kernel (GCP) vulnerabilities (USN-8877-1)	Nessus	Ubuntu Local Security Checks	Local	high
365377	Ubuntu 20.04 LTS : Linux kernel (Oracle) vulnerabilities (USN-8879-1)	Nessus	Ubuntu Local Security Checks	Local	high
365370	Ubuntu 20.04 LTS : Linux kernel (GCP) vulnerabilities (USN-8878-1)	Nessus	Ubuntu Local Security Checks	Local	high
343048	Oracle Linux 8 / 9 : Unbreakable Enterprise kernel (ELSA-2026-500249)	Nessus	Oracle Linux Local Security Checks	Local	high
342004	Linux Distros Unpatched Vulnerability : CVE-2026-80605	Nessus	Misc.	Local	medium
337224	Amazon Linux 2 : kernel (ALASKERNEL-5.10-2026-129)	Nessus	Amazon Linux Local Security Checks	Local	high
334784	Photon OS 5.0: Linux PHSA-2026-5.0-92-0952	Nessus	PhotonOS Local Security Checks	Local	high

Detections

Analytics

CVE-2026-80605

high

Tenable Plugins

high

high

high

medium

medium

medium

medium

medium

high

high

high

high

high

medium

high

high