In the Linux kernel, the following vulnerability has been resolved: net/packet: defer vmalloc TX_RING free until skbs finish AF_PACKET TX_RING skbs keep a raw pointer to their ring frame. The skb page references preserve page-backed ring blocks after pg_vec is freed, but they do not preserve a vmalloc mapping. tpacket_destruct_skb() currently drops the pending reference before writing the timestamp and TP_STATUS_AVAILABLE to the frame. Move the decrement after those stores. The smp_wmb() in __packet_set_status() orders the frame stores before the decrement. Also recheck pending TX frames under pg_vec_lock before non-closing ring replacement, so a racing send cannot add a pending skb between the initial check and the ring swap. Ring allocation can produce a mixture of page-backed and vmalloc-backed blocks. Allocate deferred-work storage during TX ring setup when the first vmalloc-backed block is encountered, and keep its pointer in the pg_vec allocation header. If allocation fails, return -ENOMEM from ring setup. On socket close, a non-NULL pointer identifies a vmalloc-backed vector without a scan. If TX skbs remain, defer the whole vector to system_long_wq. After pg_vec is detached, a late destructor can skip the pending decrement. Use socket write-memory accounting as the deferred lifetime gate instead: an skb remains charged through its final sock_wfree(), after all ring-frame accesses. The delayed work retains a socket reference and reschedules itself until no TX skbs remain. Move pending_refcnt release to packet_sock_destruct() so late skb destructors and deferred cleanup can safely use it after packet_release(). Page-backed teardown remains synchronous, and no lock is added to the TX completion hot path.

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1792243434 advisory.

  - In the Linux kernel, the following vulnerability has been resolved: ethernet: hisilicon: hns:
    hns_dsaf_misc: fix a possible array overflow in hns_dsaf_ge_srst_by_port() The if statement: if (port >=     DSAF_GE_NUM) return; limits the value of port less than DSAF_GE_NUM (i.e., 8). However, if the value of     port is 6 or 7, an array overflow could occur: port_rst_off = dsaf_dev->mac_cb[port]->port_rst_off;
    because the length of dsaf_dev->mac_cb is DSAF_MAX_PORT_NUM (i.e., 6). To fix this possible array     overflow, we first check port and if it is greater than or equal to DSAF_MAX_PORT_NUM, the function     returns. (CVE-2021-47548)

  - In the Linux kernel, the following vulnerability has been resolved: SUNRPC: Fix a suspicious RCU usage     warning I received the following warning while running cthon against an ontap server running pNFS: [     57.202521] ============================= [ 57.202522] WARNING: suspicious RCU usage [ 57.202523]     6.7.0-rc3-g2cc14f52aeb7 #41492 Not tainted [ 57.202525] ----------------------------- [ 57.202525]     net/sunrpc/xprtmultipath.c:349 RCU-list traversed in non-reader section!! [ 57.202527] other info that     might help us debug this: [ 57.202528] rcu_scheduler_active = 2, debug_locks = 1 [ 57.202529] no locks     held by test5/3567. [ 57.202530] stack backtrace: [ 57.202532] CPU: 0 PID: 3567 Comm: test5 Not tainted     6.7.0-rc3-g2cc14f52aeb7 #41492 5b09971b4965c0aceba19f3eea324a4a806e227e [ 57.202534] Hardware name: QEMU     Standard PC (Q35 + ICH9, 2009), BIOS unknown 2/2/2022 [ 57.202536] Call Trace: [ 57.202537] <TASK> [     57.202540] dump_stack_lvl+0x77/0xb0 [ 57.202551] lockdep_rcu_suspicious+0x154/0x1a0 [ 57.202556]     rpc_xprt_switch_has_addr+0x17c/0x190 [sunrpc ebe02571b9a8ceebf7d98e71675af20c19bdb1f6] [ 57.202596]     rpc_clnt_setup_test_and_add_xprt+0x50/0x180 [sunrpc ebe02571b9a8ceebf7d98e71675af20c19bdb1f6] [ 57.202621]     ? rpc_clnt_add_xprt+0x254/0x300 [sunrpc ebe02571b9a8ceebf7d98e71675af20c19bdb1f6] [ 57.202646]     rpc_clnt_add_xprt+0x27a/0x300 [sunrpc ebe02571b9a8ceebf7d98e71675af20c19bdb1f6] [ 57.202671] ?
    __pfx_rpc_clnt_setup_test_and_add_xprt+0x10/0x10 [sunrpc ebe02571b9a8ceebf7d98e71675af20c19bdb1f6] [     57.202696] nfs4_pnfs_ds_connect+0x345/0x760 [nfsv4 c716d88496ded0ea6d289bbea684fa996f9b57a9] [ 57.202728]     ? __pfx_nfs4_test_session_trunk+0x10/0x10 [nfsv4 c716d88496ded0ea6d289bbea684fa996f9b57a9] [ 57.202754]     nfs4_fl_prepare_ds+0x75/0xc0 [nfs_layout_nfsv41_files e3a4187f18ae8a27b630f9feae6831b584a9360a] [     57.202760] filelayout_write_pagelist+0x4a/0x200 [nfs_layout_nfsv41_files     e3a4187f18ae8a27b630f9feae6831b584a9360a] [ 57.202765] pnfs_generic_pg_writepages+0xbe/0x230 [nfsv4     c716d88496ded0ea6d289bbea684fa996f9b57a9] [ 57.202788] __nfs_pageio_add_request+0x3fd/0x520 [nfs     6c976fa593a7c2976f5a0aeb4965514a828e6902] [ 57.202813] nfs_pageio_add_request+0x18b/0x390 [nfs     6c976fa593a7c2976f5a0aeb4965514a828e6902] [ 57.202831] nfs_do_writepage+0x116/0x1e0 [nfs     6c976fa593a7c2976f5a0aeb4965514a828e6902] [ 57.202849] nfs_writepages_callback+0x13/0x30 [nfs     6c976fa593a7c2976f5a0aeb4965514a828e6902] [ 57.202866] write_cache_pages+0x265/0x450 [ 57.202870] ?
    __pfx_nfs_writepages_callback+0x10/0x10 [nfs 6c976fa593a7c2976f5a0aeb4965514a828e6902] [ 57.202891]     nfs_writepages+0x141/0x230 [nfs 6c976fa593a7c2976f5a0aeb4965514a828e6902] [ 57.202913]     do_writepages+0xd2/0x230 [ 57.202917] ? filemap_fdatawrite_wbc+0x5c/0x80 [ 57.202921]     filemap_fdatawrite_wbc+0x67/0x80 [ 57.202924] filemap_write_and_wait_range+0xd9/0x170 [ 57.202930]     nfs_wb_all+0x49/0x180 [nfs 6c976fa593a7c2976f5a0aeb4965514a828e6902] [ 57.202947]     nfs4_file_flush+0x72/0xb0 [nfsv4 c716d88496ded0ea6d289bbea684fa996f9b57a9] [ 57.202969]
    __se_sys_close+0x46/0xd0 [ 57.202972] do_syscall_64+0x68/0x100 [ 57.202975] ? do_syscall_64+0x77/0x100 [     57.202976] ? do_syscall_64+0x77/0x100 [ 57.202979] entry_SYSCALL_64_after_hwframe+0x6e/0x76 [ 57.202982]     RIP: 0033:0x7fe2b12e4a94 [ 57.202985] Code: 00 f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00     90 f3 0f 1e fa 80 3d d5 18 0e 00 00 74 13 b8 03 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 44 c3 0f 1f 00 48 83     ec 18 89 7c 24 0c e8 c3 [ 57.202987] RSP: 002b:00007ffe857ddb38 EFLAGS: 00000202 ORIG_RAX:
    0000000000000003 [ 57.202989] RAX: ffffffffffffffda RBX: 00007ffe857dfd68 RCX: 00007fe2b12e4a94 [     57.202991] RDX: 0000000000002000 RSI: 00007ffe857ddc40 RDI: 0000000000000003 [ 57.202992] RBP:
    00007ffe857dfc50 R08: 7fffffffffffffff R09: 0000000065650f49 [ 57.202993] R10: 00007f ---truncated---     (CVE-2023-52623)

  - In the Linux kernel, the following vulnerability has been resolved: dm: call the resume method on internal     suspend There is this reported crash when experimenting with the lvm2 testsuite. The list corruption is     caused by the fact that the postsuspend and resume methods were not paired correctly; there were two     consecutive calls to the origin_postsuspend function. The second call attempts to remove the hash_list     entry from a list, while it was already removed by the first call. Fix __dm_internal_resume so that it     calls the preresume and resume methods of the table's targets. If a preresume method of some target fails,     we are in a tricky situation. We can't return an error because dm_internal_resume isn't supposed to return     errors. We can't return success, because then the resume and postsuspend methods would not be paired     correctly. So, we set the DMF_SUSPENDED flag and we fake normal suspend - it may confuse userspace tools,     but it won't cause a kernel crash. ------------[ cut here ]------------ kernel BUG at lib/list_debug.c:56!     invalid opcode: 0000 [#1] PREEMPT SMP CPU: 1 PID: 8343 Comm: dmsetup Not tainted 6.8.0-rc6 #4 Hardware     name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.14.0-2 04/01/2014 RIP:
    0010:__list_del_entry_valid_or_report+0x77/0xc0 <snip> RSP: 0018:ffff8881b831bcc0 EFLAGS: 00010282 RAX:
    000000000000004e RBX: ffff888143b6eb80 RCX: 0000000000000000 RDX: 0000000000000001 RSI: ffffffff819053d0     RDI: 00000000ffffffff RBP: ffff8881b83a3400 R08: 00000000fffeffff R09: 0000000000000058 R10:
    0000000000000000 R11: ffffffff81a24080 R12: 0000000000000001 R13: ffff88814538e000 R14: ffff888143bc6dc0     R15: ffffffffa02e4bb0 FS: 00000000f7c0f780(0000) GS:ffff8893f0a40000(0000) knlGS:0000000000000000 CS: 0010     DS: 002b ES: 002b CR0: 0000000080050033 CR2: 0000000057fb5000 CR3: 0000000143474000 CR4: 00000000000006b0     Call Trace: <TASK> ? die+0x2d/0x80 ? do_trap+0xeb/0xf0 ? __list_del_entry_valid_or_report+0x77/0xc0 ?     do_error_trap+0x60/0x80 ? __list_del_entry_valid_or_report+0x77/0xc0 ? exc_invalid_op+0x49/0x60 ?
    __list_del_entry_valid_or_report+0x77/0xc0 ? asm_exc_invalid_op+0x16/0x20 ? table_deps+0x1b0/0x1b0     [dm_mod] ? __list_del_entry_valid_or_report+0x77/0xc0 origin_postsuspend+0x1a/0x50 [dm_snapshot]     dm_table_postsuspend_targets+0x34/0x50 [dm_mod] dm_suspend+0xd8/0xf0 [dm_mod] dev_suspend+0x1f2/0x2f0     [dm_mod] ? table_deps+0x1b0/0x1b0 [dm_mod] ctl_ioctl+0x300/0x5f0 [dm_mod] dm_compat_ctl_ioctl+0x7/0x10     [dm_mod] __x64_compat_sys_ioctl+0x104/0x170 do_syscall_64+0x184/0x1b0     entry_SYSCALL_64_after_hwframe+0x46/0x4e RIP: 0033:0xf7e6aead <snip> ---[ end trace 0000000000000000 ]---     (CVE-2024-26880)

  - In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: flush pending     destroy work before exit_net release Similar to 2c9f0293280e (netfilter: nf_tables: flush pending destroy     work before netlink notifier) to address a race between exit_net and the destroy workqueue. The trace     below shows an element to be released via destroy workqueue while exit_net path (triggered via module     removal) has already released the set that is used in such transaction. [ 1360.547789] BUG: KASAN: slab-     use-after-free in nf_tables_trans_destroy_work+0x3f5/0x590 [nf_tables] [ 1360.547861] Read of size 8 at     addr ffff888140500cc0 by task kworker/4:1/152465 [ 1360.547870] CPU: 4 PID: 152465 Comm: kworker/4:1 Not     tainted 6.8.0+ #359 [ 1360.547882] Workqueue: events nf_tables_trans_destroy_work [nf_tables] [     1360.547984] Call Trace: [ 1360.547991] <TASK> [ 1360.547998] dump_stack_lvl+0x53/0x70 [ 1360.548014]     print_report+0xc4/0x610 [ 1360.548026] ? __virt_addr_valid+0xba/0x160 [ 1360.548040] ?
    __pfx__raw_spin_lock_irqsave+0x10/0x10 [ 1360.548054] ? nf_tables_trans_destroy_work+0x3f5/0x590     [nf_tables] [ 1360.548176] kasan_report+0xae/0xe0 [ 1360.548189] ?     nf_tables_trans_destroy_work+0x3f5/0x590 [nf_tables] [ 1360.548312]     nf_tables_trans_destroy_work+0x3f5/0x590 [nf_tables] [ 1360.548447] ?
    __pfx_nf_tables_trans_destroy_work+0x10/0x10 [nf_tables] [ 1360.548577] ? _raw_spin_unlock_irq+0x18/0x30 [     1360.548591] process_one_work+0x2f1/0x670 [ 1360.548610] worker_thread+0x4d3/0x760 [ 1360.548627] ?
    __pfx_worker_thread+0x10/0x10 [ 1360.548640] kthread+0x16b/0x1b0 [ 1360.548653] ? __pfx_kthread+0x10/0x10     [ 1360.548665] ret_from_fork+0x2f/0x50 [ 1360.548679] ? __pfx_kthread+0x10/0x10 [ 1360.548690]     ret_from_fork_asm+0x1a/0x30 [ 1360.548707] </TASK> [ 1360.548719] Allocated by task 192061: [ 1360.548726]     kasan_save_stack+0x20/0x40 [ 1360.548739] kasan_save_track+0x14/0x30 [ 1360.548750]
    __kasan_kmalloc+0x8f/0xa0 [ 1360.548760] __kmalloc_node+0x1f1/0x450 [ 1360.548771]     nf_tables_newset+0x10c7/0x1b50 [nf_tables] [ 1360.548883] nfnetlink_rcv_batch+0xbc4/0xdc0 [nfnetlink] [     1360.548909] nfnetlink_rcv+0x1a8/0x1e0 [nfnetlink] [ 1360.548927] netlink_unicast+0x367/0x4f0 [     1360.548935] netlink_sendmsg+0x34b/0x610 [ 1360.548944] ____sys_sendmsg+0x4d4/0x510 [ 1360.548953]
    ___sys_sendmsg+0xc9/0x120 [ 1360.548961] __sys_sendmsg+0xbe/0x140 [ 1360.548971] do_syscall_64+0x55/0x120     [ 1360.548982] entry_SYSCALL_64_after_hwframe+0x55/0x5d [ 1360.548994] Freed by task 192222: [     1360.548999] kasan_save_stack+0x20/0x40 [ 1360.549009] kasan_save_track+0x14/0x30 [ 1360.549019]     kasan_save_free_info+0x3b/0x60 [ 1360.549028] poison_slab_object+0x100/0x180 [ 1360.549036]
    __kasan_slab_free+0x14/0x30 [ 1360.549042] kfree+0xb6/0x260 [ 1360.549049] __nft_release_table+0x473/0x6a0     [nf_tables] [ 1360.549131] nf_tables_exit_net+0x170/0x240 [nf_tables] [ 1360.549221]     ops_exit_list+0x50/0xa0 [ 1360.549229] free_exit_list+0x101/0x140 [ 1360.549236]     unregister_pernet_operations+0x107/0x160 [ 1360.549245] unregister_pernet_subsys+0x1c/0x30 [ 1360.549254]     nf_tables_module_exit+0x43/0x80 [nf_tables] [ 1360.549345] __do_sys_delete_module+0x253/0x370 [     1360.549352] do_syscall_64+0x55/0x120 [ 1360.549360] entry_SYSCALL_64_after_hwframe+0x55/0x5d (gdb) list
    *__nft_release_table+0x473 0x1e033 is in __nft_release_table (net/netfilter/nf_tables_api.c:11354). 11349     list_for_each_entry_safe(flowtable, nf, &table->flowtables, list) { 11350 list_del(&flowtable->list);
    11351 nft_use_dec(&table->use); 11352 nf_tables_flowtable_destroy(flowtable); 11353 } 11354     list_for_each_entry_safe(set, ns, &table->sets, list) { 11355 list_del(&set->list); 11356     nft_use_dec(&table->use); 11357 if (set->flags & (NFT_SET_MAP | NFT_SET_OBJECT)) 11358 nft_map_deactivat
    ---truncated--- (CVE-2024-35899)

  - In the Linux kernel, the following vulnerability has been resolved: drm/client: Fully protect modes[] with     dev->mode_config.mutex The modes[] array contains pointers to modes on the connectors' mode lists, which     are protected by dev->mode_config.mutex. Thus we need to extend modes[] the same protection or by the time     we use it the elements may already be pointing to freed/reused memory. (CVE-2024-35950)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - In the Linux kernel, the following vulnerability has been resolved: net/packet: defer vmalloc TX_RING free
    until skbs finish AF_PACKET TX_RING skbs keep a raw pointer to their ring frame. The skb page references
    preserve page-backed ring blocks after pg_vec is freed, but they do not preserve a vmalloc mapping.
    tpacket_destruct_skb() currently drops the pending reference before writing the timestamp and
    TP_STATUS_AVAILABLE to the frame. Move the decrement after those stores. The smp_wmb() in
    __packet_set_status() orders the frame stores before the decrement. Also recheck pending TX frames under
    pg_vec_lock before non-closing ring replacement, so a racing send cannot add a pending skb between the
    initial check and the ring swap. Ring allocation can produce a mixture of page-backed and vmalloc-backed
    blocks. Allocate deferred-work storage during TX ring setup when the first vmalloc-backed block is
    encountered, and keep its pointer in the pg_vec allocation header. If allocation fails, return -ENOMEM
    from ring setup. On socket close, a non-NULL pointer identifies a vmalloc-backed vector without a scan. If
    TX skbs remain, defer the whole vector to system_long_wq. After pg_vec is detached, a late destructor can
    skip the pending decrement. Use socket write-memory accounting as the deferred lifetime gate instead: an
    skb remains charged through its final sock_wfree(), after all ring-frame accesses. The delayed work
    retains a socket reference and reschedules itself until no TX skbs remain. Move pending_refcnt release to
    packet_sock_destruct() so late skb destructors and deferred cleanup can safely use it after
    packet_release(). Page-backed teardown remains synchronous, and no lock is added to the TX completion hot
    path. (CVE-2026-80841)

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4667-1 advisory.

    The SUSE Linux Enterprise 15 SP5 kernel was updated to fix various security issues:

    The following security issues were fixed:

    - CVE-2022-50645: EDAC/i10nm: fix refcount leak in pci_get_dev_wrapper() (bsc#1254633).
    - CVE-2025-39964: kernel: crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (bsc#1251966).
    - CVE-2025-40022: kernel: crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (bsc#1252682).
    - CVE-2026-43502: net/rds: handle zerocopy send cleanup before the message is queued (bsc#1266008).
    - CVE-2026-53266: netfilter: bridge: make ebt_snat ARP rewrite writable (bsc#1269136).
    - CVE-2026-53400: i2c: core: fix adapter registration race (bsc#1271906).
    - CVE-2026-64279: i2c: core: fix adapter deregistration race (bsc#1273953).
    - CVE-2026-64319: nvmet-auth: fix return value check in auth send (bsc#1273339).
    - CVE-2026-64422: net: ipv4: bound TCP reordering sysctl writes and MTU probe sizes (bsc#1273290).
    - CVE-2026-64556: perf/core: Detach event groups during remove_on_exec (bsc#1273251).
    - CVE-2026-64580: xfrm6: clear dst.dev on error to avoid double netdev_put in xfrm6_fill_dst()     (bsc#1274037).
    - CVE-2026-68155: libceph: Reject monmaps advertising zero monitors (bsc#1275304).
    - CVE-2026-68158: libceph: Fix multiplication overflow in decode_new_up_state_weight() (bsc#1275307).
    - CVE-2026-68159: libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (bsc#1275470).
    - CVE-2026-68376: sctp: fix auth_hmacs array size in struct sctp_cookie (bsc#1274836).
    - CVE-2026-68445: drm/vc4: Prevent shader BO mappings from becoming writable (bsc#1276277).
    - CVE-2026-68451: s390/zcrypt: Validate length for CCA ECC private key requests (bsc#1276287).
    - CVE-2026-68452: s390/zcrypt: Validate length for CCA AES cipher key requests (bsc#1276295).
    - CVE-2026-68454: KVM: s390: pci: Fix handling of AIF enable without AISB (bsc#1276388).
    - CVE-2026-72051: net: ip6_tunnel: require CAP_NET_ADMIN in the device netns for changelink (bsc#1276801).
    - CVE-2026-72052: net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (bsc#1276803).
    - CVE-2026-72053: net: ipip: require CAP_NET_ADMIN in the device netns for changelink (bsc#1276814).
    - CVE-2026-72054: net: ip_vti: require CAP_NET_ADMIN in the device netns for changelink (bsc#1276818).
    - CVE-2026-72055: net: ip6_vti: require CAP_NET_ADMIN in the device netns for changelink (bsc#1276821).
    - CVE-2026-72061: net: sit: require CAP_NET_ADMIN in the device netns for changelink (bsc#1277249).
    - CVE-2026-72066: cpu: hotplug: Bound hotplug states sysfs output (bsc#1277149).
    - CVE-2026-72083: scsi: target: core: Fix iSCSI ISID use-after-free in REGISTER AND MOVE (bsc#1275535).
    - CVE-2026-72084: scsi: target: core: Generate correct identifiers for PR OUT transport IDs (bsc#1275540).
    - CVE-2026-72098: dm-verity: fix buffer overflow in FEC calculation (bsc#1275543).
    - CVE-2026-72129: nvmet-rdma: handle inline data with a nonzero offset (bsc#1275545).
    - CVE-2026-72136: xfrm: xfrm_interface: require CAP_NET_ADMIN in the device netns for changelink     (bsc#1277574).
    - CVE-2026-72157: net: thunderbolt: Fix frags[] overflow by bounding frame_count (bsc#1277544).
    - CVE-2026-72164: ocfs2: avoid moving extents to occupied clusters (bsc#1277553).
    - CVE-2026-72322: ipv6: mcast: Fix potential UAF in MLD delayed work (bsc#1275972).
    - CVE-2026-72323: ipv4: igmp: Fix potential UAF in igmp_gq_start_timer() (bsc#1275985).
    - CVE-2026-72339: qede: fix off-by-one in BD ring consumption on build_skb failure (bsc#1276006).
    - CVE-2026-72348: netfilter: ip6tables: mark malformed IPv6 extension headers for hotdrop (bsc#1276007).
    - CVE-2026-72351: gue: validate REMCSUM private option length (bsc#1276009).
    - CVE-2026-72383: sctp: fix addr_wq_timer race in sctp_free_addr_wq() (bsc#1277857).
    - CVE-2026-72398: sctp: fix association labeling in the duplicate COOKIE-ECHO case (bsc#1276381).
    - CVE-2026-72434: netfilter: ipset: make sure gc is properly stopped (bsc#1278054).
    - CVE-2026-72449: drm/amdkfd: fix list_del corruption in kfd_criu_resume_svm (bsc#1278108).
    - CVE-2026-74267: net/sched: sch_codel: Do not call qdisc_tree_reduce_backlog during peek before restoring     qlen       (bsc#1276519).
    - CVE-2026-74283: tipc: require net admin for TIPCv2 netlink mutators (bsc#1276475).
    - CVE-2026-74330: configfs: fix lockless traversals of ->s_children (bsc#1277129).
    - CVE-2026-74388: ALSA: seq: oss: Fix UAF at handling events with embedded SysEx data (bsc#1278253).
    - CVE-2026-74398: ipv6: addrconf: bail out of dad_failure when state is no longer POSTDAD (bsc#1277410).
    - CVE-2026-74406: vxlan: Fix potential null-ptr-deref in vxlan_gro_prepare_receive() (bsc#1276395).
    - CVE-2026-74443: drm/vmwgfx: bound DMA command body size against suffix pointer (bsc#1278210).
    - CVE-2026-74444: drm/vmwgfx: validate DRAW_PRIMITIVES header size before division (bsc#1278211).
    - CVE-2026-74453: drm/vc4: Zero the tile state data array before each BIN job (bsc#1278178).
    - CVE-2026-74469: sctp: prevent peer transport count overflow (bsc#1277792).
    - CVE-2026-74473: vxlan: use pskb_network_may_pull() in route_shortcircuit() (bsc#1276340).
    - CVE-2026-74479: net: pktgen: fix proc entry use-after-free (bsc#1276354).
    - CVE-2026-74480: net: bridge: stop fast-leave after deleting a port group (bsc#1276353).
    - CVE-2026-74492: netfilter: ipset: do not update comments from kernel-side hash adds (bsc#1276337).
    - CVE-2026-74493: net/smc: fix socket use-after-free during link group termination (bsc#1276338).
    - CVE-2026-74540: Bluetooth: L2CAP: fix UAF in l2cap_le_connect_rsp (bsc#1275681).
    - CVE-2026-74556: scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer     (bsc#1275696).
    - CVE-2026-74586: sctp: clear new_transport when removing a peer (bsc#1277820).
    - CVE-2026-74588: sctp: keep chunk->transport in step with the list it is queued on (bsc#1277766).
    - CVE-2026-74589: bpf, sockmap: Fix sk_redir use-after-free in send verdict (bsc#1277904).
    - CVE-2026-74597: ip6_tunnel: clear skb2->cb in ip6ip6_err() (bsc#1277493).
    - CVE-2026-74609: tipc: read le->link under the node lock in tipc_node_link_down() (bsc#1277906).
    - CVE-2026-74615: vxlan: do not arm the ageing timer on a device that is down (bsc#1277901).
    - CVE-2026-74616: xdp: reject clones that overrun skb_shared_info tailroom (bsc#1277813).
    - CVE-2026-74630: ipv6: prevent in6_dev_get() from resurrecting inet6_dev (bsc#1278191).
    - CVE-2026-74688: sctp: clear control chunk transport if it is being removed (bsc#1277489).
    - CVE-2026-74700: net/sched: cls_api: Always acquire rtnl_lock when destroying locked classifiers     (bsc#1277626).
    - CVE-2026-74719: net/smc: fix qentry overwrite for CONFIRM_LINK and ADD_LINK_CONT in     smc_llc_event_handler()       (bsc#1276572).
    - CVE-2026-74737: net: ethernet: ti: am65-cpsw-nuss: Fix port_id extraction from SRC TAG (bsc#1277898).
    - CVE-2026-74743: macvlan: inherit needed_headroom and needed_tailroom from lowerdev (bsc#1277908).
    - CVE-2026-74744: ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (bsc#1278094).
    - CVE-2026-74752: sctp: validate cookie AUTH state before use (bsc#1278315).
    - CVE-2026-80540: drm/amdgpu: Fix UVD decode image min size calculation (bsc#1277590).
    - CVE-2026-80580: fbdev: bound mode sysfs output to the sysfs buffer (bsc#1278294).
    - CVE-2026-80714: ipvs: do not propagate one-packet flag to synced conns (bsc#1277561).
    - CVE-2026-80716: ALSA: pcm: wake linked drain waiters on unlink (bsc#1277837).
    - CVE-2026-80737: serial: amba-pl011: synchronize DMA teardown (bsc#1279487).
    - CVE-2026-80785: fbdev: serialize mode sysfs access with lock_fb_info() (bsc#1279619).
    - CVE-2026-80789: nvmet-tcp: bound SGL data length before allocating command buffers (bsc#1279621).
    - CVE-2026-80840: ipv6: seg6: clear IPv4 control block on IPIP decapsulation (bsc#1279875).
    - CVE-2026-80841: net/packet: defer vmalloc TX_RING free until skbs finish (bsc#1279835).
    - CVE-2026-80844: xfrm: ah6: validate routing header segments_left (bsc#1279786).
    - CVE-2026-80852: tls: device: fix out-of-bounds write in tls_append_frag() (bsc#1279532).
    - CVE-2026-80909: drm/amdgpu: Reject UVD message with invalid number of h265 refs (bsc#1279422).
    - CVE-2026-81000: net: tun: bound receive headroom (bsc#1280263).
    - CVE-2026-89479: sctp: stop processing a packet once its association is deleted (bsc#1280786).
    - CVE-2026-89482: nvme-tcp: do not accept C2HData based on blk_rq_payload_bytes() alone (bsc#1280350).
    - CVE-2026-89532: svcrdma: Fix pcl_for_each_segment for empty chunks (bsc#1280985).
    - CVE-2026-89533: svcrdma: Fix offset arithmetic in read_chunk_range (bsc#1280993).
    - CVE-2026-89544: SUNRPC: fix gssx_dec_option_array error path bugs (bsc#1280758).
    - CVE-2026-89551: SUNRPC: xdr_buf_trim: clamp buf->len to avoid underflow (bsc#1280727).
    - CVE-2026-89569: Bluetooth: RFCOMM: serialize security confirmation handling (bsc#1280733).
    - CVE-2026-89603: entry: Fix seccomp bypass after ptrace with TSYNC (bsc#1280923).
    - CVE-2026-89631: smb: client: reject a tree connect response whose byte count is too small (bsc#1280496).
    - CVE-2026-89636: smb: client: clear ce->tgthint in free_tgts() (bsc#1281042).
    - CVE-2026-89638: smb: client: clear setuid/setgid bit on write with cifsacl/modefromsid/posix extensions     (bsc#1281046).
    - CVE-2026-89674: nfsd: fix XDR length calculation in nfsd4_ff_encode_layoutget (bsc#1280243).
    - CVE-2026-89932: KVM: nVMX: Always flush vpid02 on first use (bsc#1281360).
    - CVE-2026-89968: nvmet-tcp: reject unsolicited H2CData PDUs (bsc#1281229).
    - CVE-2026-90003: futex: Prevent rcuwait use-after-free during requeue PI (bsc#1281295).
    - CVE-2026-90104: NFSv4.1: zero referring call lists before decoding (bsc#1281546).
    - CVE-2026-90198: ALSA: core: Fix use-after-free in snd_card_do_free() (bsc#1281818).
    - CVE-2026-90413: IB/isert: reject login PDUs declaring more data than was received (bsc#1282113).
    - CVE-2026-90414: IB/isert: reject PDUs declaring more data than (bsc#1282110).
    - CVE-2026-93104: RDMA/rvt: Return NULL after port allocation failure (bsc#1282284).
    - CVE-2026-93782: vhost-scsi: flush backend after device ioctls (bsc#1282906).
    - CVE-2026-93787: smb: client: bound dirent name against end of SMB response in cifs_filldir     (bsc#1282932).
    - CVE-2026-100075: RDMA/srpt: Fix srpt_alloc_rw_ctxs() unwind counters (bsc#1282881).

    The following non security issues were fixed:

    - default_gfp(): avoid using the 'newfangled' __VA_OPT__ trick (bsc#1280139).
    - fbdev/sysfs: Fix locking (jsc#PED-1166 jsc#PED-1168 jsc#PED-1170 jsc#PED-1218 jsc#PED-1220 jsc#PED-1222     jsc#PED-1223       jsc#PED-1225).
    - i2c: core: fix irq domain leak on adapter registration failure (git-fixes).
    - kernel-binary.spec.in: Fix syntax error.
    - net: mana: Cap MSI-X vectors to the device MSI-X table size (bsc#1277254).
    - net: mana: Clear RDMA teardown and suspend state in mana_rdma_probe() (git-fixes).
    - net: mana: Fall back to scattered pages for GDMA queues (bsc#1281085).
    - net: mana: Reserve extra CQ slot for the fence completion CQE (git-fixes).
    - perf: Reject exited events as group leaders (git-fixes).
    - slab: Introduce kmalloc_obj() and family (bsc#1280139).
    - slab: recognize @GFP parameter as optional in kernel-doc (bsc#1280139).
    - smb: client: fix data/file corruption on reconnects (bsc#1253005).
    - smb: client: fix stuck kworkers on reconnects during writes (bsc#1253005).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4668-1 advisory.

    The SUSE Linux Enterprise 15 SP4 kernel was updated to fix various security issues:

    The following security issues were fixed:

    - CVE-2022-50645: EDAC/i10nm: fix refcount leak in pci_get_dev_wrapper() (bsc#1254633).
    - CVE-2024-56644: net/ipv6: release expired exception dst cached in socket (bsc#1216813 bsc#1235133).
    - CVE-2025-39964: crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (bsc#1252682).
    - CVE-2025-40022: crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (bsc#1251966).
    - CVE-2026-53266: netfilter: bridge: make ebt_snat ARP rewrite writable (bsc#1269136).
    - CVE-2026-53400: i2c: core: fix adapter registration race (bsc#1271906).
    - CVE-2026-64279: i2c: core: fix adapter deregistration race (bsc#1273953).
    - CVE-2026-64319: nvmet-auth: fix return value check in auth send (bsc#1273339).
    - CVE-2026-64422: net: ipv4: bound TCP reordering sysctl writes and MTU probe sizes (bsc#1273290).
    - CVE-2026-64580: xfrm6: clear dst.dev on error to avoid double netdev_put in xfrm6_fill_dst()     (bsc#1274037).
    - CVE-2026-68376: sctp: fix auth_hmacs array size in struct sctp_cookie (bsc#1274836).
    - CVE-2026-68445: drm/vc4: Prevent shader BO mappings from becoming writable (bsc#1276277).
    - CVE-2026-68451: s390/zcrypt: Validate length for CCA ECC private key requests (bsc#1276287).
    - CVE-2026-68452: s390/zcrypt: Validate length for CCA AES cipher key requests (bsc#1276295).
    - CVE-2026-72051: net: ip6_tunnel: require CAP_NET_ADMIN in the device netns for changelink (bsc#1276801).
    - CVE-2026-72052: net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (bsc#1276803).
    - CVE-2026-72053: net: ipip: require CAP_NET_ADMIN in the device netns for changelink (bsc#1276814).
    - CVE-2026-72054: net: ip_vti: require CAP_NET_ADMIN in the device netns for changelink (bsc#1276818).
    - CVE-2026-72055: net: ip6_vti: require CAP_NET_ADMIN in the device netns for changelink (bsc#1276821).
    - CVE-2026-72061: net: sit: require CAP_NET_ADMIN in the device netns for changelink (bsc#1277249).
    - CVE-2026-72066: cpu: hotplug: Bound hotplug states sysfs output (bsc#1277149).
    - CVE-2026-72098: dm-verity: fix buffer overflow in FEC calculation (bsc#1275543).
    - CVE-2026-72129: nvmet-rdma: handle inline data with a nonzero offset (bsc#1275545).
    - CVE-2026-72136: xfrm: xfrm_interface: require CAP_NET_ADMIN in the device netns for changelink     (bsc#1277574).
    - CVE-2026-72157: net: thunderbolt: Fix frags[] overflow by bounding frame_count (bsc#1277544).
    - CVE-2026-72322: ipv6: mcast: Fix potential UAF in MLD delayed work (bsc#1275972).
    - CVE-2026-72348: netfilter: ip6tables: mark malformed IPv6 extension headers for hotdrop (bsc#1276007).
    - CVE-2026-72351: gue: validate REMCSUM private option length (bsc#1276009).
    - CVE-2026-72383: sctp: fix addr_wq_timer race in sctp_free_addr_wq() (bsc#1277857).
    - CVE-2026-72398: sctp: fix association labeling in the duplicate COOKIE-ECHO case (bsc#1276381).
    - CVE-2026-72434: netfilter: ipset: make sure gc is properly stopped (bsc#1278054).
    - CVE-2026-74267: net/sched: sch_codel: Do not call qdisc_tree_reduce_backlog during peek before restoring     qlen       (bsc#1276519).
    - CVE-2026-74283: tipc: require net admin for TIPCv2 netlink mutators (bsc#1276475).
    - CVE-2026-74330: configfs: fix lockless traversals of ->s_children (bsc#1277129).
    - CVE-2026-74398: ipv6: addrconf: bail out of dad_failure when state is no longer POSTDAD (bsc#1277410).
    - CVE-2026-74443: drm/vmwgfx: bound DMA command body size against suffix pointer (bsc#1278210).
    - CVE-2026-74444: drm/vmwgfx: validate DRAW_PRIMITIVES header size before division (bsc#1278211).
    - CVE-2026-74453: drm/vc4: Zero the tile state data array before each BIN job (bsc#1278178).
    - CVE-2026-74469: sctp: prevent peer transport count overflow (bsc#1277792).
    - CVE-2026-74473: vxlan: use pskb_network_may_pull() in route_shortcircuit() (bsc#1276340).
    - CVE-2026-74479: net: pktgen: fix proc entry use-after-free (bsc#1276354).
    - CVE-2026-74480: net: bridge: stop fast-leave after deleting a port group (bsc#1276353).
    - CVE-2026-74492: netfilter: ipset: do not update comments from kernel-side hash adds (bsc#1276337).
    - CVE-2026-74493: net/smc: fix socket use-after-free during link group termination (bsc#1276338).
    - CVE-2026-74540: Bluetooth: L2CAP: fix UAF in l2cap_le_connect_rsp (bsc#1275681).
    - CVE-2026-74586: sctp: clear new_transport when removing a peer (bsc#1277820).
    - CVE-2026-74588: sctp: keep chunk->transport in step with the list it is queued on (bsc#1277766).
    - CVE-2026-74589: bpf, sockmap: Fix sk_redir use-after-free in send verdict (bsc#1277904).
    - CVE-2026-74597: ip6_tunnel: clear skb2->cb in ip6ip6_err() (bsc#1277493).
    - CVE-2026-74609: tipc: read le->link under the node lock in tipc_node_link_down() (bsc#1277906).
    - CVE-2026-74630: ipv6: prevent in6_dev_get() from resurrecting inet6_dev (bsc#1278191).
    - CVE-2026-74688: sctp: clear control chunk transport if it is being removed (bsc#1277489).
    - CVE-2026-74700: net/sched: cls_api: Always acquire rtnl_lock when destroying locked classifiers     (bsc#1277626).
    - CVE-2026-74719: net/smc: fix qentry overwrite for CONFIRM_LINK and ADD_LINK_CONT in     smc_llc_event_handler()       (bsc#1276572).
    - CVE-2026-74744: ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (bsc#1278094).
    - CVE-2026-74752: sctp: validate cookie AUTH state before use (bsc#1278315).
    - CVE-2026-80540: drm/amdgpu: Fix UVD decode image min size calculation (bsc#1277590).
    - CVE-2026-80785: fbdev: serialize mode sysfs access with lock_fb_info() (bsc#1279619).
    - CVE-2026-80789: nvmet-tcp: bound SGL data length before allocating command buffers (bsc#1279621).
    - CVE-2026-80840: ipv6: seg6: clear IPv4 control block on IPIP decapsulation (bsc#1279875).
    - CVE-2026-80841: net/packet: defer vmalloc TX_RING free until skbs finish (bsc#1279835).
    - CVE-2026-80844: xfrm: ah6: validate routing header segments_left (bsc#1279786).
    - CVE-2026-80852: tls: device: fix out-of-bounds write in tls_append_frag() (bsc#1279532).
    - CVE-2026-81000: net: tun: bound receive headroom (bsc#1280263).
    - CVE-2026-89479: sctp: stop processing a packet once its association is deleted (bsc#1280786).
    - CVE-2026-89482: nvme-tcp: do not accept C2HData based on blk_rq_payload_bytes() alone (bsc#1280350).
    - CVE-2026-89532: svcrdma: Fix pcl_for_each_segment for empty chunks (bsc#1280985).
    - CVE-2026-89533: svcrdma: Fix offset arithmetic in read_chunk_range (bsc#1280993).
    - CVE-2026-89551: SUNRPC: xdr_buf_trim: clamp buf->len to avoid underflow (bsc#1280727).
    - CVE-2026-89569: Bluetooth: RFCOMM: serialize security confirmation handling (bsc#1280733).
    - CVE-2026-89603: entry: Fix seccomp bypass after ptrace with TSYNC (bsc#1280923).
    - CVE-2026-89631: smb: client: reject a tree connect response whose byte count is too small (bsc#1280496).
    - CVE-2026-89636: smb: client: clear ce->tgthint in free_tgts() (bsc#1281042).
    - CVE-2026-89638: smb: client: clear setuid/setgid bit on write with cifsacl/modefromsid/posix extensions     (bsc#1281046).
    - CVE-2026-89674: nfsd: fix XDR length calculation in nfsd4_ff_encode_layoutget (bsc#1280243).
    - CVE-2026-89932: KVM: nVMX: Always flush vpid02 on first use (bsc#1281360).
    - CVE-2026-89968: nvmet-tcp: reject unsolicited H2CData PDUs (bsc#1281229).
    - CVE-2026-90003: futex: Prevent rcuwait use-after-free during requeue PI (bsc#1281295).
    - CVE-2026-90104: NFSv4.1: zero referring call lists before decoding (bsc#1281546).
    - CVE-2026-90198: ALSA: core: Fix use-after-free in snd_card_do_free() (bsc#1281818).
    - CVE-2026-90413: IB/isert: reject login PDUs declaring more data than was received (bsc#1282113).
    - CVE-2026-90414: IB/isert: reject PDUs declaring more data than (bsc#1282110).
    - CVE-2026-93104: RDMA/rvt: Return NULL after port allocation failure (bsc#1282284).
    - CVE-2026-93782: vhost-scsi: flush backend after device ioctls (bsc#1282906).
    - CVE-2026-93787: smb: client: bound dirent name against end of SMB response in cifs_filldir     (bsc#1282932).
    - CVE-2026-100075: RDMA/srpt: Fix srpt_alloc_rw_ctxs() unwind counters (bsc#1282881).

    The following non security issues were fixed:

    - default_gfp(): avoid using the 'newfangled' __VA_OPT__ trick (bsc#1280139).
    - fbdev/sysfs: Fix locking (jsc#PED-1166 jsc#PED-1168 jsc#PED-1170 jsc#PED-1218 jsc#PED-1220 jsc#PED-1222     jsc#PED-1223       jsc#PED-1225).
    - i2c: core: fix irq domain leak on adapter registration failure (git-fixes).
    - slab: Introduce kmalloc_obj() and family (bsc#1280139).
    - slab: recognize @GFP parameter as optional in kernel-doc (bsc#1280139).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4660-1 advisory.

    The SUSE Linux Enterprise 15 SP6 kernel was updated to fix various security issues:

    The following security issues were fixed:

    - CVE-2025-38704: rcu/nocb: Fix possible invalid rdp's->nocb_cb_kthread pointer (bsc#1254408).
    - CVE-2026-43502: net/rds: handle zerocopy send cleanup before the message is queued (bsc#1266008).
    - CVE-2026-46135: nvmet-tcp: add bounds checks in nvmet_tcp_build_pdu_iovec (bsc#1267373).
    - CVE-2026-53266: netfilter: bridge: make ebt_snat ARP rewrite writable (bsc#1269136).
    - CVE-2026-53400: i2c: core: fix adapter registration race (bsc#1271906).
    - CVE-2026-63795: 9p: avoid putting oldfid in p9_client_walk() error path (bsc#1271955).
    - CVE-2026-64279: i2c: core: fix adapter deregistration race (bsc#1273953).
    - CVE-2026-64319: nvmet-auth: validate reply message payload bounds against transfer length (bsc#1273339).
    - CVE-2026-64320: nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (bsc#1273420).
    - CVE-2026-64422: net: ipv4: bound TCP reordering sysctl writes and MTU probe sizes (bsc#1273290).
    - CVE-2026-64556: perf/core: Detach event groups during remove_on_exec (bsc#1273251).
    - CVE-2026-64580: xfrm6: clear dst.dev on error to avoid double netdev_put in xfrm6_fill_dst()     (bsc#1274037).
    - CVE-2026-68162: sctp: avoid auth_enable sysctl UAF during netns teardown (bsc#1274920).
    - CVE-2026-68290: rds: tcp: unregister sysctl before tearing down listen socket (bsc#1275977).
    - CVE-2026-68376: sctp: fix auth_hmacs array size in struct sctp_cookie (bsc#1274836).
    - CVE-2026-68445: drm/vc4: Prevent shader BO mappings from becoming writable (bsc#1276277).
    - CVE-2026-68451: s390/zcrypt: Validate length for CCA ECC private key requests (bsc#1276287).
    - CVE-2026-68452: s390/zcrypt: Validate length for CCA AES cipher key requests (bsc#1276295).
    - CVE-2026-68454: KVM: s390: pci: Fix handling of AIF enable without AISB (bsc#1276388).
    - CVE-2026-72051: net: ip6_tunnel: require CAP_NET_ADMIN in the device netns for changelink (bsc#1276801).
    - CVE-2026-72052: net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (bsc#1276803).
    - CVE-2026-72053: net: ipip: require CAP_NET_ADMIN in the device netns for changelink (bsc#1276814).
    - CVE-2026-72054: net: ip_vti: require CAP_NET_ADMIN in the device netns for changelink (bsc#1276818).
    - CVE-2026-72055: net: ip6_vti: require CAP_NET_ADMIN in the device netns for changelink (bsc#1276821).
    - CVE-2026-72061: net: sit: require CAP_NET_ADMIN in the device netns for changelink (bsc#1277249).
    - CVE-2026-72066: cpu: hotplug: Bound hotplug states sysfs output (bsc#1277149).
    - CVE-2026-72098: dm-verity: fix buffer overflow in FEC calculation (bsc#1275543).
    - CVE-2026-72129: nvmet-rdma: handle inline data with a nonzero offset (bsc#1275545).
    - CVE-2026-72136: xfrm: xfrm_interface: require CAP_NET_ADMIN in the device netns for changelink     (bsc#1277574).
    - CVE-2026-72157: net: thunderbolt: Fix frags[] overflow by bounding frame_count (bsc#1277544).
    - CVE-2026-72164: ocfs2: avoid moving extents to occupied clusters (bsc#1277553).
    - CVE-2026-72301: ASoC: SOF: ipc3-control: Fix TOCTOU in bytes_put and bytes_get (bsc#1277742).
    - CVE-2026-72322: ipv6: mcast: Fix potential UAF in MLD delayed work (bsc#1275972).
    - CVE-2026-72323: ipv4: igmp: Fix potential UAF in igmp_gq_start_timer() (bsc#1275985).
    - CVE-2026-72348: netfilter: ip6tables: mark malformed IPv6 extension headers for hotdrop (bsc#1276007).
    - CVE-2026-72351: gue: validate REMCSUM private option length (bsc#1276009).
    - CVE-2026-72383: sctp: fix addr_wq_timer race in sctp_free_addr_wq() (bsc#1277857).
    - CVE-2026-72398: sctp: add INIT verification after cookie unpacking (bsc#1276381).
    - CVE-2026-72399: net: enetc: check the number of BDs needed for xdp_frame (bsc#1276553).
    - CVE-2026-72434: netfilter: ipset: make sure gc is properly stopped (bsc#1278054).
    - CVE-2026-72449: drm/amdkfd: fix list_del corruption in kfd_criu_resume_svm (bsc#1278108).
    - CVE-2026-74267: net/sched: sch_codel: Do not call qdisc_tree_reduce_backlog during peek before restoring     qlen       (bsc#1276519).
    - CVE-2026-74283: tipc: require net admin for TIPCv2 netlink mutators (bsc#1276475).
    - CVE-2026-74330: configfs: fix lockless traversals of ->s_children (bsc#1277129).
    - CVE-2026-74356: vhost: move smp_rmb() into vhost_get_avail_idx() (bsc#1278063).
    - CVE-2026-74363: bpf: fix UAF by restoring RCU-delayed inode freeing in bpffs (bsc#1278070).
    - CVE-2026-74388: ALSA: seq: oss: Fix UAF at handling events with embedded SysEx data (bsc#1278253).
    - CVE-2026-74398: ipv6: addrconf: bail out of dad_failure when state is no longer POSTDAD (bsc#1277410).
    - CVE-2026-74406: vxlan: Fix potential null-ptr-deref in vxlan_gro_prepare_receive() (bsc#1276395).
    - CVE-2026-74443: drm/vmwgfx: bound DMA command body size against suffix pointer (bsc#1278210).
    - CVE-2026-74444: drm/vmwgfx: validate DRAW_PRIMITIVES header size before division (bsc#1278211).
    - CVE-2026-74453: drm/vc4: Zero the tile state data array before each BIN job (bsc#1278178).
    - CVE-2026-74469: sctp: prevent peer transport count overflow (bsc#1277792).
    - CVE-2026-74473: vxlan: use pskb_network_may_pull() in route_shortcircuit() (bsc#1276340).
    - CVE-2026-74476: veth: convert frag_list skbs before running XDP (bsc#1276341).
    - CVE-2026-74479: net: pktgen: fix proc entry use-after-free (bsc#1276354).
    - CVE-2026-74480: net: bridge: stop fast-leave after deleting a port group (bsc#1276353).
    - CVE-2026-74492: netfilter: ipset: do not update comments from kernel-side hash adds (bsc#1276337).
    - CVE-2026-74493: net/smc: fix socket use-after-free during link group termination (bsc#1276338).
    - CVE-2026-74540: Bluetooth: L2CAP: fix UAF in l2cap_le_connect_rsp (bsc#1275681).
    - CVE-2026-74541: Bluetooth: ISO: clear iso_data always when detaching conn from hcon (bsc#1275694).
    - CVE-2026-74586: sctp: clear new_transport when removing a peer (bsc#1277820).
    - CVE-2026-74588: sctp: keep chunk->transport in step with the list it is queued on (bsc#1277766).
    - CVE-2026-74589: bpf, sockmap: Fix sk_redir use-after-free in send verdict (bsc#1277904).
    - CVE-2026-74597: ip6_tunnel: clear skb2->cb in ip6ip6_err() (bsc#1277493).
    - CVE-2026-74608: smb: client: Fix use-after-free in cifs_try_adding_channels() (bsc#1277796).
    - CVE-2026-74609: tipc: read le->link under the node lock in tipc_node_link_down() (bsc#1277906).
    - CVE-2026-74615: vxlan: do not arm the ageing timer on a device that is down (bsc#1277901).
    - CVE-2026-74616: xdp: reject clones that overrun skb_shared_info tailroom (bsc#1277813).
    - CVE-2026-74630: ipv6: prevent in6_dev_get() from resurrecting inet6_dev (bsc#1278191).
    - CVE-2026-74631: net: smc: fix splice entry lifetime imbalance in smc_rx_splice (bsc#1278195).
    - CVE-2026-74688: sctp: clear control chunk transport if it is being removed (bsc#1277489).
    - CVE-2026-74700: net/sched: cls_api: Always acquire rtnl_lock when destroying locked classifiers     (bsc#1277626).
    - CVE-2026-74719: net/smc: fix qentry overwrite for CONFIRM_LINK and ADD_LINK_CONT in     smc_llc_event_handler()       (bsc#1276572).
    - CVE-2026-74737: net: ethernet: ti: am65-cpsw-nuss: Fix port_id extraction from SRC TAG (bsc#1277898).
    - CVE-2026-74743: macvlan: inherit needed_headroom and needed_tailroom from lowerdev (bsc#1277908).
    - CVE-2026-74744: ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (bsc#1278094).
    - CVE-2026-74752: sctp: validate cookie AUTH state before use (bsc#1278315).
    - CVE-2026-80540: drm/amdgpu: Fix UVD decode image min size calculation (bsc#1277590).
    - CVE-2026-80580: fbdev: bound mode sysfs output to the sysfs buffer (bsc#1278294).
    - CVE-2026-80663: tools/power/x86/intel-speed-select: Harden daemon pidfile open (bsc#1278335).
    - CVE-2026-80714: ipvs: do not propagate one-packet flag to synced conns (bsc#1277561).
    - CVE-2026-80716: ALSA: pcm: wake linked drain waiters on unlink (bsc#1277837).
    - CVE-2026-80725: net: gro: properly validate BIG TCP aggregation criteria (bsc#1277452).
    - CVE-2026-80737: serial: amba-pl011: synchronize DMA teardown (bsc#1279487).
    - CVE-2026-80785: fbdev: serialize mode sysfs access with lock_fb_info() (bsc#1279619).
    - CVE-2026-80789: nvmet-tcp: bound SGL data length before allocating command buffers (bsc#1279621).
    - CVE-2026-80799: nfc: llcp: fix OOB read and u8 offset wrap in TLV parsers (bsc#1279811).
    - CVE-2026-80840: ipv6: seg6: clear IPv4 control block on IPIP decapsulation (bsc#1279875).
    - CVE-2026-80841: net/packet: defer vmalloc TX_RING free until skbs finish (bsc#1279835).
    - CVE-2026-80844: xfrm: ah6: validate routing header segments_left (bsc#1279786).
    - CVE-2026-80852: tls: device: fix out-of-bounds write in tls_append_frag() (bsc#1279532).
    - CVE-2026-80909: drm/amdgpu: Reject UVD message with invalid number of h265 refs (bsc#1279422).
    - CVE-2026-80976: seg6: reset IP6CB after IPv6 decapsulation (bsc#1280298).
    - CVE-2026-81000: net: tun: bound receive headroom (bsc#1280263).
    - CVE-2026-89479: sctp: stop processing a packet once its association is deleted (bsc#1280786).
    - CVE-2026-89482: nvme-tcp: do not accept C2HData based on blk_rq_payload_bytes() alone (bsc#1280350).
    - CVE-2026-89532: svcrdma: Fix pcl_for_each_segment for empty chunks (bsc#1280985).
    - CVE-2026-89533: svcrdma: Fix offset arithmetic in read_chunk_range (bsc#1280993).
    - CVE-2026-89542: SUNRPC: harden gss_krb5_unwrap_v2 against short tokens (bsc#1280387).
    - CVE-2026-89544: SUNRPC: fix gssx_dec_option_array error path bugs (bsc#1280758).
    - CVE-2026-89551: SUNRPC: xdr_buf_trim: clamp buf->len to avoid underflow (bsc#1280727).
    - CVE-2026-89569: Bluetooth: RFCOMM: serialize security confirmation handling (bsc#1280733).
    - CVE-2026-89603: entry: Fix seccomp bypass after ptrace with TSYNC (bsc#1280923).
    - CVE-2026-89631: smb: client: reject a tree connect response whose byte count is too small (bsc#1280496).
    - CVE-2026-89636: smb: client: clear ce->tgthint in free_tgts() (bsc#1281042).
    - CVE-2026-89638: smb: client: clear setuid/setgid bit on write with cifsacl/modefromsid/posix extensions     (bsc#1281046).
    - CVE-2026-89674: nfsd: fix XDR length calculation in nfsd4_ff_encode_layoutget (bsc#1280243).
    - CVE-2026-89702: nfsd: size fh_verify server sockaddr slot by xpt_locallen (bsc#1280487).
    - CVE-2026-89899: media: cec: disable delayed work before freeing an interrupted transmit (bsc#1281383).
    - CVE-2026-89931: KVM: nVMX: Ensure KVM_REQ_GET_NESTED_STATE_PAGES is cleared on VM-Exit (bsc#1281427).
    - CVE-2026-89968: nvmet-tcp: reject unsolicited H2CData PDUs (bsc#1281229).
    - CVE-2026-90003: futex: Prevent rcuwait use-after-free during requeue PI (bsc#1281295).
    - CVE-2026-90088: Bluetooth: RFCOMM: Validate MTU in rfcomm_apply_pn() to prevent infinite loop     (bsc#1281397).
    - CVE-2026-90104: NFSv4.1: zero referring call lists before decoding (bsc#1281546).
    - CVE-2026-90198: ALSA: core: Fix use-after-free in snd_card_do_free() (bsc#1281818).
    - CVE-2026-90259: btrfs: qgroup: fix a wrong length calculation in qgroup_free_reserved_data()     (bsc#1281680).
    - CVE-2026-90308: RDMA/erdma: Hold QP references for AE and CM processing (bsc#1281786).
    - CVE-2026-90309: RDMA/erdma: Hold CQ references when processing EQ events (bsc#1281789).
    - CVE-2026-90413: IB/isert: reject login PDUs declaring more data than was received (bsc#1282113).
    - CVE-2026-90414: IB/isert: reject PDUs declaring more data than (bsc#1282110).
    - CVE-2026-93104: RDMA/rvt: Return NULL after port allocation failure (bsc#1282284).
    - CVE-2026-93782: vhost-scsi: flush backend after device ioctls (bsc#1282906).
    - CVE-2026-100075: RDMA/srpt: Fix srpt_alloc_rw_ctxs() unwind counters (bsc#1282881).

    The following non security issues were fixed:

    - Also reflect disabled BATMAN in supported.conf.
    - Disable CONFIG_BATMAN_ADV (jsc#PED-16892).
    - Disable CONFIG_CAN (jsc#PED-16993).
    - Fif selftests build failure caused by jsc#PED-16401 backport (bsc#1281927).
    - RDMA/erdma: Use IRQ-safe XArray helpers for QP and CQ tables (git-fixes).
    - arm64: Use load LSE atomics for the non-return per-CPU atomic operations (git-fixes).
    - arm64: hibernate: pass HVC_SET_VECTORS args to the resume hvc (git-fixes).
    - arm64: mte: Fix PTRACE_{PEEK,POKE}MTETAGS error documentation (git-fixes).
    - arm64: percpu: Fix LSE operations on {8,16}-bit types (git-fixes).
    - arm64: percpu: Fix this_cpu_and() mask generation (git-fixes).
    - arm64: percpu: Fix this_cpu_write() casting (git-fixes).
    - compiler_types: Introduce __flex_counter() and family (bsc#1280139).
    - default_gfp(): avoid using the 'newfangled' __VA_OPT__ trick (bsc#1280139).
    - docs: tls: document TLS1.3 key updates (bsc#1267564 jsc#PED-16401).
    - firmware: arm_scpi: reject DVFS OPP count above MAX_DVFS_OPPS (git-fixes).
    - i2c: core: fix irq domain leak on adapter registration failure (git-fixes).
    - kabi: tls add counters for rekey (bsc#1267564 jsc#PED-16401).
    - kernel-binary.spec.in: Fix syntax error.
    - net: mana: Clear RDMA teardown and suspend state in mana_rdma_probe() (git-fixes).
    - net: mana: Reserve extra CQ slot for the fence completion CQE (git-fixes).
    - net: mana: restore the XDP program pointer when pre-allocation fails (git-fixes).
    - net: tls: Pass union tls_crypto_context pointer to memzero_explicit (bsc#1267564 jsc#PED-16401).
    - perf: Reject exited events as group leaders (git-fixes).
    - selftests: tls: add getsockopt test (bsc#1267564 jsc#PED-16401).
    - selftests: tls: add key_generation argument to tls_crypto_info_init (bsc#1267564 jsc#PED-16401).
    - selftests: tls: add rekey tests (bsc#1267564 jsc#PED-16401).
    - slab.h: disable completely broken overflow handling in flex allocations (bsc#1280139).
    - slab: Introduce kmalloc_flex() and family (bsc#1280139).
    - slab: Introduce kmalloc_obj() and family (bsc#1280139).
    - slab: recognize @GFP parameter as optional in kernel-doc (bsc#1280139).
    - smb: client: harden DFS cache against invalid target hints (git-fixes).
    - tls: add counters for rekey (bsc#1267564 jsc#PED-16401).
    - tls: block decryption when a rekey is pending (bsc#1267564 jsc#PED-16401).
    - tls: implement rekey for TLS1.3 (bsc#1267564 jsc#PED-16401).
    - tls: skip setting sk_write_space on rekey (bsc#1267564 jsc#PED-16401).
    - x86/mm: Fix pmd_modify() dropping the dirty bit (bsc#1275455).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - net/packet: defer vmalloc TX_RING free until skbs finish AF_PACKET TX_RING skbs keep a raw pointer to     their ring frame. The skb page references preserve page-backed ring blocks after pg_vec is freed, but they     do not preserve a vmalloc mapping. tpacket_destruct_skb() currently drops the pending reference before     writing the timestamp and TP_STATUS_AVAILABLE to the frame. Move the decrement after those stores. The     smp_wmb() in __packet_set_status() orders the frame stores before the decrement. Also recheck pending TX     frames under pg_vec_lock before non-closing ring replacement, so a racing send cannot add a pending skb     between the initial check and the ring swap. Ring allocation can produce a mixture of page-backed and     vmalloc-backed blocks. Allocate deferred-work storage during TX ring setup when the first vmalloc-backed     block is encountered, and keep its pointer in the pg_vec allocation header. If allocation fails, return
    -ENOMEM from ring setup. On socket close, a non-NULL pointer identifies a vmalloc-backed vector without a     scan. If TX skbs remain, defer the whole vector to system_long_wq. After pg_vec is detached, a late     destructor can skip the pending decrement. Use socket write-memory accounting as the deferred lifetime     gate instead: an skb remains charged through its final sock_wfree(), after all ring-frame accesses. The     delayed work retains a socket reference and reschedules itself until no TX skbs remain. Move     pending_refcnt release to packet_sock_destruct() so late skb destructors and deferred cleanup can safely     use it after packet_release(). Page-backed teardown remains synchronous, and no lock is added to the TX     completion hot path. (CVE-2026-80841)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
366778	AlmaLinux 9.2 [TuxCare] Security Update: bpftool / kernel / kernel-64k / kernel-64k-core / kernel-64k-debug / etc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1792243434)	Nessus	Alma Linux Local Security Checks	Local	medium
366749	SUSE SLES12: cluster-md-kmp-default / dlm-kmp-default / gfs2-kmp-default / etc (SUSE-SU-2026:4687-1)	Nessus	SuSE Local Security Checks	Local	high
366742	SUSE SLED15: cluster-md-kmp-default / dlm-kmp-default / gfs2-kmp-default / etc (SUSE-SU-2026:4706-1)	Nessus	SuSE Local Security Checks	Local	high
475016	Google: sys-kernel/cchost-kernel-6_12, sys-kernel/csql-kernel-6_12, sys-kernel/csql-kernel-6_6, sys-kernel/lakitu-kernel-6_12, sys-kernel/lakitu-kernel-6_6, sys-kernel/lakitu-nc-kernel-6_12, sys-kernel/lakitu-nc-kernel-6_6, sys-kernel/lakitu-vgpu-kernel-6_6: security update to 19216.739.5	Tenable Cloud Security	Google COS Security Checks	Local	high
475016	Google: sys-kernel/cchost-kernel-6_12, sys-kernel/csql-kernel-6_12, sys-kernel/csql-kernel-6_6, sys-kernel/lakitu-kernel-6_12, sys-kernel/lakitu-kernel-6_6, sys-kernel/lakitu-nc-kernel-6_12, sys-kernel/lakitu-nc-kernel-6_6, sys-kernel/lakitu-vgpu-kernel-6_6: security update to 19216.739.5	Tenable Self-Hosted Container Security	Google COS Security Checks	Local	high
366399	SUSE SLES15: cluster-md-kmp-default / dlm-kmp-default / gfs2-kmp-default / etc (SUSE-SU-2026:4667-1)	Nessus	SuSE Local Security Checks	Local	medium
366062	SUSE SLES15: cluster-md-kmp-default / dlm-kmp-default / gfs2-kmp-default / etc (SUSE-SU-2026:4668-1)	Nessus	SuSE Local Security Checks	Local	medium
366039	SUSE SLES15: cluster-md-kmp-default / dlm-kmp-default / gfs2-kmp-default / etc (SUSE-SU-2026:4660-1)	Nessus	SuSE Local Security Checks	Local	high
365283	Amazon Linux 2023 : bpftool6.18, kernel6.18, kernel6.18-devel (ALAS2023-2026-3187)	Nessus	Amazon Linux Local Security Checks	Local	medium
365209	Amazon Linux 2023 : bpftool6.12, kernel6.12, kernel6.12-devel (ALAS2023-2026-3193)	Nessus	Amazon Linux Local Security Checks	Local	medium
364137	Oracle Linux 10 / 9 : Unbreakable Enterprise kernel (ELSA-2026-500374)	Nessus	Oracle Linux Local Security Checks	Local	high
362907	Debian dla-4817 : ata-modules-6.12.107+deb12-armmp-di - security update	Nessus	Debian Local Security Checks	Local	high
351155	Debian dsa-6528 : ata-modules-6.12.111+deb13-armmp-di - security update	Nessus	Debian Local Security Checks	Local	high
342953	Linux Distros Unpatched Vulnerability : CVE-2026-80841	Nessus	Misc.	Local	medium

Detections

Analytics

CVE-2026-80841

high

Tenable Plugins

medium

high

high

high

high

medium

medium

high

medium

medium

high

high

high

medium