In the Linux kernel, the following vulnerability has been resolved: KVM: s390: vsie: zero stale crypto bits When shadowing crypto access bits from a format0 apcb (crycb 0 or 1), the bits 64..255 are unchanged from whatever is in the vsie page in the crycb and thus in the apcb. This gives a nested guest potential access to a device no longer available. Zero out the remaining bits.

oracle_linux ELSA-2026-76738: ELSA-2026-76738:  kernel security, bug fix, and enhancement update (IMPORTANT)

redhat RHSA-2026:76739: RHSA-2026:76739: kernel security, bug fix, and enhancement update (Important)

The remote AlmaLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:76738 advisory.

    * kernel: netfilter: nf_conncount: increase the connection clean up limit to 64 (CVE-2026-45860)
      * kernel: RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CVE-2026-45856)
      * kernel: Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CVE-2026-46275)
      * kernel: crypto: af_alg - Cap AEAD AD length to 0x80000000 (CVE-2026-52972)
      * kernel: ipvs: clear the svc scheduler ptr early on edit (CVE-2026-53270)
      * kernel: Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CVE-2026-53357)
      * kernel: net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (CVE-2026-63829)
      * kernel: KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CVE-2026-63794)
      * kernel: ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (CVE-2026-63924)
      * kernel: ipv6: exthdrs: refresh nh after handling HAO option (CVE-2026-63922)
      * kernel: ipv6: validate extension header length before copying to cmsg (CVE-2026-63920)
      * kernel: tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (CVE-2026-64024)
      * kernel: l2tp: use refcount_inc_not_zero in l2tp_session_get_by_ifname (CVE-2026-63918)
      * kernel: ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (CVE-2026-63984)
      * kernel: tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (CVE-2026-63992)
      * kernel: tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]()     (CVE-2026-63994)
      * kernel: netfilter: x_tables: add and use xtables_unregister_table_exit (CVE-2026-64078)
      * kernel: ipv6: ioam: refresh hdr pointer before ioam6_event() (CVE-2026-64132)
      * kernel: Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CVE-2026-64557)
      * kernel: vxlan: require CAP_NET_ADMIN in the device netns for changelink (CVE-2026-68432)
      * kernel: ipvs: reload ip header after head reallocation (CVE-2026-68476)
      * kernel: net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (CVE-2026-72052)
      * kernel: netfilter: nft_lookup: fix catchall element handling with inverted lookups (CVE-2026-72320)
      * kernel: netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CVE-2026-72255)
      * kernel: KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active     (CVE-2026-74516)
      * kernel: packet: use consistent hard_header_len in non-ring send paths ()
      * kernel: packet: use consistent hard_header_len in non-ring send paths (CVE-2026-74582)
      * kernel: ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CVE-2026-74669)
      * kernel: netfilter: flowtable: publish GC-visible tuple last (CVE-2026-74746)
      * kernel: ipv6: fix use-after-free in ip6_finish_output2() (CVE-2026-80792)
      * kernel: futex: Fix race on the initial mm->futex.phash.ref allocation (CVE-2026-80775)
      * kernel: KVM: s390: vsie: zero stale crypto bits (CVE-2026-80921)
      * kernel: nvme: add missing SRCU grace period in error path (CVE-2026-89972)
      * kernel: nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CVE-2026-90227)
      * kernel: netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CVE-2026-97417)
      * kernel: netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state     (CVE-2026-93288)


    Bug Fix(es) and Enhancement(s):

      * wifi card breaks using FIPS (JIRA:AlmaLinux-257457)
      * AlmaLinux10.0 - kernel: CPU hotplug unsupported by CPUMF [almalinux-10.2.z] (JIRA:AlmaLinux-270888)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the kernel-5.14.0-757.el9 build changelog.

  - In the Linux kernel, the following vulnerability has been resolved: net: mana: validate rx_req_idx to     prevent out-of-bounds array access In mana_hwc_rx_event_handler(), rx_req_idx is derived from sge->address     in DMA-coherent memory. In Confidential VMs (SEV-SNP/TDX), this memory is shared unencrypted and HW can     modify WQE contents at any time. No bounds check exists on rx_req_idx, which can lead to an out-of-bounds     access into reqs[]. Add bounds check on rx_req_idx in mana_hwc_rx_event_handler() before using it to index     the reqs[] array. (CVE-2026-64018)

  - In the Linux kernel, the following vulnerability has been resolved: net/sched: serialize qdisc_rtab_list     against concurrent get/put qdisc_get_rtab() and qdisc_put_rtab() mutate the process-global singly linked     list qdisc_rtab_list and a plain non-atomic 'int refcnt' with no lock. This was only safe because every     caller historically held the RTNL mutex, which serialized all rate-table lookups, inserts and frees. That     invariant no longer holds. cls_flower sets TCF_PROTO_OPS_DOIT_UNLOCKED, so tc_new_tfilter() keeps     rtnl_held == false for it and sets TCA_ACT_FLAGS_NO_RTNL. That flag propagates through     tcf_exts_validate_ex() -> tcf_action_init() -> tcf_action_init_1() -> tcf_police_init(), which calls     qdisc_get_rtab()/qdisc_put_rtab() with the RTNL mutex NOT held. Two RTM_NEWTFILTER requests on different     CPUs, each adding a flower filter with a police action carrying the same rate, then race on     qdisc_rtab_list and on the non-atomic refcnt, leading to a use-after-free / double-free of the kmalloc-2k     struct qdisc_rate_table. qdisc_rtab_list is a single global (not per-netns), so the corrupted object is     shared system-wide. BUG: KASAN: slab-use-after-free in qdisc_put_rtab+0x12f/0x160     qdisc_put_rtab+0x12f/0x160 tcf_police_init+0xda9/0x1590 tcf_action_init_1+0x460/0x6b0     tcf_action_init+0x439/0xa40 tcf_exts_validate_ex+0x42d/0x550 fl_change+0xddd/0x7da0     tc_new_tfilter+0xaa7/0x2420 rtnetlink_rcv_msg+0x95e/0xe90 which belongs to the cache kmalloc-2k of size     2048 Protect qdisc_rtab_list and the refcount with a dedicated spinlock. The (sleeping, GFP_KERNEL)     allocation in qdisc_get_rtab() is performed before taking the lock; if a concurrent inserter added an     identical table in the meantime the freshly allocated one is freed under the lock, so no duplicate is     leaked. qdisc_put_rtab() now decrements the refcount and unlinks under the same lock. (CVE-2026-68138)

  - In the Linux kernel, the following vulnerability has been resolved: KVM: SVM: Update x2APIC MSR intercepts     if AVIC is inhibited while L2 is active Always update x2APIC MSR intercepts for L1 when AVIC is     deactivated, even if L2 is active and KVM is using a separate MSR bitmap to run L2. If AVIC is fully     enabled prior to running L2, and is then inhibited while L2 is active (for a VM-scoped inhibit), then KVM     will run L1 with AVIC disabled, but with x2APIC MSR intercepts disabled, i.e. will allow L1 to read most     of the host's APIC state, send arbitrary interrupts, change task priority, and ultimately trivially DoS     the host. E.g. sending a self-IPI in L1 on HYPERV_REENLIGHTENMENT_VECTOR, 0xee, with CONFIG_HYPERV=n in     the host kernel as a safe PoC, yields: Spurious interrupt (vector 0xee) on CPU#425. Acked And hacking     KVM to abuse kvm_set_posted_intr_wakeup_handler() to register a handler and WARN on     POSTED_INTR_WAKEUP_VECTOR yields: ------------[ cut here ]------------ WARNING:
    arch/x86/kvm/svm/svm.c:5594 at pi_wakeup_handler+0x9/0x10 [kvm_amd], CPU#156: nested_x2apic_t/316940 CPU:
    156 UID: 0 PID: 316940 Comm: nested_x2apic_t Tainted: G S U Tainted: [S]=CPU_OUT_OF_SPEC, [U]=USER     Hardware name: Google Astoria-Turin/astoria, BIOS 0.20260209.0-0 02/09/2026 RIP:
    0010:pi_wakeup_handler+0x9/0x10 [kvm_amd] Call Trace: <IRQ> sysvec_kvm_posted_intr_wakeup_ipi+0x64/0x80     </IRQ> <TASK> asm_sysvec_kvm_posted_intr_wakeup_ipi+0x1a/0x20 RIP: 0010:vcpu_run+0x1430/0x1e40 [kvm]     kvm_arch_vcpu_ioctl_run+0x2c1/0x600 [kvm] kvm_vcpu_ioctl+0x580/0x6b0 [kvm] __se_sys_ioctl+0x6d/0xb0     do_syscall_64+0x10a/0x480 entry_SYSCALL_64_after_hwframe+0x4b/0x53 RIP: 0033:0x46ff4b </TASK> ---[ end     trace 0000000000000000 ]--- (CVE-2026-74516)

  - In the Linux kernel, the following vulnerability has been resolved: KVM: s390: vsie: zero stale crypto     bits When shadowing crypto access bits from a format0 apcb (crycb 0 or 1), the bits 64..255 are unchanged     from whatever is in the vsie page in the crycb and thus in the apcb. This gives a nested guest potential     access to a device no longer available. Zero out the remaining bits. (CVE-2026-80921)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-2037:98 advisory.

    * kernel: Linux kernel: Use-after-free in xc5000 tuner driver due to race condition (CVE-2025-39994)
      * kernel: gfs2: Fix unlikely race in gdlm_put_lock (CVE-2025-40242)
      * kernel: Linux kernel: Denial of Service in RDMA/bnxt_re driver due to race condition during QP     destruction (CVE-2023-54048)
      * kernel: nvme-pci: fix mempool alloc size (CVE-2022-50756)
      * kernel: Linux kernel: Denial of Service in QFQ scheduler via child qlen manipulation (CVE-2026-23105)
      * kernel: RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CVE-2026-45856)
      * kernel: gfs2: Fix slab-use-after-free in qd_put (CVE-2026-45861)
      * kernel: net/sched: act_ct: Only release RCU read lock after ct_ft (CVE-2026-46319)
      * kernel: gfs2: add some missing log locking (CVE-2026-53049)
      * kernel: crypto: af_alg - Cap AEAD AD length to 0x80000000 (CVE-2026-52972)
      * kernel: net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CVE-2026-53230)
      * kernel: ipvs: clear the svc scheduler ptr early on edit (CVE-2026-53270)
      * kernel: net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (CVE-2026-63829)
      * kernel: KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CVE-2026-63794)
      * kernel: tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (CVE-2026-63992)
      * kernel: tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]()     (CVE-2026-63994)
      * kernel: vxlan: require CAP_NET_ADMIN in the device netns for changelink (CVE-2026-68432)
      * kernel: net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (CVE-2026-72052)
      * kernel: netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CVE-2026-72255)
      * kernel: KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active     (CVE-2026-74516)
      * kernel: netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CVE-2026-74569)
      * kernel: ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CVE-2026-74669)
      * kernel: ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (CVE-2026-74744)
      * kernel: netfilter: flowtable: publish GC-visible tuple last (CVE-2026-74746)
      * kernel: KVM: s390: vsie: zero stale crypto bits (CVE-2026-80921)
      * kernel: nvme-tcp: fix host memory disclosure on R2T for a read command (CVE-2026-89481)
      * kernel: nvme: add missing SRCU grace period in error path (CVE-2026-89972)
      * kernel: nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CVE-2026-90227)
      * kernel: netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CVE-2026-97417)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-76739 advisory.

    - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950]     {CVE-2026-89690}
    - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas)     [RHEL-187734] {CVE-2026-89530}
    - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186]     {CVE-2026-89669}
    - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas)     [RHEL-264152] {CVE-2026-89663}
    - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240]     {CVE-2026-53398}
    - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480]     {CVE-2026-72317}
    - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246]     {CVE-2026-74744}
    - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103}
    - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970}
    - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365}
    - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365}
    - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408]     {CVE-2026-68291}
    - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408]     {CVE-2026-53286}
    - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408]     {CVE-2026-64162}
    - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408]     {CVE-2026-31647}
    - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284]     {CVE-2026-53360}
    - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284]     {CVE-2026-53360}
    - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284]     {CVE-2026-53360}
    - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284]     {CVE-2026-53360}
    - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284]     {CVE-2026-53360}
    - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar)     [RHEL-192284] {CVE-2026-53360}
    - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360}
    - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284]     {CVE-2026-53360}
    - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360}
    - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360}
    - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360}
    - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284]     {CVE-2026-53360}
    - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360}
    - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284]     {CVE-2026-53360}
    - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284]     {CVE-2026-53360}
    - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270]     {CVE-2026-64115}
    - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035}
    - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227}
    - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot)     [RHEL-271672] {CVE-2026-93288}
    - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822]     {CVE-2026-43332}
    - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972}
    - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670]     {CVE-2026-97417}
    - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317}
    - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611]     {CVE-2026-46275}
    - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot)     [RHEL-232611] {CVE-2026-46275}
    - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460]     {CVE-2026-89481}
    - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480}
    - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442}
    - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792}
    - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924}
    - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922}
    - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279]     {CVE-2026-63984}
    - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381]     {CVE-2026-63920}
    - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351]     {CVE-2026-64557}
    - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351]     {CVE-2026-64557}
    - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351]     {CVE-2026-64557}
    - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721]     {CVE-2026-63993}
    - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal)     [RHEL-259588] {CVE-2026-63994}
    - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774]     {CVE-2026-63992}
    - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889]     {CVE-2026-68432}
    - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004]     {CVE-2026-72052}
    - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040]     {CVE-2026-63829}
    - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot)     [RHEL-260635] {CVE-2026-74569}
    - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385}
    - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921}
    - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099}
    - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374]     {CVE-2026-46076}
    - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524]     {CVE-2026-74516}
    - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524]     {CVE-2026-74516}
    - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516}
    - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357}
    - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777]     {CVE-2026-53357}
    - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400]     {CVE-2026-74669}
    - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400]     {CVE-2026-74669}
    - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669}
    - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427]     {CVE-2026-72255}
    - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481]     {CVE-2026-72289}
    - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746}
    - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060]     {CVE-2026-52942}
    - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986}
    - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049}
    - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-2026_75746 advisory.

    * kernel: Linux kernel: Use-after-free in xc5000 tuner driver due to race condition (CVE-2025-39994)

    * kernel: gfs2: Fix unlikely race in gdlm_put_lock (CVE-2025-40242)

    * kernel: Linux kernel: Denial of Service in RDMA/bnxt_re driver due to race condition during QP     destruction (CVE-2023-54048)

    * kernel: nvme-pci: fix mempool alloc size (CVE-2022-50756)

    * kernel: Linux kernel: Denial of Service in QFQ scheduler via child qlen manipulation (CVE-2026-23105)

    * kernel: RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CVE-2026-45856)

    * kernel: gfs2: Fix slab-use-after-free in qd_put (CVE-2026-45861)

    * kernel: net/sched: act_ct: Only release RCU read lock after ct_ft (CVE-2026-46319)

    * kernel: gfs2: add some missing log locking (CVE-2026-53049)

    * kernel: crypto: af_alg - Cap AEAD AD length to 0x80000000 (CVE-2026-52972)

    * kernel: net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CVE-2026-53230)

    * kernel: ipvs: clear the svc scheduler ptr early on edit (CVE-2026-53270)

    * kernel: net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (CVE-2026-63829)

    * kernel: KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CVE-2026-63794)

    * kernel: tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (CVE-2026-63992)

    * kernel: tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]()     (CVE-2026-63994)

    * kernel: vxlan: require CAP_NET_ADMIN in the device netns for changelink (CVE-2026-68432)

    * kernel: net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (CVE-2026-72052)

    * kernel: netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CVE-2026-72255)

    * kernel: KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (CVE-2026-74516)

    * kernel: netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CVE-2026-74569)

    * kernel: ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CVE-2026-74669)

    * kernel: ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (CVE-2026-74744)

    * kernel: netfilter: flowtable: publish GC-visible tuple last (CVE-2026-74746)

    * kernel: KVM: s390: vsie: zero stale crypto bits (CVE-2026-80921)

    * kernel: nvme-tcp: fix host memory disclosure on R2T for a read command (CVE-2026-89481)

    * kernel: nvme: add missing SRCU grace period in error path (CVE-2026-89972)

    * kernel: nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CVE-2026-90227)

    * kernel: netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CVE-2026-97417)

    Bug Fix(es) and Enhancement(s):

    * Rocky Linux8.10 - s390/vfio_ccw: Error path cleanups (JIRA:Rocky Linux-252194)

    * Rocky Linux8.10 - s390/topology: Use zero-based numbering (JIRA:Rocky Linux-252199)

    * [nfs rhel8.10] Disable async copy on nfsd side (JIRA:Rocky Linux-266661)

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-2026_75747 advisory.

    * kernel: Linux kernel: Use-after-free in xc5000 tuner driver due to race condition (CVE-2025-39994)

    * kernel: gfs2: Fix unlikely race in gdlm_put_lock (CVE-2025-40242)

    * kernel: Linux kernel: Denial of Service in RDMA/bnxt_re driver due to race condition during QP     destruction (CVE-2023-54048)

    * kernel: nvme-pci: fix mempool alloc size (CVE-2022-50756)

    * kernel: Linux kernel: Denial of Service in QFQ scheduler via child qlen manipulation (CVE-2026-23105)

    * kernel: RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CVE-2026-45856)

    * kernel: gfs2: Fix slab-use-after-free in qd_put (CVE-2026-45861)

    * kernel: net/sched: act_ct: Only release RCU read lock after ct_ft (CVE-2026-46319)

    * kernel: gfs2: add some missing log locking (CVE-2026-53049)

    * kernel: crypto: af_alg - Cap AEAD AD length to 0x80000000 (CVE-2026-52972)

    * kernel: net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CVE-2026-53230)

    * kernel: ipvs: clear the svc scheduler ptr early on edit (CVE-2026-53270)

    * kernel: net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (CVE-2026-63829)

    * kernel: KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CVE-2026-63794)

    * kernel: tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (CVE-2026-63992)

    * kernel: tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]()     (CVE-2026-63994)

    * kernel: vxlan: require CAP_NET_ADMIN in the device netns for changelink (CVE-2026-68432)

    * kernel: net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (CVE-2026-72052)

    * kernel: netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CVE-2026-72255)

    * kernel: KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (CVE-2026-74516)

    * kernel: netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CVE-2026-74569)

    * kernel: ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CVE-2026-74669)

    * kernel: ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (CVE-2026-74744)

    * kernel: netfilter: flowtable: publish GC-visible tuple last (CVE-2026-74746)

    * kernel: KVM: s390: vsie: zero stale crypto bits (CVE-2026-80921)

    * kernel: nvme-tcp: fix host memory disclosure on R2T for a read command (CVE-2026-89481)

    * kernel: nvme: add missing SRCU grace period in error path (CVE-2026-89972)

    * kernel: nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CVE-2026-90227)

    * kernel: netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CVE-2026-97417)

    Bug Fix(es) and Enhancement(s):

    * Rocky Linux8.10 - s390/vfio_ccw: Error path cleanups (JIRA:Rocky Linux-252194)

    * Rocky Linux8.10 - s390/topology: Use zero-based numbering (JIRA:Rocky Linux-252199)

    * [nfs rhel8.10] Disable async copy on nfsd side (JIRA:Rocky Linux-266661)

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-75747 advisory.

    - nvme/ioctl: check SUBMIT_IO with CAP_SYS_ADMIN (Chris Leech) [RHEL-269479] {CVE-2026-90227}
    - nvme-pci: fix mempool alloc size (Maurizio Lombardi) [RHEL-230386] {CVE-2022-50756}
    - nvme-pci: use max of PRP or SGL for iod size (Maurizio Lombardi) [RHEL-230386] {CVE-2022-50756}
    - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270894] {CVE-2026-89972}
    - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270661]     {CVE-2026-97417}
    - crypto: af_alg - Cap AEAD AD length to 0x80000000 (Pablo Alessandro Santos Hugen) [RHEL-259055]     {CVE-2026-52972}
    - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Jamie Bainbridge) [RHEL-254254]     {CVE-2026-74744}
    - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Jamie Bainbridge) [RHEL-238885]     {CVE-2026-68432}
    - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Jamie Bainbridge) [RHEL-230777]     {CVE-2026-63992}
    - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Jamie Bainbridge) [RHEL-247003]     {CVE-2026-72052}
    - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Jamie Bainbridge) [RHEL-247023]     {CVE-2026-63829}
    - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Jamie Bainbridge)     [RHEL-259654] {CVE-2026-63994}
    - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263413]     {CVE-2026-89481}
    - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot)     [RHEL-260589] {CVE-2026-74569}
    - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258125] {CVE-2026-80921}
    - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (Mohammad Heib) [RHEL-225698]     {CVE-2026-53230}
    - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (Phil Sutter) [RHEL-254393] {CVE-2026-74669}
    - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (CKI Backport Bot)     [RHEL-254507] {CVE-2026-74516}
    - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252413]     {CVE-2026-72255}
    - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250542] {CVE-2026-74746}
    - RDMA/bnxt_re: Prevent handling any completions after qp destroy (Kamal Heib) [RHEL-231374]     {CVE-2023-54048}
    - gfs2: add some missing log locking (Andrew Price) [RHEL-230306] {CVE-2026-53049}
    - gfs2: Move gfs2_remove_from_journal to log.c (Andrew Price) [RHEL-230306] {CVE-2026-53049}
    - gfs2: Fix unlikely race in gdlm_put_lock (CKI Backport Bot) [RHEL-231267] {CVE-2025-40242}
    - gfs2: Unlock fewer glocks on unmount (CKI Backport Bot) [RHEL-231267] {CVE-2025-40242}
    - media: tuner: xc5000: Fix use-after-free in xc5000_release (Kate Hsuan) [RHEL-231646] {CVE-2025-39994}
    - net/sched: act_ct: Only release RCU read lock after ct_ft (Ivan Vecera) [RHEL-229652] {CVE-2026-46319}
    - sched: act_ct: take care of padding in struct zones_ht_key (Ivan Vecera) [RHEL-229652] {CVE-2026-46319}
    - sched: act_ct: add netns into the key of tcf_ct_flow_table (Ivan Vecera) [RHEL-229652] {CVE-2026-46319}
    - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232580]     {CVE-2026-45856}
    - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227251] {CVE-2026-45861}
    - net/sched: qfq: Use cl_is_active to determine whether class is active in qfq_rm_from_ag (CKI Backport     Bot) [RHEL-226861] {CVE-2026-23105}
    - net_sched: qfq: Fix double list add in class with netem as child qdisc (CKI Backport Bot) [RHEL-226861]     {CVE-2026-23105}
    - ipvs: clear the svc scheduler ptr early on edit (CKI Backport Bot) [RHEL-225976] {CVE-2026-53270}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:75747 advisory.

    * kernel: Linux kernel: Use-after-free in xc5000 tuner driver due to race condition (CVE-2025-39994)
      * kernel: gfs2: Fix unlikely race in gdlm_put_lock (CVE-2025-40242)
      * kernel: Linux kernel: Denial of Service in RDMA/bnxt_re driver due to race condition during QP     destruction (CVE-2023-54048)
      * kernel: nvme-pci: fix mempool alloc size (CVE-2022-50756)
      * kernel: Linux kernel: Denial of Service in QFQ scheduler via child qlen manipulation (CVE-2026-23105)
      * kernel: RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CVE-2026-45856)
      * kernel: gfs2: Fix slab-use-after-free in qd_put (CVE-2026-45861)
      * kernel: net/sched: act_ct: Only release RCU read lock after ct_ft (CVE-2026-46319)
      * kernel: gfs2: add some missing log locking (CVE-2026-53049)
      * kernel: crypto: af_alg - Cap AEAD AD length to 0x80000000 (CVE-2026-52972)
      * kernel: net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CVE-2026-53230)
      * kernel: ipvs: clear the svc scheduler ptr early on edit (CVE-2026-53270)
      * kernel: net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (CVE-2026-63829)
      * kernel: KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CVE-2026-63794)
      * kernel: tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (CVE-2026-63992)
      * kernel: tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]()     (CVE-2026-63994)
      * kernel: vxlan: require CAP_NET_ADMIN in the device netns for changelink (CVE-2026-68432)
      * kernel: net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (CVE-2026-72052)
      * kernel: netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CVE-2026-72255)
      * kernel: KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active     (CVE-2026-74516)
      * kernel: netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CVE-2026-74569)
      * kernel: ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CVE-2026-74669)
      * kernel: ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (CVE-2026-74744)
      * kernel: netfilter: flowtable: publish GC-visible tuple last (CVE-2026-74746)
      * kernel: KVM: s390: vsie: zero stale crypto bits (CVE-2026-80921)
      * kernel: nvme-tcp: fix host memory disclosure on R2T for a read command (CVE-2026-89481)
      * kernel: nvme: add missing SRCU grace period in error path (CVE-2026-89972)
      * kernel: nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CVE-2026-90227)
      * kernel: netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CVE-2026-97417)


    Bug Fix(es) and Enhancement(s):

      * AlmaLinux8.10 - s390/vfio_ccw: Error path cleanups (JIRA:AlmaLinux-252194)
      * AlmaLinux8.10 - s390/topology: Use zero-based numbering (JIRA:AlmaLinux-252199)
      * [nfs rhel8.10] Disable async copy on nfsd side (JIRA:AlmaLinux-266661)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:75746 advisory.

    * kernel: Linux kernel: Use-after-free in xc5000 tuner driver due to race condition (CVE-2025-39994)
      * kernel: gfs2: Fix unlikely race in gdlm_put_lock (CVE-2025-40242)
      * kernel: Linux kernel: Denial of Service in RDMA/bnxt_re driver due to race condition during QP     destruction (CVE-2023-54048)
      * kernel: nvme-pci: fix mempool alloc size (CVE-2022-50756)
      * kernel: Linux kernel: Denial of Service in QFQ scheduler via child qlen manipulation (CVE-2026-23105)
      * kernel: RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CVE-2026-45856)
      * kernel: gfs2: Fix slab-use-after-free in qd_put (CVE-2026-45861)
      * kernel: net/sched: act_ct: Only release RCU read lock after ct_ft (CVE-2026-46319)
      * kernel: gfs2: add some missing log locking (CVE-2026-53049)
      * kernel: crypto: af_alg - Cap AEAD AD length to 0x80000000 (CVE-2026-52972)
      * kernel: net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CVE-2026-53230)
      * kernel: ipvs: clear the svc scheduler ptr early on edit (CVE-2026-53270)
      * kernel: net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (CVE-2026-63829)
      * kernel: KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CVE-2026-63794)
      * kernel: tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (CVE-2026-63992)
      * kernel: tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]()     (CVE-2026-63994)
      * kernel: vxlan: require CAP_NET_ADMIN in the device netns for changelink (CVE-2026-68432)
      * kernel: net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (CVE-2026-72052)
      * kernel: netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CVE-2026-72255)
      * kernel: KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active     (CVE-2026-74516)
      * kernel: netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CVE-2026-74569)
      * kernel: ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CVE-2026-74669)
      * kernel: ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (CVE-2026-74744)
      * kernel: netfilter: flowtable: publish GC-visible tuple last (CVE-2026-74746)
      * kernel: KVM: s390: vsie: zero stale crypto bits (CVE-2026-80921)
      * kernel: nvme-tcp: fix host memory disclosure on R2T for a read command (CVE-2026-89481)
      * kernel: nvme: add missing SRCU grace period in error path (CVE-2026-89972)
      * kernel: nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CVE-2026-90227)
      * kernel: netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CVE-2026-97417)


    Bug Fix(es) and Enhancement(s):

      * AlmaLinux8.10 - s390/vfio_ccw: Error path cleanups (JIRA:AlmaLinux-252194)
      * AlmaLinux8.10 - s390/topology: Use zero-based numbering (JIRA:AlmaLinux-252199)
      * [nfs rhel8.10] Disable async copy on nfsd side (JIRA:AlmaLinux-266661)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:75746 advisory.

    * kernel: Linux kernel: Use-after-free in xc5000 tuner driver due to race condition (CVE-2025-39994)

    * kernel: gfs2: Fix unlikely race in gdlm_put_lock (CVE-2025-40242)

    * kernel: Linux kernel: Denial of Service in RDMA/bnxt_re driver due to race condition during QP     destruction (CVE-2023-54048)

    * kernel: nvme-pci: fix mempool alloc size (CVE-2022-50756)

    * kernel: Linux kernel: Denial of Service in QFQ scheduler via child qlen manipulation (CVE-2026-23105)

    * kernel: RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CVE-2026-45856)

    * kernel: gfs2: Fix slab-use-after-free in qd_put (CVE-2026-45861)

    * kernel: net/sched: act_ct: Only release RCU read lock after ct_ft (CVE-2026-46319)

    * kernel: gfs2: add some missing log locking (CVE-2026-53049)

    * kernel: crypto: af_alg - Cap AEAD AD length to 0x80000000 (CVE-2026-52972)

    * kernel: net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CVE-2026-53230)

    * kernel: ipvs: clear the svc scheduler ptr early on edit (CVE-2026-53270)

    * kernel: net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (CVE-2026-63829)

    * kernel: KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CVE-2026-63794)

    * kernel: tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (CVE-2026-63992)

    * kernel: tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]()     (CVE-2026-63994)

    * kernel: vxlan: require CAP_NET_ADMIN in the device netns for changelink (CVE-2026-68432)

    * kernel: net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (CVE-2026-72052)

    * kernel: netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CVE-2026-72255)

    * kernel: KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (CVE-2026-74516)

    * kernel: netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CVE-2026-74569)

    * kernel: ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CVE-2026-74669)

    * kernel: ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (CVE-2026-74744)

    * kernel: netfilter: flowtable: publish GC-visible tuple last (CVE-2026-74746)

    * kernel: KVM: s390: vsie: zero stale crypto bits (CVE-2026-80921)

    * kernel: nvme-tcp: fix host memory disclosure on R2T for a read command (CVE-2026-89481)

    * kernel: nvme: add missing SRCU grace period in error path (CVE-2026-89972)

    * kernel: nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CVE-2026-90227)

    * kernel: netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CVE-2026-97417)

    Bug Fix(es) and Enhancement(s):

    * Rocky Linux8.10 - s390/vfio_ccw: Error path cleanups (JIRA:Rocky Linux-252194)

    * Rocky Linux8.10 - s390/topology: Use zero-based numbering (JIRA:Rocky Linux-252199)

    * [nfs rhel8.10] Disable async copy on nfsd side (JIRA:Rocky Linux-266661)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:75747 advisory.

    * kernel: Linux kernel: Use-after-free in xc5000 tuner driver due to race condition (CVE-2025-39994)

    * kernel: gfs2: Fix unlikely race in gdlm_put_lock (CVE-2025-40242)

    * kernel: Linux kernel: Denial of Service in RDMA/bnxt_re driver due to race condition during QP     destruction (CVE-2023-54048)

    * kernel: nvme-pci: fix mempool alloc size (CVE-2022-50756)

    * kernel: Linux kernel: Denial of Service in QFQ scheduler via child qlen manipulation (CVE-2026-23105)

    * kernel: RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CVE-2026-45856)

    * kernel: gfs2: Fix slab-use-after-free in qd_put (CVE-2026-45861)

    * kernel: net/sched: act_ct: Only release RCU read lock after ct_ft (CVE-2026-46319)

    * kernel: gfs2: add some missing log locking (CVE-2026-53049)

    * kernel: crypto: af_alg - Cap AEAD AD length to 0x80000000 (CVE-2026-52972)

    * kernel: net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CVE-2026-53230)

    * kernel: ipvs: clear the svc scheduler ptr early on edit (CVE-2026-53270)

    * kernel: net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (CVE-2026-63829)

    * kernel: KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CVE-2026-63794)

    * kernel: tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (CVE-2026-63992)

    * kernel: tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]()     (CVE-2026-63994)

    * kernel: vxlan: require CAP_NET_ADMIN in the device netns for changelink (CVE-2026-68432)

    * kernel: net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (CVE-2026-72052)

    * kernel: netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CVE-2026-72255)

    * kernel: KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (CVE-2026-74516)

    * kernel: netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CVE-2026-74569)

    * kernel: ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CVE-2026-74669)

    * kernel: ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (CVE-2026-74744)

    * kernel: netfilter: flowtable: publish GC-visible tuple last (CVE-2026-74746)

    * kernel: KVM: s390: vsie: zero stale crypto bits (CVE-2026-80921)

    * kernel: nvme-tcp: fix host memory disclosure on R2T for a read command (CVE-2026-89481)

    * kernel: nvme: add missing SRCU grace period in error path (CVE-2026-89972)

    * kernel: nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CVE-2026-90227)

    * kernel: netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CVE-2026-97417)

    Bug Fix(es) and Enhancement(s):

    * Rocky Linux8.10 - s390/vfio_ccw: Error path cleanups (JIRA:Rocky Linux-252194)

    * Rocky Linux8.10 - s390/topology: Use zero-based numbering (JIRA:Rocky Linux-252199)

    * [nfs rhel8.10] Disable async copy on nfsd side (JIRA:Rocky Linux-266661)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:75747 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: Linux kernel: Use-after-free in xc5000 tuner driver due to race condition (CVE-2025-39994)

    * kernel: gfs2: Fix unlikely race in gdlm_put_lock (CVE-2025-40242)

    * kernel: Linux kernel: Denial of Service in RDMA/bnxt_re driver due to race condition during QP     destruction (CVE-2023-54048)

    * kernel: nvme-pci: fix mempool alloc size (CVE-2022-50756)

    * kernel: Linux kernel: Denial of Service in QFQ scheduler via child qlen manipulation (CVE-2026-23105)

    * kernel: RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CVE-2026-45856)

    * kernel: gfs2: Fix slab-use-after-free in qd_put (CVE-2026-45861)

    * kernel: net/sched: act_ct: Only release RCU read lock after ct_ft (CVE-2026-46319)

    * kernel: gfs2: add some missing log locking (CVE-2026-53049)

    * kernel: crypto: af_alg - Cap AEAD AD length to 0x80000000 (CVE-2026-52972)

    * kernel: net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CVE-2026-53230)

    * kernel: ipvs: clear the svc scheduler ptr early on edit (CVE-2026-53270)

    * kernel: net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (CVE-2026-63829)

    * kernel: KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CVE-2026-63794)

    * kernel: tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (CVE-2026-63992)

    * kernel: tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]()     (CVE-2026-63994)

    * kernel: vxlan: require CAP_NET_ADMIN in the device netns for changelink (CVE-2026-68432)

    * kernel: net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (CVE-2026-72052)

    * kernel: netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CVE-2026-72255)

    * kernel: KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (CVE-2026-74516)

    * kernel: netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CVE-2026-74569)

    * kernel: ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CVE-2026-74669)

    * kernel: ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (CVE-2026-74744)

    * kernel: netfilter: flowtable: publish GC-visible tuple last (CVE-2026-74746)

    * kernel: KVM: s390: vsie: zero stale crypto bits (CVE-2026-80921)

    * kernel: nvme-tcp: fix host memory disclosure on R2T for a read command (CVE-2026-89481)

    * kernel: nvme: add missing SRCU grace period in error path (CVE-2026-89972)

    * kernel: nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CVE-2026-90227)

    * kernel: netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CVE-2026-97417)

    Bug Fix(es) and Enhancement(s):

    * RHEL8.10 - s390/vfio_ccw: Error path cleanups (JIRA:RHEL-252194)

    * RHEL8.10 - s390/topology: Use zero-based numbering (JIRA:RHEL-252199)

    * [nfs rhel8.10] Disable async copy on nfsd side (JIRA:RHEL-266661)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:75746 advisory.

    The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with     extremely high determinism requirements.

    Security Fix(es):

    * kernel: Linux kernel: Use-after-free in xc5000 tuner driver due to race condition (CVE-2025-39994)

    * kernel: gfs2: Fix unlikely race in gdlm_put_lock (CVE-2025-40242)

    * kernel: Linux kernel: Denial of Service in RDMA/bnxt_re driver due to race condition during QP     destruction (CVE-2023-54048)

    * kernel: nvme-pci: fix mempool alloc size (CVE-2022-50756)

    * kernel: Linux kernel: Denial of Service in QFQ scheduler via child qlen manipulation (CVE-2026-23105)

    * kernel: RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CVE-2026-45856)

    * kernel: gfs2: Fix slab-use-after-free in qd_put (CVE-2026-45861)

    * kernel: net/sched: act_ct: Only release RCU read lock after ct_ft (CVE-2026-46319)

    * kernel: gfs2: add some missing log locking (CVE-2026-53049)

    * kernel: crypto: af_alg - Cap AEAD AD length to 0x80000000 (CVE-2026-52972)

    * kernel: net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CVE-2026-53230)

    * kernel: ipvs: clear the svc scheduler ptr early on edit (CVE-2026-53270)

    * kernel: net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (CVE-2026-63829)

    * kernel: KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CVE-2026-63794)

    * kernel: tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (CVE-2026-63992)

    * kernel: tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]()     (CVE-2026-63994)

    * kernel: vxlan: require CAP_NET_ADMIN in the device netns for changelink (CVE-2026-68432)

    * kernel: net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (CVE-2026-72052)

    * kernel: netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CVE-2026-72255)

    * kernel: KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (CVE-2026-74516)

    * kernel: netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CVE-2026-74569)

    * kernel: ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CVE-2026-74669)

    * kernel: ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (CVE-2026-74744)

    * kernel: netfilter: flowtable: publish GC-visible tuple last (CVE-2026-74746)

    * kernel: KVM: s390: vsie: zero stale crypto bits (CVE-2026-80921)

    * kernel: nvme-tcp: fix host memory disclosure on R2T for a read command (CVE-2026-89481)

    * kernel: nvme: add missing SRCU grace period in error path (CVE-2026-89972)

    * kernel: nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CVE-2026-90227)

    * kernel: netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CVE-2026-97417)

    Bug Fix(es) and Enhancement(s):

    * RHEL8.10 - s390/vfio_ccw: Error path cleanups (JIRA:RHEL-252194)

    * RHEL8.10 - s390/topology: Use zero-based numbering (JIRA:RHEL-252199)

    * [nfs rhel8.10] Disable async copy on nfsd side (JIRA:RHEL-266661)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - KVM: s390: vsie: zero stale crypto bits When shadowing crypto access bits from a format0 apcb (crycb 0 or     1), the bits 64..255 are unchanged from whatever is in the vsie page in the crycb and thus in the apcb.
    This gives a nested guest potential access to a device no longer available. Zero out the remaining bits.
    (CVE-2026-80921)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
367954	AlmaLinux 10 : kernel (ALSA-2026:76738)	Nessus	Alma Linux Local Security Checks	Local	high
367949	CentOS 9 : kernel-5.14.0-757.el9	Nessus	CentOS Local Security Checks	Local	critical
365530	MiracleLinux 8 : kernel-4.18.0-553.171.1.el8_10 (AXSA:2026-2037:98)	Nessus	Miracle Linux Local Security Checks	Local	high
365481	Oracle Linux 9 : kernel (ELSA-2026-76739)	Nessus	Oracle Linux Local Security Checks	Local	high
363847	Rocky Linux 8 [CIQ] Security Update: kernel-rt / kernel-rt-core / kernel-rt-debug / kernel-rt-debug-core / etc Multiple Vulnerabilities (crlsa-2026_75746)	Nessus	Rocky Linux Local Security Checks	Local	high
363827	Rocky Linux 8 [CIQ] Security Update: bpftool / bpftool-debuginfo / kernel / kernel-abi-stablelists / etc Multiple Vulnerabilities (crlsa-2026_75747)	Nessus	Rocky Linux Local Security Checks	Local	high
363163	Oracle Linux 8 : kernel (ELSA-2026-75747)	Nessus	Oracle Linux Local Security Checks	Local	high
363160	AlmaLinux 8 : kernel (ALSA-2026:75747)	Nessus	Alma Linux Local Security Checks	Local	high
363159	AlmaLinux 8 : kernel-rt (ALSA-2026:75746)	Nessus	Alma Linux Local Security Checks	Local	high
363103	RockyLinux 8 : kernel-rt (RLSA-2026:75746)	Nessus	Rocky Linux Local Security Checks	Local	high
363102	RockyLinux 8 : kernel (RLSA-2026:75747)	Nessus	Rocky Linux Local Security Checks	Local	high
362970	RHEL 8 : kernel (RHSA-2026:75747)	Nessus	Red Hat Local Security Checks	Local	high
362940	RHEL 8 : kernel-rt (RHSA-2026:75746)	Nessus	Red Hat Local Security Checks	Local	high
362907	Debian dla-4817 : ata-modules-6.12.107+deb12-armmp-di - security update	Nessus	Debian Local Security Checks	Local	high
351155	Debian dsa-6528 : ata-modules-6.12.111+deb13-armmp-di - security update	Nessus	Debian Local Security Checks	Local	high
344369	Linux Distros Unpatched Vulnerability : CVE-2026-80921	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2026-80921

high

Tenable Plugins

Coming Soon

high

critical

high

high

high

high

high

high

high

high

high

high

high

high

high

high