In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: use check_add_overflow for shader size+offset bound vmw_shader_define() validates the user-supplied shader window against its backing buffer with (u64)buffer->tbo.base.size < (u64)size + (u64)offset drm_vmw_shader_create_arg::offset is __u64 in the uapi; when it is near U64_MAX the unsigned addition wraps and the resulting tiny value passes the check. The unbounded offset is then stored in res->guest_memory_offset and forwarded to host SVGA shader-create commands. Use check_add_overflow() to detect the wrap and compare the resulting endpoint against the buffer size.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:81552 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (CVE-2026-46309)

    * kernel: macsec: fix replay protection at XPN lower-PN wrap (CVE-2026-63925)

    * kernel: bpf: Support for hardening against JIT spraying (CVE-2026-64508)

    * kernel: x86/bugs: Enable IBPB flush on BPF JIT allocation (CVE-2026-64507)

    * kernel: drm/amd/display: set new_stream to NULL after release (CVE-2026-68236)

    * kernel: drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CVE-2026-68278)

    * kernel: drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CVE-2026-68245)

    * kernel: openvswitch: fix GSO userspace truncation underflow (CVE-2026-68123)

    * kernel: cifs: validate DFS referral string offsets (CVE-2026-72318)

    * kernel: drm/vmwgfx: use check_add_overflow for shader size+offset bound (CVE-2026-80887)

    * kernel: nvmet-auth: Synchronize timeout work during SQ teardown (CVE-2026-89970)

    * kernel: drm/amdkfd: Add TLB flush after MES queue eviction/suspension (CVE-2026-89811)

    * kernel: media: cx231xx: reject geometry changes while the VBI queue is busy (CVE-2026-89894)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-82807 advisory.

    - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (Jocelyn Falempe) [RHEL-262108]     {CVE-2026-89811}
    - drm/amd/display: set new_stream to NULL after release (Jocelyn Falempe) [RHEL-260521] {CVE-2026-68236}
    - drm/vmwgfx: use check_add_overflow for shader size+offset bound (Jocelyn Falempe) [RHEL-258131]     {CVE-2026-80887}
    - drm/amdgpu/vce: fix integer overflow in image size (Jocelyn Falempe) [RHEL-237823 RHEL-268877]     {CVE-2026-68108}
    - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (Jocelyn Falempe) [RHEL-240862]     {CVE-2026-68278}
    - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225371]     {CVE-2026-63920}
    - wifi: mac80211: defer link RX stats percpu free to RCU (CKI Backport Bot) [RHEL-263760] {CVE-2026-68409}
    - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261990] {CVE-2026-72318}
    - openvswitch: vport: fix self-deadlock on release of tunnel ports (Timothy Redaelli) [RHEL-253844]     {CVE-2026-31678}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-2026_82807 advisory.

    * kernel: openvswitch: defer tunnel netdev_put to RCU release (CVE-2026-31678)

    * kernel: ipv6: validate extension header length before copying to cmsg (CVE-2026-63920)

    * kernel: drm/amd/display: set new_stream to NULL after release (CVE-2026-68236)

    * kernel: drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CVE-2026-68278)

    * kernel: wifi: mac80211: defer link RX stats percpu free to RCU (CVE-2026-68409)

    * kernel: drm/amdgpu/vce: fix integer overflow in image size (CVE-2026-68108)

    * kernel: cifs: validate DFS referral string offsets (CVE-2026-72318)

    * kernel: drm/vmwgfx: use check_add_overflow for shader size+offset bound (CVE-2026-80887)

    * kernel: drm/amdkfd: Add TLB flush after MES queue eviction/suspension (CVE-2026-89811)

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-2026_82806 advisory.

    * kernel: openvswitch: defer tunnel netdev_put to RCU release (CVE-2026-31678)

    * kernel: ipv6: validate extension header length before copying to cmsg (CVE-2026-63920)

    * kernel: drm/amd/display: set new_stream to NULL after release (CVE-2026-68236)

    * kernel: drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CVE-2026-68278)

    * kernel: wifi: mac80211: defer link RX stats percpu free to RCU (CVE-2026-68409)

    * kernel: drm/amdgpu/vce: fix integer overflow in image size (CVE-2026-68108)

    * kernel: drm/vmwgfx: use check_add_overflow for shader size+offset bound (CVE-2026-80887)

    * kernel: drm/amdkfd: Add TLB flush after MES queue eviction/suspension (CVE-2026-89811)

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-2075:102 advisory.

    * kernel: openvswitch: defer tunnel netdev_put to RCU release (CVE-2026-31678)
      * kernel: ipv6: validate extension header length before copying to cmsg (CVE-2026-63920)
      * kernel: drm/amd/display: set new_stream to NULL after release (CVE-2026-68236)
      * kernel: drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CVE-2026-68278)
      * kernel: wifi: mac80211: defer link RX stats percpu free to RCU (CVE-2026-68409)
      * kernel: drm/amdgpu/vce: fix integer overflow in image size (CVE-2026-68108)
      * kernel: cifs: validate DFS referral string offsets (CVE-2026-72318)
      * kernel: drm/vmwgfx: use check_add_overflow for shader size+offset bound (CVE-2026-80887)
      * kernel: drm/amdkfd: Add TLB flush after MES queue eviction/suspension (CVE-2026-89811)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:82807 advisory.

    * kernel: openvswitch: defer tunnel netdev_put to RCU release (CVE-2026-31678)

    * kernel: ipv6: validate extension header length before copying to cmsg (CVE-2026-63920)

    * kernel: drm/amd/display: set new_stream to NULL after release (CVE-2026-68236)

    * kernel: drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CVE-2026-68278)

    * kernel: wifi: mac80211: defer link RX stats percpu free to RCU (CVE-2026-68409)

    * kernel: drm/amdgpu/vce: fix integer overflow in image size (CVE-2026-68108)

    * kernel: cifs: validate DFS referral string offsets (CVE-2026-72318)

    * kernel: drm/vmwgfx: use check_add_overflow for shader size+offset bound (CVE-2026-80887)

    * kernel: drm/amdkfd: Add TLB flush after MES queue eviction/suspension (CVE-2026-89811)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:82806 advisory.

    * kernel: openvswitch: defer tunnel netdev_put to RCU release (CVE-2026-31678)

    * kernel: ipv6: validate extension header length before copying to cmsg (CVE-2026-63920)

    * kernel: drm/amd/display: set new_stream to NULL after release (CVE-2026-68236)

    * kernel: drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CVE-2026-68278)

    * kernel: wifi: mac80211: defer link RX stats percpu free to RCU (CVE-2026-68409)

    * kernel: drm/amdgpu/vce: fix integer overflow in image size (CVE-2026-68108)

    * kernel: drm/vmwgfx: use check_add_overflow for shader size+offset bound (CVE-2026-80887)

    * kernel: drm/amdkfd: Add TLB flush after MES queue eviction/suspension (CVE-2026-89811)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:81552 advisory.

    * kernel: drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (CVE-2026-46309)
      * kernel: macsec: fix replay protection at XPN lower-PN wrap (CVE-2026-63925)
      * kernel: bpf: Support for hardening against JIT spraying (CVE-2026-64508)
      * kernel: x86/bugs: Enable IBPB flush on BPF JIT allocation (CVE-2026-64507)
      * kernel: drm/amd/display: set new_stream to NULL after release (CVE-2026-68236)
      * kernel: drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CVE-2026-68278)
      * kernel: drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CVE-2026-68245)
      * kernel: openvswitch: fix GSO userspace truncation underflow (CVE-2026-68123)
      * kernel: cifs: validate DFS referral string offsets (CVE-2026-72318)
      * kernel: drm/vmwgfx: use check_add_overflow for shader size+offset bound (CVE-2026-80887)
      * kernel: nvmet-auth: Synchronize timeout work during SQ teardown (CVE-2026-89970)
      * kernel: drm/amdkfd: Add TLB flush after MES queue eviction/suspension (CVE-2026-89811)
      * kernel: media: cx231xx: reject geometry changes while the VBI queue is busy (CVE-2026-89894)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-2026_81552 advisory.

    * kernel: drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (CVE-2026-46309)

    * kernel: macsec: fix replay protection at XPN lower-PN wrap (CVE-2026-63925)

    * kernel: bpf: Support for hardening against JIT spraying (CVE-2026-64508)

    * kernel: x86/bugs: Enable IBPB flush on BPF JIT allocation (CVE-2026-64507)

    * kernel: drm/amd/display: set new_stream to NULL after release (CVE-2026-68236)

    * kernel: drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CVE-2026-68278)

    * kernel: drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CVE-2026-68245)

    * kernel: openvswitch: fix GSO userspace truncation underflow (CVE-2026-68123)

    * kernel: cifs: validate DFS referral string offsets (CVE-2026-72318)

    * kernel: drm/vmwgfx: use check_add_overflow for shader size+offset bound (CVE-2026-80887)

    * kernel: nvmet-auth: Synchronize timeout work during SQ teardown (CVE-2026-89970)

    * kernel: drm/amdkfd: Add TLB flush after MES queue eviction/suspension (CVE-2026-89811)

    * kernel: media: cx231xx: reject geometry changes while the VBI queue is busy (CVE-2026-89894)

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-81552 advisory.

    - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348]     {CVE-2026-89970}
    - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (Jose Exposito) [RHEL-262131]     {CVE-2026-89811}
    - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (Jose Exposito) [RHEL-250806]     {CVE-2026-46309}
    - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236}
    - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162]     {CVE-2026-80887}
    - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241]     {CVE-2026-68245}
    - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851]     {CVE-2026-68278}
    - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508}
    - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507}
    - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508}
    - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123}
    - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527]     {CVE-2026-89894}
    - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925}
    - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318}
    - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950]     {CVE-2026-89690}
    - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas)     [RHEL-187734] {CVE-2026-89530}
    - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186]     {CVE-2026-89669}
    - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas)     [RHEL-264152] {CVE-2026-89663}
    - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240]     {CVE-2026-53398}
    - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480]     {CVE-2026-72317}
    - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246]     {CVE-2026-74744}
    - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103}
    - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970}
    - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365}
    - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365}
    - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408]     {CVE-2026-68291}
    - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408]     {CVE-2026-53286}
    - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408]     {CVE-2026-64162}
    - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408]     {CVE-2026-31647}
    - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284]     {CVE-2026-53360}
    - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284]     {CVE-2026-53360}
    - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284]     {CVE-2026-53360}
    - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284]     {CVE-2026-53360}
    - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284]     {CVE-2026-53360}
    - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar)     [RHEL-192284] {CVE-2026-53360}
    - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360}
    - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284]     {CVE-2026-53360}
    - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360}
    - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360}
    - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360}
    - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284]     {CVE-2026-53360}
    - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360}
    - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284]     {CVE-2026-53360}
    - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284]     {CVE-2026-53360}
    - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270]     {CVE-2026-64115}
    - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035}
    - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227}
    - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot)     [RHEL-271672] {CVE-2026-93288}
    - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822]     {CVE-2026-43332}
    - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972}
    - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670]     {CVE-2026-97417}
    - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317}
    - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611]     {CVE-2026-46275}
    - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot)     [RHEL-232611] {CVE-2026-46275}
    - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460]     {CVE-2026-89481}
    - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480}
    - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442}
    - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792}
    - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924}
    - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922}
    - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279]     {CVE-2026-63984}
    - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381]     {CVE-2026-63920}
    - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351]     {CVE-2026-64557}
    - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351]     {CVE-2026-64557}
    - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351]     {CVE-2026-64557}
    - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721]     {CVE-2026-63993}
    - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal)     [RHEL-259588] {CVE-2026-63994}
    - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774]     {CVE-2026-63992}
    - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889]     {CVE-2026-68432}
    - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004]     {CVE-2026-72052}
    - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040]     {CVE-2026-63829}
    - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot)     [RHEL-260635] {CVE-2026-74569}
    - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385}
    - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921}
    - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099}
    - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374]     {CVE-2026-46076}
    - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524]     {CVE-2026-74516}
    - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524]     {CVE-2026-74516}
    - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516}
    - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357}
    - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777]     {CVE-2026-53357}
    - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400]     {CVE-2026-74669}
    - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400]     {CVE-2026-74669}
    - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669}
    - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427]     {CVE-2026-72255}
    - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481]     {CVE-2026-72289}
    - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746}
    - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060]     {CVE-2026-52942}
    - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986}
    - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049}
    - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:82807 advisory.

    * kernel: openvswitch: defer tunnel netdev_put to RCU release (CVE-2026-31678)
      * kernel: ipv6: validate extension header length before copying to cmsg (CVE-2026-63920)
      * kernel: drm/amd/display: set new_stream to NULL after release (CVE-2026-68236)
      * kernel: drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CVE-2026-68278)
      * kernel: wifi: mac80211: defer link RX stats percpu free to RCU (CVE-2026-68409)
      * kernel: drm/amdgpu/vce: fix integer overflow in image size (CVE-2026-68108)
      * kernel: cifs: validate DFS referral string offsets (CVE-2026-72318)
      * kernel: drm/vmwgfx: use check_add_overflow for shader size+offset bound (CVE-2026-80887)
      * kernel: drm/amdkfd: Add TLB flush after MES queue eviction/suspension (CVE-2026-89811)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:82806 advisory.

    * kernel: openvswitch: defer tunnel netdev_put to RCU release (CVE-2026-31678)
      * kernel: ipv6: validate extension header length before copying to cmsg (CVE-2026-63920)
      * kernel: drm/amd/display: set new_stream to NULL after release (CVE-2026-68236)
      * kernel: drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CVE-2026-68278)
      * kernel: wifi: mac80211: defer link RX stats percpu free to RCU (CVE-2026-68409)
      * kernel: drm/amdgpu/vce: fix integer overflow in image size (CVE-2026-68108)
      * kernel: drm/vmwgfx: use check_add_overflow for shader size+offset bound (CVE-2026-80887)
      * kernel: drm/amdkfd: Add TLB flush after MES queue eviction/suspension (CVE-2026-89811)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:82806 advisory.

    The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with     extremely high determinism requirements.

    Security Fix(es):

    * kernel: openvswitch: defer tunnel netdev_put to RCU release (CVE-2026-31678)

    * kernel: ipv6: validate extension header length before copying to cmsg (CVE-2026-63920)

    * kernel: drm/amd/display: set new_stream to NULL after release (CVE-2026-68236)

    * kernel: drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CVE-2026-68278)

    * kernel: wifi: mac80211: defer link RX stats percpu free to RCU (CVE-2026-68409)

    * kernel: drm/amdgpu/vce: fix integer overflow in image size (CVE-2026-68108)

    * kernel: drm/vmwgfx: use check_add_overflow for shader size+offset bound (CVE-2026-80887)

    * kernel: drm/amdkfd: Add TLB flush after MES queue eviction/suspension (CVE-2026-89811)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:82807 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: openvswitch: defer tunnel netdev_put to RCU release (CVE-2026-31678)

    * kernel: ipv6: validate extension header length before copying to cmsg (CVE-2026-63920)

    * kernel: drm/amd/display: set new_stream to NULL after release (CVE-2026-68236)

    * kernel: drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CVE-2026-68278)

    * kernel: wifi: mac80211: defer link RX stats percpu free to RCU (CVE-2026-68409)

    * kernel: drm/amdgpu/vce: fix integer overflow in image size (CVE-2026-68108)

    * kernel: cifs: validate DFS referral string offsets (CVE-2026-72318)

    * kernel: drm/vmwgfx: use check_add_overflow for shader size+offset bound (CVE-2026-80887)

    * kernel: drm/amdkfd: Add TLB flush after MES queue eviction/suspension (CVE-2026-89811)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:81552 advisory.

    * kernel: drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (CVE-2026-46309)

    * kernel: macsec: fix replay protection at XPN lower-PN wrap (CVE-2026-63925)

    * kernel: bpf: Support for hardening against JIT spraying (CVE-2026-64508)

    * kernel: x86/bugs: Enable IBPB flush on BPF JIT allocation (CVE-2026-64507)

    * kernel: drm/amd/display: set new_stream to NULL after release (CVE-2026-68236)

    * kernel: drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CVE-2026-68278)

    * kernel: drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CVE-2026-68245)

    * kernel: openvswitch: fix GSO userspace truncation underflow (CVE-2026-68123)

    * kernel: cifs: validate DFS referral string offsets (CVE-2026-72318)

    * kernel: drm/vmwgfx: use check_add_overflow for shader size+offset bound (CVE-2026-80887)

    * kernel: nvmet-auth: Synchronize timeout work during SQ teardown (CVE-2026-89970)

    * kernel: drm/amdkfd: Add TLB flush after MES queue eviction/suspension (CVE-2026-89811)

    * kernel: media: cx231xx: reject geometry changes while the VBI queue is busy (CVE-2026-89894)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4788 advisory.

    -------------------------------------------------------------------------     Debian LTS Advisory DLA-4788-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                        Ben Hutchings     September 19, 2026                            https://wiki.debian.org/LTS
    -------------------------------------------------------------------------

    Package        : linux-6.12     Version        : 6.12.107-1~deb12u1     CVE ID         : CVE-2025-38525 CVE-2025-40054 CVE-2025-40074 CVE-2026-43197                      CVE-2026-53092 CVE-2026-64017 CVE-2026-64216 CVE-2026-64581                      CVE-2026-64586 CVE-2026-68082 CVE-2026-68118 CVE-2026-68132                      CVE-2026-68138 CVE-2026-68159 CVE-2026-68166 CVE-2026-68169                      CVE-2026-68198 CVE-2026-68253 CVE-2026-68254 CVE-2026-68264                      CVE-2026-68266 CVE-2026-68267 CVE-2026-68273 CVE-2026-68276                      CVE-2026-68322 CVE-2026-68367 CVE-2026-68431 CVE-2026-68451                      CVE-2026-68452 CVE-2026-68480 CVE-2026-72111 CVE-2026-74440                      CVE-2026-74441 CVE-2026-74442 CVE-2026-74443 CVE-2026-74444                      CVE-2026-74445 CVE-2026-74446 CVE-2026-74447 CVE-2026-74448                      CVE-2026-74450 CVE-2026-74451 CVE-2026-74452 CVE-2026-74453                      CVE-2026-74454 CVE-2026-74455 CVE-2026-74456 CVE-2026-74457                      CVE-2026-74458 CVE-2026-74459 CVE-2026-74460 CVE-2026-74461                      CVE-2026-74463 CVE-2026-74464 CVE-2026-74465 CVE-2026-74467                      CVE-2026-74468 CVE-2026-74469 CVE-2026-74470 CVE-2026-74471                      CVE-2026-74472 CVE-2026-74473 CVE-2026-74474 CVE-2026-74475                      CVE-2026-74476 CVE-2026-74478 CVE-2026-74479 CVE-2026-74480                      CVE-2026-74481 CVE-2026-74482 CVE-2026-74483 CVE-2026-74484                      CVE-2026-74485 CVE-2026-74487 CVE-2026-74488 CVE-2026-74490                      CVE-2026-74492 CVE-2026-74493 CVE-2026-74494 CVE-2026-74495                      CVE-2026-74497 CVE-2026-74498 CVE-2026-74499 CVE-2026-74500                      CVE-2026-74501 CVE-2026-74502 CVE-2026-74503 CVE-2026-74504                      CVE-2026-74505 CVE-2026-74507 CVE-2026-74508 CVE-2026-74509                      CVE-2026-74510 CVE-2026-74512 CVE-2026-74514 CVE-2026-74515                      CVE-2026-74516 CVE-2026-74517 CVE-2026-74518 CVE-2026-74519                      CVE-2026-74522 CVE-2026-74523 CVE-2026-74524 CVE-2026-74525                      CVE-2026-74531 CVE-2026-74532 CVE-2026-74535 CVE-2026-74536                      CVE-2026-74540 CVE-2026-74541 CVE-2026-74543 CVE-2026-74545                      CVE-2026-74546 CVE-2026-74547 CVE-2026-74548 CVE-2026-74549                      CVE-2026-74550 CVE-2026-74551 CVE-2026-74552 CVE-2026-74553                      CVE-2026-74555 CVE-2026-74556 CVE-2026-74557 CVE-2026-74563                      CVE-2026-74564 CVE-2026-74565 CVE-2026-74566 CVE-2026-74567                      CVE-2026-74569 CVE-2026-74572 CVE-2026-74574 CVE-2026-74575                      CVE-2026-74576 CVE-2026-74577 CVE-2026-74579 CVE-2026-74580                      CVE-2026-74581 CVE-2026-74582 CVE-2026-74583 CVE-2026-74585                      CVE-2026-74586 CVE-2026-74587 CVE-2026-74588 CVE-2026-74589                      CVE-2026-74590 CVE-2026-74592 CVE-2026-74594 CVE-2026-74595                      CVE-2026-74597 CVE-2026-74598 CVE-2026-74599 CVE-2026-74601                      CVE-2026-74602 CVE-2026-74603 CVE-2026-74604 CVE-2026-74606                      CVE-2026-74607 CVE-2026-74608 CVE-2026-74609 CVE-2026-74610                      CVE-2026-74612 CVE-2026-74613 CVE-2026-74614 CVE-2026-74615                      CVE-2026-74616 CVE-2026-74618 CVE-2026-74619 CVE-2026-74620                      CVE-2026-74621 CVE-2026-74622 CVE-2026-74623 CVE-2026-74624                      CVE-2026-74625 CVE-2026-74626 CVE-2026-74628 CVE-2026-74630                      CVE-2026-74631 CVE-2026-74632 CVE-2026-74634 CVE-2026-74635                      CVE-2026-74636 CVE-2026-74637 CVE-2026-74641 CVE-2026-74644                      CVE-2026-74646 CVE-2026-74647 CVE-2026-74648 CVE-2026-74649                      CVE-2026-74650 CVE-2026-74651 CVE-2026-74653 CVE-2026-74654                      CVE-2026-74655 CVE-2026-74656 CVE-2026-74657 CVE-2026-74658                      CVE-2026-74659 CVE-2026-74660 CVE-2026-74661 CVE-2026-74662                      CVE-2026-74663 CVE-2026-74664 CVE-2026-74665 CVE-2026-74666                      CVE-2026-74667 CVE-2026-74668 CVE-2026-74669 CVE-2026-74670                      CVE-2026-74671 CVE-2026-74672 CVE-2026-74673 CVE-2026-74675                      CVE-2026-74676 CVE-2026-74677 CVE-2026-74678 CVE-2026-74679                      CVE-2026-74680 CVE-2026-74682 CVE-2026-74683 CVE-2026-74684                      CVE-2026-74685 CVE-2026-74688 CVE-2026-74689 CVE-2026-74691                      CVE-2026-74692 CVE-2026-74693 CVE-2026-74694 CVE-2026-74696                      CVE-2026-74700 CVE-2026-74701 CVE-2026-74704 CVE-2026-74705                      CVE-2026-74710 CVE-2026-74712 CVE-2026-74714 CVE-2026-74717                      CVE-2026-74718 CVE-2026-74719 CVE-2026-74720 CVE-2026-74722                      CVE-2026-74724 CVE-2026-74725 CVE-2026-74726 CVE-2026-74730                      CVE-2026-74732 CVE-2026-74736 CVE-2026-74737 CVE-2026-74739                      CVE-2026-74740 CVE-2026-74742 CVE-2026-74743 CVE-2026-74744                      CVE-2026-74746 CVE-2026-74748 CVE-2026-80522 CVE-2026-80525                      CVE-2026-80526 CVE-2026-80527 CVE-2026-80528 CVE-2026-80529                      CVE-2026-80530 CVE-2026-80531 CVE-2026-80532 CVE-2026-80533                      CVE-2026-80534 CVE-2026-80535 CVE-2026-80536 CVE-2026-80539                      CVE-2026-80540 CVE-2026-80541 CVE-2026-80547 CVE-2026-80548                      CVE-2026-80549 CVE-2026-80550 CVE-2026-80551 CVE-2026-80552                      CVE-2026-80553 CVE-2026-80554 CVE-2026-80555 CVE-2026-80556                      CVE-2026-80557 CVE-2026-80558 CVE-2026-80559 CVE-2026-80560                      CVE-2026-80561 CVE-2026-80562 CVE-2026-80563 CVE-2026-80565                      CVE-2026-80566 CVE-2026-80567 CVE-2026-80568 CVE-2026-80569                      CVE-2026-80570 CVE-2026-80572 CVE-2026-80573 CVE-2026-80574                      CVE-2026-80575 CVE-2026-80576 CVE-2026-80577 CVE-2026-80578                      CVE-2026-80583 CVE-2026-80584 CVE-2026-80585 CVE-2026-80586                      CVE-2026-80587 CVE-2026-80589 CVE-2026-80590 CVE-2026-80678                      CVE-2026-80679 CVE-2026-80680 CVE-2026-80681 CVE-2026-80684                      CVE-2026-80686 CVE-2026-80689 CVE-2026-80691 CVE-2026-80694                      CVE-2026-80695 CVE-2026-80696 CVE-2026-80700 CVE-2026-80702                      CVE-2026-80703 CVE-2026-80704 CVE-2026-80706 CVE-2026-80707                      CVE-2026-80708 CVE-2026-80709 CVE-2026-80710 CVE-2026-80711                      CVE-2026-80714 CVE-2026-80715 CVE-2026-80716 CVE-2026-80717                      CVE-2026-80718 CVE-2026-80722 CVE-2026-80723 CVE-2026-80725                      CVE-2026-80726 CVE-2026-80727 CVE-2026-80728 CVE-2026-80730                      CVE-2026-80731 CVE-2026-80732 CVE-2026-80733 CVE-2026-80736                      CVE-2026-80737 CVE-2026-80739 CVE-2026-80742 CVE-2026-80743                      CVE-2026-80744 CVE-2026-80749 CVE-2026-80752 CVE-2026-80754                      CVE-2026-80756 CVE-2026-80757 CVE-2026-80759 CVE-2026-80763                      CVE-2026-80764 CVE-2026-80765 CVE-2026-80767 CVE-2026-80770                      CVE-2026-80771 CVE-2026-80772 CVE-2026-80779 CVE-2026-80781                      CVE-2026-80782 CVE-2026-80784 CVE-2026-80788 CVE-2026-80789                      CVE-2026-80790 CVE-2026-80791 CVE-2026-80792 CVE-2026-80793                      CVE-2026-80794 CVE-2026-80795 CVE-2026-80797 CVE-2026-80798                      CVE-2026-80799 CVE-2026-80800 CVE-2026-80801 CVE-2026-80802                      CVE-2026-80803 CVE-2026-80805 CVE-2026-80808 CVE-2026-80809                      CVE-2026-80812 CVE-2026-80814 CVE-2026-80815 CVE-2026-80819                      CVE-2026-80820 CVE-2026-80823 CVE-2026-80887 CVE-2026-80888                      CVE-2026-80889 CVE-2026-80890 CVE-2026-80891 CVE-2026-80892                      CVE-2026-80893 CVE-2026-80894 CVE-2026-80901 CVE-2026-80902                      CVE-2026-80903 CVE-2026-80904 CVE-2026-80906 CVE-2026-80907                      CVE-2026-80908 CVE-2026-80909 CVE-2026-80910 CVE-2026-80911                      CVE-2026-80912 CVE-2026-80913 CVE-2026-80915 CVE-2026-80916                      CVE-2026-80917 CVE-2026-80918     Debian Bug     : 1142912 1143545

    Several vulnerabilities have been discovered in the Linux kernel that     may lead to a privilege escalation, denial of service or information     leaks.

    For Debian 12 bookworm, these problems have been fixed in version     6.12.107-1~deb12u1.  This update additionally includes many more bug     fixes from stable updates 6.12.102-6.12.107, and adds drivers for     Alcor card readers.

    We recommend that you upgrade your linux-6.12 packages.

    For the detailed security status of linux-6.12 please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/linux-6.12

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS     Attachment:
    signature.asc     Description: PGP signature

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - drm/vmwgfx: use check_add_overflow for shader size+offset bound vmw_shader_define() validates the user-     supplied shader window against its backing buffer with (u64)buffer->tbo.base.size < (u64)size +     (u64)offset drm_vmw_shader_create_arg::offset is __u64 in the uapi; when it is near U64_MAX the unsigned     addition wraps and the resulting tiny value passes the check. The unbounded offset is then stored in     res->guest_memory_offset and forwarded to host SVGA shader-create commands. Use check_add_overflow() to     detect the wrap and compare the resulting endpoint against the buffer size. (CVE-2026-80887)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
369197	RHEL 9 : kernel (RHSA-2026:81552)	Nessus	Red Hat Local Security Checks	Local	high
366692	Oracle Linux 8 : kernel (ELSA-2026-82807)	Nessus	Oracle Linux Local Security Checks	Local	critical
366514	Rocky Linux 8 [CIQ] Security Update: bpftool / bpftool-debuginfo / kernel / kernel-abi-stablelists / etc Multiple Vulnerabilities (crlsa-2026_82807)	Nessus	Rocky Linux Local Security Checks	Local	critical
366512	Rocky Linux 8 [CIQ] Security Update: kernel-rt / kernel-rt-core / kernel-rt-debug / kernel-rt-debug-core / etc Multiple Vulnerabilities (crlsa-2026_82806)	Nessus	Rocky Linux Local Security Checks	Local	high
366449	MiracleLinux 8 : kernel-4.18.0-553.173.1.el8_10 (AXSA:2026-2075:102)	Nessus	Miracle Linux Local Security Checks	Local	critical
366116	RockyLinux 8 : kernel (RLSA-2026:82807)	Nessus	Rocky Linux Local Security Checks	Local	critical
366113	RockyLinux 8 : kernel-rt (RLSA-2026:82806)	Nessus	Rocky Linux Local Security Checks	Local	high
366103	AlmaLinux 9 : kernel (ALSA-2026:81552)	Nessus	Alma Linux Local Security Checks	Local	high
366054	Rocky Linux 9 [CIQ] Security Update: kernel / kernel-64k / kernel-64k-core / kernel-64k-debug / etc Multiple Vulnerabilities (crlsa-2026_81552)	Nessus	Rocky Linux Local Security Checks	Local	high
365679	Oracle Linux 9 : kernel (ELSA-2026-81552)	Nessus	Oracle Linux Local Security Checks	Local	high
365610	AlmaLinux 8 : kernel (ALSA-2026:82807)	Nessus	Alma Linux Local Security Checks	Local	critical
365609	AlmaLinux 8 : kernel-rt (ALSA-2026:82806)	Nessus	Alma Linux Local Security Checks	Local	high
365583	RHEL 8 : kernel-rt (RHSA-2026:82806)	Nessus	Red Hat Local Security Checks	Local	high
365579	RHEL 8 : kernel (RHSA-2026:82807)	Nessus	Red Hat Local Security Checks	Local	critical
365544	RockyLinux 9 : kernel (RLSA-2026:81552)	Nessus	Rocky Linux Local Security Checks	Local	high
364137	Oracle Linux 10 / 9 : Unbreakable Enterprise kernel (ELSA-2026-500374)	Nessus	Oracle Linux Local Security Checks	Local	high
348574	Debian dla-4788 : ata-modules-6.12.100+deb12-armmp-di - security update	Nessus	Debian Local Security Checks	Local	medium
343438	Linux Distros Unpatched Vulnerability : CVE-2026-80887	Nessus	Misc.	Local	high
341899	Amazon Linux 2023 : bpftool6.12, kernel6.12, kernel6.12-devel (ALAS2023-2026-2110)	Nessus	Amazon Linux Local Security Checks	Local	medium
341888	Amazon Linux 2023 : bpftool6.18, kernel6.18, kernel6.18-devel (ALAS2023-2026-2106)	Nessus	Amazon Linux Local Security Checks	Local	high

Detections

Analytics

CVE-2026-80887

high

Tenable Plugins

high

critical

critical

high

critical

critical

high

high

high

high

critical

high

high

critical

high

high

medium

high

medium

high