In the Linux kernel, the following vulnerability has been resolved: nvme-tcp: fix host memory disclosure on R2T for a read command nvme_tcp_handle_r2t() does not check the direction of the request the R2T refers to. A malicious controller can send an R2T for a READ and the host will answer it: nvme_tcp_setup_h2c_data_pdu() builds the H2CData header and nvme_tcp_try_send_data() sends the request's data buffer. That buffer is the READ destination, so its contents go to the controller. The command then completes normally and nothing is logged. Against a test controller that answers every READ with an R2T, a 4096 byte buffered read returned all 4096 bytes, split over two R2Ts. The pages contained stale kernel data, including an array of struct page pointers. Reject an R2T for a request that is not a write.

The Rocky Linux 10.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-2026_71602 advisory.

    * kernel: fbcon: Set fb_display[i]->mode to NULL when the mode is released (CVE-2025-40323)

    * kernel: libceph: fix potential use-after-free in have_mon_and_osd_map() (CVE-2025-68285)

    * kernel: libceph: make decode_pool() more resilient against corrupted osdmaps (CVE-2025-71116)

    * kernel: libceph: prevent potential out-of-bounds reads in handle_auth_done() (CVE-2026-22984)

    * kernel: libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CVE-2026-22990)

    * kernel: Linux kernel: Denial of Service in libceph OSD client due to unreset sparse-read state     (CVE-2026-23136)

    * kernel: drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (CVE-2026-46230)

    * kernel: drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CVE-2026-46204)

    * kernel: drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (CVE-2026-46199)

    * kernel: drm/amdgpu/userq: fix access to stale wptr mapping (CVE-2026-46311)

    * kernel: af_unix: Drop all SCM attributes for SOCKMAP (CVE-2026-53005)

    * kernel: accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CVE-2026-53203)

    * kernel: drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CVE-2026-53290)

    * kernel: drm/virtio: use uninterruptible resv lock for plane updates (CVE-2026-64098)

    * kernel: Linux kernel: PPPoE memory corruption via stale pointer (CVE-2026-68121)

    * kernel: drm/amdgpu/vce: fix integer overflow in image size (CVE-2026-68108)

    * kernel: drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CVE-2026-68257)

    * kernel: drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CVE-2026-68267)

    * kernel: drm/xe: Hold a dma-buf reference for imported BOs (CVE-2026-68266)

    * kernel: drm/amdgpu: Fix context pstate override handling (CVE-2026-68273)

    * kernel: Linux kernel IPVS: Denial of Service due to stale memory references (CVE-2026-80714)

    * kernel: nvme-tcp: fix host memory disclosure on R2T for a read command (CVE-2026-89481)

    Bug Fix(es) and Enhancement(s):

    * Bypass DMA APIs for coherent allocations for pre-mapped memory [rhel-10.2.z] (JIRA:Rocky Linux-252331)

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:71602 advisory.

    * kernel: fbcon: Set fb_display[i]->mode to NULL when the mode is released (CVE-2025-40323)

    * kernel: libceph: fix potential use-after-free in have_mon_and_osd_map() (CVE-2025-68285)

    * kernel: libceph: make decode_pool() more resilient against corrupted osdmaps (CVE-2025-71116)

    * kernel: libceph: prevent potential out-of-bounds reads in handle_auth_done() (CVE-2026-22984)

    * kernel: libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CVE-2026-22990)

    * kernel: Linux kernel: Denial of Service in libceph OSD client due to unreset sparse-read state     (CVE-2026-23136)

    * kernel: drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (CVE-2026-46230)

    * kernel: drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CVE-2026-46204)

    * kernel: drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (CVE-2026-46199)

    * kernel: drm/amdgpu/userq: fix access to stale wptr mapping (CVE-2026-46311)

    * kernel: af_unix: Drop all SCM attributes for SOCKMAP (CVE-2026-53005)

    * kernel: accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CVE-2026-53203)

    * kernel: drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CVE-2026-53290)

    * kernel: drm/virtio: use uninterruptible resv lock for plane updates (CVE-2026-64098)

    * kernel: Linux kernel: PPPoE memory corruption via stale pointer (CVE-2026-68121)

    * kernel: drm/amdgpu/vce: fix integer overflow in image size (CVE-2026-68108)

    * kernel: drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CVE-2026-68257)

    * kernel: drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CVE-2026-68267)

    * kernel: drm/xe: Hold a dma-buf reference for imported BOs (CVE-2026-68266)

    * kernel: drm/amdgpu: Fix context pstate override handling (CVE-2026-68273)

    * kernel: Linux kernel IPVS: Denial of Service due to stale memory references (CVE-2026-80714)

    * kernel: nvme-tcp: fix host memory disclosure on R2T for a read command (CVE-2026-89481)

    Bug Fix(es) and Enhancement(s):

    * Bypass DMA APIs for coherent allocations for pre-mapped memory [rhel-10.2.z] (JIRA:Rocky Linux-252331)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:71602 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: fbcon: Set fb_display[i]->mode to NULL when the mode is released (CVE-2025-40323)

    * kernel: libceph: fix potential use-after-free in have_mon_and_osd_map() (CVE-2025-68285)

    * kernel: libceph: make decode_pool() more resilient against corrupted osdmaps (CVE-2025-71116)

    * kernel: libceph: prevent potential out-of-bounds reads in handle_auth_done() (CVE-2026-22984)

    * kernel: libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CVE-2026-22990)

    * kernel: Linux kernel: Denial of Service in libceph OSD client due to unreset sparse-read state     (CVE-2026-23136)

    * kernel: drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (CVE-2026-46230)

    * kernel: drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CVE-2026-46204)

    * kernel: drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (CVE-2026-46199)

    * kernel: drm/amdgpu/userq: fix access to stale wptr mapping (CVE-2026-46311)

    * kernel: af_unix: Drop all SCM attributes for SOCKMAP (CVE-2026-53005)

    * kernel: accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CVE-2026-53203)

    * kernel: drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CVE-2026-53290)

    * kernel: drm/virtio: use uninterruptible resv lock for plane updates (CVE-2026-64098)

    * kernel: Linux kernel: PPPoE memory corruption via stale pointer (CVE-2026-68121)

    * kernel: drm/amdgpu/vce: fix integer overflow in image size (CVE-2026-68108)

    * kernel: drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CVE-2026-68257)

    * kernel: drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CVE-2026-68267)

    * kernel: drm/xe: Hold a dma-buf reference for imported BOs (CVE-2026-68266)

    * kernel: drm/amdgpu: Fix context pstate override handling (CVE-2026-68273)

    * kernel: Linux kernel IPVS: Denial of Service due to stale memory references (CVE-2026-80714)

    * kernel: nvme-tcp: fix host memory disclosure on R2T for a read command (CVE-2026-89481)

    Bug Fix(es) and Enhancement(s):

    * Bypass DMA APIs for coherent allocations for pre-mapped memory [rhel-10.2.z] (JIRA:RHEL-252331)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - nvme-tcp: fix host memory disclosure on R2T for a read command nvme_tcp_handle_r2t() does not check the     direction of the request the R2T refers to. A malicious controller can send an R2T for a READ and the host     will answer it: nvme_tcp_setup_h2c_data_pdu() builds the H2CData header and nvme_tcp_try_send_data() sends     the request's data buffer. That buffer is the READ destination, so its contents go to the controller. The     command then completes normally and nothing is logged. Against a test controller that answers every READ     with an R2T, a 4096 byte buffered read returned all 4096 bytes, split over two R2Ts. The pages contained     stale kernel data, including an array of struct page pointers. Reject an R2T for a request that is not a     write. (CVE-2026-89481)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
362907	Debian dla-4817 : ata-modules-6.12.107+deb12-armmp-di - security update	Nessus	Debian Local Security Checks	Local	high
354966	Rocky Linux 10.2 [CIQ] Security Update: kernel / kernel-64k / kernel-64k-core / kernel-64k-debug / etc Multiple Vulnerabilities (crlsa-2026_71602)	Nessus	Rocky Linux Local Security Checks	Local	high
351155	Debian dsa-6528 : ata-modules-6.12.111+deb13-armmp-di - security update	Nessus	Debian Local Security Checks	Local	high
350784	RockyLinux 10 : kernel (RLSA-2026:71602)	Nessus	Rocky Linux Local Security Checks	Local	high
349906	RHEL 10 : kernel (RHSA-2026:71602)	Nessus	Red Hat Local Security Checks	Local	high
345433	Linux Distros Unpatched Vulnerability : CVE-2026-89481	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2026-89481

high

Tenable Plugins

high

high

high

high

high

high