In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix OOB in free_rd_atomic_resources() free_rd_atomic_resources() iterates using qp->attr.max_dest_rd_atomic. Updating max_dest_rd_atomic before freeing the old array can make the free path walk past the old allocation and trigger a slab out-of-bounds write catched by KASAN: ================================================================== BUG: KASAN: slab-out-of-bounds in free_rd_atomic_resource drivers/infiniband/sw/rxe/rxe_qp.c:180 [inline] BUG: KASAN: slab-out-of-bounds in free_rd_atomic_resources drivers/infiniband/sw/rxe/rxe_qp.c:171 [inline] BUG: KASAN: slab-out-of-bounds in free_rd_atomic_resources drivers/infiniband/sw/rxe/rxe_qp.c:163 [inline] BUG: KASAN: slab-out-of-bounds in rxe_qp_from_attr+0x1e88/0x2150 drivers/infiniband/sw/rxe/rxe_qp.c:712 Write of size 4 at addr ffff88802b8dddb8 by task syz.3.451/11063 CPU: 0 UID: 0 PID: 11063 Comm: syz.3.451 Not tainted 7.1.0 #2 PREEMPT(full) Hardware name: QEMU Ubuntu 24.04 PC v2 (i440FX + PIIX, arch_caps fix, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 Call Trace: <TASK> __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x10e/0x1f0 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:378 [inline] print_report+0xf7/0x600 mm/kasan/report.c:482 kasan_report+0xe4/0x120 mm/kasan/report.c:595 free_rd_atomic_resource drivers/infiniband/sw/rxe/rxe_qp.c:180 [inline] free_rd_atomic_resources drivers/infiniband/sw/rxe/rxe_qp.c:171 [inline] free_rd_atomic_resources drivers/infiniband/sw/rxe/rxe_qp.c:163 [inline] rxe_qp_from_attr+0x1e88/0x2150 drivers/infiniband/sw/rxe/rxe_qp.c:712 rxe_modify_qp+0x1e2/0x530 drivers/infiniband/sw/rxe/rxe_verbs.c:623 ib_security_modify_qp+0x223/0xfa0 drivers/infiniband/core/security.c:625 _ib_modify_qp+0x333/0xec0 drivers/infiniband/core/verbs.c:1915 modify_qp+0x13ca/0x1940 drivers/infiniband/core/uverbs_cmd.c:1932 ib_uverbs_modify_qp+0xcb/0x120 drivers/infiniband/core/uverbs_cmd.c:1958 ib_uverbs_write+0xb86/0x1030 drivers/infiniband/core/uverbs_main.c:680 vfs_write+0x2aa/0x1070 fs/read_write.c:686 ksys_write+0x1f8/0x250 fs/read_write.c:740 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0x116/0x800 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fefc75a70cd Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fefc8495018 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 RAX: ffffffffffffffda RBX: 00007fefc7835fa0 RCX: 00007fefc75a70cd RDX: 0000000000000078 RSI: 0000200000000240 RDI: 0000000000000007 RBP: 00007fefc764f10f R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007fefc7836038 R14: 00007fefc7835fa0 R15: 00007ffcf0586aa0 </TASK> Allocated by task 11063: kasan_save_stack+0x33/0x60 mm/kasan/common.c:57 kasan_save_track+0x14/0x30 mm/kasan/common.c:78 poison_kmalloc_redzone mm/kasan/common.c:398 [inline] __kasan_kmalloc+0xaa/0xb0 mm/kasan/common.c:415 kasan_kmalloc include/linux/kasan.h:263 [inline] __do_kmalloc_node mm/slub.c:5296 [inline] __kmalloc_noprof+0x32a/0x850 mm/slub.c:5308 kmalloc_noprof include/linux/slab.h:954 [inline] kzalloc_noprof include/linux/slab.h:1188 [inline] alloc_rd_atomic_resources drivers/infiniband/sw/rxe/rxe_qp.c:155 [inline] rxe_qp_from_attr+0x3f8/0x2150 drivers/infiniband/sw/rxe/rxe_qp.c:714 rxe_modify_qp+0x1e2/0x530 drivers/infiniband/sw/rxe/rxe_verbs.c:623 ib_security_modify_qp+0x223/0xfa0 drivers/infiniband/core/security.c:625 _ib_modify_qp+0x333/0xec0 drivers/infiniband/core/verbs.c:1915 modify_qp+0x13ca/0x1940 drivers/infiniband/core/uverbs_cmd.c:1932 ib_uverbs_modify_qp+0xcb/0x120 drivers/infiniband/core/uverbs_cmd.c:1958 ib_uverbs_write+0xb86/0x1030 drivers/infiniband/core/uverbs_ma ---truncated---

The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-2026_1641 advisory.

    This advisory aggregates security fixes for the kernel SRPM in CIQ FIPS 9.6 Compliant. It addresses 24     CVEs: CVE-2026-53002, CVE-2026-63919, CVE-2026-74746, CVE-2025-21826, CVE-2026-98260, and 19 more.

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of kernel installed on the remote host is prior to 5.10.269-270.1108. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.10-2026-133 advisory.

    An issue in the Linux kernel's virtio-net/TAP networking path could allow an actor with privileged access     inside a guest virtual machine to send specially crafted network packets that corrupt host kernel memory     on KVM-based hypervisors running unpatched Linux kernel versions 4.4 through 6.18. This could result in     disclosure of host memory or a denial of service.



    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: nf_tables: add hook transactions for device deletions (CVE-2026-63858)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf, skmsg: fix verdict sk_data_ready racing with ktls rx

    sk_psock_strp_data_ready() already checks tls_sw_has_ctx_rx() anddefers to psock->saved_data_ready when a     TLS RX context is present,avoiding a conflict with the TLS strparser's ownership of the receivequeue     (commit e91de6afa81c, bpf: Fix running sk_skb program typeswith ktls).

    sk_psock_verdict_data_ready() has no equivalent guard.  When a socketis inserted into a sockmap     (BPF_SK_SKB_VERDICT) before TLS RX isconfigured, tls_sw_strparser_arm() saves     sk_psock_verdict_data_readyas rx_ctx->saved_data_ready.  On data arrival:

    tls_data_ready -> tls_strp_data_ready -> tls_rx_msg_ready-> saved_data_ready() =     sk_psock_verdict_data_ready()-> tcp_read_skb() drains sk_receive_queue via __skb_unlink()without calling     tcp_eat_skb(), so copied_seq is not advanced.

    tls_strp_msg_load() then finds tcp_inq() >= full_len (stale), callstcp_recv_skb() on the now-empty queue,     hits WARN_ON_ONCE(!first), andreturns with rx_ctx->strp.anchor.frag_list pointing at a psock-     owned(potentially freed) skb.  tls_decrypt_sg() subsequently walks thatfrag_list: use-after-free.

    Apply the same fix as sk_psock_strp_data_ready(): if a TLS RX contextis present, call     psock->saved_data_ready (sock_def_readable) to wakerecv() waiters and return immediately, leaving the     receive queueuntouched.  TLS retains sole ownership of the queue and decrypts therecord normally through     tls_sw_recvmsg(). (CVE-2026-64025)

    In the Linux kernel, the following vulnerability has been resolved:

    USB: iowarrior: fix use-after-free on disconnect race (CVE-2026-64341)

    In the Linux kernel, the following vulnerability has been resolved:

    ipvs: reload ip header after head reallocation (CVE-2026-68476)

    In the Linux kernel, the following vulnerability has been resolved:

    ipv4: igmp: Fix potential UAF in igmp_gq_start_timer() (CVE-2026-72323)

    In the Linux kernel, the following vulnerability has been resolved:

    bridge: stp: Fix a potential use-after-free when deleting a bridge (CVE-2026-72389)

    In the Linux kernel, the following vulnerability has been resolved:

    ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (CVE-2026-74744)

    In the Linux kernel, the following vulnerability has been resolved:

    HID: magicmouse: do not keep a stale msc->input if no input is claimed (CVE-2026-80782)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: don't enable DAX on new encrypted files (CVE-2026-80806)

    In the Linux kernel, the following vulnerability has been resolved:

    nilfs2: reject invalid block index in GC ioctl (CVE-2026-80807)

    In the Linux kernel, the following vulnerability has been resolved:

    usb: usbfs: fix use-after-free of usb_device in usbdev_release() (CVE-2026-80824)

    In the Linux kernel, the following vulnerability has been resolved:

    USB: serial: option: fix slab OOB read in interrupt URB callback (CVE-2026-80827)

    In the Linux kernel, the following vulnerability has been resolved:

    usb: core: Add lock to usb_wakeup_notification() (CVE-2026-80830)

    In the Linux kernel, the following vulnerability has been resolved:

    ipv6: seg6: clear IPv4 control block on IPIP decapsulation (CVE-2026-80840)

    In the Linux kernel, the following vulnerability has been resolved:

    xfrm: fix xfrm_state_construct() auth-trunc leak (CVE-2026-80843)

    In the Linux kernel, the following vulnerability has been resolved:

    RDMA/rxe: Fix OOB in free_rd_atomic_resources() (CVE-2026-80863)

    In the Linux kernel, the following vulnerability has been resolved: ipv4: validate checksum_start before     completing checksum If a packet with bad checksum metadata gets into the ipv4 stack, skb_checksum_help can     corrupt the network header and cause a bunch of mischief. This was discovered and reported by Paulos, and     has been reporoduced by others independently since. We really shouldn't allow such packets in, but as a     defence in depth measure, let's also check before we complete the checksum. A more complete validation at     input is forthcoming, but needs more work. (CVE-2026-99999)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:77219 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: ipv6: add NULL checks for idev in SRv6 paths (CVE-2026-23442)

    * kernel: RDMA/rxe: Fix race condition in QP timer handlers (CVE-2026-45910)

    * kernel: RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (CVE-2026-46043)

    * kernel: RDMA/rxe: Reject unknown opcodes before ICRC processing (CVE-2026-46133)

    * kernel: RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (CVE-2026-46114)

    * kernel: ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (CVE-2026-63924)

    * kernel: ipv6: exthdrs: refresh nh after handling HAO option (CVE-2026-63922)

    * kernel: ipv6: validate extension header length before copying to cmsg (CVE-2026-63920)

    * kernel: ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (CVE-2026-63984)

    * kernel: Kernel SMB client: Double-free vulnerability allows remote denial of service or privilege     escalation (CVE-2026-64385)

    * kernel: smb: client: fix double-free in SMB2_flush() replay (CVE-2026-64383)

    * kernel: smb: client: fix query_info() replay double-free (CVE-2026-64386)

    * kernel: RDMA/rxe: Fix a use-after-free problem in rxe_mmap (CVE-2026-64582)

    * kernel: ipv6: fix use-after-free in ip6_finish_output2() (CVE-2026-80792)

    * kernel: RDMA/rxe: Fix responder UAF on IB_QP_MAX_DEST_RD_ATOMIC modify_qp (CVE-2026-80864)

    * kernel: RDMA/rxe: Fix OOB in free_rd_atomic_resources() (CVE-2026-80863)

    Bug Fix(es) and Enhancement(s):

    * gfs2: Remote delete issues [rhel-9.6.z] (JIRA:RHEL-172430)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:77301 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: smc: Fix use-after-free in tcp_write_timer_handler() (CVE-2023-53781)

    * kernel: ALSA: firewire-motu: fix buffer overflow in hwdep read for DSP events (CVE-2025-68347)

    * kernel: xfrm: hold dev ref until after transport_finish NF_HOOK (CVE-2026-31663)

    * kernel: Bluetooth: MGMT: validate LTK enc_size on load (CVE-2026-43020)

    * kernel: Linux kernel: xfrm single-frag length not properly limited ()

    * kernel: RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (CVE-2026-46043)

    * kernel: RDMA/rxe: Reject unknown opcodes before ICRC processing (CVE-2026-46133)

    * kernel: sctp: purge outqueue on stale COOKIE-ECHO handling (CVE-2026-52924)

    * kernel: xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (CVE-2026-53239)

    * kernel: ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate() (CVE-2026-63921)

    * kernel: xfrm: input: hold netns during deferred transport reinjection (CVE-2026-63919)

    * kernel: ip6: vti: Use ip6_tnl.net in vti6_changelink() (CVE-2026-63917)

    * kernel: AMD-SN-7061: Safe RET Interrupt Vulnerability (CVE-2026-68480)

    * kernel: RDMA/rxe: Fix a use-after-free problem in rxe_mmap (CVE-2026-64582)

    * kernel: net: qrtr: restrict socket creation to the initial network namespace (CVE-2026-68294)

    * kernel: xfrm: fix stale skb->prev after async crypto steals a GSO segment (CVE-2026-68426)

    * kernel: netfilter: flowtable: publish GC-visible tuple last (CVE-2026-74746)

    * kernel: RDMA/rxe: Fix responder UAF on IB_QP_MAX_DEST_RD_ATOMIC modify_qp (CVE-2026-80864)

    * kernel: RDMA/rxe: Fix OOB in free_rd_atomic_resources() (CVE-2026-80863)

    Bug Fix(es) and Enhancement(s):

    * scsi: mpt3sas: avoid freeing unallocated PCIe SGL buffers (JIRA:RHEL-256999)

    * xfs corruption from [xfs_trans_cancel] during inode allocation (JIRA:RHEL-257187)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:77218 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: xfrm: hold dev ref until after transport_finish NF_HOOK (CVE-2026-31663)

    * kernel: smb: client: fix OOB reads parsing symlink error response (CVE-2026-31613)

    * kernel: RDMA/rxe: Fix race condition in QP timer handlers (CVE-2026-45910)

    * kernel: RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (CVE-2026-46043)

    * kernel: RDMA/rxe: Reject unknown opcodes before ICRC processing (CVE-2026-46133)

    * kernel: RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (CVE-2026-46114)

    * kernel: xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (CVE-2026-53239)

    * kernel: ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (CVE-2026-63924)

    * kernel: ipv6: exthdrs: refresh nh after handling HAO option (CVE-2026-63922)

    * kernel: ipv6: validate extension header length before copying to cmsg (CVE-2026-63920)

    * kernel: netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CVE-2026-64007)

    * kernel: ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate() (CVE-2026-63921)

    * kernel: ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (CVE-2026-63984)

    * kernel: xfrm: input: hold netns during deferred transport reinjection (CVE-2026-63919)

    * kernel: ip6: vti: Use ip6_tnl.net in vti6_changelink() (CVE-2026-63917)

    * kernel: RDMA/rxe: Fix a use-after-free problem in rxe_mmap (CVE-2026-64582)

    * kernel: xfrm: fix stale skb->prev after async crypto steals a GSO segment (CVE-2026-68426)

    * kernel: nvmet-auth: reject short AUTH_RECEIVE buffers (CVE-2026-72130)

    * kernel: ipv6: fix use-after-free in ip6_finish_output2() (CVE-2026-80792)

    * kernel: RDMA/rxe: Fix responder UAF on IB_QP_MAX_DEST_RD_ATOMIC modify_qp (CVE-2026-80864)

    * kernel: RDMA/rxe: Fix OOB in free_rd_atomic_resources() (CVE-2026-80863)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:77217 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: xfrm: hold dev ref until after transport_finish NF_HOOK (CVE-2026-31663)

    * kernel: ALSA: 6fire: fix use-after-free on disconnect (CVE-2026-31581)

    * kernel: gfs2: Fix use-after-free in iomap inline data write path (CVE-2026-45984)

    * kernel: udf: fix partition descriptor append bookkeeping (CVE-2026-45991)

    * kernel: RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (CVE-2026-46043)

    * kernel: RDMA/rxe: Reject unknown opcodes before ICRC processing (CVE-2026-46133)

    * kernel: sctp: purge outqueue on stale COOKIE-ECHO handling (CVE-2026-52924)

    * kernel: xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (CVE-2026-53239)

    * kernel: netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CVE-2026-64007)

    * kernel: ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate() (CVE-2026-63921)

    * kernel: xfrm: input: hold netns during deferred transport reinjection (CVE-2026-63919)

    * kernel: ip6: vti: Use ip6_tnl.net in vti6_changelink() (CVE-2026-63917)

    * kernel: RDMA/rxe: Fix a use-after-free problem in rxe_mmap (CVE-2026-64582)

    * kernel: net: qrtr: restrict socket creation to the initial network namespace (CVE-2026-68294)

    * kernel: xfrm: fix stale skb->prev after async crypto steals a GSO segment (CVE-2026-68426)

    * kernel: scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CVE-2026-74556)

    * kernel: netfilter: flowtable: publish GC-visible tuple last (CVE-2026-74746)

    * kernel: RDMA/rxe: Fix responder UAF on IB_QP_MAX_DEST_RD_ATOMIC modify_qp (CVE-2026-80864)

    * kernel: RDMA/rxe: Fix OOB in free_rd_atomic_resources() (CVE-2026-80863)

    Bug Fix(es) and Enhancement(s):

    * xfs corruption from [xfs_trans_cancel] during inode allocation (JIRA:RHEL-257185)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:77216 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: ALSA: firewire-motu: fix buffer overflow in hwdep read for DSP events (CVE-2025-68347)

    * kernel: xfrm: hold dev ref until after transport_finish NF_HOOK (CVE-2026-31663)

    * kernel: udf: fix partition descriptor append bookkeeping (CVE-2026-45991)

    * kernel: RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (CVE-2026-46043)

    * kernel: RDMA/rxe: Reject unknown opcodes before ICRC processing (CVE-2026-46133)

    * kernel: ipc: limit next_id allocation to the valid ID range (CVE-2026-52923)

    * kernel: sctp: purge outqueue on stale COOKIE-ECHO handling (CVE-2026-52924)

    * kernel: dm cache policy smq: fix missing locks in invalidating cache blocks (CVE-2026-53062)

    * kernel: xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (CVE-2026-53239)

    * kernel: netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CVE-2026-64007)

    * kernel: ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate() (CVE-2026-63921)

    * kernel: xfrm: input: hold netns during deferred transport reinjection (CVE-2026-63919)

    * kernel: ip6: vti: Use ip6_tnl.net in vti6_changelink() (CVE-2026-63917)

    * kernel: nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CVE-2026-64320)

    * kernel: AMD-SN-7061: Safe RET Interrupt Vulnerability (CVE-2026-68480)

    * kernel: RDMA/rxe: Fix a use-after-free problem in rxe_mmap (CVE-2026-64582)

    * kernel: net: qrtr: restrict socket creation to the initial network namespace (CVE-2026-68294)

    * kernel: xfrm: fix stale skb->prev after async crypto steals a GSO segment (CVE-2026-68426)

    * kernel: scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CVE-2026-74556)

    * kernel: netfilter: flowtable: publish GC-visible tuple last (CVE-2026-74746)

    * kernel: RDMA/rxe: Fix responder UAF on IB_QP_MAX_DEST_RD_ATOMIC modify_qp (CVE-2026-80864)

    * kernel: RDMA/rxe: Fix OOB in free_rd_atomic_resources() (CVE-2026-80863)

    Bug Fix(es) and Enhancement(s):

    * NFS client hangs while returning delegations (JIRA:RHEL-112278)

    * scsi: mpt3sas: avoid freeing unallocated PCIe SGL buffers (JIRA:RHEL-256998)

    * xfs corruption from [xfs_trans_cancel] during inode allocation (JIRA:RHEL-257186)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the kernel-5.14.0-756.el9 build changelog.

  - In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: bound element ID read     when checking non-inheritance cfg80211_is_element_inherited() reads the first data octet of the candidate     element (id = elem->data[0]) to look it up in an extension non-inheritance list. It does so after testing     elem->id, but without verifying that the element actually has a data octet. A zero-length extension     element (WLAN_EID_EXTENSION with length 0) therefore makes it read one octet past the end of the element.
    _ieee802_11_parse_elems_full() runs this check for every element of a frame once a non-inheritance context     exists -- e.g. while parsing a per-STA profile of a Multi-Link element in a (re)association response, or a     non-transmitted BSS profile -- so a crafted frame from an AP can trigger a one-octet slab-out-of-bounds     read during element parsing: BUG: KASAN: slab-out-of-bounds in cfg80211_is_element_inherited Read of size     1 ... in net/wireless/scan.c Return early (treat the element as inherited) when an extension element     carries no data, mirroring the existing handling of empty ID lists. The bug was found by fuzzing     ieee802_11_parse_elems_full() under KASAN. (CVE-2026-68402)

  - In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: Reject MPA FPDU length     underflow before signed receive math A malicious connected siw peer can send an iWARP FPDU whose MPA     length field (c_hdr->mpa_len, 16 bit big-endian, peer-controlled) is smaller than the fixed DDP/RDMAP     header for the announced opcode. Soft-iWARP parses the full header in siw_get_hdr() based on     iwarp_pktinfo[opcode] .hdr_len, but never compares mpa_len against that header length. siw_tcp_rx_data()     then derives srx->fpdu_part_rem = be16_to_cpu(mpa_len) - fpdu_part_rcvd + MPA_HDR_SIZE; where     fpdu_part_rcvd equals iwarp_pktinfo[opcode].hdr_len at this point. For a tagged WRITE (hdr_len 16,     MPA_HDR_SIZE 2) the smallest on-wire mpa_len of 0 yields fpdu_part_rem = -14, and any mpa_len below     hdr_len - MPA_HDR_SIZE underflows to a negative int. The signed value then flows into     siw_proc_write()/siw_proc_rresp() as bytes = min(srx->fpdu_part_rem, srx->skb_new); is handed to     siw_check_mem() as an int len (whose interval check addr + len > mem->va + mem->len is satisfied for a     valid base when len is negative), and reaches siw_rx_data() -> siw_rx_kva() / siw_rx_umem() ->     skb_copy_bits() as a signed copy length. The header copy branch in skb_copy_bits() promotes that to     size_t, producing a multi-gigabyte read. KASAN under a KUnit harness that drives the real kernel TCP     receive path -- a loopback AF_INET socketpair, the malformed FPDU written via kernel_sendmsg,     sk_data_ready firing in softirq, tcp_read_sock dispatching to siw_tcp_rx_data -- reports: BUG: KASAN: use-     after-free in skb_copy_bits+0x284/0x480 Read of size 4294967295 at addr ffff888... Call Trace:
    skb_copy_bits siw_rx_kva siw_rx_data siw_check_mem siw_proc_write siw_tcp_rx_data __tcp_read_sock     siw_qp_llp_data_ready tcp_data_ready tcp_data_queue Add the missing invariant at the earliest point where     the peer header is fully assembled. iwarp_pktinfo[*].hdr_len - MPA_HDR_SIZE is exactly the value the siw     transmitter uses as the minimum mpa_len for each opcode (drivers/infiniband/sw/siw/siw_qp.c:33), so this     matches the protocol contract. Out-of-range FPDUs terminate the connection with TERM_ERROR_LAYER_LLP /     LLP_ETYPE_MPA / LLP_ECODE_FPDU_START -- which is RFC 5044 Section 8 error code 3 (Marker and ULPDU Length     fields do not agree on the start of an FPDU), the correct framing-error class for this inconsistency.
    (CVE-2026-64102)

  - In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix race condition in QP     timer handlers I encontered the following warning: WARNING: drivers/infiniband/sw/rxe/rxe_task.c:249 at     rxe_sched_task+0x1c8/0x238 [rdma_rxe], CPU#0: swapper/0/0 ... libsha1 [last unloaded: ip6_udp_tunnel] CPU:
    0 UID: 0 PID: 0 Comm: swapper/0 Tainted: G C 6.19.0-rc5-64k-v8+ #37 PREEMPT Tainted: [C]=CRAP Hardware     name: Raspberry Pi 4 Model B Rev 1.2 Call trace: rxe_sched_task+0x1c8/0x238 [rdma_rxe] (P)     retransmit_timer+0x130/0x188 [rdma_rxe] call_timer_fn+0x68/0x4d0 __run_timers+0x630/0x888 ... WARNING:
    drivers/infiniband/sw/rxe/rxe_task.c:38 at rxe_sched_task+0x1c0/0x238 [rdma_rxe], CPU#0: swapper/0/0 ...
    WARNING: drivers/infiniband/sw/rxe/rxe_task.c:111 at do_work+0x488/0x5c8 [rdma_rxe], CPU#3:
    kworker/u17:4/93400 ... refcount_t: underflow; use-after-free. WARNING: lib/refcount.c:28 at     refcount_warn_saturate+0x138/0x1a0, CPU#3: kworker/u17:4/93400 The issue is caused by a race condition     between retransmit_timer() and rxe_destroy_qp, leading to the Queue Pair's (QP) reference count dropping     to zero during timer handler execution. It seems this warning is harmless because rxe_qp_do_cleanup() will     flush all pending timers and requests. Example of flow causing the issue: CPU0 CPU1 retransmit_timer() {     spin_lock_irqsave rxe_destroy_qp() __rxe_cleanup() __rxe_put() // qp->ref_count decrease to 0     rxe_qp_do_cleanup() { if (qp->valid) { rxe_sched_task() { WARN_ON(rxe_read(task->qp) <= 0); } }     spin_unlock_irqrestore } spin_lock_irqsave qp->valid = 0 spin_unlock_irqrestore } Ensure the QP's     reference count is maintained and its validity is checked within the timer callbacks by adding calls to     rxe_get(qp) and corresponding rxe_put(qp) after use. (CVE-2026-45910)

  - In the Linux kernel, the following vulnerability has been resolved: ext4: fix e4b bitmap inconsistency     reports A bitmap inconsistency issue was observed during stress tests under mixed huge-page workloads.
    Ext4 reported multiple e4b bitmap check failures like: ext4_mb_complex_scan_group:2508: group 350, 8179     free clusters as per group info. But got 8192 blocks Analysis and experimentation confirmed that the issue     is caused by a race condition between page migration and bitmap modification. Although this timing window     is extremely narrow, it is still hit in practice: folio_lock ext4_mb_load_buddy __migrate_folio check ref     count folio_mc_copy __filemap_get_folio folio_try_get(folio) ...... mb_mark_used ext4_mb_unload_buddy
    __folio_migrate_mapping folio_ref_freeze folio_unlock The root cause of this issue is that the fast path     of load_buddy only increments the folio's reference count, which is insufficient to prevent concurrent     folio migration. We observed that the folio migration process acquires the folio lock. Therefore, we can     determine whether to take the fast path in load_buddy by checking the lock status. If the folio is locked,     we opt for the slow path (which acquires the lock) to close this concurrency window. Additionally, this     change addresses the following issues: When the DOUBLE_CHECK macro is enabled to inspect bitmap-related     issues, the following error may be triggered: corruption in group 324 at byte 784(6272): f in copy != ff     on disk/prealloc Analysis reveals that this is a false positive. There is a specific race window where the     bitmap and the group descriptor become momentarily inconsistent, leading to this error report:
    ext4_mb_load_buddy ext4_mb_load_buddy __filemap_get_folio(create|lock) folio_lock ext4_mb_init_cache     folio_mark_uptodate __filemap_get_folio(no lock) ...... mb_mark_used mb_mark_used_double mb_cmp_bitmaps     mb_set_bits(e4b->bd_bitmap) folio_unlock The original logic assumed that since mb_cmp_bitmaps is called     when the bitmap is newly loaded from disk, the folio lock would be sufficient to prevent concurrent     access. However, this overlooks a specific race condition: if another process attempts to load buddy and     finds the folio is already in an uptodate state, it will immediately begin using it without holding folio     lock. (CVE-2026-45942)

  - In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Validate pad and ICRC before     payload_size() in rxe_rcv rxe_rcv() currently checks only that the incoming packet is at least     header_size(pkt) bytes long before payload_size() is used. However, payload_size() subtracts both the     attacker-controlled BTH pad field and RXE_ICRC_SIZE from pkt->paylen: payload_size = pkt->paylen -     offset[RXE_PAYLOAD] - bth_pad(pkt) - RXE_ICRC_SIZE This means a short packet can still make payload_size()     underflow even if it includes enough bytes for the fixed headers. Simply requiring header_size(pkt) +     RXE_ICRC_SIZE is not sufficient either, because a packet with a forged non-zero BTH pad can still leave     payload_size() negative and pass an underflowed value to later receive-path users. Fix this by validating     pkt->paylen against the full minimum length required by payload_size(): header_size(pkt) + bth_pad(pkt) +     RXE_ICRC_SIZE. (CVE-2026-46043)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Rocky Linux 8.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-2026_1573 advisory.

    This advisory aggregates security fixes for the kernel SRPM in CIQ LTS 8.6. It addresses 51 CVEs:
    CVE-2026-53002, CVE-2026-64268, CVE-2021-4083, CVE-2022-1012, CVE-2023-1637, and 46 more.

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Rocky Linux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-2026_1575 advisory.

    This advisory aggregates security fixes for the kernel SRPM in CIQ FIPS 9.2 Compliant. It addresses 86     CVEs: CVE-2026-64268, CVE-2026-64304, CVE-2023-52933, CVE-2023-1637, CVE-2024-41090, and 81 more.

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4777 advisory.

    - -------------------------------------------------------------------------     Debian LTS Advisory DLA-4777-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                 Salvatore Bonaccorso     September 08, 2026                            https://wiki.debian.org/LTS
    - -------------------------------------------------------------------------

    Package        : linux     Version        : 6.1.187-1     CVE ID         : CVE-2023-53706 CVE-2023-54141 CVE-2023-54263 CVE-2024-38620                      CVE-2024-46754 CVE-2024-58094 CVE-2024-58095 CVE-2025-22104                      CVE-2025-38117 CVE-2025-38203 CVE-2025-38206 CVE-2025-38237                      CVE-2025-38616 CVE-2025-39833 CVE-2025-39901 CVE-2025-39925                      CVE-2025-40054 CVE-2025-40064 CVE-2025-40102 CVE-2025-40139                      CVE-2025-40168 CVE-2025-40206 CVE-2025-40307 CVE-2025-68794                      CVE-2026-23394 CVE-2026-31419 CVE-2026-43491 CVE-2026-45963                      CVE-2026-46111 CVE-2026-46158 CVE-2026-46170 CVE-2026-46266                      CVE-2026-53089 CVE-2026-53090 CVE-2026-53361 CVE-2026-64082                      CVE-2026-64139 CVE-2026-64192 CVE-2026-64270 CVE-2026-64272                      CVE-2026-64280 CVE-2026-64294 CVE-2026-64434 CVE-2026-64507                      CVE-2026-64508 CVE-2026-64542 CVE-2026-64543 CVE-2026-64561                      CVE-2026-64562 CVE-2026-64563 CVE-2026-64564 CVE-2026-64565                      CVE-2026-64567 CVE-2026-64569 CVE-2026-64571 CVE-2026-64572                      CVE-2026-64573 CVE-2026-64576 CVE-2026-64577 CVE-2026-64578                      CVE-2026-64579 CVE-2026-64580 CVE-2026-64581 CVE-2026-64582                      CVE-2026-64583 CVE-2026-64584 CVE-2026-64586 CVE-2026-64590                      CVE-2026-68082 CVE-2026-68093 CVE-2026-68096 CVE-2026-68099                      CVE-2026-68100 CVE-2026-68104 CVE-2026-68106 CVE-2026-68108                      CVE-2026-68111 CVE-2026-68115 CVE-2026-68117 CVE-2026-68121                      CVE-2026-68123 CVE-2026-68124 CVE-2026-68125 CVE-2026-68127                      CVE-2026-68129 CVE-2026-68130 CVE-2026-68131 CVE-2026-68132                      CVE-2026-68135 CVE-2026-68136 CVE-2026-68137 CVE-2026-68138                      CVE-2026-68140 CVE-2026-68141 CVE-2026-68142 CVE-2026-68143                      CVE-2026-68144 CVE-2026-68146 CVE-2026-68147 CVE-2026-68148                      CVE-2026-68151 CVE-2026-68153 CVE-2026-68154 CVE-2026-68155                      CVE-2026-68156 CVE-2026-68157 CVE-2026-68158 CVE-2026-68159                      CVE-2026-68160 CVE-2026-68162 CVE-2026-68164 CVE-2026-68165                      CVE-2026-68169 CVE-2026-68175 CVE-2026-68176 CVE-2026-68180                      CVE-2026-68181 CVE-2026-68182 CVE-2026-68183 CVE-2026-68184                      CVE-2026-68186 CVE-2026-68187 CVE-2026-68188 CVE-2026-68189                      CVE-2026-68190 CVE-2026-68192 CVE-2026-68194 CVE-2026-68195                      CVE-2026-68196 CVE-2026-68197 CVE-2026-68198 CVE-2026-68199                      CVE-2026-68202 CVE-2026-68204 CVE-2026-68206 CVE-2026-68207                      CVE-2026-68209 CVE-2026-68210 CVE-2026-68212 CVE-2026-68213                      CVE-2026-68214 CVE-2026-68215 CVE-2026-68216 CVE-2026-68217                      CVE-2026-68218 CVE-2026-68222 CVE-2026-68223 CVE-2026-68226                      CVE-2026-68227 CVE-2026-68229 CVE-2026-68231 CVE-2026-68234                      CVE-2026-68243 CVE-2026-68244 CVE-2026-68246 CVE-2026-68248                      CVE-2026-68249 CVE-2026-68250 CVE-2026-68251 CVE-2026-68253                      CVE-2026-68254 CVE-2026-68255 CVE-2026-68259 CVE-2026-68269                      CVE-2026-68277 CVE-2026-68278 CVE-2026-68279 CVE-2026-68280                      CVE-2026-68284 CVE-2026-68294 CVE-2026-68297 CVE-2026-68299                      CVE-2026-68300 CVE-2026-68301 CVE-2026-68302 CVE-2026-68304                      CVE-2026-68309 CVE-2026-68310 CVE-2026-68313 CVE-2026-68315                      CVE-2026-68320 CVE-2026-68322 CVE-2026-68324 CVE-2026-68325                      CVE-2026-68326 CVE-2026-68327 CVE-2026-68328 CVE-2026-68331                      CVE-2026-68333 CVE-2026-68335 CVE-2026-68336 CVE-2026-68338                      CVE-2026-68340 CVE-2026-68343 CVE-2026-68344 CVE-2026-68349                      CVE-2026-68350 CVE-2026-68351 CVE-2026-68352 CVE-2026-68353                      CVE-2026-68354 CVE-2026-68355 CVE-2026-68357 CVE-2026-68359                      CVE-2026-68360 CVE-2026-68361 CVE-2026-68362 CVE-2026-68363                      CVE-2026-68365 CVE-2026-68366 CVE-2026-68367 CVE-2026-68368                      CVE-2026-68369 CVE-2026-68370 CVE-2026-68371 CVE-2026-68373                      CVE-2026-68376 CVE-2026-68377 CVE-2026-68386 CVE-2026-68388                      CVE-2026-68395 CVE-2026-68397 CVE-2026-68398 CVE-2026-68402                      CVE-2026-68403 CVE-2026-68405 CVE-2026-68406 CVE-2026-68407                      CVE-2026-68410 CVE-2026-68411 CVE-2026-68413 CVE-2026-68414                      CVE-2026-68417 CVE-2026-68422 CVE-2026-68425 CVE-2026-68427                      CVE-2026-68428 CVE-2026-68430 CVE-2026-68431 CVE-2026-68432                      CVE-2026-68433 CVE-2026-68434 CVE-2026-68444 CVE-2026-68446                      CVE-2026-68450 CVE-2026-68451 CVE-2026-68452 CVE-2026-68476                      CVE-2026-68480 CVE-2026-72012 CVE-2026-72015 CVE-2026-72017                      CVE-2026-72023 CVE-2026-72030 CVE-2026-72035 CVE-2026-72040                      CVE-2026-72041 CVE-2026-72045 CVE-2026-72051 CVE-2026-72057                      CVE-2026-72062 CVE-2026-72063 CVE-2026-72065 CVE-2026-72069                      CVE-2026-72070 CVE-2026-72077 CVE-2026-72096 CVE-2026-72099                      CVE-2026-72110 CVE-2026-72113 CVE-2026-72114 CVE-2026-72115                      CVE-2026-72116 CVE-2026-72117 CVE-2026-72118 CVE-2026-72119                      CVE-2026-72121 CVE-2026-72124 CVE-2026-72125 CVE-2026-72142                      CVE-2026-72146 CVE-2026-72157 CVE-2026-72170 CVE-2026-72172                      CVE-2026-72191 CVE-2026-72216 CVE-2026-72236 CVE-2026-72237                      CVE-2026-72242 CVE-2026-72252 CVE-2026-72253 CVE-2026-72260                      CVE-2026-72262 CVE-2026-72299 CVE-2026-72305 CVE-2026-72308                      CVE-2026-72323 CVE-2026-72392 CVE-2026-74436 CVE-2026-74441                      CVE-2026-74443 CVE-2026-74444 CVE-2026-74446 CVE-2026-74450                      CVE-2026-74453 CVE-2026-74454 CVE-2026-74455 CVE-2026-74456                      CVE-2026-74457 CVE-2026-74458 CVE-2026-74459 CVE-2026-74460                      CVE-2026-74461 CVE-2026-74463 CVE-2026-74464 CVE-2026-74465                      CVE-2026-74467 CVE-2026-74468 CVE-2026-74469 CVE-2026-74470                      CVE-2026-74471 CVE-2026-74472 CVE-2026-74473 CVE-2026-74475                      CVE-2026-74476 CVE-2026-74478 CVE-2026-74479 CVE-2026-74480                      CVE-2026-74481 CVE-2026-74482 CVE-2026-74485 CVE-2026-74487                      CVE-2026-74488 CVE-2026-74490 CVE-2026-74492 CVE-2026-74493                      CVE-2026-74494 CVE-2026-74495 CVE-2026-74497 CVE-2026-74498                      CVE-2026-74499 CVE-2026-74505 CVE-2026-74507 CVE-2026-74508                      CVE-2026-74509 CVE-2026-74510 CVE-2026-74512 CVE-2026-74514                      CVE-2026-74515 CVE-2026-74516 CVE-2026-74518 CVE-2026-74519                      CVE-2026-74522 CVE-2026-74523 CVE-2026-74525 CVE-2026-74540                      CVE-2026-74546 CVE-2026-74547 CVE-2026-74548 CVE-2026-74549                      CVE-2026-74550 CVE-2026-74551 CVE-2026-74552 CVE-2026-74553                      CVE-2026-74555 CVE-2026-74556 CVE-2026-74557 CVE-2026-74563                      CVE-2026-74564 CVE-2026-74566 CVE-2026-74567 CVE-2026-74569                      CVE-2026-74575 CVE-2026-74577 CVE-2026-74579 CVE-2026-74580                      CVE-2026-74581 CVE-2026-74582 CVE-2026-74583 CVE-2026-74585                      CVE-2026-74586 CVE-2026-74587 CVE-2026-74588 CVE-2026-74589                      CVE-2026-74594 CVE-2026-74595 CVE-2026-74597 CVE-2026-74598                      CVE-2026-74601 CVE-2026-74603 CVE-2026-74604 CVE-2026-74607                      CVE-2026-74608 CVE-2026-74609 CVE-2026-74612 CVE-2026-74613                      CVE-2026-74614 CVE-2026-74615 CVE-2026-74616 CVE-2026-74620                      CVE-2026-74621 CVE-2026-74622 CVE-2026-74623 CVE-2026-74624                      CVE-2026-74625 CVE-2026-74626 CVE-2026-74628 CVE-2026-74630                      CVE-2026-74631 CVE-2026-74632 CVE-2026-74635 CVE-2026-74636                      CVE-2026-74637 CVE-2026-74641 CVE-2026-74647 CVE-2026-74648                      CVE-2026-74649 CVE-2026-74650 CVE-2026-74651 CVE-2026-74654                      CVE-2026-74656 CVE-2026-74657 CVE-2026-74658 CVE-2026-74659                      CVE-2026-74660 CVE-2026-74662 CVE-2026-74663 CVE-2026-74664                      CVE-2026-74666 CVE-2026-74667 CVE-2026-74668 CVE-2026-74669                      CVE-2026-74671 CVE-2026-74672 CVE-2026-74673 CVE-2026-74675                      CVE-2026-74676 CVE-2026-74678 CVE-2026-74679 CVE-2026-74680                      CVE-2026-74682 CVE-2026-74683 CVE-2026-74688 CVE-2026-74689                      CVE-2026-74691 CVE-2026-74692 CVE-2026-74693 CVE-2026-74694                      CVE-2026-74696 CVE-2026-74697 CVE-2026-74701 CVE-2026-74704                      CVE-2026-74705 CVE-2026-74714 CVE-2026-74717 CVE-2026-74719                      CVE-2026-74720 CVE-2026-74722 CVE-2026-74724 CVE-2026-74726                      CVE-2026-74730 CVE-2026-74737 CVE-2026-74739 CVE-2026-74743                      CVE-2026-74744 CVE-2026-74746 CVE-2026-74748 CVE-2026-80527                      CVE-2026-80528 CVE-2026-80529 CVE-2026-80534 CVE-2026-80536                      CVE-2026-80539 CVE-2026-80540 CVE-2026-80541 CVE-2026-80547                      CVE-2026-80548 CVE-2026-80549 CVE-2026-80550 CVE-2026-80552                      CVE-2026-80553 CVE-2026-80555 CVE-2026-80557 CVE-2026-80558                      CVE-2026-80559 CVE-2026-80560 CVE-2026-80561 CVE-2026-80562                      CVE-2026-80565 CVE-2026-80567 CVE-2026-80568 CVE-2026-80569                      CVE-2026-80570 CVE-2026-80572 CVE-2026-80573 CVE-2026-80574                      CVE-2026-80583 CVE-2026-80584 CVE-2026-80586 CVE-2026-80589                      CVE-2026-80590 CVE-2026-80678 CVE-2026-80679 CVE-2026-80680                      CVE-2026-80681 CVE-2026-80684 CVE-2026-80686 CVE-2026-80706                      CVE-2026-80707 CVE-2026-80708 CVE-2026-80709 CVE-2026-80714                      CVE-2026-80715 CVE-2026-80716 CVE-2026-80717 CVE-2026-80718                      CVE-2026-80722 CVE-2026-80725 CVE-2026-80726 CVE-2026-80730                      CVE-2026-80731 CVE-2026-80732 CVE-2026-80733 CVE-2026-80737                      CVE-2026-80742 CVE-2026-80743 CVE-2026-80744 CVE-2026-80752                      CVE-2026-80754 CVE-2026-80756 CVE-2026-80757 CVE-2026-80762                      CVE-2026-80763 CVE-2026-80764 CVE-2026-80765 CVE-2026-80766                      CVE-2026-80767 CVE-2026-80768 CVE-2026-80770 CVE-2026-80772                      CVE-2026-80781 CVE-2026-80782 CVE-2026-80783 CVE-2026-80784                      CVE-2026-80788 CVE-2026-80789 CVE-2026-80790 CVE-2026-80791                      CVE-2026-80792 CVE-2026-80793 CVE-2026-80794 CVE-2026-80795                      CVE-2026-80796 CVE-2026-80797 CVE-2026-80798 CVE-2026-80799                      CVE-2026-80800 CVE-2026-80801 CVE-2026-80802 CVE-2026-80803                      CVE-2026-80805 CVE-2026-80806 CVE-2026-80807 CVE-2026-80808                      CVE-2026-80809 CVE-2026-80812 CVE-2026-80814 CVE-2026-80819                      CVE-2026-80823 CVE-2026-80824 CVE-2026-80826 CVE-2026-80827                      CVE-2026-80828 CVE-2026-80829 CVE-2026-80830 CVE-2026-80831                      CVE-2026-80832 CVE-2026-80840 CVE-2026-80842 CVE-2026-80843                      CVE-2026-80844 CVE-2026-80846 CVE-2026-80848 CVE-2026-80852                      CVE-2026-80854 CVE-2026-80855 CVE-2026-80856 CVE-2026-80863                      CVE-2026-80888 CVE-2026-80890 CVE-2026-80891 CVE-2026-80892                      CVE-2026-80893 CVE-2026-80901 CVE-2026-80902 CVE-2026-80904                      CVE-2026-80906 CVE-2026-80908 CVE-2026-80909 CVE-2026-80910                      CVE-2026-80913

    Several vulnerabilities have been discovered in the Linux kernel that     may lead to a privilege escalation, denial of service or information     leaks.

    For Debian 12 bookworm, these problems have been fixed in version     6.1.187-1.

    We recommend that you upgrade your linux packages.

    For the detailed security status of linux please refer to its security     tracker page at:
    https://security-tracker.debian.org/tracker/linux

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - RDMA/rxe: Fix OOB in free_rd_atomic_resources() free_rd_atomic_resources() iterates using     qp->attr.max_dest_rd_atomic. Updating max_dest_rd_atomic before freeing the old array can make the free     path walk past the old allocation and trigger a slab out-of-bounds write catched by KASAN:
    ================================================================== BUG: KASAN: slab-out-of-bounds in     free_rd_atomic_resource drivers/infiniband/sw/rxe/rxe_qp.c:180 [inline] BUG: KASAN: slab-out-of-bounds in     free_rd_atomic_resources drivers/infiniband/sw/rxe/rxe_qp.c:171 [inline] BUG: KASAN: slab-out-of-bounds in     free_rd_atomic_resources drivers/infiniband/sw/rxe/rxe_qp.c:163 [inline] BUG: KASAN: slab-out-of-bounds in     rxe_qp_from_attr+0x1e88/0x2150 drivers/infiniband/sw/rxe/rxe_qp.c:712 Write of size 4 at addr     ffff88802b8dddb8 by task syz.3.451/11063 CPU: 0 UID: 0 PID: 11063 Comm: syz.3.451 Not tainted 7.1.0 #2     PREEMPT(full) Hardware name: QEMU Ubuntu 24.04 PC v2 (i440FX + PIIX, arch_caps fix, 1996), BIOS     1.16.3-debian-1.16.3-2 04/01/2014 Call Trace: <TASK> __dump_stack lib/dump_stack.c:94 [inline]     dump_stack_lvl+0x10e/0x1f0 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:378 [inline]     print_report+0xf7/0x600 mm/kasan/report.c:482 kasan_report+0xe4/0x120 mm/kasan/report.c:595     free_rd_atomic_resource drivers/infiniband/sw/rxe/rxe_qp.c:180 [inline] free_rd_atomic_resources     drivers/infiniband/sw/rxe/rxe_qp.c:171 [inline] free_rd_atomic_resources     drivers/infiniband/sw/rxe/rxe_qp.c:163 [inline] rxe_qp_from_attr+0x1e88/0x2150     drivers/infiniband/sw/rxe/rxe_qp.c:712 rxe_modify_qp+0x1e2/0x530 drivers/infiniband/sw/rxe/rxe_verbs.c:623     ib_security_modify_qp+0x223/0xfa0 drivers/infiniband/core/security.c:625 _ib_modify_qp+0x333/0xec0     drivers/infiniband/core/verbs.c:1915 modify_qp+0x13ca/0x1940 drivers/infiniband/core/uverbs_cmd.c:1932     ib_uverbs_modify_qp+0xcb/0x120 drivers/infiniband/core/uverbs_cmd.c:1958 ib_uverbs_write+0xb86/0x1030     drivers/infiniband/core/uverbs_main.c:680 vfs_write+0x2aa/0x1070 fs/read_write.c:686     ksys_write+0x1f8/0x250 fs/read_write.c:740 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]     do_syscall_64+0x116/0x800 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP:
    0033:0x7fefc75a70cd Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48     89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89     01 48 RSP: 002b:00007fefc8495018 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 RAX: ffffffffffffffda RBX:
    00007fefc7835fa0 RCX: 00007fefc75a70cd RDX: 0000000000000078 RSI: 0000200000000240 RDI: 0000000000000007     RBP: 00007fefc764f10f R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11:
    0000000000000246 R12: 0000000000000000 R13: 00007fefc7836038 R14: 00007fefc7835fa0 R15: 00007ffcf0586aa0     </TASK> Allocated by task 11063: kasan_save_stack+0x33/0x60 mm/kasan/common.c:57     kasan_save_track+0x14/0x30 mm/kasan/common.c:78 poison_kmalloc_redzone mm/kasan/common.c:398 [inline]
    __kasan_kmalloc+0xaa/0xb0 mm/kasan/common.c:415 kasan_kmalloc include/linux/kasan.h:263 [inline]
    __do_kmalloc_node mm/slub.c:5296 [inline] __kmalloc_noprof+0x32a/0x850 mm/slub.c:5308 kmalloc_noprof     include/linux/slab.h:954 [inline] kzalloc_noprof include/linux/slab.h:1188 [inline]     alloc_rd_atomic_resources drivers/infiniband/sw/rxe/rxe_qp.c:155 [inline] rxe_qp_from_attr+0x3f8/0x2150     drivers/infiniband/sw/rxe/rxe_qp.c:714 rxe_modify_qp+0x1e2/0x530 drivers/infiniband/sw/rxe/rxe_verbs.c:623     ib_security_modify_qp+0x223/0xfa0 drivers/infiniband/core/security.c:625 _ib_modify_qp+0x333/0xec0     drivers/infiniband/core/verbs.c:1915 modify_qp+0x13ca/0x1940 drivers/infiniband/core/uverbs_cmd.c:1932     ib_uverbs_modify_qp+0xcb/0x120 drivers/infiniband/core/uverbs_cmd.c:1958 ib_uverbs_write+0xb86/0x1030     drivers/infiniband/core/uverbs_ma ---truncated--- (CVE-2026-80863)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
366749	SUSE SLES12: cluster-md-kmp-default / dlm-kmp-default / gfs2-kmp-default / etc (SUSE-SU-2026:4687-1)	Nessus	SuSE Local Security Checks	Local	high
366742	SUSE SLED15: cluster-md-kmp-default / dlm-kmp-default / gfs2-kmp-default / etc (SUSE-SU-2026:4706-1)	Nessus	SuSE Local Security Checks	Local	high
366513	Rocky Linux 9.6 [CIQ] Security Update: kernel / kernel-64k / kernel-64k-core / kernel-64k-debug / etc Multiple Vulnerabilities (ciqsa-2026_1641)	Nessus	Rocky Linux Local Security Checks	Local	high
365191	Amazon Linux 2 : kernel (ALASKERNEL-5.10-2026-133)	Nessus	Amazon Linux Local Security Checks	Local	high
364148	RHEL 9 : kernel (RHSA-2026:77219)	Nessus	Red Hat Local Security Checks	Local	medium
364137	Oracle Linux 10 / 9 : Unbreakable Enterprise kernel (ELSA-2026-500374)	Nessus	Oracle Linux Local Security Checks	Local	high
363954	Oracle Linux 8 / 9 : Unbreakable Enterprise kernel (ELSA-2026-500377)	Nessus	Oracle Linux Local Security Checks	Local	high
363823	RHEL 8 : kernel (RHSA-2026:77301)	Nessus	Red Hat Local Security Checks	Local	high
363822	RHEL 9 : kernel (RHSA-2026:77218)	Nessus	Red Hat Local Security Checks	Local	critical
363817	RHEL 8 : kernel (RHSA-2026:77217)	Nessus	Red Hat Local Security Checks	Local	high
363766	RHEL 8 : kernel (RHSA-2026:77216)	Nessus	Red Hat Local Security Checks	Local	critical
363461	CentOS 9 : kernel-5.14.0-756.el9	Nessus	CentOS Local Security Checks	Local	critical
362907	Debian dla-4817 : ata-modules-6.12.107+deb12-armmp-di - security update	Nessus	Debian Local Security Checks	Local	high
359534	Rocky Linux 8.6 [CIQ] Security Update: bpftool / kernel / kernel-abi-stablelists / kernel-core / etc Multiple Vulnerabilities (ciqsa-2026_1573)	Nessus	Rocky Linux Local Security Checks	Local	high
359533	Rocky Linux 9.2 [CIQ] Security Update: bpftool / kernel / kernel-64k / kernel-64k-core / kernel-64k-debug / etc Multiple Vulnerabilities (ciqsa-2026_1575)	Nessus	Rocky Linux Local Security Checks	Local	high
351155	Debian dsa-6528 : ata-modules-6.12.111+deb13-armmp-di - security update	Nessus	Debian Local Security Checks	Local	high
343851	Debian dla-4777 : ata-modules-6.1.0-52-armmp-di - security update	Nessus	Debian Local Security Checks	Local	high
343045	Linux Distros Unpatched Vulnerability : CVE-2026-80863	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2026-80863

high

Tenable Plugins

high

high

high

high

medium

high

high

high

critical

high

critical

critical

high

high

high

high

high

high