In the Linux kernel, the following vulnerability has been resolved: selinux: require every boolean value to be defined p_bools.nprim comes from the policy image independently of how many booleans follow it, and cond_index_bool() fills bool_val_to_struct[] at value - 1, so a count larger than the values present leaves NULL entries. Every user of that array then walks it by index and dereferences each entry: cond_evaluate_expr() on the access-vector path, security_get_bools() and security_get_bool_value() behind selinuxfs, and security_set_bools(). A sparse class value is absorbed by policydb_class_isvalid() and its siblings; booleans have no such predicate, and no consumer that could use one. Reject a boolean value that no boolean defines, once, where the array is built. Conforming policies define every boolean they declare and are unaffected.

The CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS7:CLSA-2026:1793321383 advisory.

  - In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Fix premature hw access     after PCI error After a recoverable PCI error has been detected and recovered, qla driver needs to check     to see if the error condition still persist and/or wait for the OS to give the resume signal. Sep 8     22:26:03 localhost kernel: WARNING: CPU: 9 PID: 124606 at qla_tmpl.c:440 qla27xx_fwdt_entry_t266+0x55/0x60     [qla2xxx] Sep 8 22:26:03 localhost kernel: RIP: 0010:qla27xx_fwdt_entry_t266+0x55/0x60 [qla2xxx] Sep 8     22:26:03 localhost kernel: Call Trace: Sep 8 22:26:03 localhost kernel: ? qla27xx_walk_template+0xb1/0x1b0     [qla2xxx] Sep 8 22:26:03 localhost kernel: ? qla27xx_execute_fwdt_template+0x12a/0x160 [qla2xxx] Sep 8     22:26:03 localhost kernel: ? qla27xx_fwdump+0xa0/0x1c0 [qla2xxx] Sep 8 22:26:03 localhost kernel: ?     qla2xxx_pci_mmio_enabled+0xfb/0x120 [qla2xxx] Sep 8 22:26:03 localhost kernel: ?     report_mmio_enabled+0x44/0x80 Sep 8 22:26:03 localhost kernel: ? report_slot_reset+0x80/0x80 Sep 8     22:26:03 localhost kernel: ? pci_walk_bus+0x70/0x90 Sep 8 22:26:03 localhost kernel: ?     aer_dev_correctable_show+0xc0/0xc0 Sep 8 22:26:03 localhost kernel: ? pcie_do_recovery+0x1bb/0x240 Sep 8     22:26:03 localhost kernel: ? aer_recover_work_func+0xaa/0xd0 Sep 8 22:26:03 localhost kernel: ?     process_one_work+0x1a7/0x360 .. Sep 8 22:26:03 localhost kernel: qla2xxx [0000:42:00.2]-8041:22: detected     PCI disconnect. Sep 8 22:26:03 localhost kernel: qla2xxx [0000:42:00.2]-107ff:22: qla27xx_fwdt_entry_t262:
    dump ram MB failed. Area 5h start 198013h end 198013h Sep 8 22:26:03 localhost kernel: qla2xxx     [0000:42:00.2]-107ff:22: Unable to capture FW dump Sep 8 22:26:03 localhost kernel: qla2xxx     [0000:42:00.2]-1015:22: cmd=0x0, waited 5221 msecs Sep 8 22:26:03 localhost kernel: qla2xxx     [0000:42:00.2]-680d:22: mmio enabled returning. Sep 8 22:26:03 localhost kernel: qla2xxx     [0000:42:00.2]-d04c:22: MBX Command timeout for cmd 0, iocontrol=ffffffff jiffies=10140f2e5     mb[0-3]=[0xffff 0xffff 0xffff 0xffff] (CVE-2022-49157)

  - In the Linux kernel, the following vulnerability has been resolved: mrp: introduce active flags to prevent     UAF when applicant uninit The caller of del_timer_sync must prevent restarting of the timer, If we have no     this synchronization, there is a small probability that the cancellation will not be successful. And     syzbot report the fellowing crash: ================================================================== BUG:
    KASAN: use-after-free in hlist_add_head include/linux/list.h:929 [inline] BUG: KASAN: use-after-free in     enqueue_timer+0x18/0xa4 kernel/time/timer.c:605 Write at addr f9ff000024df6058 by task syz-fuzzer/2256     Pointer tag: [f9], memory tag: [fe] CPU: 1 PID: 2256 Comm: syz-fuzzer Not tainted     6.1.0-rc5-syzkaller-00008- ge01d50cbd6ee #0 Hardware name: linux,dummy-virt (DT) Call trace:
    dump_backtrace.part.0+0xe0/0xf0 arch/arm64/kernel/stacktrace.c:156 dump_backtrace     arch/arm64/kernel/stacktrace.c:162 [inline] show_stack+0x18/0x40 arch/arm64/kernel/stacktrace.c:163
    __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x68/0x84 lib/dump_stack.c:106     print_address_description mm/kasan/report.c:284 [inline] print_report+0x1a8/0x4a0 mm/kasan/report.c:395     kasan_report+0x94/0xb4 mm/kasan/report.c:495 __do_kernel_fault+0x164/0x1e0 arch/arm64/mm/fault.c:320     do_bad_area arch/arm64/mm/fault.c:473 [inline] do_tag_check_fault+0x78/0x8c arch/arm64/mm/fault.c:749     do_mem_abort+0x44/0x94 arch/arm64/mm/fault.c:825 el1_abort+0x40/0x60 arch/arm64/kernel/entry-common.c:367     el1h_64_sync_handler+0xd8/0xe4 arch/arm64/kernel/entry-common.c:427 el1h_64_sync+0x64/0x68     arch/arm64/kernel/entry.S:576 hlist_add_head include/linux/list.h:929 [inline] enqueue_timer+0x18/0xa4     kernel/time/timer.c:605 mod_timer+0x14/0x20 kernel/time/timer.c:1161 mrp_periodic_timer_arm     net/802/mrp.c:614 [inline] mrp_periodic_timer+0xa0/0xc0 net/802/mrp.c:627     call_timer_fn.constprop.0+0x24/0x80 kernel/time/timer.c:1474 expire_timers+0x98/0xc4     kernel/time/timer.c:1519 To fix it, we can introduce a new active flags to make sure the timer will not     restart. (CVE-2022-50697)

  - In the Linux kernel, the following vulnerability has been resolved: crypto: qat - fix DMA transfer     direction When CONFIG_DMA_API_DEBUG is selected, while running the crypto self test on the QAT crypto     algorithms, the function add_dma_entry() reports a warning similar to the one below, saying that     overlapping mappings are not supported. This occurs in tests where the input and the output scatter list     point to the same buffers (i.e. two different scatter lists which point to the same chunks of memory). The     logic that implements the mapping uses the flag DMA_BIDIRECTIONAL for both the input and the output     scatter lists which leads to overlapped write mappings. These are not supported by the DMA layer. Fix by     specifying the correct DMA transfer directions when mapping buffers. For in-place operations where the     input scatter list matches the output scatter list, buffers are mapped once with DMA_BIDIRECTIONAL,     otherwise input buffers are mapped using the flag DMA_TO_DEVICE and output buffers are mapped with     DMA_FROM_DEVICE. Overlapping a read mapping with a write mapping is a valid case in dma-coherent devices     like QAT. The function that frees and unmaps the buffers, qat_alg_free_bufl() has been changed accordingly     to the changes to the mapping function. DMA-API: 4xxx 0000:06:00.0: cacheline tracking EEXIST, overlapping     mappings aren't supported WARNING: CPU: 53 PID: 4362 at kernel/dma/debug.c:570 add_dma_entry+0x1e9/0x270     ... Call Trace: dma_map_page_attrs+0x82/0x2d0 ? preempt_count_add+0x6a/0xa0     qat_alg_sgl_to_bufl+0x45b/0x990 [intel_qat] qat_alg_aead_dec+0x71/0x250 [intel_qat]     crypto_aead_decrypt+0x3d/0x70 test_aead_vec_cfg+0x649/0x810 ? number+0x310/0x3a0 ? vsnprintf+0x2a3/0x550 ?     scnprintf+0x42/0x70 ? valid_sg_divisions.constprop.0+0x86/0xa0 ? test_aead_vec+0xdf/0x120     test_aead_vec+0xdf/0x120 alg_test_aead+0x185/0x400 alg_test+0x3d8/0x500 ?     crypto_acomp_scomp_free_ctx+0x30/0x30 ? __schedule+0x32a/0x12a0 ? ttwu_queue_wakelist+0xbf/0x110 ?
    _raw_spin_unlock_irqrestore+0x23/0x40 ? try_to_wake_up+0x83/0x570 ? _raw_spin_unlock_irqrestore+0x23/0x40     ? __set_cpus_allowed_ptr_locked+0xea/0x1b0 ? crypto_acomp_scomp_free_ctx+0x30/0x30     cryptomgr_test+0x27/0x50 kthread+0xe6/0x110 ? kthread_complete_and_exit+0x20/0x20 ret_from_fork+0x1f/0x30     (CVE-2022-50774)

  - In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: cfg80211: Pass the PMK     in binary instead of hex Apparently the hex passphrase mechanism does not work on newer chips/firmware     (e.g. BCM4387). It seems there was a simple way of passing it in binary all along, so use that and avoid     the hexification. OpenBSD has been doing it like this from the beginning, so this should work on all     chips. Also clear the structure before setting the PMK. This was leaking uninitialized stack contents to     the device. (CVE-2023-53715)

  - In the Linux kernel, the following vulnerability has been resolved: posix-timers: Ensure timer ID search-     loop limit is valid posix_timer_add() tries to allocate a posix timer ID by starting from the cached ID     which was stored by the last successful allocation. This is done in a loop searching the ID space for a     free slot one by one. The loop has to terminate when the search wrapped around to the starting point. But     that's racy vs. establishing the starting point. That is read out lockless, which leads to the following     problem: CPU0 CPU1 posix_timer_add() start = sig->posix_timer_id; lock(hash_lock); ... posix_timer_add()     if (++sig->posix_timer_id < 0) start = sig->posix_timer_id; sig->posix_timer_id = 0; So CPU1 can observe a     negative start value, i.e. -1, and the loop break never happens because the condition can never be true:
    if (sig->posix_timer_id == start) break; While this is unlikely to ever turn into an endless loop as the     ID space is huge (INT_MAX), the racy read of the start value caught the attention of KCSAN and Dmitry     unearthed that incorrectness. Rewrite it so that all id operations are under the hash lock.
    (CVE-2023-53728)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the linux package has been released.

The CentOS Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS6:CLSA-2026:1792975902 advisory.

  - In the Linux kernel, the following vulnerability has been resolved: hwrng: geode - Fix PCI device refcount     leak for_each_pci_dev() is implemented by pci_get_device(). The comment of pci_get_device() says that it     will increase the reference count for the returned pci_dev and also decrease the reference count for the     input pci_dev @from if it is not NULL. If we break for_each_pci_dev() loop with pdev not NULL, we need to     call pci_dev_put() to decrease the reference count. We add a new struct 'amd_geode_priv' to record pointer     of the pci_dev and membase, and then add missing pci_dev_put() for the normal and error path.
    (CVE-2022-50659)

  - In the Linux kernel, the following vulnerability has been resolved: ubi: Fix use-after-free when volume     resizing failed There is an use-after-free problem reported by KASAN:
    ================================================================== BUG: KASAN: use-after-free in     ubi_eba_copy_table+0x11f/0x1c0 [ubi] Read of size 8 at addr ffff888101eec008 by task ubirsvol/4735 CPU: 2     PID: 4735 Comm: ubirsvol Not tainted 6.1.0-rc1-00003-g84fa3304a7fc-dirty #14 Hardware name: QEMU Standard     PC (i440FX + PIIX, 1996), BIOS 1.14.0-1.fc33 04/01/2014 Call Trace: <TASK> dump_stack_lvl+0x34/0x44     print_report+0x171/0x472 kasan_report+0xad/0x130 ubi_eba_copy_table+0x11f/0x1c0 [ubi]     ubi_resize_volume+0x4f9/0xbc0 [ubi] ubi_cdev_ioctl+0x701/0x1850 [ubi] __x64_sys_ioctl+0x11d/0x170     do_syscall_64+0x35/0x80 entry_SYSCALL_64_after_hwframe+0x46/0xb0 </TASK> When ubi_change_vtbl_record()     returns an error in ubi_resize_volume(), new_eba_tbl will be freed on error handing path, but it is     holded by vol->eba_tbl in ubi_eba_replace_table(). It means that the liftcycle of vol->eba_tbl and     vol are different, so when resizing volume in next time, it causing an use-after-free fault. Fix it by     not freeing new_eba_tbl after it replaced in ubi_eba_replace_table(), while will be freed in next volume     resizing. (CVE-2023-53800)

  - In the Linux kernel, the following vulnerability has been resolved: media: av7110: prevent underflow in     write_ts_to_decoder() The buf[4] value comes from the user via ts_play(). It is a value in the u8 range.
    The final length we pass to av7110_ipack_instant_repack() is len - (buf[4] + 1) - 4 so add a check to     ensure that the length is not negative. It's not clear that passing a negative len value does anything bad     necessarily, but it's not best practice. With the new bounds checking the if (!len) condition is no     longer possible or required so remove that. (CVE-2023-54284)

  - In the Linux kernel, the following vulnerability has been resolved: ext4: fix dirtyclusters double     decrement on fs shutdown fstests test generic/388 occasionally reproduces a warning in ext4_put_super()     associated with the dirty clusters count: WARNING: CPU: 7 PID: 76064 at fs/ext4/super.c:1324     ext4_put_super+0x48c/0x590 [ext4] Tracing the failure shows that the warning fires due to an     s_dirtyclusters_counter value of -1. IOW, this appears to be a spurious decrement as opposed to some sort     of leak. Further tracing of the dirty cluster count deltas and an LLM scan of the resulting output     identified the cause as a double decrement in the error path between ext4_mb_mark_diskspace_used() and the     caller ext4_mb_new_blocks(). First, note that generic/388 is a shutdown vs. fsstress test and so produces     a random set of operations and shutdown injections. In the problematic case, the shutdown triggers an     error return from the ext4_handle_dirty_metadata() call(s) made from ext4_mb_mark_context(). The changed     value is non-zero at this point, so ext4_mb_mark_diskspace_used() does not exit after the error bubbles up     from ext4_mb_mark_context(). Instead, the former decrements both cluster counters and returns the error up     to ext4_mb_new_blocks(). The latter falls into the !ar->len out path which decrements the dirty clusters     counter a second time, creating the inconsistency. To avoid this problem and simplify ownership of the     cluster reservation in this codepath, lift the counter reduction to a single place in the caller. This     makes it more clear that ext4_mb_new_blocks() is responsible for acquiring cluster reservation (via     ext4_claim_free_clusters()) in the !delalloc case as well as releasing it, regardless of whether it ends     up consumed or returned due to failure. (CVE-2026-45920)

  - In the Linux kernel, the following vulnerability has been resolved: wifi: b43: enforce bounds check on     firmware key index in b43_rx() The firmware-controlled key index in b43_rx() can exceed the dev->key[]     array size (58 entries). The existing B43_WARN_ON is non-enforcing in production builds, allowing an out-     of-bounds read. Make the B43_WARN_ON check enforcing by dropping the frame when the firmware returns an     invalid key index. (CVE-2026-46122)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of kernel installed on the remote host is prior to 5.10.268-266.1092. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.10-2026-132 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    drm/virtio: use uninterruptible resv lock for plane updates (CVE-2026-64098)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf: Reject BPF_MAP_TYPE_INODE_STORAGE creation if BPF LSM is uninitialized

    When CONFIG_BPF_LSM=y is set, BPF inode storage maps(BPF_MAP_TYPE_INODE_STORAGE) are compiled into the     kernel. However,if the BPF LSM is not explicitly enabled at boot time (e.g. omittedfrom the lsm= boot     parameter), lsm_prepare() is never executed forthe BPF LSM.

    Consequently, the BPF inode security blob offset(bpf_lsm_blob_sizes.lbs_inode) is never initialized and     remains atits default compiled size of 8 bytes instead of being updated to avalid offset past the reserved     struct rcu_head (typically 16 bytesor more).

    When a privileged user creates and updates a BPF_MAP_TYPE_INODE_STORAGEmap, bpf_inode() evaluates     inode->i_security + 8. This erroneouslyaliases the struct rcu_head.func callback pointer at the     beginningof the inode->i_security blob. During subsequent map element cleanupor inode destruction, writing     NULL to owner_storage clears the queuedRCU callback pointer. When rcu_do_batch() later executes the     queuedcallback, it attempts an instruction fetch at address 0x0, triggeringan immediate kernel panic.

    Fix this by introducing a global bpf_lsm_initialized boolean flagmarked with __ro_after_init. Set this     flag to true inside bpf_lsm_init()when the LSM framework successfully registers the BPF LSM. Gate     mapallocation in inode_storage_map_alloc() on this flag, returning-EOPNOTSUPP if the BPF LSM is in turn     uninitialized.

    This fail-fast approach prevents userspace from allocating inodestorage maps when the supporting BPF LSM     infrastructure is absent,avoiding zombie map states. (CVE-2026-64192)

    In the Linux kernel, the following vulnerability has been resolved:

    i2c: core: fix adapter deregistration race (CVE-2026-64279)

    In the Linux kernel, the following vulnerability has been resolved:

    libceph: fix two unsafe bare decodes in decode_lockers() (CVE-2026-68082)

    In the Linux kernel, the following vulnerability has been resolved:

    audit: fix recursive locking deadlock in audit_dupe_exe() (CVE-2026-68096)

    In the Linux kernel, the following vulnerability has been resolved:

    super: fix emergency thaw deadlock on frozen block devices (CVE-2026-68132)

    In the Linux kernel, the following vulnerability has been resolved:

    net: gro: fix double aggregation of flush-marked skbs (CVE-2026-68136)

    In the Linux kernel, the following vulnerability has been resolved:

    ftrace: Add global mutex to serialize trace_parser access (CVE-2026-68146)

    In the Linux kernel, the following vulnerability has been resolved:

    libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CVE-2026-68159)

    In the Linux kernel, the following vulnerability has been resolved:

    sctp: avoid auth_enable sysctl UAF during netns teardown (CVE-2026-68162)

    In the Linux kernel, the following vulnerability has been resolved:

    drm/virtio: bound EDID block reads to the response buffer (CVE-2026-68255)

    In the Linux kernel, the following vulnerability has been resolved:

    drm/dp/mst: fix OOB reads on 2-byte fields in sideband reply parsers (CVE-2026-68277)

    In the Linux kernel, the following vulnerability has been resolved:

    drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CVE-2026-68278)

    In the Linux kernel, the following vulnerability has been resolved:

    drm/dp/mst: fix OOB reads in remote DPCD/I2C sideband reply parsers (CVE-2026-68279)

    In the Linux kernel, the following vulnerability has been resolved:

    mmc: vub300: fix use-after-free on probe failure (CVE-2026-72073)

    In the Linux kernel, the following vulnerability has been resolved:

    scsi: target: Bound PR-OUT TransportID parsing to the received buffer (CVE-2026-72084)

    In the Linux kernel, the following vulnerability has been resolved:

    scsi: lpfc: Fix memory leak in lpfc_sli4_driver_resource_setup() (CVE-2026-72087)

    In the Linux kernel, the following vulnerability has been resolved:

    dm-verity: make error counter atomic (CVE-2026-72096)

    In the Linux kernel, the following vulnerability has been resolved:

    dm-integrity: don't increment hash_offset twice (CVE-2026-72099)

    In the Linux kernel, the following vulnerability has been resolved:

    jbd2: fix integer underflow in jbd2_journal_initialize_fast_commit() (CVE-2026-72225)

    In the Linux kernel, the following vulnerability has been resolved:

    selinux: avoid sk_socket dereference in selinux_sctp_bind_connect() (CVE-2026-72242)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: nft_set_pipapo: don't leak bad clone into future transaction (CVE-2026-72252)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: nf_conntrack_sip: validate skb_dst() before accessing it (CVE-2026-72253)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CVE-2026-72255)

    In the Linux kernel, the following vulnerability has been resolved:

    KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (CVE-2026-72288)

    In the Linux kernel, the following vulnerability has been resolved:

    tipc: restrict socket queue dumps in enqueue tracepoints (CVE-2026-72299)

    In the Linux kernel, the following vulnerability has been resolved:

    mlxsw: fix refcount leak in mlxsw_sp_port_lag_join() (CVE-2026-72308)

    In the Linux kernel, the following vulnerability has been resolved:

    sctp: add INIT verification after cookie unpacking (CVE-2026-72398)

    In the Linux kernel, the following vulnerability has been resolved:

    sctp: fix err_chunk memory leaks in INIT handling (CVE-2026-72413)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: nft_compat: ebtables emulation must reject non-bridge targets (CVE-2026-72416)

    In the Linux kernel, the following vulnerability has been resolved:

    xprtrdma: Repost Receive buffers for malformed replies (CVE-2026-72464)

    In the Linux kernel, the following vulnerability has been resolved:

    RDMA/rxe: Fix TOCTOU heap overflow in get_srq_wqe (CVE-2026-74378)

    In the Linux kernel, the following vulnerability has been resolved:

    OPP: Fix race between OPP addition and lookup (CVE-2026-74405)

    In the Linux kernel, the following vulnerability has been resolved:

    scsi: scsi_debug: Fix REPORT ZONES alloc_len underflow OOB write (CVE-2026-74470)

    In the Linux kernel, the following vulnerability has been resolved:

    net: pktgen: fix proc entry use-after-free (CVE-2026-74479)

    In the Linux kernel, the following vulnerability has been resolved:

    binfmt_misc: restore write access when removing an entry (CVE-2026-74487)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: nf_tables: make nft_object rhltable per table (CVE-2026-74565)

    In the Linux kernel, the following vulnerability has been resolved:

    packet: use consistent hard_header_len in non-ring send paths (CVE-2026-74582)

    In the Linux kernel, the following vulnerability has been resolved:

    sched/psi: Shut down rtpoll_timer in psi_cgroup_free() (CVE-2026-74594)

    In the Linux kernel, the following vulnerability has been resolved:

    ring-buffer: Use current_context for safe per-CPU buffer swap (CVE-2026-74601)

    In the Linux kernel, the following vulnerability has been resolved:

    net/sched: act_gact, act_police: range check the fallback control action (CVE-2026-74620)

    In the Linux kernel, the following vulnerability has been resolved:

    mm/huge_memory: fix huge_zero_pfn race (CVE-2026-74632)

    In the Linux kernel, the following vulnerability has been resolved:

    perf/core: Fix group leader use-after-free after sibling detach (CVE-2026-74637)

    In the Linux kernel, the following vulnerability has been resolved:

    ipv4: Fix fib_nlmsg_size() for RTA_VIA nexthops (CVE-2026-74657)

    In the Linux kernel, the following vulnerability has been resolved:

    inet: frags: publish queues before arming timer (CVE-2026-74662)

    In the Linux kernel, the following vulnerability has been resolved:

    net/sched: reject overly deep qdisc hierarchies (CVE-2026-74663)

    In the Linux kernel, the following vulnerability has been resolved:

    packet: synchronize pressure clearing with ring reconfiguration (CVE-2026-74666)

    In the Linux kernel, the following vulnerability has been resolved:

    packet: use consistent hard_header_len in TX_RING send path (CVE-2026-74668)

    In the Linux kernel, the following vulnerability has been resolved:

    net: tap: set skb->dev before parsing virtio net header in tap_get_user_xdp() (CVE-2026-74684)

    In the Linux kernel, the following vulnerability has been resolved:

    net/sched: cls_api: Always acquire rtnl_lock when destroying locked classifiers (CVE-2026-74700)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: flowtable: publish GC-visible tuple last (CVE-2026-74746)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: ipset: fix refcount race between list:set GC and swap (CVE-2026-74748)

    In the Linux kernel, the following vulnerability has been resolved:

    ceph: fix hanging __ceph_get_caps() with stale mds_wanted (CVE-2026-80527)

    In the Linux kernel, the following vulnerability has been resolved:

    ceph: avoid fs reclaim while using current->journal_info (CVE-2026-80528)

    In the Linux kernel, the following vulnerability has been resolved:

    xfs: fix ilock leak on error in xfs_dq_get_next_id (CVE-2026-80534)

    In the Linux kernel, the following vulnerability has been resolved:

    xfs: bounds-check buffer log item's dirty bitmap (CVE-2026-80536)

    In the Linux kernel, the following vulnerability has been resolved:

    libceph: fix OOB read in decode_watchers() via missing bounds check (CVE-2026-80557)

    In the Linux kernel, the following vulnerability has been resolved:

    libceph: Avoid using invalid osd indices from primary_temp (CVE-2026-80558)

    In the Linux kernel, the following vulnerability has been resolved:

    libceph: fix multiple unsafe decodes in decode_locker() (CVE-2026-80561)

    In the Linux kernel, the following vulnerability has been resolved:

    mptcp: options: reset DSS fields in case of unexpected size (CVE-2026-80586)

    In the Linux kernel, the following vulnerability has been resolved:

    inet: frags: strip GSO state from fragments before reassembly (CVE-2026-80590)

    In the Linux kernel, the following vulnerability has been resolved:

    serial: amba-pl011: synchronize DMA teardown (CVE-2026-80737)

    In the Linux kernel, the following vulnerability has been resolved:

    af_packet: Don't send zero-byte data in tpacket_snd(). (CVE-2026-80742)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: nf_tables_offload: suppress WARN_ON_ONCE for ENOMEM in abort path (CVE-2026-80744)

    In the Linux kernel, the following vulnerability has been resolved:

    selinux: do not cancel a policy conversion that never started (CVE-2026-80756)

    In the Linux kernel, the following vulnerability has been resolved:

    selinux: reject a class permission count below its inherited common (CVE-2026-80757)

    In the Linux kernel, the following vulnerability has been resolved:

    HID: hyperv: validate initial device info bounds (CVE-2026-80765)

    In the Linux kernel, the following vulnerability has been resolved:

    HID: core: fix OOB read of field->usage in hid_set_field() (CVE-2026-80781)

    In the Linux kernel, the following vulnerability has been resolved:

    ipv6: fix use-after-free in ip6_finish_output2() (CVE-2026-80792)

    In the Linux kernel, the following vulnerability has been resolved:

    ipv4: reject undersized MTUs in ip_do_fragment() (CVE-2026-80793)

    In the Linux kernel, the following vulnerability has been resolved:

    xfs: validate attr entry pointer before field access (CVE-2026-80805)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: stop retrying saturated xattr cache entries (CVE-2026-80808)

    In the Linux kernel, the following vulnerability has been resolved:

    rndis_host: add overflow check in rndis_rx_fixup() (CVE-2026-80814)

    In the Linux kernel, the following vulnerability has been resolved:

    net: packet: fix wrong transport_header when sending VLAN-tagged frame (CVE-2026-80906)

    In the Linux kernel, the following vulnerability has been resolved:

    selinux: require every boolean value to be defined (CVE-2026-80913)

    In the Linux kernel, the following vulnerability has been resolved:

    HID: core: fix number/pointer type confusion on long items (CVE-2026-80918)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4788 advisory.

    -------------------------------------------------------------------------     Debian LTS Advisory DLA-4788-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                        Ben Hutchings     September 19, 2026                            https://wiki.debian.org/LTS
    -------------------------------------------------------------------------

    Package        : linux-6.12     Version        : 6.12.107-1~deb12u1     CVE ID         : CVE-2025-38525 CVE-2025-40054 CVE-2025-40074 CVE-2026-43197                      CVE-2026-53092 CVE-2026-64017 CVE-2026-64216 CVE-2026-64581                      CVE-2026-64586 CVE-2026-68082 CVE-2026-68118 CVE-2026-68132                      CVE-2026-68138 CVE-2026-68159 CVE-2026-68166 CVE-2026-68169                      CVE-2026-68198 CVE-2026-68253 CVE-2026-68254 CVE-2026-68264                      CVE-2026-68266 CVE-2026-68267 CVE-2026-68273 CVE-2026-68276                      CVE-2026-68322 CVE-2026-68367 CVE-2026-68431 CVE-2026-68451                      CVE-2026-68452 CVE-2026-68480 CVE-2026-72111 CVE-2026-74440                      CVE-2026-74441 CVE-2026-74442 CVE-2026-74443 CVE-2026-74444                      CVE-2026-74445 CVE-2026-74446 CVE-2026-74447 CVE-2026-74448                      CVE-2026-74450 CVE-2026-74451 CVE-2026-74452 CVE-2026-74453                      CVE-2026-74454 CVE-2026-74455 CVE-2026-74456 CVE-2026-74457                      CVE-2026-74458 CVE-2026-74459 CVE-2026-74460 CVE-2026-74461                      CVE-2026-74463 CVE-2026-74464 CVE-2026-74465 CVE-2026-74467                      CVE-2026-74468 CVE-2026-74469 CVE-2026-74470 CVE-2026-74471                      CVE-2026-74472 CVE-2026-74473 CVE-2026-74474 CVE-2026-74475                      CVE-2026-74476 CVE-2026-74478 CVE-2026-74479 CVE-2026-74480                      CVE-2026-74481 CVE-2026-74482 CVE-2026-74483 CVE-2026-74484                      CVE-2026-74485 CVE-2026-74487 CVE-2026-74488 CVE-2026-74490                      CVE-2026-74492 CVE-2026-74493 CVE-2026-74494 CVE-2026-74495                      CVE-2026-74497 CVE-2026-74498 CVE-2026-74499 CVE-2026-74500                      CVE-2026-74501 CVE-2026-74502 CVE-2026-74503 CVE-2026-74504                      CVE-2026-74505 CVE-2026-74507 CVE-2026-74508 CVE-2026-74509                      CVE-2026-74510 CVE-2026-74512 CVE-2026-74514 CVE-2026-74515                      CVE-2026-74516 CVE-2026-74517 CVE-2026-74518 CVE-2026-74519                      CVE-2026-74522 CVE-2026-74523 CVE-2026-74524 CVE-2026-74525                      CVE-2026-74531 CVE-2026-74532 CVE-2026-74535 CVE-2026-74536                      CVE-2026-74540 CVE-2026-74541 CVE-2026-74543 CVE-2026-74545                      CVE-2026-74546 CVE-2026-74547 CVE-2026-74548 CVE-2026-74549                      CVE-2026-74550 CVE-2026-74551 CVE-2026-74552 CVE-2026-74553                      CVE-2026-74555 CVE-2026-74556 CVE-2026-74557 CVE-2026-74563                      CVE-2026-74564 CVE-2026-74565 CVE-2026-74566 CVE-2026-74567                      CVE-2026-74569 CVE-2026-74572 CVE-2026-74574 CVE-2026-74575                      CVE-2026-74576 CVE-2026-74577 CVE-2026-74579 CVE-2026-74580                      CVE-2026-74581 CVE-2026-74582 CVE-2026-74583 CVE-2026-74585                      CVE-2026-74586 CVE-2026-74587 CVE-2026-74588 CVE-2026-74589                      CVE-2026-74590 CVE-2026-74592 CVE-2026-74594 CVE-2026-74595                      CVE-2026-74597 CVE-2026-74598 CVE-2026-74599 CVE-2026-74601                      CVE-2026-74602 CVE-2026-74603 CVE-2026-74604 CVE-2026-74606                      CVE-2026-74607 CVE-2026-74608 CVE-2026-74609 CVE-2026-74610                      CVE-2026-74612 CVE-2026-74613 CVE-2026-74614 CVE-2026-74615                      CVE-2026-74616 CVE-2026-74618 CVE-2026-74619 CVE-2026-74620                      CVE-2026-74621 CVE-2026-74622 CVE-2026-74623 CVE-2026-74624                      CVE-2026-74625 CVE-2026-74626 CVE-2026-74628 CVE-2026-74630                      CVE-2026-74631 CVE-2026-74632 CVE-2026-74634 CVE-2026-74635                      CVE-2026-74636 CVE-2026-74637 CVE-2026-74641 CVE-2026-74644                      CVE-2026-74646 CVE-2026-74647 CVE-2026-74648 CVE-2026-74649                      CVE-2026-74650 CVE-2026-74651 CVE-2026-74653 CVE-2026-74654                      CVE-2026-74655 CVE-2026-74656 CVE-2026-74657 CVE-2026-74658                      CVE-2026-74659 CVE-2026-74660 CVE-2026-74661 CVE-2026-74662                      CVE-2026-74663 CVE-2026-74664 CVE-2026-74665 CVE-2026-74666                      CVE-2026-74667 CVE-2026-74668 CVE-2026-74669 CVE-2026-74670                      CVE-2026-74671 CVE-2026-74672 CVE-2026-74673 CVE-2026-74675                      CVE-2026-74676 CVE-2026-74677 CVE-2026-74678 CVE-2026-74679                      CVE-2026-74680 CVE-2026-74682 CVE-2026-74683 CVE-2026-74684                      CVE-2026-74685 CVE-2026-74688 CVE-2026-74689 CVE-2026-74691                      CVE-2026-74692 CVE-2026-74693 CVE-2026-74694 CVE-2026-74696                      CVE-2026-74700 CVE-2026-74701 CVE-2026-74704 CVE-2026-74705                      CVE-2026-74710 CVE-2026-74712 CVE-2026-74714 CVE-2026-74717                      CVE-2026-74718 CVE-2026-74719 CVE-2026-74720 CVE-2026-74722                      CVE-2026-74724 CVE-2026-74725 CVE-2026-74726 CVE-2026-74730                      CVE-2026-74732 CVE-2026-74736 CVE-2026-74737 CVE-2026-74739                      CVE-2026-74740 CVE-2026-74742 CVE-2026-74743 CVE-2026-74744                      CVE-2026-74746 CVE-2026-74748 CVE-2026-80522 CVE-2026-80525                      CVE-2026-80526 CVE-2026-80527 CVE-2026-80528 CVE-2026-80529                      CVE-2026-80530 CVE-2026-80531 CVE-2026-80532 CVE-2026-80533                      CVE-2026-80534 CVE-2026-80535 CVE-2026-80536 CVE-2026-80539                      CVE-2026-80540 CVE-2026-80541 CVE-2026-80547 CVE-2026-80548                      CVE-2026-80549 CVE-2026-80550 CVE-2026-80551 CVE-2026-80552                      CVE-2026-80553 CVE-2026-80554 CVE-2026-80555 CVE-2026-80556                      CVE-2026-80557 CVE-2026-80558 CVE-2026-80559 CVE-2026-80560                      CVE-2026-80561 CVE-2026-80562 CVE-2026-80563 CVE-2026-80565                      CVE-2026-80566 CVE-2026-80567 CVE-2026-80568 CVE-2026-80569                      CVE-2026-80570 CVE-2026-80572 CVE-2026-80573 CVE-2026-80574                      CVE-2026-80575 CVE-2026-80576 CVE-2026-80577 CVE-2026-80578                      CVE-2026-80583 CVE-2026-80584 CVE-2026-80585 CVE-2026-80586                      CVE-2026-80587 CVE-2026-80589 CVE-2026-80590 CVE-2026-80678                      CVE-2026-80679 CVE-2026-80680 CVE-2026-80681 CVE-2026-80684                      CVE-2026-80686 CVE-2026-80689 CVE-2026-80691 CVE-2026-80694                      CVE-2026-80695 CVE-2026-80696 CVE-2026-80700 CVE-2026-80702                      CVE-2026-80703 CVE-2026-80704 CVE-2026-80706 CVE-2026-80707                      CVE-2026-80708 CVE-2026-80709 CVE-2026-80710 CVE-2026-80711                      CVE-2026-80714 CVE-2026-80715 CVE-2026-80716 CVE-2026-80717                      CVE-2026-80718 CVE-2026-80722 CVE-2026-80723 CVE-2026-80725                      CVE-2026-80726 CVE-2026-80727 CVE-2026-80728 CVE-2026-80730                      CVE-2026-80731 CVE-2026-80732 CVE-2026-80733 CVE-2026-80736                      CVE-2026-80737 CVE-2026-80739 CVE-2026-80742 CVE-2026-80743                      CVE-2026-80744 CVE-2026-80749 CVE-2026-80752 CVE-2026-80754                      CVE-2026-80756 CVE-2026-80757 CVE-2026-80759 CVE-2026-80763                      CVE-2026-80764 CVE-2026-80765 CVE-2026-80767 CVE-2026-80770                      CVE-2026-80771 CVE-2026-80772 CVE-2026-80779 CVE-2026-80781                      CVE-2026-80782 CVE-2026-80784 CVE-2026-80788 CVE-2026-80789                      CVE-2026-80790 CVE-2026-80791 CVE-2026-80792 CVE-2026-80793                      CVE-2026-80794 CVE-2026-80795 CVE-2026-80797 CVE-2026-80798                      CVE-2026-80799 CVE-2026-80800 CVE-2026-80801 CVE-2026-80802                      CVE-2026-80803 CVE-2026-80805 CVE-2026-80808 CVE-2026-80809                      CVE-2026-80812 CVE-2026-80814 CVE-2026-80815 CVE-2026-80819                      CVE-2026-80820 CVE-2026-80823 CVE-2026-80887 CVE-2026-80888                      CVE-2026-80889 CVE-2026-80890 CVE-2026-80891 CVE-2026-80892                      CVE-2026-80893 CVE-2026-80894 CVE-2026-80901 CVE-2026-80902                      CVE-2026-80903 CVE-2026-80904 CVE-2026-80906 CVE-2026-80907                      CVE-2026-80908 CVE-2026-80909 CVE-2026-80910 CVE-2026-80911                      CVE-2026-80912 CVE-2026-80913 CVE-2026-80915 CVE-2026-80916                      CVE-2026-80917 CVE-2026-80918     Debian Bug     : 1142912 1143545

    Several vulnerabilities have been discovered in the Linux kernel that     may lead to a privilege escalation, denial of service or information     leaks.

    For Debian 12 bookworm, these problems have been fixed in version     6.12.107-1~deb12u1.  This update additionally includes many more bug     fixes from stable updates 6.12.102-6.12.107, and adds drivers for     Alcor card readers.

    We recommend that you upgrade your linux-6.12 packages.

    For the detailed security status of linux-6.12 please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/linux-6.12

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS     Attachment:
    signature.asc     Description: PGP signature

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4777 advisory.

    - -------------------------------------------------------------------------     Debian LTS Advisory DLA-4777-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                 Salvatore Bonaccorso     September 08, 2026                            https://wiki.debian.org/LTS
    - -------------------------------------------------------------------------

    Package        : linux     Version        : 6.1.187-1     CVE ID         : CVE-2023-53706 CVE-2023-54141 CVE-2023-54263 CVE-2024-38620                      CVE-2024-46754 CVE-2024-58094 CVE-2024-58095 CVE-2025-22104                      CVE-2025-38117 CVE-2025-38203 CVE-2025-38206 CVE-2025-38237                      CVE-2025-38616 CVE-2025-39833 CVE-2025-39901 CVE-2025-39925                      CVE-2025-40054 CVE-2025-40064 CVE-2025-40102 CVE-2025-40139                      CVE-2025-40168 CVE-2025-40206 CVE-2025-40307 CVE-2025-68794                      CVE-2026-23394 CVE-2026-31419 CVE-2026-43491 CVE-2026-45963                      CVE-2026-46111 CVE-2026-46158 CVE-2026-46170 CVE-2026-46266                      CVE-2026-53089 CVE-2026-53090 CVE-2026-53361 CVE-2026-64082                      CVE-2026-64139 CVE-2026-64192 CVE-2026-64270 CVE-2026-64272                      CVE-2026-64280 CVE-2026-64294 CVE-2026-64434 CVE-2026-64507                      CVE-2026-64508 CVE-2026-64542 CVE-2026-64543 CVE-2026-64561                      CVE-2026-64562 CVE-2026-64563 CVE-2026-64564 CVE-2026-64565                      CVE-2026-64567 CVE-2026-64569 CVE-2026-64571 CVE-2026-64572                      CVE-2026-64573 CVE-2026-64576 CVE-2026-64577 CVE-2026-64578                      CVE-2026-64579 CVE-2026-64580 CVE-2026-64581 CVE-2026-64582                      CVE-2026-64583 CVE-2026-64584 CVE-2026-64586 CVE-2026-64590                      CVE-2026-68082 CVE-2026-68093 CVE-2026-68096 CVE-2026-68099                      CVE-2026-68100 CVE-2026-68104 CVE-2026-68106 CVE-2026-68108                      CVE-2026-68111 CVE-2026-68115 CVE-2026-68117 CVE-2026-68121                      CVE-2026-68123 CVE-2026-68124 CVE-2026-68125 CVE-2026-68127                      CVE-2026-68129 CVE-2026-68130 CVE-2026-68131 CVE-2026-68132                      CVE-2026-68135 CVE-2026-68136 CVE-2026-68137 CVE-2026-68138                      CVE-2026-68140 CVE-2026-68141 CVE-2026-68142 CVE-2026-68143                      CVE-2026-68144 CVE-2026-68146 CVE-2026-68147 CVE-2026-68148                      CVE-2026-68151 CVE-2026-68153 CVE-2026-68154 CVE-2026-68155                      CVE-2026-68156 CVE-2026-68157 CVE-2026-68158 CVE-2026-68159                      CVE-2026-68160 CVE-2026-68162 CVE-2026-68164 CVE-2026-68165                      CVE-2026-68169 CVE-2026-68175 CVE-2026-68176 CVE-2026-68180                      CVE-2026-68181 CVE-2026-68182 CVE-2026-68183 CVE-2026-68184                      CVE-2026-68186 CVE-2026-68187 CVE-2026-68188 CVE-2026-68189                      CVE-2026-68190 CVE-2026-68192 CVE-2026-68194 CVE-2026-68195                      CVE-2026-68196 CVE-2026-68197 CVE-2026-68198 CVE-2026-68199                      CVE-2026-68202 CVE-2026-68204 CVE-2026-68206 CVE-2026-68207                      CVE-2026-68209 CVE-2026-68210 CVE-2026-68212 CVE-2026-68213                      CVE-2026-68214 CVE-2026-68215 CVE-2026-68216 CVE-2026-68217                      CVE-2026-68218 CVE-2026-68222 CVE-2026-68223 CVE-2026-68226                      CVE-2026-68227 CVE-2026-68229 CVE-2026-68231 CVE-2026-68234                      CVE-2026-68243 CVE-2026-68244 CVE-2026-68246 CVE-2026-68248                      CVE-2026-68249 CVE-2026-68250 CVE-2026-68251 CVE-2026-68253                      CVE-2026-68254 CVE-2026-68255 CVE-2026-68259 CVE-2026-68269                      CVE-2026-68277 CVE-2026-68278 CVE-2026-68279 CVE-2026-68280                      CVE-2026-68284 CVE-2026-68294 CVE-2026-68297 CVE-2026-68299                      CVE-2026-68300 CVE-2026-68301 CVE-2026-68302 CVE-2026-68304                      CVE-2026-68309 CVE-2026-68310 CVE-2026-68313 CVE-2026-68315                      CVE-2026-68320 CVE-2026-68322 CVE-2026-68324 CVE-2026-68325                      CVE-2026-68326 CVE-2026-68327 CVE-2026-68328 CVE-2026-68331                      CVE-2026-68333 CVE-2026-68335 CVE-2026-68336 CVE-2026-68338                      CVE-2026-68340 CVE-2026-68343 CVE-2026-68344 CVE-2026-68349                      CVE-2026-68350 CVE-2026-68351 CVE-2026-68352 CVE-2026-68353                      CVE-2026-68354 CVE-2026-68355 CVE-2026-68357 CVE-2026-68359                      CVE-2026-68360 CVE-2026-68361 CVE-2026-68362 CVE-2026-68363                      CVE-2026-68365 CVE-2026-68366 CVE-2026-68367 CVE-2026-68368                      CVE-2026-68369 CVE-2026-68370 CVE-2026-68371 CVE-2026-68373                      CVE-2026-68376 CVE-2026-68377 CVE-2026-68386 CVE-2026-68388                      CVE-2026-68395 CVE-2026-68397 CVE-2026-68398 CVE-2026-68402                      CVE-2026-68403 CVE-2026-68405 CVE-2026-68406 CVE-2026-68407                      CVE-2026-68410 CVE-2026-68411 CVE-2026-68413 CVE-2026-68414                      CVE-2026-68417 CVE-2026-68422 CVE-2026-68425 CVE-2026-68427                      CVE-2026-68428 CVE-2026-68430 CVE-2026-68431 CVE-2026-68432                      CVE-2026-68433 CVE-2026-68434 CVE-2026-68444 CVE-2026-68446                      CVE-2026-68450 CVE-2026-68451 CVE-2026-68452 CVE-2026-68476                      CVE-2026-68480 CVE-2026-72012 CVE-2026-72015 CVE-2026-72017                      CVE-2026-72023 CVE-2026-72030 CVE-2026-72035 CVE-2026-72040                      CVE-2026-72041 CVE-2026-72045 CVE-2026-72051 CVE-2026-72057                      CVE-2026-72062 CVE-2026-72063 CVE-2026-72065 CVE-2026-72069                      CVE-2026-72070 CVE-2026-72077 CVE-2026-72096 CVE-2026-72099                      CVE-2026-72110 CVE-2026-72113 CVE-2026-72114 CVE-2026-72115                      CVE-2026-72116 CVE-2026-72117 CVE-2026-72118 CVE-2026-72119                      CVE-2026-72121 CVE-2026-72124 CVE-2026-72125 CVE-2026-72142                      CVE-2026-72146 CVE-2026-72157 CVE-2026-72170 CVE-2026-72172                      CVE-2026-72191 CVE-2026-72216 CVE-2026-72236 CVE-2026-72237                      CVE-2026-72242 CVE-2026-72252 CVE-2026-72253 CVE-2026-72260                      CVE-2026-72262 CVE-2026-72299 CVE-2026-72305 CVE-2026-72308                      CVE-2026-72323 CVE-2026-72392 CVE-2026-74436 CVE-2026-74441                      CVE-2026-74443 CVE-2026-74444 CVE-2026-74446 CVE-2026-74450                      CVE-2026-74453 CVE-2026-74454 CVE-2026-74455 CVE-2026-74456                      CVE-2026-74457 CVE-2026-74458 CVE-2026-74459 CVE-2026-74460                      CVE-2026-74461 CVE-2026-74463 CVE-2026-74464 CVE-2026-74465                      CVE-2026-74467 CVE-2026-74468 CVE-2026-74469 CVE-2026-74470                      CVE-2026-74471 CVE-2026-74472 CVE-2026-74473 CVE-2026-74475                      CVE-2026-74476 CVE-2026-74478 CVE-2026-74479 CVE-2026-74480                      CVE-2026-74481 CVE-2026-74482 CVE-2026-74485 CVE-2026-74487                      CVE-2026-74488 CVE-2026-74490 CVE-2026-74492 CVE-2026-74493                      CVE-2026-74494 CVE-2026-74495 CVE-2026-74497 CVE-2026-74498                      CVE-2026-74499 CVE-2026-74505 CVE-2026-74507 CVE-2026-74508                      CVE-2026-74509 CVE-2026-74510 CVE-2026-74512 CVE-2026-74514                      CVE-2026-74515 CVE-2026-74516 CVE-2026-74518 CVE-2026-74519                      CVE-2026-74522 CVE-2026-74523 CVE-2026-74525 CVE-2026-74540                      CVE-2026-74546 CVE-2026-74547 CVE-2026-74548 CVE-2026-74549                      CVE-2026-74550 CVE-2026-74551 CVE-2026-74552 CVE-2026-74553                      CVE-2026-74555 CVE-2026-74556 CVE-2026-74557 CVE-2026-74563                      CVE-2026-74564 CVE-2026-74566 CVE-2026-74567 CVE-2026-74569                      CVE-2026-74575 CVE-2026-74577 CVE-2026-74579 CVE-2026-74580                      CVE-2026-74581 CVE-2026-74582 CVE-2026-74583 CVE-2026-74585                      CVE-2026-74586 CVE-2026-74587 CVE-2026-74588 CVE-2026-74589                      CVE-2026-74594 CVE-2026-74595 CVE-2026-74597 CVE-2026-74598                      CVE-2026-74601 CVE-2026-74603 CVE-2026-74604 CVE-2026-74607                      CVE-2026-74608 CVE-2026-74609 CVE-2026-74612 CVE-2026-74613                      CVE-2026-74614 CVE-2026-74615 CVE-2026-74616 CVE-2026-74620                      CVE-2026-74621 CVE-2026-74622 CVE-2026-74623 CVE-2026-74624                      CVE-2026-74625 CVE-2026-74626 CVE-2026-74628 CVE-2026-74630                      CVE-2026-74631 CVE-2026-74632 CVE-2026-74635 CVE-2026-74636                      CVE-2026-74637 CVE-2026-74641 CVE-2026-74647 CVE-2026-74648                      CVE-2026-74649 CVE-2026-74650 CVE-2026-74651 CVE-2026-74654                      CVE-2026-74656 CVE-2026-74657 CVE-2026-74658 CVE-2026-74659                      CVE-2026-74660 CVE-2026-74662 CVE-2026-74663 CVE-2026-74664                      CVE-2026-74666 CVE-2026-74667 CVE-2026-74668 CVE-2026-74669                      CVE-2026-74671 CVE-2026-74672 CVE-2026-74673 CVE-2026-74675                      CVE-2026-74676 CVE-2026-74678 CVE-2026-74679 CVE-2026-74680                      CVE-2026-74682 CVE-2026-74683 CVE-2026-74688 CVE-2026-74689                      CVE-2026-74691 CVE-2026-74692 CVE-2026-74693 CVE-2026-74694                      CVE-2026-74696 CVE-2026-74697 CVE-2026-74701 CVE-2026-74704                      CVE-2026-74705 CVE-2026-74714 CVE-2026-74717 CVE-2026-74719                      CVE-2026-74720 CVE-2026-74722 CVE-2026-74724 CVE-2026-74726                      CVE-2026-74730 CVE-2026-74737 CVE-2026-74739 CVE-2026-74743                      CVE-2026-74744 CVE-2026-74746 CVE-2026-74748 CVE-2026-80527                      CVE-2026-80528 CVE-2026-80529 CVE-2026-80534 CVE-2026-80536                      CVE-2026-80539 CVE-2026-80540 CVE-2026-80541 CVE-2026-80547                      CVE-2026-80548 CVE-2026-80549 CVE-2026-80550 CVE-2026-80552                      CVE-2026-80553 CVE-2026-80555 CVE-2026-80557 CVE-2026-80558                      CVE-2026-80559 CVE-2026-80560 CVE-2026-80561 CVE-2026-80562                      CVE-2026-80565 CVE-2026-80567 CVE-2026-80568 CVE-2026-80569                      CVE-2026-80570 CVE-2026-80572 CVE-2026-80573 CVE-2026-80574                      CVE-2026-80583 CVE-2026-80584 CVE-2026-80586 CVE-2026-80589                      CVE-2026-80590 CVE-2026-80678 CVE-2026-80679 CVE-2026-80680                      CVE-2026-80681 CVE-2026-80684 CVE-2026-80686 CVE-2026-80706                      CVE-2026-80707 CVE-2026-80708 CVE-2026-80709 CVE-2026-80714                      CVE-2026-80715 CVE-2026-80716 CVE-2026-80717 CVE-2026-80718                      CVE-2026-80722 CVE-2026-80725 CVE-2026-80726 CVE-2026-80730                      CVE-2026-80731 CVE-2026-80732 CVE-2026-80733 CVE-2026-80737                      CVE-2026-80742 CVE-2026-80743 CVE-2026-80744 CVE-2026-80752                      CVE-2026-80754 CVE-2026-80756 CVE-2026-80757 CVE-2026-80762                      CVE-2026-80763 CVE-2026-80764 CVE-2026-80765 CVE-2026-80766                      CVE-2026-80767 CVE-2026-80768 CVE-2026-80770 CVE-2026-80772                      CVE-2026-80781 CVE-2026-80782 CVE-2026-80783 CVE-2026-80784                      CVE-2026-80788 CVE-2026-80789 CVE-2026-80790 CVE-2026-80791                      CVE-2026-80792 CVE-2026-80793 CVE-2026-80794 CVE-2026-80795                      CVE-2026-80796 CVE-2026-80797 CVE-2026-80798 CVE-2026-80799                      CVE-2026-80800 CVE-2026-80801 CVE-2026-80802 CVE-2026-80803                      CVE-2026-80805 CVE-2026-80806 CVE-2026-80807 CVE-2026-80808                      CVE-2026-80809 CVE-2026-80812 CVE-2026-80814 CVE-2026-80819                      CVE-2026-80823 CVE-2026-80824 CVE-2026-80826 CVE-2026-80827                      CVE-2026-80828 CVE-2026-80829 CVE-2026-80830 CVE-2026-80831                      CVE-2026-80832 CVE-2026-80840 CVE-2026-80842 CVE-2026-80843                      CVE-2026-80844 CVE-2026-80846 CVE-2026-80848 CVE-2026-80852                      CVE-2026-80854 CVE-2026-80855 CVE-2026-80856 CVE-2026-80863                      CVE-2026-80888 CVE-2026-80890 CVE-2026-80891 CVE-2026-80892                      CVE-2026-80893 CVE-2026-80901 CVE-2026-80902 CVE-2026-80904                      CVE-2026-80906 CVE-2026-80908 CVE-2026-80909 CVE-2026-80910                      CVE-2026-80913

    Several vulnerabilities have been discovered in the Linux kernel that     may lead to a privilege escalation, denial of service or information     leaks.

    For Debian 12 bookworm, these problems have been fixed in version     6.1.187-1.

    We recommend that you upgrade your linux packages.

    For the detailed security status of linux please refer to its security     tracker page at:
    https://security-tracker.debian.org/tracker/linux

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - selinux: require every boolean value to be defined p_bools.nprim comes from the policy image independently     of how many booleans follow it, and cond_index_bool() fills bool_val_to_struct[] at value - 1, so a count     larger than the values present leaves NULL entries. Every user of that array then walks it by index and     dereferences each entry: cond_evaluate_expr() on the access-vector path, security_get_bools() and     security_get_bool_value() behind selinuxfs, and security_set_bools(). A sparse class value is absorbed by     policydb_class_isvalid() and its siblings; booleans have no such predicate, and no consumer that could use     one. Reject a boolean value that no boolean defines, once, where the array is built. Conforming policies     define every boolean they declare and are unaffected. (CVE-2026-80913)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
376443	Ubuntu 24.04 LTS / 26.04 LTS : Linux kernel vulnerabilities (USN-8959-1)	Nessus	Ubuntu Local Security Checks	Local	high
375804	Ubuntu 20.04 LTS / 22.04 LTS : Linux kernel vulnerabilities (USN-8961-1)	Nessus	Ubuntu Local Security Checks	Local	high
375672	CentOS Linux 7 [TuxCare] Security Update: bpftool / kernel / kernel-debug / kernel-debug-devel / kernel-devel / etc Multiple Vulnerabilities (CENTOS7:CLSA-2026:1793321383)	Nessus	CentOS Local Security Checks	Local	high
375124	Photon OS 5.0: Linux PHSA-2026-5.0-91-0982	Nessus	PhotonOS Local Security Checks	Local	critical
375000	Photon OS 5.0: Linux PHSA-2026-5.0-92-0982	Nessus	PhotonOS Local Security Checks	Local	critical
373891	CentOS Linux 6 [TuxCare] Security Update: kernel / kernel-abi-whitelists / kernel-debug / kernel-debug-devel / etc Multiple Vulnerabilities (CENTOS6:CLSA-2026:1792975902)	Nessus	CentOS Local Security Checks	Local	high
365279	Amazon Linux 2023 : bpftool6.12, kernel6.12, kernel6.12-devel (ALAS2023-2026-3196)	Nessus	Amazon Linux Local Security Checks	Local	medium
364137	Oracle Linux 10 / 9 : Unbreakable Enterprise kernel (ELSA-2026-500374)	Nessus	Oracle Linux Local Security Checks	Local	high
363954	Oracle Linux 8 / 9 : Unbreakable Enterprise kernel (ELSA-2026-500377)	Nessus	Oracle Linux Local Security Checks	Local	high
351061	Amazon Linux 2 : kernel (ALASKERNEL-5.10-2026-132)	Nessus	Amazon Linux Local Security Checks	Local	medium
351051	Amazon Linux 2 : kernel (ALASKERNEL-5.15-2026-116)	Nessus	Amazon Linux Local Security Checks	Local	high
351016	Amazon Linux 2023 : bpftool6.18, kernel6.18, kernel6.18-devel (ALAS2023-2026-3139)	Nessus	Amazon Linux Local Security Checks	Local	critical
348574	Debian dla-4788 : ata-modules-6.12.100+deb12-armmp-di - security update	Nessus	Debian Local Security Checks	Local	medium
345814	Amazon Linux 2023 : bpftool, kernel, kernel-devel (ALAS2023-2026-2143)	Nessus	Amazon Linux Local Security Checks	Local	medium
343851	Debian dla-4777 : ata-modules-6.1.0-52-armmp-di - security update	Nessus	Debian Local Security Checks	Local	high
343010	Linux Distros Unpatched Vulnerability : CVE-2026-80913	Nessus	Misc.	Local	medium

Detections

Analytics

CVE-2026-80913

high

Tenable Plugins

high

high

high

critical

critical

high

medium

high

high

medium

high

critical

medium

medium

high

medium