In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: serialize security confirmation handling rfcomm_security_cfm() looks up a session on session_list and then walks its DLC list without holding rfcomm_mutex. Since RFCOMM session teardown uses rfcomm_mutex, krfcommd can close and free the same session and DLCs concurrently: hci_rx_work krfcommd ----------- --------- rfcomm_session_get() rfcomm_lock() rfcomm_session_close() rfcomm_dlc_unlink() rfcomm_session_del() kfree(s) rfcomm_unlock() walk s->dlcs The callback can then read a freed session list head and touch freed DLCs while updating their flags or timers. Serialize the session lookup and DLC traversal in rfcomm_security_cfm() with rfcomm_mutex. This matches the existing RFCOMM session lifetime rules and prevents concurrent rfcomm_session_del() / rfcomm_dlc_unlink() from tearing the objects down while the callback is using them. KASAN reported: BUG: KASAN: slab-use-after-free in rfcomm_security_cfm+0x41c/0x440 Read of size 8 at addr ffff888111fb3960 by task kworker/u17:1/89 Workqueue: hci0 hci_rx_work Call Trace: rfcomm_security_cfm+0x41c/0x440 hci_encrypt_cfm+0x139/0x590 hci_encrypt_change_evt+0x37b/0xc40 hci_event_packet+0x71b/0xb20 hci_rx_work+0x293/0x730 Allocated by task 69: rfcomm_session_add+0x9e/0x2f0 rfcomm_run+0x44b/0x41e0 Freed by task 69: kfree+0x131/0x3c0 rfcomm_session_del+0x188/0x220 rfcomm_run+0x1985/0x41e0

tuxcare CENTOS7:CLSA-2026:1792751247: kernel: Fix of 90 CVEs (Important)

The CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS-STREAM8:CLSA-2026:1792759740 advisory.

  - In the Linux kernel, the following vulnerability has been resolved: mrp: introduce active flags to prevent     UAF when applicant uninit The caller of del_timer_sync must prevent restarting of the timer, If we have no     this synchronization, there is a small probability that the cancellation will not be successful. And     syzbot report the fellowing crash: ================================================================== BUG:
    KASAN: use-after-free in hlist_add_head include/linux/list.h:929 [inline] BUG: KASAN: use-after-free in     enqueue_timer+0x18/0xa4 kernel/time/timer.c:605 Write at addr f9ff000024df6058 by task syz-fuzzer/2256     Pointer tag: [f9], memory tag: [fe] CPU: 1 PID: 2256 Comm: syz-fuzzer Not tainted     6.1.0-rc5-syzkaller-00008- ge01d50cbd6ee #0 Hardware name: linux,dummy-virt (DT) Call trace:
    dump_backtrace.part.0+0xe0/0xf0 arch/arm64/kernel/stacktrace.c:156 dump_backtrace     arch/arm64/kernel/stacktrace.c:162 [inline] show_stack+0x18/0x40 arch/arm64/kernel/stacktrace.c:163
    __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x68/0x84 lib/dump_stack.c:106     print_address_description mm/kasan/report.c:284 [inline] print_report+0x1a8/0x4a0 mm/kasan/report.c:395     kasan_report+0x94/0xb4 mm/kasan/report.c:495 __do_kernel_fault+0x164/0x1e0 arch/arm64/mm/fault.c:320     do_bad_area arch/arm64/mm/fault.c:473 [inline] do_tag_check_fault+0x78/0x8c arch/arm64/mm/fault.c:749     do_mem_abort+0x44/0x94 arch/arm64/mm/fault.c:825 el1_abort+0x40/0x60 arch/arm64/kernel/entry-common.c:367     el1h_64_sync_handler+0xd8/0xe4 arch/arm64/kernel/entry-common.c:427 el1h_64_sync+0x64/0x68     arch/arm64/kernel/entry.S:576 hlist_add_head include/linux/list.h:929 [inline] enqueue_timer+0x18/0xa4     kernel/time/timer.c:605 mod_timer+0x14/0x20 kernel/time/timer.c:1161 mrp_periodic_timer_arm     net/802/mrp.c:614 [inline] mrp_periodic_timer+0xa0/0xc0 net/802/mrp.c:627     call_timer_fn.constprop.0+0x24/0x80 kernel/time/timer.c:1474 expire_timers+0x98/0xc4     kernel/time/timer.c:1519 To fix it, we can introduce a new active flags to make sure the timer will not     restart. (CVE-2022-50697)

  - In the Linux kernel, the following vulnerability has been resolved: ubi: Fix use-after-free when volume     resizing failed There is an use-after-free problem reported by KASAN:
    ================================================================== BUG: KASAN: use-after-free in     ubi_eba_copy_table+0x11f/0x1c0 [ubi] Read of size 8 at addr ffff888101eec008 by task ubirsvol/4735 CPU: 2     PID: 4735 Comm: ubirsvol Not tainted 6.1.0-rc1-00003-g84fa3304a7fc-dirty #14 Hardware name: QEMU Standard     PC (i440FX + PIIX, 1996), BIOS 1.14.0-1.fc33 04/01/2014 Call Trace: <TASK> dump_stack_lvl+0x34/0x44     print_report+0x171/0x472 kasan_report+0xad/0x130 ubi_eba_copy_table+0x11f/0x1c0 [ubi]     ubi_resize_volume+0x4f9/0xbc0 [ubi] ubi_cdev_ioctl+0x701/0x1850 [ubi] __x64_sys_ioctl+0x11d/0x170     do_syscall_64+0x35/0x80 entry_SYSCALL_64_after_hwframe+0x46/0xb0 </TASK> When ubi_change_vtbl_record()     returns an error in ubi_resize_volume(), new_eba_tbl will be freed on error handing path, but it is     holded by vol->eba_tbl in ubi_eba_replace_table(). It means that the liftcycle of vol->eba_tbl and     vol are different, so when resizing volume in next time, it causing an use-after-free fault. Fix it by     not freeing new_eba_tbl after it replaced in ubi_eba_replace_table(), while will be freed in next volume     resizing. (CVE-2023-53800)

  - In the Linux kernel, the following vulnerability has been resolved: RDMA/uverbs: Validate wqe_size before     using it in ib_uverbs_post_send ib_uverbs_post_send() uses cmd.wqe_size from userspace without any     validation before passing it to kmalloc() and using the allocated buffer as struct ib_uverbs_send_wr. If a     user provides a small wqe_size value (e.g., 1), kmalloc() will succeed, but subsequent accesses to     user_wr->opcode, user_wr->num_sge, and other fields will read beyond the allocated buffer, resulting in an     out-of-bounds read from kernel heap memory. This could potentially leak sensitive kernel information to     userspace. Additionally, providing an excessively large wqe_size can trigger a WARNING in the memory     allocation path, as reported by syzkaller. This is inconsistent with ib_uverbs_unmarshall_recv() which     properly validates that wqe_size >= sizeof(struct ib_uverbs_recv_wr) before proceeding. Add the same     validation for ib_uverbs_post_send() to ensure wqe_size is at least sizeof(struct ib_uverbs_send_wr).
    (CVE-2026-45856)

  - In the Linux kernel, the following vulnerability has been resolved: gfs2: Fix slab-use-after-free in     qd_put Commit a475c5dd16e5 (gfs2: Free quota data objects synchronously) started freeing quota data     objects during filesystem shutdown instead of putting them back onto the LRU list, but it failed to remove     these objects from the LRU list, causing LRU list corruption. This caused use-after-free when the shrinker     (gfs2_qd_shrink_scan) tried to access already-freed objects on the LRU list. Fix this by removing qd     objects from the LRU list before freeing them in qd_put(). Initial fix from Deepanshu Kartikey     <kartikey406@gmail.com>. (CVE-2026-45861)

  - In the Linux kernel, the following vulnerability has been resolved: gfs2: Fix use-after-free in iomap     inline data write path The inline data buffer head (dibh) is being released prematurely in     gfs2_iomap_begin() via release_metapath() while iomap->inline_data still points to dibh->b_data. This     causes a use-after-free when iomap_write_end_inline() later attempts to write to the inline data area. The     bug sequence: 1. gfs2_iomap_begin() calls gfs2_meta_inode_buffer() to read inode metadata into dibh 2.
    Sets iomap->inline_data = dibh->b_data + sizeof(struct gfs2_dinode) 3. Calls release_metapath() which     calls brelse(dibh), dropping refcount to 0 4. kswapd reclaims the page (~39ms later in the syzbot report)     5. iomap_write_end_inline() tries to memcpy() to iomap->inline_data 6. KASAN detects use-after-free write     to freed memory Fix by storing dibh in iomap->private and incrementing its refcount with get_bh() in     gfs2_iomap_begin(). The buffer is then properly released in gfs2_iomap_end() after the inline write     completes, ensuring the page stays alive for the entire iomap operation. Note: A C reproducer is not     available for this issue. The fix is based on analysis of the KASAN report and code review showing the     buffer head is freed before use. [agruenba: Take buffer head reference in gfs2_iomap_begin() to avoid     leaks in gfs2_iomap_get() and gfs2_iomap_alloc().] (CVE-2026-45984)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4667-1 advisory.

    The SUSE Linux Enterprise 15 SP5 kernel was updated to fix various security issues:

    The following security issues were fixed:

    - CVE-2022-50645: EDAC/i10nm: fix refcount leak in pci_get_dev_wrapper() (bsc#1254633).
    - CVE-2025-39964: kernel: crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (bsc#1251966).
    - CVE-2025-40022: kernel: crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (bsc#1252682).
    - CVE-2026-43502: net/rds: handle zerocopy send cleanup before the message is queued (bsc#1266008).
    - CVE-2026-53266: netfilter: bridge: make ebt_snat ARP rewrite writable (bsc#1269136).
    - CVE-2026-53400: i2c: core: fix adapter registration race (bsc#1271906).
    - CVE-2026-64279: i2c: core: fix adapter deregistration race (bsc#1273953).
    - CVE-2026-64319: nvmet-auth: fix return value check in auth send (bsc#1273339).
    - CVE-2026-64422: net: ipv4: bound TCP reordering sysctl writes and MTU probe sizes (bsc#1273290).
    - CVE-2026-64556: perf/core: Detach event groups during remove_on_exec (bsc#1273251).
    - CVE-2026-64580: xfrm6: clear dst.dev on error to avoid double netdev_put in xfrm6_fill_dst()     (bsc#1274037).
    - CVE-2026-68155: libceph: Reject monmaps advertising zero monitors (bsc#1275304).
    - CVE-2026-68158: libceph: Fix multiplication overflow in decode_new_up_state_weight() (bsc#1275307).
    - CVE-2026-68159: libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (bsc#1275470).
    - CVE-2026-68376: sctp: fix auth_hmacs array size in struct sctp_cookie (bsc#1274836).
    - CVE-2026-68445: drm/vc4: Prevent shader BO mappings from becoming writable (bsc#1276277).
    - CVE-2026-68451: s390/zcrypt: Validate length for CCA ECC private key requests (bsc#1276287).
    - CVE-2026-68452: s390/zcrypt: Validate length for CCA AES cipher key requests (bsc#1276295).
    - CVE-2026-68454: KVM: s390: pci: Fix handling of AIF enable without AISB (bsc#1276388).
    - CVE-2026-72051: net: ip6_tunnel: require CAP_NET_ADMIN in the device netns for changelink (bsc#1276801).
    - CVE-2026-72052: net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (bsc#1276803).
    - CVE-2026-72053: net: ipip: require CAP_NET_ADMIN in the device netns for changelink (bsc#1276814).
    - CVE-2026-72054: net: ip_vti: require CAP_NET_ADMIN in the device netns for changelink (bsc#1276818).
    - CVE-2026-72055: net: ip6_vti: require CAP_NET_ADMIN in the device netns for changelink (bsc#1276821).
    - CVE-2026-72061: net: sit: require CAP_NET_ADMIN in the device netns for changelink (bsc#1277249).
    - CVE-2026-72066: cpu: hotplug: Bound hotplug states sysfs output (bsc#1277149).
    - CVE-2026-72083: scsi: target: core: Fix iSCSI ISID use-after-free in REGISTER AND MOVE (bsc#1275535).
    - CVE-2026-72084: scsi: target: core: Generate correct identifiers for PR OUT transport IDs (bsc#1275540).
    - CVE-2026-72098: dm-verity: fix buffer overflow in FEC calculation (bsc#1275543).
    - CVE-2026-72129: nvmet-rdma: handle inline data with a nonzero offset (bsc#1275545).
    - CVE-2026-72136: xfrm: xfrm_interface: require CAP_NET_ADMIN in the device netns for changelink     (bsc#1277574).
    - CVE-2026-72157: net: thunderbolt: Fix frags[] overflow by bounding frame_count (bsc#1277544).
    - CVE-2026-72164: ocfs2: avoid moving extents to occupied clusters (bsc#1277553).
    - CVE-2026-72322: ipv6: mcast: Fix potential UAF in MLD delayed work (bsc#1275972).
    - CVE-2026-72323: ipv4: igmp: Fix potential UAF in igmp_gq_start_timer() (bsc#1275985).
    - CVE-2026-72339: qede: fix off-by-one in BD ring consumption on build_skb failure (bsc#1276006).
    - CVE-2026-72348: netfilter: ip6tables: mark malformed IPv6 extension headers for hotdrop (bsc#1276007).
    - CVE-2026-72351: gue: validate REMCSUM private option length (bsc#1276009).
    - CVE-2026-72383: sctp: fix addr_wq_timer race in sctp_free_addr_wq() (bsc#1277857).
    - CVE-2026-72398: sctp: fix association labeling in the duplicate COOKIE-ECHO case (bsc#1276381).
    - CVE-2026-72434: netfilter: ipset: make sure gc is properly stopped (bsc#1278054).
    - CVE-2026-72449: drm/amdkfd: fix list_del corruption in kfd_criu_resume_svm (bsc#1278108).
    - CVE-2026-74267: net/sched: sch_codel: Do not call qdisc_tree_reduce_backlog during peek before restoring     qlen       (bsc#1276519).
    - CVE-2026-74283: tipc: require net admin for TIPCv2 netlink mutators (bsc#1276475).
    - CVE-2026-74330: configfs: fix lockless traversals of ->s_children (bsc#1277129).
    - CVE-2026-74388: ALSA: seq: oss: Fix UAF at handling events with embedded SysEx data (bsc#1278253).
    - CVE-2026-74398: ipv6: addrconf: bail out of dad_failure when state is no longer POSTDAD (bsc#1277410).
    - CVE-2026-74406: vxlan: Fix potential null-ptr-deref in vxlan_gro_prepare_receive() (bsc#1276395).
    - CVE-2026-74443: drm/vmwgfx: bound DMA command body size against suffix pointer (bsc#1278210).
    - CVE-2026-74444: drm/vmwgfx: validate DRAW_PRIMITIVES header size before division (bsc#1278211).
    - CVE-2026-74453: drm/vc4: Zero the tile state data array before each BIN job (bsc#1278178).
    - CVE-2026-74469: sctp: prevent peer transport count overflow (bsc#1277792).
    - CVE-2026-74473: vxlan: use pskb_network_may_pull() in route_shortcircuit() (bsc#1276340).
    - CVE-2026-74479: net: pktgen: fix proc entry use-after-free (bsc#1276354).
    - CVE-2026-74480: net: bridge: stop fast-leave after deleting a port group (bsc#1276353).
    - CVE-2026-74492: netfilter: ipset: do not update comments from kernel-side hash adds (bsc#1276337).
    - CVE-2026-74493: net/smc: fix socket use-after-free during link group termination (bsc#1276338).
    - CVE-2026-74540: Bluetooth: L2CAP: fix UAF in l2cap_le_connect_rsp (bsc#1275681).
    - CVE-2026-74556: scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer     (bsc#1275696).
    - CVE-2026-74586: sctp: clear new_transport when removing a peer (bsc#1277820).
    - CVE-2026-74588: sctp: keep chunk->transport in step with the list it is queued on (bsc#1277766).
    - CVE-2026-74589: bpf, sockmap: Fix sk_redir use-after-free in send verdict (bsc#1277904).
    - CVE-2026-74597: ip6_tunnel: clear skb2->cb in ip6ip6_err() (bsc#1277493).
    - CVE-2026-74609: tipc: read le->link under the node lock in tipc_node_link_down() (bsc#1277906).
    - CVE-2026-74615: vxlan: do not arm the ageing timer on a device that is down (bsc#1277901).
    - CVE-2026-74616: xdp: reject clones that overrun skb_shared_info tailroom (bsc#1277813).
    - CVE-2026-74630: ipv6: prevent in6_dev_get() from resurrecting inet6_dev (bsc#1278191).
    - CVE-2026-74688: sctp: clear control chunk transport if it is being removed (bsc#1277489).
    - CVE-2026-74700: net/sched: cls_api: Always acquire rtnl_lock when destroying locked classifiers     (bsc#1277626).
    - CVE-2026-74719: net/smc: fix qentry overwrite for CONFIRM_LINK and ADD_LINK_CONT in     smc_llc_event_handler()       (bsc#1276572).
    - CVE-2026-74737: net: ethernet: ti: am65-cpsw-nuss: Fix port_id extraction from SRC TAG (bsc#1277898).
    - CVE-2026-74743: macvlan: inherit needed_headroom and needed_tailroom from lowerdev (bsc#1277908).
    - CVE-2026-74744: ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (bsc#1278094).
    - CVE-2026-74752: sctp: validate cookie AUTH state before use (bsc#1278315).
    - CVE-2026-80540: drm/amdgpu: Fix UVD decode image min size calculation (bsc#1277590).
    - CVE-2026-80580: fbdev: bound mode sysfs output to the sysfs buffer (bsc#1278294).
    - CVE-2026-80714: ipvs: do not propagate one-packet flag to synced conns (bsc#1277561).
    - CVE-2026-80716: ALSA: pcm: wake linked drain waiters on unlink (bsc#1277837).
    - CVE-2026-80737: serial: amba-pl011: synchronize DMA teardown (bsc#1279487).
    - CVE-2026-80785: fbdev: serialize mode sysfs access with lock_fb_info() (bsc#1279619).
    - CVE-2026-80789: nvmet-tcp: bound SGL data length before allocating command buffers (bsc#1279621).
    - CVE-2026-80840: ipv6: seg6: clear IPv4 control block on IPIP decapsulation (bsc#1279875).
    - CVE-2026-80841: net/packet: defer vmalloc TX_RING free until skbs finish (bsc#1279835).
    - CVE-2026-80844: xfrm: ah6: validate routing header segments_left (bsc#1279786).
    - CVE-2026-80852: tls: device: fix out-of-bounds write in tls_append_frag() (bsc#1279532).
    - CVE-2026-80909: drm/amdgpu: Reject UVD message with invalid number of h265 refs (bsc#1279422).
    - CVE-2026-81000: net: tun: bound receive headroom (bsc#1280263).
    - CVE-2026-89479: sctp: stop processing a packet once its association is deleted (bsc#1280786).
    - CVE-2026-89482: nvme-tcp: do not accept C2HData based on blk_rq_payload_bytes() alone (bsc#1280350).
    - CVE-2026-89532: svcrdma: Fix pcl_for_each_segment for empty chunks (bsc#1280985).
    - CVE-2026-89533: svcrdma: Fix offset arithmetic in read_chunk_range (bsc#1280993).
    - CVE-2026-89544: SUNRPC: fix gssx_dec_option_array error path bugs (bsc#1280758).
    - CVE-2026-89551: SUNRPC: xdr_buf_trim: clamp buf->len to avoid underflow (bsc#1280727).
    - CVE-2026-89569: Bluetooth: RFCOMM: serialize security confirmation handling (bsc#1280733).
    - CVE-2026-89603: entry: Fix seccomp bypass after ptrace with TSYNC (bsc#1280923).
    - CVE-2026-89631: smb: client: reject a tree connect response whose byte count is too small (bsc#1280496).
    - CVE-2026-89636: smb: client: clear ce->tgthint in free_tgts() (bsc#1281042).
    - CVE-2026-89638: smb: client: clear setuid/setgid bit on write with cifsacl/modefromsid/posix extensions     (bsc#1281046).
    - CVE-2026-89674: nfsd: fix XDR length calculation in nfsd4_ff_encode_layoutget (bsc#1280243).
    - CVE-2026-89932: KVM: nVMX: Always flush vpid02 on first use (bsc#1281360).
    - CVE-2026-89968: nvmet-tcp: reject unsolicited H2CData PDUs (bsc#1281229).
    - CVE-2026-90003: futex: Prevent rcuwait use-after-free during requeue PI (bsc#1281295).
    - CVE-2026-90104: NFSv4.1: zero referring call lists before decoding (bsc#1281546).
    - CVE-2026-90198: ALSA: core: Fix use-after-free in snd_card_do_free() (bsc#1281818).
    - CVE-2026-90413: IB/isert: reject login PDUs declaring more data than was received (bsc#1282113).
    - CVE-2026-90414: IB/isert: reject PDUs declaring more data than (bsc#1282110).
    - CVE-2026-93104: RDMA/rvt: Return NULL after port allocation failure (bsc#1282284).
    - CVE-2026-93782: vhost-scsi: flush backend after device ioctls (bsc#1282906).
    - CVE-2026-93787: smb: client: bound dirent name against end of SMB response in cifs_filldir     (bsc#1282932).
    - CVE-2026-100075: RDMA/srpt: Fix srpt_alloc_rw_ctxs() unwind counters (bsc#1282881).

    The following non security issues were fixed:

    - default_gfp(): avoid using the 'newfangled' __VA_OPT__ trick (bsc#1280139).
    - fbdev/sysfs: Fix locking (jsc#PED-1166 jsc#PED-1168 jsc#PED-1170 jsc#PED-1218 jsc#PED-1220 jsc#PED-1222     jsc#PED-1223       jsc#PED-1225).
    - i2c: core: fix irq domain leak on adapter registration failure (git-fixes).
    - kernel-binary.spec.in: Fix syntax error.
    - net: mana: Cap MSI-X vectors to the device MSI-X table size (bsc#1277254).
    - net: mana: Clear RDMA teardown and suspend state in mana_rdma_probe() (git-fixes).
    - net: mana: Fall back to scattered pages for GDMA queues (bsc#1281085).
    - net: mana: Reserve extra CQ slot for the fence completion CQE (git-fixes).
    - perf: Reject exited events as group leaders (git-fixes).
    - slab: Introduce kmalloc_obj() and family (bsc#1280139).
    - slab: recognize @GFP parameter as optional in kernel-doc (bsc#1280139).
    - smb: client: fix data/file corruption on reconnects (bsc#1253005).
    - smb: client: fix stuck kworkers on reconnects during writes (bsc#1253005).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4668-1 advisory.

    The SUSE Linux Enterprise 15 SP4 kernel was updated to fix various security issues:

    The following security issues were fixed:

    - CVE-2022-50645: EDAC/i10nm: fix refcount leak in pci_get_dev_wrapper() (bsc#1254633).
    - CVE-2024-56644: net/ipv6: release expired exception dst cached in socket (bsc#1216813 bsc#1235133).
    - CVE-2025-39964: crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (bsc#1252682).
    - CVE-2025-40022: crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (bsc#1251966).
    - CVE-2026-53266: netfilter: bridge: make ebt_snat ARP rewrite writable (bsc#1269136).
    - CVE-2026-53400: i2c: core: fix adapter registration race (bsc#1271906).
    - CVE-2026-64279: i2c: core: fix adapter deregistration race (bsc#1273953).
    - CVE-2026-64319: nvmet-auth: fix return value check in auth send (bsc#1273339).
    - CVE-2026-64422: net: ipv4: bound TCP reordering sysctl writes and MTU probe sizes (bsc#1273290).
    - CVE-2026-64580: xfrm6: clear dst.dev on error to avoid double netdev_put in xfrm6_fill_dst()     (bsc#1274037).
    - CVE-2026-68376: sctp: fix auth_hmacs array size in struct sctp_cookie (bsc#1274836).
    - CVE-2026-68445: drm/vc4: Prevent shader BO mappings from becoming writable (bsc#1276277).
    - CVE-2026-68451: s390/zcrypt: Validate length for CCA ECC private key requests (bsc#1276287).
    - CVE-2026-68452: s390/zcrypt: Validate length for CCA AES cipher key requests (bsc#1276295).
    - CVE-2026-72051: net: ip6_tunnel: require CAP_NET_ADMIN in the device netns for changelink (bsc#1276801).
    - CVE-2026-72052: net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (bsc#1276803).
    - CVE-2026-72053: net: ipip: require CAP_NET_ADMIN in the device netns for changelink (bsc#1276814).
    - CVE-2026-72054: net: ip_vti: require CAP_NET_ADMIN in the device netns for changelink (bsc#1276818).
    - CVE-2026-72055: net: ip6_vti: require CAP_NET_ADMIN in the device netns for changelink (bsc#1276821).
    - CVE-2026-72061: net: sit: require CAP_NET_ADMIN in the device netns for changelink (bsc#1277249).
    - CVE-2026-72066: cpu: hotplug: Bound hotplug states sysfs output (bsc#1277149).
    - CVE-2026-72098: dm-verity: fix buffer overflow in FEC calculation (bsc#1275543).
    - CVE-2026-72129: nvmet-rdma: handle inline data with a nonzero offset (bsc#1275545).
    - CVE-2026-72136: xfrm: xfrm_interface: require CAP_NET_ADMIN in the device netns for changelink     (bsc#1277574).
    - CVE-2026-72157: net: thunderbolt: Fix frags[] overflow by bounding frame_count (bsc#1277544).
    - CVE-2026-72322: ipv6: mcast: Fix potential UAF in MLD delayed work (bsc#1275972).
    - CVE-2026-72348: netfilter: ip6tables: mark malformed IPv6 extension headers for hotdrop (bsc#1276007).
    - CVE-2026-72351: gue: validate REMCSUM private option length (bsc#1276009).
    - CVE-2026-72383: sctp: fix addr_wq_timer race in sctp_free_addr_wq() (bsc#1277857).
    - CVE-2026-72398: sctp: fix association labeling in the duplicate COOKIE-ECHO case (bsc#1276381).
    - CVE-2026-72434: netfilter: ipset: make sure gc is properly stopped (bsc#1278054).
    - CVE-2026-74267: net/sched: sch_codel: Do not call qdisc_tree_reduce_backlog during peek before restoring     qlen       (bsc#1276519).
    - CVE-2026-74283: tipc: require net admin for TIPCv2 netlink mutators (bsc#1276475).
    - CVE-2026-74330: configfs: fix lockless traversals of ->s_children (bsc#1277129).
    - CVE-2026-74398: ipv6: addrconf: bail out of dad_failure when state is no longer POSTDAD (bsc#1277410).
    - CVE-2026-74443: drm/vmwgfx: bound DMA command body size against suffix pointer (bsc#1278210).
    - CVE-2026-74444: drm/vmwgfx: validate DRAW_PRIMITIVES header size before division (bsc#1278211).
    - CVE-2026-74453: drm/vc4: Zero the tile state data array before each BIN job (bsc#1278178).
    - CVE-2026-74469: sctp: prevent peer transport count overflow (bsc#1277792).
    - CVE-2026-74473: vxlan: use pskb_network_may_pull() in route_shortcircuit() (bsc#1276340).
    - CVE-2026-74479: net: pktgen: fix proc entry use-after-free (bsc#1276354).
    - CVE-2026-74480: net: bridge: stop fast-leave after deleting a port group (bsc#1276353).
    - CVE-2026-74492: netfilter: ipset: do not update comments from kernel-side hash adds (bsc#1276337).
    - CVE-2026-74493: net/smc: fix socket use-after-free during link group termination (bsc#1276338).
    - CVE-2026-74540: Bluetooth: L2CAP: fix UAF in l2cap_le_connect_rsp (bsc#1275681).
    - CVE-2026-74586: sctp: clear new_transport when removing a peer (bsc#1277820).
    - CVE-2026-74588: sctp: keep chunk->transport in step with the list it is queued on (bsc#1277766).
    - CVE-2026-74589: bpf, sockmap: Fix sk_redir use-after-free in send verdict (bsc#1277904).
    - CVE-2026-74597: ip6_tunnel: clear skb2->cb in ip6ip6_err() (bsc#1277493).
    - CVE-2026-74609: tipc: read le->link under the node lock in tipc_node_link_down() (bsc#1277906).
    - CVE-2026-74630: ipv6: prevent in6_dev_get() from resurrecting inet6_dev (bsc#1278191).
    - CVE-2026-74688: sctp: clear control chunk transport if it is being removed (bsc#1277489).
    - CVE-2026-74700: net/sched: cls_api: Always acquire rtnl_lock when destroying locked classifiers     (bsc#1277626).
    - CVE-2026-74719: net/smc: fix qentry overwrite for CONFIRM_LINK and ADD_LINK_CONT in     smc_llc_event_handler()       (bsc#1276572).
    - CVE-2026-74744: ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (bsc#1278094).
    - CVE-2026-74752: sctp: validate cookie AUTH state before use (bsc#1278315).
    - CVE-2026-80540: drm/amdgpu: Fix UVD decode image min size calculation (bsc#1277590).
    - CVE-2026-80785: fbdev: serialize mode sysfs access with lock_fb_info() (bsc#1279619).
    - CVE-2026-80789: nvmet-tcp: bound SGL data length before allocating command buffers (bsc#1279621).
    - CVE-2026-80840: ipv6: seg6: clear IPv4 control block on IPIP decapsulation (bsc#1279875).
    - CVE-2026-80841: net/packet: defer vmalloc TX_RING free until skbs finish (bsc#1279835).
    - CVE-2026-80844: xfrm: ah6: validate routing header segments_left (bsc#1279786).
    - CVE-2026-80852: tls: device: fix out-of-bounds write in tls_append_frag() (bsc#1279532).
    - CVE-2026-81000: net: tun: bound receive headroom (bsc#1280263).
    - CVE-2026-89479: sctp: stop processing a packet once its association is deleted (bsc#1280786).
    - CVE-2026-89482: nvme-tcp: do not accept C2HData based on blk_rq_payload_bytes() alone (bsc#1280350).
    - CVE-2026-89532: svcrdma: Fix pcl_for_each_segment for empty chunks (bsc#1280985).
    - CVE-2026-89533: svcrdma: Fix offset arithmetic in read_chunk_range (bsc#1280993).
    - CVE-2026-89551: SUNRPC: xdr_buf_trim: clamp buf->len to avoid underflow (bsc#1280727).
    - CVE-2026-89569: Bluetooth: RFCOMM: serialize security confirmation handling (bsc#1280733).
    - CVE-2026-89603: entry: Fix seccomp bypass after ptrace with TSYNC (bsc#1280923).
    - CVE-2026-89631: smb: client: reject a tree connect response whose byte count is too small (bsc#1280496).
    - CVE-2026-89636: smb: client: clear ce->tgthint in free_tgts() (bsc#1281042).
    - CVE-2026-89638: smb: client: clear setuid/setgid bit on write with cifsacl/modefromsid/posix extensions     (bsc#1281046).
    - CVE-2026-89674: nfsd: fix XDR length calculation in nfsd4_ff_encode_layoutget (bsc#1280243).
    - CVE-2026-89932: KVM: nVMX: Always flush vpid02 on first use (bsc#1281360).
    - CVE-2026-89968: nvmet-tcp: reject unsolicited H2CData PDUs (bsc#1281229).
    - CVE-2026-90003: futex: Prevent rcuwait use-after-free during requeue PI (bsc#1281295).
    - CVE-2026-90104: NFSv4.1: zero referring call lists before decoding (bsc#1281546).
    - CVE-2026-90198: ALSA: core: Fix use-after-free in snd_card_do_free() (bsc#1281818).
    - CVE-2026-90413: IB/isert: reject login PDUs declaring more data than was received (bsc#1282113).
    - CVE-2026-90414: IB/isert: reject PDUs declaring more data than (bsc#1282110).
    - CVE-2026-93104: RDMA/rvt: Return NULL after port allocation failure (bsc#1282284).
    - CVE-2026-93782: vhost-scsi: flush backend after device ioctls (bsc#1282906).
    - CVE-2026-93787: smb: client: bound dirent name against end of SMB response in cifs_filldir     (bsc#1282932).
    - CVE-2026-100075: RDMA/srpt: Fix srpt_alloc_rw_ctxs() unwind counters (bsc#1282881).

    The following non security issues were fixed:

    - default_gfp(): avoid using the 'newfangled' __VA_OPT__ trick (bsc#1280139).
    - fbdev/sysfs: Fix locking (jsc#PED-1166 jsc#PED-1168 jsc#PED-1170 jsc#PED-1218 jsc#PED-1220 jsc#PED-1222     jsc#PED-1223       jsc#PED-1225).
    - i2c: core: fix irq domain leak on adapter registration failure (git-fixes).
    - slab: Introduce kmalloc_obj() and family (bsc#1280139).
    - slab: recognize @GFP parameter as optional in kernel-doc (bsc#1280139).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4660-1 advisory.

    The SUSE Linux Enterprise 15 SP6 kernel was updated to fix various security issues:

    The following security issues were fixed:

    - CVE-2025-38704: rcu/nocb: Fix possible invalid rdp's->nocb_cb_kthread pointer (bsc#1254408).
    - CVE-2026-43502: net/rds: handle zerocopy send cleanup before the message is queued (bsc#1266008).
    - CVE-2026-46135: nvmet-tcp: add bounds checks in nvmet_tcp_build_pdu_iovec (bsc#1267373).
    - CVE-2026-53266: netfilter: bridge: make ebt_snat ARP rewrite writable (bsc#1269136).
    - CVE-2026-53400: i2c: core: fix adapter registration race (bsc#1271906).
    - CVE-2026-63795: 9p: avoid putting oldfid in p9_client_walk() error path (bsc#1271955).
    - CVE-2026-64279: i2c: core: fix adapter deregistration race (bsc#1273953).
    - CVE-2026-64319: nvmet-auth: validate reply message payload bounds against transfer length (bsc#1273339).
    - CVE-2026-64320: nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (bsc#1273420).
    - CVE-2026-64422: net: ipv4: bound TCP reordering sysctl writes and MTU probe sizes (bsc#1273290).
    - CVE-2026-64556: perf/core: Detach event groups during remove_on_exec (bsc#1273251).
    - CVE-2026-64580: xfrm6: clear dst.dev on error to avoid double netdev_put in xfrm6_fill_dst()     (bsc#1274037).
    - CVE-2026-68162: sctp: avoid auth_enable sysctl UAF during netns teardown (bsc#1274920).
    - CVE-2026-68290: rds: tcp: unregister sysctl before tearing down listen socket (bsc#1275977).
    - CVE-2026-68376: sctp: fix auth_hmacs array size in struct sctp_cookie (bsc#1274836).
    - CVE-2026-68445: drm/vc4: Prevent shader BO mappings from becoming writable (bsc#1276277).
    - CVE-2026-68451: s390/zcrypt: Validate length for CCA ECC private key requests (bsc#1276287).
    - CVE-2026-68452: s390/zcrypt: Validate length for CCA AES cipher key requests (bsc#1276295).
    - CVE-2026-68454: KVM: s390: pci: Fix handling of AIF enable without AISB (bsc#1276388).
    - CVE-2026-72051: net: ip6_tunnel: require CAP_NET_ADMIN in the device netns for changelink (bsc#1276801).
    - CVE-2026-72052: net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (bsc#1276803).
    - CVE-2026-72053: net: ipip: require CAP_NET_ADMIN in the device netns for changelink (bsc#1276814).
    - CVE-2026-72054: net: ip_vti: require CAP_NET_ADMIN in the device netns for changelink (bsc#1276818).
    - CVE-2026-72055: net: ip6_vti: require CAP_NET_ADMIN in the device netns for changelink (bsc#1276821).
    - CVE-2026-72061: net: sit: require CAP_NET_ADMIN in the device netns for changelink (bsc#1277249).
    - CVE-2026-72066: cpu: hotplug: Bound hotplug states sysfs output (bsc#1277149).
    - CVE-2026-72098: dm-verity: fix buffer overflow in FEC calculation (bsc#1275543).
    - CVE-2026-72129: nvmet-rdma: handle inline data with a nonzero offset (bsc#1275545).
    - CVE-2026-72136: xfrm: xfrm_interface: require CAP_NET_ADMIN in the device netns for changelink     (bsc#1277574).
    - CVE-2026-72157: net: thunderbolt: Fix frags[] overflow by bounding frame_count (bsc#1277544).
    - CVE-2026-72164: ocfs2: avoid moving extents to occupied clusters (bsc#1277553).
    - CVE-2026-72301: ASoC: SOF: ipc3-control: Fix TOCTOU in bytes_put and bytes_get (bsc#1277742).
    - CVE-2026-72322: ipv6: mcast: Fix potential UAF in MLD delayed work (bsc#1275972).
    - CVE-2026-72323: ipv4: igmp: Fix potential UAF in igmp_gq_start_timer() (bsc#1275985).
    - CVE-2026-72348: netfilter: ip6tables: mark malformed IPv6 extension headers for hotdrop (bsc#1276007).
    - CVE-2026-72351: gue: validate REMCSUM private option length (bsc#1276009).
    - CVE-2026-72383: sctp: fix addr_wq_timer race in sctp_free_addr_wq() (bsc#1277857).
    - CVE-2026-72398: sctp: add INIT verification after cookie unpacking (bsc#1276381).
    - CVE-2026-72399: net: enetc: check the number of BDs needed for xdp_frame (bsc#1276553).
    - CVE-2026-72434: netfilter: ipset: make sure gc is properly stopped (bsc#1278054).
    - CVE-2026-72449: drm/amdkfd: fix list_del corruption in kfd_criu_resume_svm (bsc#1278108).
    - CVE-2026-74267: net/sched: sch_codel: Do not call qdisc_tree_reduce_backlog during peek before restoring     qlen       (bsc#1276519).
    - CVE-2026-74283: tipc: require net admin for TIPCv2 netlink mutators (bsc#1276475).
    - CVE-2026-74330: configfs: fix lockless traversals of ->s_children (bsc#1277129).
    - CVE-2026-74356: vhost: move smp_rmb() into vhost_get_avail_idx() (bsc#1278063).
    - CVE-2026-74363: bpf: fix UAF by restoring RCU-delayed inode freeing in bpffs (bsc#1278070).
    - CVE-2026-74388: ALSA: seq: oss: Fix UAF at handling events with embedded SysEx data (bsc#1278253).
    - CVE-2026-74398: ipv6: addrconf: bail out of dad_failure when state is no longer POSTDAD (bsc#1277410).
    - CVE-2026-74406: vxlan: Fix potential null-ptr-deref in vxlan_gro_prepare_receive() (bsc#1276395).
    - CVE-2026-74443: drm/vmwgfx: bound DMA command body size against suffix pointer (bsc#1278210).
    - CVE-2026-74444: drm/vmwgfx: validate DRAW_PRIMITIVES header size before division (bsc#1278211).
    - CVE-2026-74453: drm/vc4: Zero the tile state data array before each BIN job (bsc#1278178).
    - CVE-2026-74469: sctp: prevent peer transport count overflow (bsc#1277792).
    - CVE-2026-74473: vxlan: use pskb_network_may_pull() in route_shortcircuit() (bsc#1276340).
    - CVE-2026-74476: veth: convert frag_list skbs before running XDP (bsc#1276341).
    - CVE-2026-74479: net: pktgen: fix proc entry use-after-free (bsc#1276354).
    - CVE-2026-74480: net: bridge: stop fast-leave after deleting a port group (bsc#1276353).
    - CVE-2026-74492: netfilter: ipset: do not update comments from kernel-side hash adds (bsc#1276337).
    - CVE-2026-74493: net/smc: fix socket use-after-free during link group termination (bsc#1276338).
    - CVE-2026-74540: Bluetooth: L2CAP: fix UAF in l2cap_le_connect_rsp (bsc#1275681).
    - CVE-2026-74541: Bluetooth: ISO: clear iso_data always when detaching conn from hcon (bsc#1275694).
    - CVE-2026-74586: sctp: clear new_transport when removing a peer (bsc#1277820).
    - CVE-2026-74588: sctp: keep chunk->transport in step with the list it is queued on (bsc#1277766).
    - CVE-2026-74589: bpf, sockmap: Fix sk_redir use-after-free in send verdict (bsc#1277904).
    - CVE-2026-74597: ip6_tunnel: clear skb2->cb in ip6ip6_err() (bsc#1277493).
    - CVE-2026-74608: smb: client: Fix use-after-free in cifs_try_adding_channels() (bsc#1277796).
    - CVE-2026-74609: tipc: read le->link under the node lock in tipc_node_link_down() (bsc#1277906).
    - CVE-2026-74615: vxlan: do not arm the ageing timer on a device that is down (bsc#1277901).
    - CVE-2026-74616: xdp: reject clones that overrun skb_shared_info tailroom (bsc#1277813).
    - CVE-2026-74630: ipv6: prevent in6_dev_get() from resurrecting inet6_dev (bsc#1278191).
    - CVE-2026-74631: net: smc: fix splice entry lifetime imbalance in smc_rx_splice (bsc#1278195).
    - CVE-2026-74688: sctp: clear control chunk transport if it is being removed (bsc#1277489).
    - CVE-2026-74700: net/sched: cls_api: Always acquire rtnl_lock when destroying locked classifiers     (bsc#1277626).
    - CVE-2026-74719: net/smc: fix qentry overwrite for CONFIRM_LINK and ADD_LINK_CONT in     smc_llc_event_handler()       (bsc#1276572).
    - CVE-2026-74737: net: ethernet: ti: am65-cpsw-nuss: Fix port_id extraction from SRC TAG (bsc#1277898).
    - CVE-2026-74743: macvlan: inherit needed_headroom and needed_tailroom from lowerdev (bsc#1277908).
    - CVE-2026-74744: ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (bsc#1278094).
    - CVE-2026-74752: sctp: validate cookie AUTH state before use (bsc#1278315).
    - CVE-2026-80540: drm/amdgpu: Fix UVD decode image min size calculation (bsc#1277590).
    - CVE-2026-80580: fbdev: bound mode sysfs output to the sysfs buffer (bsc#1278294).
    - CVE-2026-80663: tools/power/x86/intel-speed-select: Harden daemon pidfile open (bsc#1278335).
    - CVE-2026-80714: ipvs: do not propagate one-packet flag to synced conns (bsc#1277561).
    - CVE-2026-80716: ALSA: pcm: wake linked drain waiters on unlink (bsc#1277837).
    - CVE-2026-80725: net: gro: properly validate BIG TCP aggregation criteria (bsc#1277452).
    - CVE-2026-80737: serial: amba-pl011: synchronize DMA teardown (bsc#1279487).
    - CVE-2026-80785: fbdev: serialize mode sysfs access with lock_fb_info() (bsc#1279619).
    - CVE-2026-80789: nvmet-tcp: bound SGL data length before allocating command buffers (bsc#1279621).
    - CVE-2026-80799: nfc: llcp: fix OOB read and u8 offset wrap in TLV parsers (bsc#1279811).
    - CVE-2026-80840: ipv6: seg6: clear IPv4 control block on IPIP decapsulation (bsc#1279875).
    - CVE-2026-80841: net/packet: defer vmalloc TX_RING free until skbs finish (bsc#1279835).
    - CVE-2026-80844: xfrm: ah6: validate routing header segments_left (bsc#1279786).
    - CVE-2026-80852: tls: device: fix out-of-bounds write in tls_append_frag() (bsc#1279532).
    - CVE-2026-80909: drm/amdgpu: Reject UVD message with invalid number of h265 refs (bsc#1279422).
    - CVE-2026-80976: seg6: reset IP6CB after IPv6 decapsulation (bsc#1280298).
    - CVE-2026-81000: net: tun: bound receive headroom (bsc#1280263).
    - CVE-2026-89479: sctp: stop processing a packet once its association is deleted (bsc#1280786).
    - CVE-2026-89482: nvme-tcp: do not accept C2HData based on blk_rq_payload_bytes() alone (bsc#1280350).
    - CVE-2026-89532: svcrdma: Fix pcl_for_each_segment for empty chunks (bsc#1280985).
    - CVE-2026-89533: svcrdma: Fix offset arithmetic in read_chunk_range (bsc#1280993).
    - CVE-2026-89542: SUNRPC: harden gss_krb5_unwrap_v2 against short tokens (bsc#1280387).
    - CVE-2026-89544: SUNRPC: fix gssx_dec_option_array error path bugs (bsc#1280758).
    - CVE-2026-89551: SUNRPC: xdr_buf_trim: clamp buf->len to avoid underflow (bsc#1280727).
    - CVE-2026-89569: Bluetooth: RFCOMM: serialize security confirmation handling (bsc#1280733).
    - CVE-2026-89603: entry: Fix seccomp bypass after ptrace with TSYNC (bsc#1280923).
    - CVE-2026-89631: smb: client: reject a tree connect response whose byte count is too small (bsc#1280496).
    - CVE-2026-89636: smb: client: clear ce->tgthint in free_tgts() (bsc#1281042).
    - CVE-2026-89638: smb: client: clear setuid/setgid bit on write with cifsacl/modefromsid/posix extensions     (bsc#1281046).
    - CVE-2026-89674: nfsd: fix XDR length calculation in nfsd4_ff_encode_layoutget (bsc#1280243).
    - CVE-2026-89702: nfsd: size fh_verify server sockaddr slot by xpt_locallen (bsc#1280487).
    - CVE-2026-89899: media: cec: disable delayed work before freeing an interrupted transmit (bsc#1281383).
    - CVE-2026-89931: KVM: nVMX: Ensure KVM_REQ_GET_NESTED_STATE_PAGES is cleared on VM-Exit (bsc#1281427).
    - CVE-2026-89968: nvmet-tcp: reject unsolicited H2CData PDUs (bsc#1281229).
    - CVE-2026-90003: futex: Prevent rcuwait use-after-free during requeue PI (bsc#1281295).
    - CVE-2026-90088: Bluetooth: RFCOMM: Validate MTU in rfcomm_apply_pn() to prevent infinite loop     (bsc#1281397).
    - CVE-2026-90104: NFSv4.1: zero referring call lists before decoding (bsc#1281546).
    - CVE-2026-90198: ALSA: core: Fix use-after-free in snd_card_do_free() (bsc#1281818).
    - CVE-2026-90259: btrfs: qgroup: fix a wrong length calculation in qgroup_free_reserved_data()     (bsc#1281680).
    - CVE-2026-90308: RDMA/erdma: Hold QP references for AE and CM processing (bsc#1281786).
    - CVE-2026-90309: RDMA/erdma: Hold CQ references when processing EQ events (bsc#1281789).
    - CVE-2026-90413: IB/isert: reject login PDUs declaring more data than was received (bsc#1282113).
    - CVE-2026-90414: IB/isert: reject PDUs declaring more data than (bsc#1282110).
    - CVE-2026-93104: RDMA/rvt: Return NULL after port allocation failure (bsc#1282284).
    - CVE-2026-93782: vhost-scsi: flush backend after device ioctls (bsc#1282906).
    - CVE-2026-100075: RDMA/srpt: Fix srpt_alloc_rw_ctxs() unwind counters (bsc#1282881).

    The following non security issues were fixed:

    - Also reflect disabled BATMAN in supported.conf.
    - Disable CONFIG_BATMAN_ADV (jsc#PED-16892).
    - Disable CONFIG_CAN (jsc#PED-16993).
    - Fif selftests build failure caused by jsc#PED-16401 backport (bsc#1281927).
    - RDMA/erdma: Use IRQ-safe XArray helpers for QP and CQ tables (git-fixes).
    - arm64: Use load LSE atomics for the non-return per-CPU atomic operations (git-fixes).
    - arm64: hibernate: pass HVC_SET_VECTORS args to the resume hvc (git-fixes).
    - arm64: mte: Fix PTRACE_{PEEK,POKE}MTETAGS error documentation (git-fixes).
    - arm64: percpu: Fix LSE operations on {8,16}-bit types (git-fixes).
    - arm64: percpu: Fix this_cpu_and() mask generation (git-fixes).
    - arm64: percpu: Fix this_cpu_write() casting (git-fixes).
    - compiler_types: Introduce __flex_counter() and family (bsc#1280139).
    - default_gfp(): avoid using the 'newfangled' __VA_OPT__ trick (bsc#1280139).
    - docs: tls: document TLS1.3 key updates (bsc#1267564 jsc#PED-16401).
    - firmware: arm_scpi: reject DVFS OPP count above MAX_DVFS_OPPS (git-fixes).
    - i2c: core: fix irq domain leak on adapter registration failure (git-fixes).
    - kabi: tls add counters for rekey (bsc#1267564 jsc#PED-16401).
    - kernel-binary.spec.in: Fix syntax error.
    - net: mana: Clear RDMA teardown and suspend state in mana_rdma_probe() (git-fixes).
    - net: mana: Reserve extra CQ slot for the fence completion CQE (git-fixes).
    - net: mana: restore the XDP program pointer when pre-allocation fails (git-fixes).
    - net: tls: Pass union tls_crypto_context pointer to memzero_explicit (bsc#1267564 jsc#PED-16401).
    - perf: Reject exited events as group leaders (git-fixes).
    - selftests: tls: add getsockopt test (bsc#1267564 jsc#PED-16401).
    - selftests: tls: add key_generation argument to tls_crypto_info_init (bsc#1267564 jsc#PED-16401).
    - selftests: tls: add rekey tests (bsc#1267564 jsc#PED-16401).
    - slab.h: disable completely broken overflow handling in flex allocations (bsc#1280139).
    - slab: Introduce kmalloc_flex() and family (bsc#1280139).
    - slab: Introduce kmalloc_obj() and family (bsc#1280139).
    - slab: recognize @GFP parameter as optional in kernel-doc (bsc#1280139).
    - smb: client: harden DFS cache against invalid target hints (git-fixes).
    - tls: add counters for rekey (bsc#1267564 jsc#PED-16401).
    - tls: block decryption when a rekey is pending (bsc#1267564 jsc#PED-16401).
    - tls: implement rekey for TLS1.3 (bsc#1267564 jsc#PED-16401).
    - tls: skip setting sk_write_space on rekey (bsc#1267564 jsc#PED-16401).
    - x86/mm: Fix pmd_modify() dropping the dirty bit (bsc#1275455).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Bluetooth: RFCOMM: serialize security confirmation handling rfcomm_security_cfm() looks up a session on     session_list and then walks its DLC list without holding rfcomm_mutex. Since RFCOMM session teardown uses     rfcomm_mutex, krfcommd can close and free the same session and DLCs concurrently: hci_rx_work krfcommd
    ----------- --------- rfcomm_session_get() rfcomm_lock() rfcomm_session_close() rfcomm_dlc_unlink()     rfcomm_session_del() kfree(s) rfcomm_unlock() walk s->dlcs The callback can then read a freed session list     head and touch freed DLCs while updating their flags or timers. Serialize the session lookup and DLC     traversal in rfcomm_security_cfm() with rfcomm_mutex. This matches the existing RFCOMM session lifetime     rules and prevents concurrent rfcomm_session_del() / rfcomm_dlc_unlink() from tearing the objects down     while the callback is using them. KASAN reported: BUG: KASAN: slab-use-after-free in     rfcomm_security_cfm+0x41c/0x440 Read of size 8 at addr ffff888111fb3960 by task kworker/u17:1/89     Workqueue: hci0 hci_rx_work Call Trace: rfcomm_security_cfm+0x41c/0x440 hci_encrypt_cfm+0x139/0x590     hci_encrypt_change_evt+0x37b/0xc40 hci_event_packet+0x71b/0xb20 hci_rx_work+0x293/0x730 Allocated by task     69: rfcomm_session_add+0x9e/0x2f0 rfcomm_run+0x44b/0x41e0 Freed by task 69: kfree+0x131/0x3c0     rfcomm_session_del+0x188/0x220 rfcomm_run+0x1985/0x41e0 (CVE-2026-89569)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
371420	CentOS Linux 8 [TuxCare] Security Update: bpftool / kernel / kernel-core / kernel-cross-headers / etc Multiple Vulnerabilities (CENTOS-STREAM8:CLSA-2026:1792759740)	Nessus	CentOS Local Security Checks	Local	high
366919	Debian dla-4841 : ata-modules-6.1.0-53-armmp-di - security update	Nessus	Debian Local Security Checks	Local	high
366749	SUSE SLES12: cluster-md-kmp-default / dlm-kmp-default / gfs2-kmp-default / etc (SUSE-SU-2026:4687-1)	Nessus	SuSE Local Security Checks	Local	high
366742	SUSE SLED15: cluster-md-kmp-default / dlm-kmp-default / gfs2-kmp-default / etc (SUSE-SU-2026:4706-1)	Nessus	SuSE Local Security Checks	Local	high
366399	SUSE SLES15: cluster-md-kmp-default / dlm-kmp-default / gfs2-kmp-default / etc (SUSE-SU-2026:4667-1)	Nessus	SuSE Local Security Checks	Local	medium
366062	SUSE SLES15: cluster-md-kmp-default / dlm-kmp-default / gfs2-kmp-default / etc (SUSE-SU-2026:4668-1)	Nessus	SuSE Local Security Checks	Local	medium
366039	SUSE SLES15: cluster-md-kmp-default / dlm-kmp-default / gfs2-kmp-default / etc (SUSE-SU-2026:4660-1)	Nessus	SuSE Local Security Checks	Local	high
364137	Oracle Linux 10 / 9 : Unbreakable Enterprise kernel (ELSA-2026-500374)	Nessus	Oracle Linux Local Security Checks	Local	high
362907	Debian dla-4817 : ata-modules-6.12.107+deb12-armmp-di - security update	Nessus	Debian Local Security Checks	Local	high
351155	Debian dsa-6528 : ata-modules-6.12.111+deb13-armmp-di - security update	Nessus	Debian Local Security Checks	Local	high
345164	Linux Distros Unpatched Vulnerability : CVE-2026-89569	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2026-89569

high

Tenable Plugins

Coming Soon

high

high

high

high

medium

medium

high

high

high

high

high