In the Linux kernel, the following vulnerability has been resolved: slip: fix use-after-free in sl_sync() slip_devs[] stores bare net_device pointers and takes no reference on them. sl_sync() and sl_alloc() walk that table from slip_open() under rtnl_lock(), while an entry is dropped by sl_free_netdev(), which sl_setup() installs as dev->priv_destructor. priv_destructor is called from netdev_run_todo(), which deliberately runs with the RTNL semaphore released so that it can sleep while waiting for the device refcount to drop: /* Snapshot list, allow later requests */ list_replace_init(&net_todo_list, &list); __rtnl_unlock(); ... if (dev->priv_destructor) dev->priv_destructor(dev); /* slip_devs[i] = NULL */ if (dev->needs_free_netdev) free_netdev(dev); ... /* Free network device */ kobject_put(&dev->dev.kobj); So rtnl_lock() does not serialise slip_open() against the teardown at all. sl_sync() can load slip_devs[i] while the entry is still published and dereference it after netdev_run_todo() has run the destructor and released the device: CPU0 (slip_open) CPU1 (slip_close) unregister_netdev() rtnl_unlock() netdev_run_todo() __rtnl_unlock() rtnl_lock() sl_sync() dev = slip_devs[i] priv_destructor(dev) slip_devs[i] = NULL kobject_put(&dev->dev.kobj) /* dev is freed */ sl = netdev_priv(dev) if (sl->tty || sl->leased) /* use-after-free */ BUG: KASAN: use-after-free in sl_sync drivers/net/slip/slip.c:730 [inline] BUG: KASAN: use-after-free in slip_open+0xef4/0x1210 drivers/net/slip/slip.c:806 Read of size 1 at addr ffff8880712dac71 by task syz-executor.2/6506 CPU: 2 PID: 6506 Comm: syz-executor.2 Not tainted 6.1.134-syzkaller-00260-g0c8fc3469765 #0 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 Call Trace: sl_sync drivers/net/slip/slip.c:730 [inline] slip_open+0xef4/0x1210 drivers/net/slip/slip.c:806 tty_ldisc_open+0xa2/0x120 drivers/tty/tty_ldisc.c:433 tty_set_ldisc+0x324/0x720 drivers/tty/tty_ldisc.c:564 tiocsetd drivers/tty/tty_io.c:2428 [inline] tty_ioctl+0x5f0/0x1530 drivers/tty/tty_io.c:2712 Allocated by task 6502: alloc_netdev_mqs+0x98/0xfe0 net/core/dev.c:10719 sl_alloc drivers/net/slip/slip.c:756 [inline] slip_open+0x36d/0x1210 drivers/net/slip/slip.c:817 tty_ldisc_open+0xa2/0x120 drivers/tty/tty_ldisc.c:433 tty_set_ldisc+0x324/0x720 drivers/tty/tty_ldisc.c:564 Freed by task 6497: device_release+0xa2/0x240 drivers/base/core.c:2507 kobject_put+0x179/0x280 lib/kobject.c:729 netdev_run_todo+0x6c8/0xef0 net/core/dev.c:10509 slip_close+0x166/0x1c0 drivers/net/slip/slip.c:906 tty_ldisc_close+0x113/0x1a0 drivers/tty/tty_ldisc.c:456 tty_ldisc_kill+0x94/0x160 drivers/tty/tty_ldisc.c:614 tty_ldisc_release+0xe3/0x2b0 drivers/tty/tty_ldisc.c:782 tty_release+0xbcc/0xe70 drivers/tty/tty_io.c:1860 Commit e58c19124189 ("slip: Fix use-after-free Read in slip_open") fixed a different source of stale entries - a device left in slip_devs[] after slip_open() freed it on the registration error path - and does not address this race, which is why the report survives it. Drop the entry from ndo_uninit instead. unregister_netdevice() calls ndo_uninit under RTNL, before the device is queued to netdev_run_todo(), so an entry that sl_sync() can still see while holding RTNL belongs to a device that cannot be freed until RTNL is dropped. sl_free_netdev() stays only for the slip_open() error path, where register_netdevice() may have failed before ndo_init and ndo_uninit is then not called either. Both running for the same device is harmless: the ---truncated---

The CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS7:CLSA-2026:1792234299 advisory.

  - nfqnl_mangle in net/netfilter/nfnetlink_queue.c in the Linux kernel through 5.18.14 allows remote     attackers to cause a denial of service (panic) because, in the case of an nf_queue verdict with a one-byte     nfta_payload attribute, an skb_pull can encounter a negative skb->len. (CVE-2022-36946)

  - In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mvm: Fix a memory     corruption issue A few lines above, space is kzalloc()'ed for: sizeof(struct iwl_nvm_data) + sizeof(struct     ieee80211_channel) + sizeof(struct ieee80211_rate) 'mvm->nvm_data' is a 'struct iwl_nvm_data', so it is     fine. At the end of this structure, there is the 'channels' flex array. Each element is of type 'struct     ieee80211_channel'. So only 1 element is allocated in this array. When doing:
    mvm->nvm_data->bands[0].channels = mvm->nvm_data->channels; We point at the first element of the     'channels' flex array. So this is fine. However, when doing: mvm->nvm_data->bands[0].bitrates = (void
    *)((u8 *)mvm->nvm_data->channels + 1); because of the (u8 *) cast, we add only 1 to the address of the     beginning of the flex array. It is likely that we want point at the 'struct ieee80211_rate' allocated just     after. Remove the spurious casting so that the pointer arithmetic works as expected. (CVE-2023-52531)

  - In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Don't (re)check L1     intercepts when completing userspace I/O When completing emulation of instruction that generated a     userspace exit for I/O, don't recheck L1 intercepts as KVM has already finished that phase of instruction     execution, i.e. has already committed to allowing L2 to perform I/O. If L1 (or host userspace) modifies     the I/O permission bitmaps during the exit to userspace, KVM will treat the access as being intercepted     despite already having emulated the I/O access. Pivot on EMULTYPE_NO_DECODE to detect that KVM is     completing emulation. Of the three users of EMULTYPE_NO_DECODE, only complete_emulated_io() (the intended     recipient) can reach the code in question. gp_interception()'s use is mutually exclusive with     is_guest_mode(), and complete_emulated_insn_gp() unconditionally pairs EMULTYPE_NO_DECODE with     EMULTYPE_SKIP. The bad behavior was detected by a syzkaller program that toggles port I/O interception     during the userspace I/O exit, ultimately resulting in a WARN on vcpu->arch.pio.count being non-zero due     to KVM no completing emulation of the I/O instruction. WARNING: CPU: 23 PID: 1083 at     arch/x86/kvm/x86.c:8039 emulator_pio_in_out+0x154/0x170 [kvm] Modules linked in: kvm_intel kvm irqbypass     CPU: 23 UID: 1000 PID: 1083 Comm: repro Not tainted 6.16.0-rc5-c1610d2d66b1-next-vm #74 NONE Hardware     name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015 RIP: 0010:emulator_pio_in_out+0x154/0x170     [kvm] PKRU: 55555554 Call Trace: <TASK> kvm_fast_pio+0xd6/0x1d0 [kvm] vmx_handle_exit+0x149/0x610     [kvm_intel] kvm_arch_vcpu_ioctl_run+0xda8/0x1ac0 [kvm] kvm_vcpu_ioctl+0x244/0x8c0 [kvm]
    __x64_sys_ioctl+0x8a/0xd0 do_syscall_64+0x5d/0xc60 entry_SYSCALL_64_after_hwframe+0x4b/0x53 </TASK>     (CVE-2025-40026)

  - In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btusb: fix use-after-free     on registration failure Make sure to release the sibling interfaces in case controller registration fails     to avoid use-after-free and double-free when they are eventually disconnected. This issue was reported by     Sashiko while reviewing a fix for a wakeup source leak in the btusb probe errors paths. (CVE-2026-64471)

  - In the Linux kernel, the following vulnerability has been resolved: ALSA: firewire: isight: bound the     sample count to the packet payload isight_packet() takes the frame count from the device iso packet and     checks it only against the device claimed iso length. count = be32_to_cpu(payload->sample_count); if     (likely(count <= (length - 16) / 4)) isight_samples(isight, payload->samples, count); length is the iso     header data_length. It can be up to 0xffff. So the gate allows a count up to about 16379. isight_samples()     then copies count frames out of payload->samples into the PCM DMA buffer. payload->samples holds only 2 *     MAX_FRAMES_PER_PACKET values. The device multiplexes two samples per frame. A count past     MAX_FRAMES_PER_PACKET reads past the payload. A count past the buffer size writes past runtime->dma_area.
    The smallest PCM buffer is larger than MAX_FRAMES_PER_PACKET. Bounding the count to MAX_FRAMES_PER_PACKET     keeps both the read and the write in range. A malicious or faulty Apple iSight on the FireWire bus reaches     this during a normal capture. Add the MAX_FRAMES_PER_PACKET bound to the gate. (CVE-2026-64483)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The CentOS Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS6:CLSA-2026:1791949745 advisory.

  - In the Linux kernel, the following vulnerability has been resolved: HID: core: zero-initialize the report     buffer Since the report buffer is used by all kinds of drivers in various ways, let's zero-initialize it     during allocation to make sure that it can't be ever used to leak kernel memory via specially-crafted     report. (CVE-2024-50302)

  - In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Fix potential out-of-     bound accesses for Extigy and Mbox devices A bogus device can provide a bNumConfigurations value that     exceeds the initial value used in usb_get_configuration for allocating dev->config. This can lead to out-     of-bounds accesses later, e.g. in usb_destroy_configuration. (CVE-2024-53197)

  - In the Linux kernel, the following vulnerability has been resolved: smb: client: reject userspace     cifs.spnego descriptions cifs.spnego key descriptions contain authority-bearing fields such as pid, uid,     creduid, and upcall_target that cifs.upcall treats as kernel-originating inputs. However, userspace can     also create keys of this type through request_key(2) or add_key(2), allowing those fields to be supplied     without CIFS origin. Only accept cifs.spnego descriptions while CIFS is using its private spnego_cred to     request the key. (CVE-2026-46243)

  - In the Linux kernel, the following vulnerability has been resolved: Bluetooth: serialize accept_q access     bt_sock_poll() walks the accept queue without synchronization, while child teardown can unlink the same     socket and drop its last reference. The unsynchronized accept queue walk has existed since the initial     Bluetooth import. Protect accept_q with a dedicated lock for queue updates and polling. Also rework     bt_accept_dequeue() to take temporary child references under the queue lock before dropping it and locking     the child socket. (CVE-2026-52918)

  - In the Linux kernel, the following vulnerability has been resolved: netfilter: bridge: make ebt_snat ARP     rewrite writable The ebtables SNAT target keeps the Ethernet source address rewrite behind     skb_ensure_writable(skb, 0). This is intentional: at the bridge ebtables hooks the Ethernet header is     addressed through skb_mac_header()/eth_hdr(), while skb->data points at the Ethernet payload. Asking     skb_ensure_writable() for ETH_HLEN bytes would check the payload, not the Ethernet header, and would     reintroduce the small packet regression fixed by commit 63137bc5882a. However, the optional ARP sender     hardware address rewrite is different. It writes through skb_store_bits() at an offset relative to     skb->data: skb_store_bits(skb, sizeof(struct arphdr), info->mac, ETH_ALEN) skb_header_pointer() only     safely reads the ARP header; it does not make the later sender hardware address range writable. If that     range is still held in a nonlinear skb fragment backed by a splice-imported file page, skb_store_bits()     maps the frag page and copies the new MAC address directly into it. Ensure the ARP SHA range is writable     before reading the ARP header and before calling skb_store_bits(). (CVE-2026-53266)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - slip: fix use-after-free in sl_sync() slip_devs[] stores bare net_device pointers and takes no reference     on them. sl_sync() and sl_alloc() walk that table from slip_open() under rtnl_lock(), while an entry is     dropped by sl_free_netdev(), which sl_setup() installs as dev->priv_destructor. priv_destructor is called     from netdev_run_todo(), which deliberately runs with the RTNL semaphore released so that it can sleep     while waiting for the device refcount to drop: /* Snapshot list, allow later requests */     list_replace_init(&net_todo_list, &list); __rtnl_unlock(); ... if (dev->priv_destructor)     dev->priv_destructor(dev); /* slip_devs[i] = NULL */ if (dev->needs_free_netdev) free_netdev(dev); ... /*     Free network device */ kobject_put(&dev->dev.kobj); So rtnl_lock() does not serialise slip_open() against     the teardown at all. sl_sync() can load slip_devs[i] while the entry is still published and dereference it     after netdev_run_todo() has run the destructor and released the device: CPU0 (slip_open) CPU1 (slip_close)     unregister_netdev() rtnl_unlock() netdev_run_todo() __rtnl_unlock() rtnl_lock() sl_sync() dev =     slip_devs[i] priv_destructor(dev) slip_devs[i] = NULL kobject_put(&dev->dev.kobj) /* dev is freed */ sl =     netdev_priv(dev) if (sl->tty || sl->leased) /* use-after-free */ BUG: KASAN: use-after-free in sl_sync     drivers/net/slip/slip.c:730 [inline] BUG: KASAN: use-after-free in slip_open+0xef4/0x1210     drivers/net/slip/slip.c:806 Read of size 1 at addr ffff8880712dac71 by task syz-executor.2/6506 CPU: 2     PID: 6506 Comm: syz-executor.2 Not tainted 6.1.134-syzkaller-00260-g0c8fc3469765 #0 Hardware name: QEMU     Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 Call Trace: sl_sync     drivers/net/slip/slip.c:730 [inline] slip_open+0xef4/0x1210 drivers/net/slip/slip.c:806     tty_ldisc_open+0xa2/0x120 drivers/tty/tty_ldisc.c:433 tty_set_ldisc+0x324/0x720     drivers/tty/tty_ldisc.c:564 tiocsetd drivers/tty/tty_io.c:2428 [inline] tty_ioctl+0x5f0/0x1530     drivers/tty/tty_io.c:2712 Allocated by task 6502: alloc_netdev_mqs+0x98/0xfe0 net/core/dev.c:10719     sl_alloc drivers/net/slip/slip.c:756 [inline] slip_open+0x36d/0x1210 drivers/net/slip/slip.c:817     tty_ldisc_open+0xa2/0x120 drivers/tty/tty_ldisc.c:433 tty_set_ldisc+0x324/0x720     drivers/tty/tty_ldisc.c:564 Freed by task 6497: device_release+0xa2/0x240 drivers/base/core.c:2507     kobject_put+0x179/0x280 lib/kobject.c:729 netdev_run_todo+0x6c8/0xef0 net/core/dev.c:10509     slip_close+0x166/0x1c0 drivers/net/slip/slip.c:906 tty_ldisc_close+0x113/0x1a0 drivers/tty/tty_ldisc.c:456     tty_ldisc_kill+0x94/0x160 drivers/tty/tty_ldisc.c:614 tty_ldisc_release+0xe3/0x2b0     drivers/tty/tty_ldisc.c:782 tty_release+0xbcc/0xe70 drivers/tty/tty_io.c:1860 Commit e58c19124189 (slip:
    Fix use-after-free Read in slip_open) fixed a different source of stale entries - a device left in     slip_devs[] after slip_open() freed it on the registration error path - and does not address this race,     which is why the report survives it. Drop the entry from ndo_uninit instead. unregister_netdevice() calls     ndo_uninit under RTNL, before the device is queued to netdev_run_todo(), so an entry that sl_sync() can     still see while holding RTNL belongs to a device that cannot be freed until RTNL is dropped.
    sl_free_netdev() stays only for the slip_open() error path, where register_netdevice() may have failed     before ndo_init and ndo_uninit is then not called either. Both running for the same device is harmless:
    the ---truncated--- (CVE-2026-81001)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
369489	CentOS Linux 7 [TuxCare] Security Update: bpftool / kernel / kernel-debug / kernel-debug-devel / kernel-devel / etc Multiple Vulnerabilities (CENTOS7:CLSA-2026:1792234299)	Nessus	CentOS Local Security Checks	Local	high
367921	CentOS Linux 6 [TuxCare] Security Update: kernel / kernel-abi-whitelists / kernel-debug / kernel-debug-devel / etc Multiple Vulnerabilities (CENTOS6:CLSA-2026:1791949745)	Nessus	CentOS Local Security Checks	Local	high
366919	Debian dla-4841 : ata-modules-6.1.0-53-armmp-di - security update	Nessus	Debian Local Security Checks	Local	high
366749	SUSE SLES12: cluster-md-kmp-default / dlm-kmp-default / gfs2-kmp-default / etc (SUSE-SU-2026:4687-1)	Nessus	SuSE Local Security Checks	Local	high
366742	SUSE SLED15: cluster-md-kmp-default / dlm-kmp-default / gfs2-kmp-default / etc (SUSE-SU-2026:4706-1)	Nessus	SuSE Local Security Checks	Local	high
366741	Amazon Linux 2 : kernel (ALASKERNEL-5.10-2026-135)	Nessus	Amazon Linux Local Security Checks	Local	medium
364137	Oracle Linux 10 / 9 : Unbreakable Enterprise kernel (ELSA-2026-500374)	Nessus	Oracle Linux Local Security Checks	Local	high
362907	Debian dla-4817 : ata-modules-6.12.107+deb12-armmp-di - security update	Nessus	Debian Local Security Checks	Local	high
351155	Debian dsa-6528 : ata-modules-6.12.111+deb13-armmp-di - security update	Nessus	Debian Local Security Checks	Local	high
345224	Linux Distros Unpatched Vulnerability : CVE-2026-81001	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2026-81001

high

Tenable Plugins

high

high

high

high

high

medium

high

high

high

high