In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Add bounds check for CRAT subtype length The CRAT parser validates that the subtype header fits within the image, but does not verify that the advertised subtype length fits. A malformed CRAT table with an oversized length field causes out-of-bounds reads when kfd_parse_subtype() casts the header to specific subtype structures. Add validation that sub_type_hdr + length does not exceed the image boundary before parsing the subtype contents. (cherry picked from commit 48e1d1e6e8798aef0312e68d8e586021b5b3cf4d)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-146145 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    drm/amdkfd: Add bounds check for CRAT subtype length

    The CRAT parser validates that the subtype header fits within the image,     but does not verify that the advertised subtype length fits. A malformed     CRAT table with an oversized length field causes out-of-bounds reads when     kfd_parse_subtype() casts the header to specific subtype structures.

    Add validation that sub_type_hdr + length does not exceed the image     boundary before parsing the subtype contents.

    (cherry picked from commit 48e1d1e6e8798aef0312e68d8e586021b5b3cf4d)

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - drm/amdkfd: Add bounds check for CRAT subtype length The CRAT parser validates that the subtype header     fits within the image, but does not verify that the advertised subtype length fits. A malformed CRAT table     with an oversized length field causes out-of-bounds reads when kfd_parse_subtype() casts the header to     specific subtype structures. Add validation that sub_type_hdr + length does not exceed the image boundary     before parsing the subtype contents. (cherry picked from commit 48e1d1e6e8798aef0312e68d8e586021b5b3cf4d)     (CVE-2026-80747)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
376443	Ubuntu 24.04 LTS / 26.04 LTS : Linux kernel vulnerabilities (USN-8959-1)	Nessus	Ubuntu Local Security Checks	Local	high
372515	Unity Linux 20.1070a Security Update: kernel (UTSA-2026-146145)	Nessus	Unity Linux Local Security Checks	Local	high
366749	SUSE SLES12: cluster-md-kmp-default / dlm-kmp-default / gfs2-kmp-default / etc (SUSE-SU-2026:4687-1)	Nessus	SuSE Local Security Checks	Local	high
366742	SUSE SLED15: cluster-md-kmp-default / dlm-kmp-default / gfs2-kmp-default / etc (SUSE-SU-2026:4706-1)	Nessus	SuSE Local Security Checks	Local	high
342738	Linux Distros Unpatched Vulnerability : CVE-2026-80747	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2026-80747

high

Tenable Plugins

high

high

high

high

high