In the Linux kernel, the following vulnerability has been resolved: net/iucv: filter frames in afiucv_hs_rcv() by ingress device afiucv_hs_rcv() selects a socket from iucv_sk_list by matching four 8-byte name fields in the transport header alone. No check is made against the net_device the frame arrived on. This can cause a frame arriving on any netdev to be delivered to an AF_IUCV socket. Three problems follow. First, a frame arriving over HiperSockets can be delivered to a socket bound to the classic z/VM IUCV transport, which has iucv->hs_dev == NULL. iucv_sock_bind() takes the classic path whenever the requested userid matches iucv_userid, even on a guest that also has a HiperSockets device carrying the same identifier. The child socket created by afiucv_hs_callback_syn() for such a match inherits hs_dev = NULL and transport = AF_IUCV_TRANS_HIPER, so the first send() on it returns -ENODEV. The socket delivered to accept() is unusable. Second, a frame arriving on one netdev can be delivered to a socket bound to a different IQD device. Which can lead to - Accept-queue exhaustion (DoS) - Attacker-controlled peer identity in the child socket - Data injection into existing sockets - Fabric noise on the IQD fabric, where bogus replies are sent - killing established connections Third, all AF_IUCV sockets live in init_net, as iucv_sock_alloc() calls sk_alloc(&init_net, ...). But even frames arriving on netdev devices in a namespace can be delivered to an IUCV socket. So a process in an unprivileged user and network namespace holding only the CAP_NET_RAW capability valid within that namespace can send a raw ETH_P_AF_IUCV frame on its own lo device and have it matched against init_net sockets. Fix all three by skipping any socket whose hs_dev does not match the ingress device. A classic z/VM IUCV socket has hs_dev == NULL; the ingress dev is never NULL, so classic sockets are skipped automatically. An unbound HIPER socket also has hs_dev == NULL and is skipped. A bound HIPER socket is only reachable from the exact IQD device it was bound to. Because hs_dev is always a device in init_net (iucv_sock_bind() scans for_each_netdev_rcu(&init_net, ...) exclusively), a frame whose ingress device belongs to another namespace never matches any socket. Note that AF_IUCV over HiperSockets provides no per-connection authentication: no sequence numbers, no TLS, no nonce. The four name fields identifying a connection are exchanged in plaintext on the shared HiperSockets segment (VCHID). Any host on the same HiperSockets segment could spoof any frame type against an existing connection. That is a protocol-level property unchanged by this patch. The fix reduces the attack surface to peers present on the same HiperSockets segment.

The CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS7:CLSA-2026:1792234299 advisory.

  - nfqnl_mangle in net/netfilter/nfnetlink_queue.c in the Linux kernel through 5.18.14 allows remote     attackers to cause a denial of service (panic) because, in the case of an nf_queue verdict with a one-byte     nfta_payload attribute, an skb_pull can encounter a negative skb->len. (CVE-2022-36946)

  - In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mvm: Fix a memory     corruption issue A few lines above, space is kzalloc()'ed for: sizeof(struct iwl_nvm_data) + sizeof(struct     ieee80211_channel) + sizeof(struct ieee80211_rate) 'mvm->nvm_data' is a 'struct iwl_nvm_data', so it is     fine. At the end of this structure, there is the 'channels' flex array. Each element is of type 'struct     ieee80211_channel'. So only 1 element is allocated in this array. When doing:
    mvm->nvm_data->bands[0].channels = mvm->nvm_data->channels; We point at the first element of the     'channels' flex array. So this is fine. However, when doing: mvm->nvm_data->bands[0].bitrates = (void
    *)((u8 *)mvm->nvm_data->channels + 1); because of the (u8 *) cast, we add only 1 to the address of the     beginning of the flex array. It is likely that we want point at the 'struct ieee80211_rate' allocated just     after. Remove the spurious casting so that the pointer arithmetic works as expected. (CVE-2023-52531)

  - In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Don't (re)check L1     intercepts when completing userspace I/O When completing emulation of instruction that generated a     userspace exit for I/O, don't recheck L1 intercepts as KVM has already finished that phase of instruction     execution, i.e. has already committed to allowing L2 to perform I/O. If L1 (or host userspace) modifies     the I/O permission bitmaps during the exit to userspace, KVM will treat the access as being intercepted     despite already having emulated the I/O access. Pivot on EMULTYPE_NO_DECODE to detect that KVM is     completing emulation. Of the three users of EMULTYPE_NO_DECODE, only complete_emulated_io() (the intended     recipient) can reach the code in question. gp_interception()'s use is mutually exclusive with     is_guest_mode(), and complete_emulated_insn_gp() unconditionally pairs EMULTYPE_NO_DECODE with     EMULTYPE_SKIP. The bad behavior was detected by a syzkaller program that toggles port I/O interception     during the userspace I/O exit, ultimately resulting in a WARN on vcpu->arch.pio.count being non-zero due     to KVM no completing emulation of the I/O instruction. WARNING: CPU: 23 PID: 1083 at     arch/x86/kvm/x86.c:8039 emulator_pio_in_out+0x154/0x170 [kvm] Modules linked in: kvm_intel kvm irqbypass     CPU: 23 UID: 1000 PID: 1083 Comm: repro Not tainted 6.16.0-rc5-c1610d2d66b1-next-vm #74 NONE Hardware     name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015 RIP: 0010:emulator_pio_in_out+0x154/0x170     [kvm] PKRU: 55555554 Call Trace: <TASK> kvm_fast_pio+0xd6/0x1d0 [kvm] vmx_handle_exit+0x149/0x610     [kvm_intel] kvm_arch_vcpu_ioctl_run+0xda8/0x1ac0 [kvm] kvm_vcpu_ioctl+0x244/0x8c0 [kvm]
    __x64_sys_ioctl+0x8a/0xd0 do_syscall_64+0x5d/0xc60 entry_SYSCALL_64_after_hwframe+0x4b/0x53 </TASK>     (CVE-2025-40026)

  - In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btusb: fix use-after-free     on registration failure Make sure to release the sibling interfaces in case controller registration fails     to avoid use-after-free and double-free when they are eventually disconnected. This issue was reported by     Sashiko while reviewing a fix for a wakeup source leak in the btusb probe errors paths. (CVE-2026-64471)

  - In the Linux kernel, the following vulnerability has been resolved: ALSA: firewire: isight: bound the     sample count to the packet payload isight_packet() takes the frame count from the device iso packet and     checks it only against the device claimed iso length. count = be32_to_cpu(payload->sample_count); if     (likely(count <= (length - 16) / 4)) isight_samples(isight, payload->samples, count); length is the iso     header data_length. It can be up to 0xffff. So the gate allows a count up to about 16379. isight_samples()     then copies count frames out of payload->samples into the PCM DMA buffer. payload->samples holds only 2 *     MAX_FRAMES_PER_PACKET values. The device multiplexes two samples per frame. A count past     MAX_FRAMES_PER_PACKET reads past the payload. A count past the buffer size writes past runtime->dma_area.
    The smallest PCM buffer is larger than MAX_FRAMES_PER_PACKET. Bounding the count to MAX_FRAMES_PER_PACKET     keeps both the read and the write in range. A malicious or faulty Apple iSight on the FireWire bus reaches     this during a normal capture. Add the MAX_FRAMES_PER_PACKET bound to the gate. (CVE-2026-64483)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:83156 advisory.

    * kernel: net/sched: act_ct: Only release RCU read lock after ct_ft (CVE-2026-46319)
      * kernel: net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CVE-2026-53011)
      * kernel: wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (CVE-2026-64030)
      * kernel: wifi: cfg80211: use wiphy work for socket owner autodisconnect (CVE-2026-68404)
      * kernel: Linux kernel: Denial of Service due to use-after-free in act_tunnel_key (CVE-2026-68377)
      * kernel: net/iucv: fix use-after-free of a severed iucv_path (CVE-2026-68140)
      * kernel: wifi: mac80211: defer link RX stats percpu free to RCU (CVE-2026-68409)
      * kernel: KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling     (CVE-2026-72288)
      * kernel: ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CVE-2026-72262)
      * kernel: netfilter: nft_lookup: fix catchall element handling with inverted lookups (CVE-2026-72320)
      * kernel: ALSA: usx2y: bound the hwdep mmap fault offset (CVE-2026-74641)
      * kernel: udp: fix potential use-after-free in tunnel segmentation (CVE-2026-74705)
      * kernel: net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (CVE-2026-80985)
      * kernel: svcrdma: Validate Read chunk positions before reconstruction (CVE-2026-89526)
      * kernel: net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CVE-2026-81003)
      * kernel: NFSD: Prevent client use-after-free during blocked-lock reaping (CVE-2026-90036)
      * kernel: SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (CVE-2026-93207)
      * kernel: svcrdma: Reject Write/Reply chunks with segcount 0 (CVE-2026-93228)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-2026_83156 advisory.

    * kernel: net/sched: act_ct: Only release RCU read lock after ct_ft (CVE-2026-46319)

    * kernel: net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CVE-2026-53011)

    * kernel: wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (CVE-2026-64030)

    * kernel: wifi: cfg80211: use wiphy work for socket owner autodisconnect (CVE-2026-68404)

    * kernel: Linux kernel: Denial of Service due to use-after-free in act_tunnel_key (CVE-2026-68377)

    * kernel: net/iucv: fix use-after-free of a severed iucv_path (CVE-2026-68140)

    * kernel: wifi: mac80211: defer link RX stats percpu free to RCU (CVE-2026-68409)

    * kernel: KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling     (CVE-2026-72288)

    * kernel: ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CVE-2026-72262)

    * kernel: netfilter: nft_lookup: fix catchall element handling with inverted lookups (CVE-2026-72320)

    * kernel: ALSA: usx2y: bound the hwdep mmap fault offset (CVE-2026-74641)

    * kernel: udp: fix potential use-after-free in tunnel segmentation (CVE-2026-74705)

    * kernel: net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (CVE-2026-80985)

    * kernel: svcrdma: Validate Read chunk positions before reconstruction (CVE-2026-89526)

    * kernel: net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CVE-2026-81003)

    * kernel: NFSD: Prevent client use-after-free during blocked-lock reaping (CVE-2026-90036)

    * kernel: SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (CVE-2026-93207)

    * kernel: svcrdma: Reject Write/Reply chunks with segcount 0 (CVE-2026-93228)

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-83156 advisory.

    - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472]     {CVE-2026-80985}
    - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472]     {CVE-2026-80985}
    - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472]     {CVE-2026-80985}
    - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa)     [RHEL-243814] {CVE-2026-72288}
    - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058]     {CVE-2026-93207}
    - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228}
    - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929]     {CVE-2026-90036}
    - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929]     {CVE-2026-89659}
    - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453]     {CVE-2026-89526}
    - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705}
    - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908]     {CVE-2026-81003}
    - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez)     [RHEL-240485] {CVE-2026-68404}
    - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez)     [RHEL-240485] {CVE-2026-68404}
    - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez)     [RHEL-240485] {CVE-2026-68404}
    - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788]     {CVE-2026-68409}
    - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560]     {CVE-2026-64030}
    - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686]     {CVE-2026-72262}
    - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140}
    - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot)     [RHEL-261293] {CVE-2026-72320}
    - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641}
    - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219]     {CVE-2026-68377}
    - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654]     {CVE-2026-46319}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:83156 advisory.

    * kernel: net/sched: act_ct: Only release RCU read lock after ct_ft (CVE-2026-46319)

    * kernel: net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CVE-2026-53011)

    * kernel: wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (CVE-2026-64030)

    * kernel: wifi: cfg80211: use wiphy work for socket owner autodisconnect (CVE-2026-68404)

    * kernel: Linux kernel: Denial of Service due to use-after-free in act_tunnel_key (CVE-2026-68377)

    * kernel: net/iucv: fix use-after-free of a severed iucv_path (CVE-2026-68140)

    * kernel: wifi: mac80211: defer link RX stats percpu free to RCU (CVE-2026-68409)

    * kernel: KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling     (CVE-2026-72288)

    * kernel: ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CVE-2026-72262)

    * kernel: netfilter: nft_lookup: fix catchall element handling with inverted lookups (CVE-2026-72320)

    * kernel: ALSA: usx2y: bound the hwdep mmap fault offset (CVE-2026-74641)

    * kernel: udp: fix potential use-after-free in tunnel segmentation (CVE-2026-74705)

    * kernel: net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (CVE-2026-80985)

    * kernel: svcrdma: Validate Read chunk positions before reconstruction (CVE-2026-89526)

    * kernel: net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CVE-2026-81003)

    * kernel: NFSD: Prevent client use-after-free during blocked-lock reaping (CVE-2026-90036)

    * kernel: SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (CVE-2026-93207)

    * kernel: svcrdma: Reject Write/Reply chunks with segcount 0 (CVE-2026-93228)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:83156 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: net/sched: act_ct: Only release RCU read lock after ct_ft (CVE-2026-46319)

    * kernel: net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CVE-2026-53011)

    * kernel: wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (CVE-2026-64030)

    * kernel: wifi: cfg80211: use wiphy work for socket owner autodisconnect (CVE-2026-68404)

    * kernel: Linux kernel: Denial of Service due to use-after-free in act_tunnel_key (CVE-2026-68377)

    * kernel: net/iucv: fix use-after-free of a severed iucv_path (CVE-2026-68140)

    * kernel: wifi: mac80211: defer link RX stats percpu free to RCU (CVE-2026-68409)

    * kernel: KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling     (CVE-2026-72288)

    * kernel: ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CVE-2026-72262)

    * kernel: netfilter: nft_lookup: fix catchall element handling with inverted lookups (CVE-2026-72320)

    * kernel: ALSA: usx2y: bound the hwdep mmap fault offset (CVE-2026-74641)

    * kernel: udp: fix potential use-after-free in tunnel segmentation (CVE-2026-74705)

    * kernel: net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (CVE-2026-80985)

    * kernel: svcrdma: Validate Read chunk positions before reconstruction (CVE-2026-89526)

    * kernel: net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CVE-2026-81003)

    * kernel: NFSD: Prevent client use-after-free during blocked-lock reaping (CVE-2026-90036)

    * kernel: SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (CVE-2026-93207)

    * kernel: svcrdma: Reject Write/Reply chunks with segcount 0 (CVE-2026-93228)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - net/iucv: filter frames in afiucv_hs_rcv() by ingress device afiucv_hs_rcv() selects a socket from     iucv_sk_list by matching four 8-byte name fields in the transport header alone. No check is made against     the net_device the frame arrived on. This can cause a frame arriving on any netdev to be delivered to an     AF_IUCV socket. Three problems follow. First, a frame arriving over HiperSockets can be delivered to a     socket bound to the classic z/VM IUCV transport, which has iucv->hs_dev == NULL. iucv_sock_bind() takes     the classic path whenever the requested userid matches iucv_userid, even on a guest that also has a     HiperSockets device carrying the same identifier. The child socket created by afiucv_hs_callback_syn() for     such a match inherits hs_dev = NULL and transport = AF_IUCV_TRANS_HIPER, so the first send() on it returns
    -ENODEV. The socket delivered to accept() is unusable. Second, a frame arriving on one netdev can be     delivered to a socket bound to a different IQD device. Which can lead to - Accept-queue exhaustion (DoS) -     Attacker-controlled peer identity in the child socket - Data injection into existing sockets - Fabric     noise on the IQD fabric, where bogus replies are sent - killing established connections Third, all AF_IUCV     sockets live in init_net, as iucv_sock_alloc() calls sk_alloc(&init_net, ...). But even frames arriving on     netdev devices in a namespace can be delivered to an IUCV socket. So a process in an unprivileged user and     network namespace holding only the CAP_NET_RAW capability valid within that namespace can send a raw     ETH_P_AF_IUCV frame on its own lo device and have it matched against init_net sockets. Fix all three by     skipping any socket whose hs_dev does not match the ingress device. A classic z/VM IUCV socket has hs_dev     == NULL; the ingress dev is never NULL, so classic sockets are skipped automatically. An unbound HIPER     socket also has hs_dev == NULL and is skipped. A bound HIPER socket is only reachable from the exact IQD     device it was bound to. Because hs_dev is always a device in init_net (iucv_sock_bind() scans     for_each_netdev_rcu(&init_net, ...) exclusively), a frame whose ingress device belongs to another     namespace never matches any socket. Note that AF_IUCV over HiperSockets provides no per-connection     authentication: no sequence numbers, no TLS, no nonce. The four name fields identifying a connection are     exchanged in plaintext on the shared HiperSockets segment (VCHID). Any host on the same HiperSockets     segment could spoof any frame type against an existing connection. That is a protocol-level property     unchanged by this patch. The fix reduces the attack surface to peers present on the same HiperSockets     segment. (CVE-2026-81003)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
369489	CentOS Linux 7 [TuxCare] Security Update: bpftool / kernel / kernel-debug / kernel-debug-devel / kernel-devel / etc Multiple Vulnerabilities (CENTOS7:CLSA-2026:1792234299)	Nessus	CentOS Local Security Checks	Local	high
367391	AlmaLinux 9 : kernel (ALSA-2026:83156)	Nessus	Alma Linux Local Security Checks	Local	critical
366919	Debian dla-4841 : ata-modules-6.1.0-53-armmp-di - security update	Nessus	Debian Local Security Checks	Local	high
366777	Rocky Linux 9 [CIQ] Security Update: kernel / kernel-64k / kernel-64k-core / kernel-64k-debug / etc Multiple Vulnerabilities (crlsa-2026_83156)	Nessus	Rocky Linux Local Security Checks	Local	critical
366665	Oracle Linux 9 : kernel (ELSA-2026-83156)	Nessus	Oracle Linux Local Security Checks	Local	critical
366496	RockyLinux 9 : kernel (RLSA-2026:83156)	Nessus	Rocky Linux Local Security Checks	Local	critical
366029	RHEL 9 : kernel (RHSA-2026:83156)	Nessus	Red Hat Local Security Checks	Local	critical
362907	Debian dla-4817 : ata-modules-6.12.107+deb12-armmp-di - security update	Nessus	Debian Local Security Checks	Local	high
351155	Debian dsa-6528 : ata-modules-6.12.111+deb13-armmp-di - security update	Nessus	Debian Local Security Checks	Local	high
345006	Linux Distros Unpatched Vulnerability : CVE-2026-81003	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2026-81003

high

Tenable Plugins

high

critical

high

critical

critical

critical

critical

high

high

high