In the Linux kernel, the following vulnerability has been resolved: mpls: reload header after pskb_may_pull() mpls_select_multipath() calls mpls_multipath_hash() to choose a nexthop when an MPLS route has multiple nexthops. While walking the MPLS label stack, the hash routine caches hdr for the current label. After finding the bottom-of-stack label, it calls pskb_may_pull() before reading the inner IP header. If an skb is constructed with the inner IP header in nonlinear data and insufficient tailroom in the linear head, pskb_may_pull() calls pskb_expand_head() to replace the skb head and free the old one. This leaves hdr pointing to freed memory. The IPv6 path can invalidate hdr again when it performs a second pull for the larger header. The issue was found through static analysis. A reproducer sending a legal Geneve packet through a bareudp/MPLS multipath setup triggered the same KASAN report in 2 of 2 unpatched runs: BUG: KASAN: slab-use-after-free in mpls_select_multipath Read of size 1 at addr ffff88800ecc6e20 by task ksoftirqd/1/23 Call Trace: mpls_select_multipath mpls_forward __netif_receive_skb_list_core netif_receive_skb_list_internal napi_complete_done gro_cell_poll __napi_poll net_rx_action Freed by task 23: kfree pskb_expand_head __pskb_pull_tail mpls_select_multipath Reload hdr from the current skb head after each successful pull before deriving the inner IPv4 or IPv6 header pointer.

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1789898700 advisory.

  - In the Linux kernel, the following vulnerability has been resolved: ceph: fix possible deadlock when     holding Fwb to get inline_data 1, mount with wsync. 2, create a file with O_RDWR, and the request was sent     to mds.0: ceph_atomic_open()--> ceph_mdsc_do_request(openc) finish_open(file, dentry, ceph_open)-->     ceph_open()--> ceph_init_file()--> ceph_init_file_info()--> ceph_uninline_data()--> { ... if     (inline_version == 1 || /* initial version, no data */ inline_version == CEPH_INLINE_NONE) goto     out_unlock; ... } The inline_version will be 1, which is the initial version for the new create file. And     here the ci->i_inline_version will keep with 1, it's buggy. 3, buffer write to the file immediately:
    ceph_write_iter()--> ceph_get_caps(file, need=Fw, want=Fb, ...); generic_perform_write()-->     a_ops->write_begin()--> ceph_write_begin()--> netfs_write_begin()--> netfs_begin_read()-->     netfs_rreq_submit_slice()--> netfs_read_from_server()--> rreq->netfs_ops->issue_read()-->     ceph_netfs_issue_read()--> { ... if (ci->i_inline_version != CEPH_INLINE_NONE &&     ceph_netfs_issue_op_inline(subreq)) return; ... } ceph_put_cap_refs(ci, Fwb); The     ceph_netfs_issue_op_inline() will send a getattr(Fsr) request to mds.1. 4, then the mds.1 will request the     rd lock for CInode::filelock from the auth mds.0, the mds.0 will do the CInode::filelock state transation     from excl --> sync, but it need to revoke the Fxwb caps back from the clients. While the kernel client has     aleady held the Fwb caps and waiting for the getattr(Fsr). It's deadlock! URL:
    https://tracker.ceph.com/issues/55377 (CVE-2022-49296)

  - In the Linux kernel, the following vulnerability has been resolved: tracing: Fix reading strings from     synthetic events The follow commands caused a crash: # cd /sys/kernel/tracing # echo 's:open char file[]'     > dynamic_events # echo 'hist:keys=common_pid:file=filename:onchange($file).trace(open,$file)' >     events/syscalls/sys_enter_openat/trigger' # echo 1 > events/synthetic/open/enable BOOM! The problem is     that the synthetic event field char file[] will read the value given to it as a string without any     memory checks to make sure the address is valid. The above example will pass in the user space address and     the sythetic event code will happily call strlen() on it and then strscpy() where either one will cause an     oops when accessing user space addresses. Use the helper functions from trace_kprobe and trace_eprobe that     can read strings safely (and actually succeed when the address is from user space and the memory is mapped     in). Now the above can show: packagekitd-1721 [000] ...2. 104.597170: open:
    file=/usr/lib/rpm/fileattrs/cmake.attr in:imjournal-978 [006] ...2. 104.599642: open:
    file=/var/lib/rsyslog/imjournal.state.tmp packagekitd-1721 [000] ...2. 104.626308: open:
    file=/usr/lib/rpm/fileattrs/debuginfo.attr (CVE-2022-50255)

  - In the Linux kernel, the following vulnerability has been resolved: hwrng: core - Fix page fault dead lock     on mmap-ed hwrng There is a dead-lock in the hwrng device read path. This triggers when the user reads     from /dev/hwrng into memory also mmap-ed from /dev/hwrng. The resulting page fault triggers a recursive     read which then dead-locks. Fix this by using a stack buffer when calling copy_to_user. (CVE-2023-52615)

  - In the Linux kernel, the following vulnerability has been resolved: fscache: Use wait_on_bit() to wait for     the freeing of relinquished volume The freeing of relinquished volume will wake up the pending volume     acquisition by using wake_up_bit(), however it is mismatched with wait_var_event() used in     fscache_wait_on_volume_collision() and it will never wake up the waiter in the wait-queue because these     two functions operate on different wait-queues. According to the implementation in     fscache_wait_on_volume_collision(), if the wake-up of pending acquisition is delayed longer than 20     seconds (e.g., due to the delay of on-demand fd closing), the first wait_var_event_timeout() will timeout     and the following wait_var_event() will hang forever as shown below: FS-Cache: Potential volume collision     new=00000024 old=00000022 ...... INFO: task mount:1148 blocked for more than 122 seconds. Not tainted     6.1.0-rc6+ #1 task:mount state:D stack:0 pid:1148 ppid:1 Call Trace: <TASK> __schedule+0x2f6/0xb80     schedule+0x67/0xe0 fscache_wait_on_volume_collision.cold+0x80/0x82 __fscache_acquire_volume+0x40d/0x4e0     erofs_fscache_register_volume+0x51/0xe0 [erofs] erofs_fscache_register_fs+0x19c/0x240 [erofs]     erofs_fc_fill_super+0x746/0xaf0 [erofs] vfs_get_super+0x7d/0x100 get_tree_nodev+0x16/0x20     erofs_fc_get_tree+0x20/0x30 [erofs] vfs_get_tree+0x24/0xb0 path_mount+0x2fa/0xa90 do_mount+0x7c/0xa0
    __x64_sys_mount+0x8b/0xe0 do_syscall_64+0x30/0x60 entry_SYSCALL_64_after_hwframe+0x46/0xb0 Considering     that wake_up_bit() is more selective, so fix it by using wait_on_bit() instead of wait_var_event() to wait     for the freeing of relinquished volume. In addition because waitqueue_active() is used in wake_up_bit()     and clear_bit() doesn't imply any memory barrier, use clear_and_wake_up_bit() to add the missing memory     barrier between cursor->flags and waitqueue_active(). (CVE-2023-52982)

  - In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: fix iso_conn related     locking and validity issues sk->sk_state indicates whether iso_pi(sk)->conn is valid. Operations that     check/update sk_state and access conn should hold lock_sock, otherwise they can race. The order of taking     locks is hci_dev_lock > lock_sock > iso_conn_lock, which is how it is in connect/disconnect_cfm ->     iso_conn_del -> iso_chan_del. Fix locking in iso_connect_cis/bis and sendmsg/recvmsg to take lock_sock     around updating sk_state and conn. iso_conn_del must not occur during iso_connect_cis/bis, as it frees the     iso_conn. Hold hdev->lock longer to prevent that. This should not reintroduce the issue fixed in commit     241f51931c35 (Bluetooth: ISO: Avoid circular locking dependency), since the we acquire locks in order.
    We retain the fix in iso_sock_connect to release lock_sock before iso_connect_* acquires hdev->lock.
    Similarly for commit 6a5ad251b7cd (Bluetooth: ISO: Fix possible circular locking dependency). We retain     the fix in iso_conn_ready to not acquire iso_conn_lock before lock_sock. iso_conn_add shall return     iso_conn with valid hcon. Make it so also when reusing an old CIS connection waiting for disconnect     timeout (see __iso_sock_close where conn->hcon is set to NULL). Trace with iso_conn_del after iso_chan_add     in iso_connect_cis: =============================================================== iso_sock_create:771:
    sock 00000000be9b69b7 iso_sock_init:693: sk 000000004dff667e iso_sock_bind:827: sk 000000004dff667e     70:1a:b8:98:ff:a2 type 1 iso_sock_setsockopt:1289: sk 000000004dff667e iso_sock_setsockopt:1289: sk     000000004dff667e iso_sock_setsockopt:1289: sk 000000004dff667e iso_sock_connect:875: sk 000000004dff667e     iso_connect_cis:353: 70:1a:b8:98:ff:a2 -> 28:3d:c2:4a:7e:da hci_get_route:1199: 70:1a:b8:98:ff:a2 ->     28:3d:c2:4a:7e:da hci_conn_add:1005: hci0 dst 28:3d:c2:4a:7e:da iso_conn_add:140: hcon 000000007b65d182     conn 00000000daf8625e __iso_chan_add:214: conn 00000000daf8625e iso_connect_cfm:1700: hcon     000000007b65d182 bdaddr 28:3d:c2:4a:7e:da status 12 iso_conn_del:187: hcon 000000007b65d182 conn     00000000daf8625e, err 16 iso_sock_clear_timer:117: sock 000000004dff667e state 3 <Note: sk_state is     BT_BOUND (3), so iso_connect_cis is still running at this point> iso_chan_del:153: sk 000000004dff667e,     conn 00000000daf8625e, err 16 hci_conn_del:1151: hci0 hcon 000000007b65d182 handle 65535     hci_conn_unlink:1102: hci0: hcon 000000007b65d182 hci_chan_list_flush:2780: hcon 000000007b65d182     iso_sock_getsockopt:1376: sk 000000004dff667e iso_sock_getname:1070: sock 00000000be9b69b7, sk     000000004dff667e iso_sock_getname:1070: sock 00000000be9b69b7, sk 000000004dff667e     iso_sock_getsockopt:1376: sk 000000004dff667e iso_sock_getname:1070: sock 00000000be9b69b7, sk     000000004dff667e iso_sock_getname:1070: sock 00000000be9b69b7, sk 000000004dff667e iso_sock_shutdown:1434:
    sock 00000000be9b69b7, sk 000000004dff667e, how 1 __iso_sock_close:632: sk 000000004dff667e state 5 socket     00000000be9b69b7 <Note: sk_state is BT_CONNECT (5), even though iso_chan_del sets BT_CLOSED (6). Only     iso_connect_cis sets it to BT_CONNECT, so it must be that iso_chan_del occurred between iso_chan_add and     end of iso_connect_cis.> BUG: kernel NULL pointer dereference, address: 0000000000000000 PGD     8000000006467067 P4D 8000000006467067 PUD 3f5f067 PMD 0 Oops: 0000 [#1] PREEMPT SMP PTI Hardware name:
    QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-1.fc38 04/01/2014 RIP: 0010:__iso_sock_close     (net/bluetooth/iso.c:664) bluetooth =============================================================== Trace     with iso_conn_del before iso_chan_add in iso_connect_cis:
    =============================================================== iso_connect_cis:356: 70:1a:b8:98:ff:a2 ->     28:3d:c2:4a:7e:da ... iso_conn_add:140: hcon 0000000093bc551f conn 00000000768ae504 hci_dev_put:1487: hci0     orig refcnt 21 hci_event_packet:7607: hci0: e ---truncated--- (CVE-2023-54164)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - mpls: reload header after pskb_may_pull() mpls_select_multipath() calls mpls_multipath_hash() to choose a     nexthop when an MPLS route has multiple nexthops. While walking the MPLS label stack, the hash routine     caches hdr for the current label. After finding the bottom-of-stack label, it calls pskb_may_pull() before     reading the inner IP header. If an skb is constructed with the inner IP header in nonlinear data and     insufficient tailroom in the linear head, pskb_may_pull() calls pskb_expand_head() to replace the skb head     and free the old one. This leaves hdr pointing to freed memory. The IPv6 path can invalidate hdr again     when it performs a second pull for the larger header. The issue was found through static analysis. A     reproducer sending a legal Geneve packet through a bareudp/MPLS multipath setup triggered the same KASAN     report in 2 of 2 unpatched runs: BUG: KASAN: slab-use-after-free in mpls_select_multipath Read of size 1     at addr ffff88800ecc6e20 by task ksoftirqd/1/23 Call Trace: mpls_select_multipath mpls_forward
    __netif_receive_skb_list_core netif_receive_skb_list_internal napi_complete_done gro_cell_poll __napi_poll     net_rx_action Freed by task 23: kfree pskb_expand_head __pskb_pull_tail mpls_select_multipath Reload hdr     from the current skb head after each successful pull before deriving the inner IPv4 or IPv6 header     pointer. (CVE-2026-89555)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
362907	Debian dla-4817 : ata-modules-6.12.107+deb12-armmp-di - security update	Nessus	Debian Local Security Checks	Local	high
360912	AlmaLinux 9.2 [TuxCare] Security Update: bpftool / kernel / kernel-abi-stablelists / kernel-core / etc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1789898700)	Nessus	Alma Linux Local Security Checks	Local	high
351155	Debian dsa-6528 : ata-modules-6.12.111+deb13-armmp-di - security update	Nessus	Debian Local Security Checks	Local	high
345165	Linux Distros Unpatched Vulnerability : CVE-2026-89555	Nessus	Misc.	Local	critical

Detections

Analytics

CVE-2026-89555

critical

Tenable Plugins

high

high

high

critical