In the Linux kernel, the following vulnerability has been resolved: nvme-tcp: reject a read that transferred too few bytes nvme_tcp_recv_data() completes a request once the current C2HData PDU has been consumed. Nothing compares the total bytes received against the length the command asked for: struct nvme_tcp_request has no receive-side counter, queue->data_remaining is per queue, and blk_mq_end_request() completes for blk_rq_bytes(rq) unconditionally with no residual concept anywhere above. A controller can therefore answer a 4096-byte read with 512 bytes and have it reported as a complete read; user space then gets 4096 bytes of which 3584 are whatever was already in the page. I reproduced that with a test target. Count the bytes received and refuse to complete a successful read whose count does not match, at the two NVME_TCP_F_DATA_SUCCESS paths and in nvme_tcp_process_nvme_cqe(). The success test shifts req->status right by one, because the driver keeps the wire value there and shifts it on completion, so the check must see what the completion path will see. Only REQ_OP_READ is checked, because there the length comes from the sectors the request covers; a passthrough command is built by its submitter, which picks both command and buffer, so the kernel has nothing to compare against.

The Rocky Linux 10.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-2026_72624 advisory.

    * kernel: KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (CVE-2026-46076)

    * kernel: ext4: fix e4b bitmap inconsistency reports (CVE-2026-45942)

    * kernel: KVM: arm64: Reassign nested_mmus array behind mmu_lock (CVE-2026-46317)

    * kernel: fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (CVE-2026-53341)

    * kernel: perf/core: Detach event groups during remove_on_exec (CVE-2026-64556)

    * kernel: vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CVE-2026-68299)

    * kernel: crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CVE-2026-80522)

    * kernel: perf: Reject exited events as group leaders (CVE-2026-74753)

    * kernel: nvme-tcp: reject a read that transferred too few bytes (CVE-2026-89480)

    * kernel: KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation (CVE-2026-89775)

    Bug Fix(es) and Enhancement(s):

    * KVM: s390: Limit adapter indicator access to mapped page [rhel-10.2.z] (JIRA:Rocky Linux-188661)

    * crypto: xxhash64 should not be fips approved [rhel-10.2.z] (JIRA:Rocky Linux-254943)

    * kata-tdx TD vCPU stuck at reset vector (EIP=0xFFF0) on Intel Xeon 6 (Granite Rapids / Sierra Forest) ?     guest never executes. (10.2.z) (JIRA:Rocky Linux-260402)

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-2026_71330 advisory.

    * kernel: drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CVE-2026-31566)

    * kernel: netfilter: nf_queue: hold bridge skb->dev while queued (CVE-2026-52912)

    * kernel: Linux kernel: PPPoE memory corruption via stale pointer (CVE-2026-68121)

    * kernel: Linux kernel IPVS: Denial of Service due to stale memory references (CVE-2026-80714)

    * kernel: nvme-tcp: reject a read that transferred too few bytes (CVE-2026-89480)

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-2026_71329 advisory.

    * kernel: drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CVE-2026-31566)

    * kernel: netfilter: nf_queue: hold bridge skb->dev while queued (CVE-2026-52912)

    * kernel: Linux kernel: PPPoE memory corruption via stale pointer (CVE-2026-68121)

    * kernel: Linux kernel IPVS: Denial of Service due to stale memory references (CVE-2026-80714)

    * kernel: nvme-tcp: reject a read that transferred too few bytes (CVE-2026-89480)

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-71329 advisory.

    - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237293] {CVE-2026-68121}
    - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263345] {CVE-2026-89480}
    - nvme: rename and document nvme_end_request (CKI Backport Bot) [RHEL-263345] {CVE-2026-89480}
    - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255839] {CVE-2026-80714}
    - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231233] {CVE-2026-52912}
    - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221269]     {CVE-2026-31566}
    - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264385] {CVE-2026-81000}
    - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264314] {CVE-2026-80844}
    - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262571]     {CVE-2026-89846}
    - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243620]     {CVE-2026-72261}
    - mac802154: llsec: add skb_cow_data() before in-place crypto (Abhishek Rawal) [RHEL-231030]     {CVE-2026-63831}
    - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234282]     {CVE-2026-64564}
    - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222381] {CVE-2026-43370}
    - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264205]     {CVE-2025-39964}
    - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264205]     {CVE-2025-39964}
    - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot)     [RHEL-260522] {CVE-2026-64534}
    - nvmet-tcp: pass iov_len instead of sg->length to bvec_set_page() (Chris Leech) [RHEL-260522]     {CVE-2026-64534}
    - nvmet-tcp: remove nvmet_tcp_finish_cmd (CKI Backport Bot) [RHEL-260522] {CVE-2026-64534}
    - nvmet-tcp: fix NULL pointer dereference during release (Chris Leech) [RHEL-260522] {CVE-2026-64534}
    - nvmet-tcp: don't map pages which can't come from HIGHMEM (CKI Backport Bot) [RHEL-260522]     {CVE-2026-64534}
    - keys: Pin request_key_auth payload in instantiate paths (Bruno Meneguele) [RHEL-225491] {CVE-2026-63823}
    - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228475]     {CVE-2026-45894}
    - iommu/amd: Fix clone_alias() to use the original device's devid (Eder Zulian) [RHEL-227450]     {CVE-2026-53053}
    - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237326] {CVE-2026-68188}
    - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236787]     {CVE-2026-68293}
    - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233821] {CVE-2026-64582}
    - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226871] {CVE-2026-46133}
    - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228181]     {CVE-2026-46043}
    - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231810]     {CVE-2026-53062}
    - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231810]     {CVE-2026-53062}
    - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231060]     {CVE-2026-63947}
    - Bluetooth: L2CAP: Fix potential user-after-free (CKI Backport Bot) [RHEL-229428] {CVE-2023-54214}
    - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228747]     {CVE-2026-63975}
    - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport     Bot) [RHEL-227528] {CVE-2026-43334}
    - Bluetooth: Fix race condition in hidp_session_thread (CKI Backport Bot) [RHEL-227382] {CVE-2023-54120}
    - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225633] {CVE-2026-53254}
    - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225571]     {CVE-2026-53256}
    - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225535] {CVE-2026-52918}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:72624 advisory.

    * kernel: KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (CVE-2026-46076)

    * kernel: ext4: fix e4b bitmap inconsistency reports (CVE-2026-45942)

    * kernel: KVM: arm64: Reassign nested_mmus array behind mmu_lock (CVE-2026-46317)

    * kernel: fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (CVE-2026-53341)

    * kernel: perf/core: Detach event groups during remove_on_exec (CVE-2026-64556)

    * kernel: vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CVE-2026-68299)

    * kernel: crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CVE-2026-80522)

    * kernel: perf: Reject exited events as group leaders (CVE-2026-74753)

    * kernel: nvme-tcp: reject a read that transferred too few bytes (CVE-2026-89480)

    * kernel: KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation (CVE-2026-89775)

    Bug Fix(es) and Enhancement(s):

    * KVM: s390: Limit adapter indicator access to mapped page [rhel-10.2.z] (JIRA:Rocky Linux-188661)

    * crypto: xxhash64 should not be fips approved [rhel-10.2.z] (JIRA:Rocky Linux-254943)

    * kata-tdx TD vCPU stuck at reset vector (EIP=0xFFF0) on Intel Xeon 6 (Granite Rapids / Sierra Forest) ?     guest never executes. (10.2.z) (JIRA:Rocky Linux-260402)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:72624 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (CVE-2026-46076)

    * kernel: ext4: fix e4b bitmap inconsistency reports (CVE-2026-45942)

    * kernel: KVM: arm64: Reassign nested_mmus array behind mmu_lock (CVE-2026-46317)

    * kernel: fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (CVE-2026-53341)

    * kernel: perf/core: Detach event groups during remove_on_exec (CVE-2026-64556)

    * kernel: vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CVE-2026-68299)

    * kernel: crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CVE-2026-80522)

    * kernel: perf: Reject exited events as group leaders (CVE-2026-74753)

    * kernel: nvme-tcp: reject a read that transferred too few bytes (CVE-2026-89480)

    * kernel: KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation (CVE-2026-89775)

    Bug Fix(es) and Enhancement(s):

    * KVM: s390: Limit adapter indicator access to mapped page [rhel-10.2.z] (JIRA:RHEL-188661)

    * crypto: xxhash64 should not be fips approved [rhel-10.2.z] (JIRA:RHEL-254943)

    * kata-tdx TD vCPU stuck at reset vector (EIP=0xFFF0) on Intel Xeon 6 (Granite Rapids / Sierra Forest) ?     guest never executes. (10.2.z) (JIRA:RHEL-260402)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:71330 advisory.

    * kernel: drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CVE-2026-31566)

    * kernel: netfilter: nf_queue: hold bridge skb->dev while queued (CVE-2026-52912)

    * kernel: Linux kernel: PPPoE memory corruption via stale pointer (CVE-2026-68121)

    * kernel: Linux kernel IPVS: Denial of Service due to stale memory references (CVE-2026-80714)

    * kernel: nvme-tcp: reject a read that transferred too few bytes (CVE-2026-89480)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:71329 advisory.

    * kernel: drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CVE-2026-31566)

    * kernel: netfilter: nf_queue: hold bridge skb->dev while queued (CVE-2026-52912)

    * kernel: Linux kernel: PPPoE memory corruption via stale pointer (CVE-2026-68121)

    * kernel: Linux kernel IPVS: Denial of Service due to stale memory references (CVE-2026-80714)

    * kernel: nvme-tcp: reject a read that transferred too few bytes (CVE-2026-89480)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:71330 advisory.

    * kernel: drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CVE-2026-31566)
      * kernel: netfilter: nf_queue: hold bridge skb->dev while queued (CVE-2026-52912)
      * kernel: Linux kernel: PPPoE memory corruption via stale pointer (CVE-2026-68121)
      * kernel: Linux kernel IPVS: Denial of Service due to stale memory references (CVE-2026-80714)
      * kernel: nvme-tcp: reject a read that transferred too few bytes (CVE-2026-89480)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:71329 advisory.

    * kernel: drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CVE-2026-31566)
      * kernel: netfilter: nf_queue: hold bridge skb->dev while queued (CVE-2026-52912)
      * kernel: Linux kernel: PPPoE memory corruption via stale pointer (CVE-2026-68121)
      * kernel: Linux kernel IPVS: Denial of Service due to stale memory references (CVE-2026-80714)
      * kernel: nvme-tcp: reject a read that transferred too few bytes (CVE-2026-89480)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:71330 advisory.

    The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with     extremely high determinism requirements.

    Security Fix(es):

    * kernel: drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CVE-2026-31566)

    * kernel: netfilter: nf_queue: hold bridge skb->dev while queued (CVE-2026-52912)

    * kernel: Linux kernel: PPPoE memory corruption via stale pointer (CVE-2026-68121)

    * kernel: Linux kernel IPVS: Denial of Service due to stale memory references (CVE-2026-80714)

    * kernel: nvme-tcp: reject a read that transferred too few bytes (CVE-2026-89480)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:71329 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CVE-2026-31566)

    * kernel: netfilter: nf_queue: hold bridge skb->dev while queued (CVE-2026-52912)

    * kernel: Linux kernel: PPPoE memory corruption via stale pointer (CVE-2026-68121)

    * kernel: Linux kernel IPVS: Denial of Service due to stale memory references (CVE-2026-80714)

    * kernel: nvme-tcp: reject a read that transferred too few bytes (CVE-2026-89480)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - nvme-tcp: reject a read that transferred too few bytes nvme_tcp_recv_data() completes a request once the     current C2HData PDU has been consumed. Nothing compares the total bytes received against the length the     command asked for: struct nvme_tcp_request has no receive-side counter, queue->data_remaining is per     queue, and blk_mq_end_request() completes for blk_rq_bytes(rq) unconditionally with no residual concept     anywhere above. A controller can therefore answer a 4096-byte read with 512 bytes and have it reported as     a complete read; user space then gets 4096 bytes of which 3584 are whatever was already in the page. I     reproduced that with a test target. Count the bytes received and refuse to complete a successful read     whose count does not match, at the two NVME_TCP_F_DATA_SUCCESS paths and in nvme_tcp_process_nvme_cqe().
    The success test shifts req->status right by one, because the driver keeps the wire value there and shifts     it on completion, so the check must see what the completion path will see. Only REQ_OP_READ is checked,     because there the length comes from the sectors the request covers; a passthrough command is built by its     submitter, which picks both command and buffer, so the kernel has nothing to compare against.
    (CVE-2026-89480)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
362907	Debian dla-4817 : ata-modules-6.12.107+deb12-armmp-di - security update	Nessus	Debian Local Security Checks	Local	high
359532	Rocky Linux 10.2 [CIQ] Security Update: kernel / kernel-64k / kernel-64k-core / kernel-64k-debug / etc Multiple Vulnerabilities (crlsa-2026_72624)	Nessus	Rocky Linux Local Security Checks	Local	critical
356148	Rocky Linux 8 [CIQ] Security Update: kernel-rt / kernel-rt-core / kernel-rt-debug / kernel-rt-debug-core / etc Multiple Vulnerabilities (crlsa-2026_71330)	Nessus	Rocky Linux Local Security Checks	Local	high
355157	Rocky Linux 8 [CIQ] Security Update: bpftool / bpftool-debuginfo / kernel / kernel-abi-stablelists / etc Multiple Vulnerabilities (crlsa-2026_71329)	Nessus	Rocky Linux Local Security Checks	Local	high
352254	Oracle Linux 8 : kernel (ELSA-2026-71329)	Nessus	Oracle Linux Local Security Checks	Local	high
351440	RockyLinux 10 : kernel (RLSA-2026:72624)	Nessus	Rocky Linux Local Security Checks	Local	critical
351155	Debian dsa-6528 : ata-modules-6.12.111+deb13-armmp-di - security update	Nessus	Debian Local Security Checks	Local	high
351147	RHEL 10 : kernel (RHSA-2026:72624)	Nessus	Red Hat Local Security Checks	Local	critical
350181	RockyLinux 8 : kernel-rt (RLSA-2026:71330)	Nessus	Rocky Linux Local Security Checks	Local	high
350180	RockyLinux 8 : kernel (RLSA-2026:71329)	Nessus	Rocky Linux Local Security Checks	Local	high
349761	AlmaLinux 8 : kernel-rt (ALSA-2026:71330)	Nessus	Alma Linux Local Security Checks	Local	high
349753	AlmaLinux 8 : kernel (ALSA-2026:71329)	Nessus	Alma Linux Local Security Checks	Local	high
349667	RHEL 8 : kernel-rt (RHSA-2026:71330)	Nessus	Red Hat Local Security Checks	Local	high
349662	RHEL 8 : kernel (RHSA-2026:71329)	Nessus	Red Hat Local Security Checks	Local	high
345251	Linux Distros Unpatched Vulnerability : CVE-2026-89480	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2026-89480

high

Tenable Plugins

high

critical

high

high

high

critical

high

critical

high

high

high

high

high

high

high