In the Linux kernel, the following vulnerability has been resolved: ext2: Fix lost inode updates for IS_SYNC inodes ext2_setsize() and ext2_xattr_set2() had a construct like: if (IS_SYNC(inode)) { sync_inode_metadata(inode, 1); } else { mark_inode_dirty(inode); } which leads to lost inode updates for IS_SYNC inodes because sync_inode_metadata() does anything only if the inode is already dirty and hence inode updates may be simply lost. Fix the problem by unconditionally marking the inode dirty and *then* call sync_inode_metadata().

The remote Ubuntu 24.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-9002-1 advisory.

    It was discovered that the io_uring subsystem in the Linux kernel did not properly handle canceled task     work when processing certain wait operations, leading to the operation being performed in the wrong task     context. A local attacker could possibly use this to cause a denial of service (system crash).
    (CVE-2026-81010)

    Several security issues were discovered in the Linux kernel. An attacker could possibly use these to     compromise the system. This update corrects flaws in the following subsystems:

    - ARM32 architecture;

    - ARM64 architecture;

    - MIPS architecture;

    - OpenRISC architecture;

    - PowerPC architecture;

    - RISC-V architecture;

    - S390 architecture;

    - x86 architecture;

    - Intel NPU Driver;

    - ACPI drivers;

    - Serial ATA and Parallel ATA drivers;

    - Auxiliary display drivers;

    - Ublk userspace block driver;

    - Bluetooth drivers;

    - Character device driver;

    - CPU idle management framework;

    - Hardware crypto device drivers;

    - CXL (Compute Express Link) drivers;

    - ARM SCMI message protocol;

    - GPIO subsystem;

    - GPU drivers;

    - HID subsystem;

    - HSI subsystem;

    - Hardware monitoring drivers;

    - I2C subsystem;

    - I3C subsystem;

    - IIO subsystem;

    - InfiniBand drivers;

    - Input Device core drivers;

    - On-Chip Interconnect management framework;

    - IOMMU subsystem;

    - Multiple devices driver;

    - Media drivers;

    - Fastrpc Driver;

    - Amazon Nitro Secure Module driver;

    - MMC subsystem;

    - MTD block device drivers;

    - Ethernet bonding driver;

    - Network drivers;

    - Microsoft Azure Network Adapter (MANA) driver;

    - Texas Instruments network drivers;

    - MediaTek network drivers;

    - NTB driver;

    - NVDIMM (Non-Volatile Memory Device) drivers;

    - NVME drivers;

    - NVMEM (Non Volatile Memory) drivers;

    - PCI subsystem;

    - Chrome hardware platform drivers;

    - x86 platform drivers;

    - Power supply drivers;

    - RapidIO drivers;

    - Voltage and Current Regulator drivers;

    - S/390 drivers;

    - SCSI subsystem;

    - SLIMbus drivers;

    - NVIDIA Tegra SoC drivers;

    - Realtek RTL8723BS SDIO drivers;

    - TCM subsystem;

    - Trusted Execution Environment drivers;

    - Thunderbolt and USB4 drivers;

    - TTY drivers;

    - USB Device Class drivers;

    - Faraday FOTG210 USB2 dual-role controller driver;

    - USB Gadget drivers;

    - USB Host Controller drivers;

    - Siemens ID Mouse USB driver;

    - IOWarrior USB driver;

    - LD Didactic USB driver;

    - LEGO USB Tower driver;

    - USB Serial drivers;

    - USB Type-C support driver;

    - USB Type-C Port Controller Manager driver;

    - USB Type-C Connector System Software Interface driver;

    - USB over IP driver;

    - VFIO drivers;

    - Framebuffer layer;

    - W1 Dallas's 1-wire bus driver;

    - AFS file system;

    - BTRFS file system;

    - Ceph distributed file system;

    - eCrypt file system;

    - File systems infrastructure;

    - Ext4 file system;

    - F2FS file system;

    - FUSE (File system in Userspace);

    - Network file system (NFS) server daemon;

    - NILFS2 file system;

    - NTFS3 file system;

    - OCFS2 file system;

    - OrangeFS file system;

    - SMB network file system;

    - UBI file system;

    - Drivers core;

    - Tracing infrastructure;

    - KProbes tracing;

    - Networking core;

    - Netfilter;

    - Sun RPC protocol;

    - IPv6 networking;

    - Bluetooth subsystem;

    - IPv4 networking;

    - IP tunnels definitions;

    - SCTP protocol;

    - User-space API (UAPI);

    - IPC subsystem;

    - Audit subsystem;

    - BPF subsystem;

    - DMA mapping infrastructure;

    - Kernel futex primitives;

    - Scheduler infrastructure;

    - Signal handling mechanism;

    - Memory management;

    - 6LoWPAN network protocol;

    - IEEE 802 network protocols;

    - B.A.T.M.A.N. meshing protocol;

    - Ethernet bridge;

    - CAN network layer;

    - Ceph Core library;

    - Devlink API;

    - HSR network protocol;

    - IEEE802154.4 network protocol;

    - IUCV driver;

    - MAC80211 subsystem;

    - Management Component Transport Protocol (MCTP);

    - MultiProtocol Label Switching driver;

    - Multipath TCP;

    - NetLabel subsystem;

    - Open vSwitch;

    - Packet sockets;

    - RDS protocol;

    - Network traffic control;

    - SMC sockets;

    - Network sockets;

    - VMware vSockets driver;

    - XFRM subsystem;

    - AppArmor security module;

    - Key management;

    - Landlock security;

    - Simplified Mandatory Access Control Kernel framework;

    - ALSA framework;

    - Digigram PCXHR ALSA driver;

    - Wolfson Microelectronics audio codecs;

    - USB sound devices;

    - KVM subsystem; (CVE-2024-40954, CVE-2025-38261, CVE-2025-68296, CVE-2025-68730, CVE-2025-68768,     CVE-2026-23346, CVE-2026-43219, CVE-2026-43240, CVE-2026-43311, CVE-2026-43331, CVE-2026-45930,     CVE-2026-52913, CVE-2026-52930, CVE-2026-52939, CVE-2026-52944, CVE-2026-52948, CVE-2026-52953,     CVE-2026-53080, CVE-2026-53134, CVE-2026-53135, CVE-2026-53140, CVE-2026-53144, CVE-2026-53150,     CVE-2026-53154, CVE-2026-53158, CVE-2026-53168, CVE-2026-53177, CVE-2026-53178, CVE-2026-53179,     CVE-2026-53181, CVE-2026-53190, CVE-2026-53208, CVE-2026-53210, CVE-2026-53213, CVE-2026-53214,     CVE-2026-53218, CVE-2026-53219, CVE-2026-53220, CVE-2026-53227, CVE-2026-53236, CVE-2026-53237,     CVE-2026-53238, CVE-2026-53242, CVE-2026-53245, CVE-2026-53249, CVE-2026-53251, CVE-2026-53252,     CVE-2026-53261, CVE-2026-53263, CVE-2026-53265, CVE-2026-53274, CVE-2026-53331, CVE-2026-53332,     CVE-2026-53336, CVE-2026-53337, CVE-2026-53339, CVE-2026-53343, CVE-2026-53345, CVE-2026-53347,     CVE-2026-53349, CVE-2026-53350, CVE-2026-53352, CVE-2026-53353, CVE-2026-63868, CVE-2026-63871,     CVE-2026-63876, CVE-2026-63877, CVE-2026-63882, CVE-2026-63883, CVE-2026-63890, CVE-2026-63891,     CVE-2026-63892, CVE-2026-63895, CVE-2026-63896, CVE-2026-63897, CVE-2026-63898, CVE-2026-63899,     CVE-2026-63900, CVE-2026-63901, CVE-2026-63902, CVE-2026-63903, CVE-2026-63904, CVE-2026-63905,     CVE-2026-63908, CVE-2026-63928, CVE-2026-63931, CVE-2026-63933, CVE-2026-63934, CVE-2026-63943,     CVE-2026-63949, CVE-2026-63956, CVE-2026-63957, CVE-2026-63958, CVE-2026-63959, CVE-2026-63960,     CVE-2026-63961, CVE-2026-63964, CVE-2026-63967, CVE-2026-63969, CVE-2026-63973, CVE-2026-63990,     CVE-2026-63991, CVE-2026-64001, CVE-2026-64006, CVE-2026-64012, CVE-2026-64014, CVE-2026-64078,     CVE-2026-64090, CVE-2026-64094, CVE-2026-64131, CVE-2026-64233, CVE-2026-64234, CVE-2026-64240,     CVE-2026-64305, CVE-2026-64329, CVE-2026-64330, CVE-2026-64340, CVE-2026-64341, CVE-2026-64342,     CVE-2026-64343, CVE-2026-64344, CVE-2026-64346, CVE-2026-64348, CVE-2026-64352, CVE-2026-64362,     CVE-2026-64363, CVE-2026-64365, CVE-2026-64407, CVE-2026-64421, CVE-2026-64424, CVE-2026-64433,     CVE-2026-64446, CVE-2026-64525, CVE-2026-64527, CVE-2026-64528, CVE-2026-74506, CVE-2026-80590,     CVE-2026-80591, CVE-2026-80593, CVE-2026-80598, CVE-2026-80599, CVE-2026-80600, CVE-2026-80601,     CVE-2026-80603, CVE-2026-80609, CVE-2026-80613, CVE-2026-80619, CVE-2026-80622, CVE-2026-80628,     CVE-2026-80630, CVE-2026-80631, CVE-2026-80634, CVE-2026-80635, CVE-2026-80637, CVE-2026-80644,     CVE-2026-80645, CVE-2026-80646, CVE-2026-80649, CVE-2026-80653, CVE-2026-80662, CVE-2026-80663,     CVE-2026-80664, CVE-2026-80668, CVE-2026-80677, CVE-2026-80678, CVE-2026-80680, CVE-2026-80681,     CVE-2026-80684, CVE-2026-80691, CVE-2026-80692, CVE-2026-80693, CVE-2026-80694, CVE-2026-80700,     CVE-2026-80702, CVE-2026-80706, CVE-2026-80707, CVE-2026-80709, CVE-2026-80710, CVE-2026-80714,     CVE-2026-80716, CVE-2026-80717, CVE-2026-80718, CVE-2026-80722, CVE-2026-80725, CVE-2026-80731,     CVE-2026-80732, CVE-2026-80737, CVE-2026-80738, CVE-2026-80747, CVE-2026-80752, CVE-2026-80754,     CVE-2026-80840, CVE-2026-80928, CVE-2026-80931, CVE-2026-80932, CVE-2026-80933, CVE-2026-80935,     CVE-2026-80937, CVE-2026-80944, CVE-2026-80945, CVE-2026-80947, CVE-2026-80952, CVE-2026-80967,     CVE-2026-80971, CVE-2026-80976, CVE-2026-80977, CVE-2026-80978, CVE-2026-80980, CVE-2026-80982,     CVE-2026-80987, CVE-2026-80989, CVE-2026-80990, CVE-2026-80991, CVE-2026-80992, CVE-2026-80994,     CVE-2026-81000, CVE-2026-81001, CVE-2026-81002, CVE-2026-81003, CVE-2026-81007, CVE-2026-81008,     CVE-2026-81011, CVE-2026-81012, CVE-2026-81016, CVE-2026-81017, CVE-2026-89440, CVE-2026-89441,     CVE-2026-89442, CVE-2026-89443, CVE-2026-89448, CVE-2026-89452, CVE-2026-89456, CVE-2026-89465,     CVE-2026-89466, CVE-2026-89469, CVE-2026-89470, CVE-2026-89471, CVE-2026-89472, CVE-2026-89476,     CVE-2026-89477, CVE-2026-89478, CVE-2026-89479, CVE-2026-89480, CVE-2026-89481, CVE-2026-89482,     CVE-2026-89483, CVE-2026-89485, CVE-2026-89487, CVE-2026-89488, CVE-2026-89489, CVE-2026-89492,     CVE-2026-89493, CVE-2026-89494, CVE-2026-89495, CVE-2026-89497, CVE-2026-89500, CVE-2026-89501,     CVE-2026-89502, CVE-2026-89503, CVE-2026-89504, CVE-2026-89508, CVE-2026-89510, CVE-2026-89511,     CVE-2026-89520, CVE-2026-89524, CVE-2026-89526, CVE-2026-89528, CVE-2026-89530, CVE-2026-89532,     CVE-2026-89533, CVE-2026-89536, CVE-2026-89537, CVE-2026-89538, CVE-2026-89540, CVE-2026-89541,     CVE-2026-89542, CVE-2026-89544, CVE-2026-89545, CVE-2026-89547, CVE-2026-89548, CVE-2026-89549,     CVE-2026-89550, CVE-2026-89551, CVE-2026-89553, CVE-2026-89554, CVE-2026-89555, CVE-2026-89557,     CVE-2026-89559, CVE-2026-89560, CVE-2026-89561, CVE-2026-89562, CVE-2026-89563, CVE-2026-89564,     CVE-2026-89569, CVE-2026-89573, CVE-2026-89574, CVE-2026-89579, CVE-2026-89580, CVE-2026-89583,     CVE-2026-89585, CVE-2026-89586, CVE-2026-89587, CVE-2026-89594, CVE-2026-89596, CVE-2026-89597,     CVE-2026-89599, CVE-2026-89601, CVE-2026-89605, CVE-2026-89606, CVE-2026-89607, CVE-2026-89608,     CVE-2026-89609, CVE-2026-89615, CVE-2026-89616, CVE-2026-89617, CVE-2026-89622, CVE-2026-89626,     CVE-2026-89631, CVE-2026-89633, CVE-2026-89634, CVE-2026-89636, CVE-2026-89637, CVE-2026-89638,     CVE-2026-89640, CVE-2026-89643, CVE-2026-89647, CVE-2026-89648, CVE-2026-89649, CVE-2026-89650,     CVE-2026-89652, CVE-2026-89653, CVE-2026-89654, CVE-2026-89655, CVE-2026-89656, CVE-2026-89657,     CVE-2026-89659, CVE-2026-89662, CVE-2026-89663, CVE-2026-89665, CVE-2026-89669, CVE-2026-89671,     CVE-2026-89672, CVE-2026-89674, CVE-2026-89676, CVE-2026-89680, CVE-2026-89682, CVE-2026-89684,     CVE-2026-89685, CVE-2026-89686, CVE-2026-89690, CVE-2026-89691, CVE-2026-89694, CVE-2026-89696,     CVE-2026-89697, CVE-2026-89699, CVE-2026-89702, CVE-2026-89704, CVE-2026-89705, CVE-2026-89706,     CVE-2026-89707, CVE-2026-89708, CVE-2026-89709, CVE-2026-89711, CVE-2026-89712, CVE-2026-89713,     CVE-2026-89720, CVE-2026-89723, CVE-2026-89724, CVE-2026-89725, CVE-2026-89729, CVE-2026-89731,     CVE-2026-89733, CVE-2026-89736, CVE-2026-89738, CVE-2026-89742, CVE-2026-89743, CVE-2026-89747,     CVE-2026-89750, CVE-2026-89755, CVE-2026-89761, CVE-2026-89762, CVE-2026-89763, CVE-2026-89774,     CVE-2026-89777, CVE-2026-89778, CVE-2026-89779, CVE-2026-89781, CVE-2026-89782, CVE-2026-89783,     CVE-2026-89786, CVE-2026-89788, CVE-2026-89789, CVE-2026-89792, CVE-2026-89793, CVE-2026-89795,     CVE-2026-89799, CVE-2026-89801, CVE-2026-89803, CVE-2026-89806, CVE-2026-89808, CVE-2026-89810,     CVE-2026-89811, CVE-2026-89819, CVE-2026-89823, CVE-2026-89832, CVE-2026-89838, CVE-2026-89840,     CVE-2026-89844, CVE-2026-89846, CVE-2026-89847, CVE-2026-89848, CVE-2026-89849, CVE-2026-89854,     CVE-2026-89856, CVE-2026-89857, CVE-2026-89860, CVE-2026-89861, CVE-2026-89863, CVE-2026-89870,     CVE-2026-89877, CVE-2026-89880, CVE-2026-89883, CVE-2026-89887, CVE-2026-89888, CVE-2026-89890,     CVE-2026-89893, CVE-2026-89894, CVE-2026-89897, CVE-2026-89899, CVE-2026-89902, CVE-2026-89903,     CVE-2026-89908, CVE-2026-89912, CVE-2026-89920, CVE-2026-89922, CVE-2026-89927, CVE-2026-89929,     CVE-2026-89930, CVE-2026-89932, CVE-2026-89938, CVE-2026-89951, CVE-2026-89954, CVE-2026-89957,     CVE-2026-89959, CVE-2026-89960, CVE-2026-89961, CVE-2026-89965, CVE-2026-89968, CVE-2026-89969,     CVE-2026-89970, CVE-2026-89972, CVE-2026-89973, CVE-2026-89979, CVE-2026-89988, CVE-2026-89992,     CVE-2026-89995, CVE-2026-89997, CVE-2026-89998, CVE-2026-89999, CVE-2026-90000, CVE-2026-90002,     CVE-2026-90003, CVE-2026-90007, CVE-2026-90011, CVE-2026-90013, CVE-2026-90016, CVE-2026-90017,     CVE-2026-90018, CVE-2026-90022, CVE-2026-90025, CVE-2026-90026, CVE-2026-90027, CVE-2026-90032,     CVE-2026-90036, CVE-2026-90037, CVE-2026-90041, CVE-2026-90042, CVE-2026-90044, CVE-2026-90045,     CVE-2026-90048, CVE-2026-90049, CVE-2026-90170, CVE-2026-92502, CVE-2026-93221)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - ext2: Fix lost inode updates for IS_SYNC inodes ext2_setsize() and ext2_xattr_set2() had a construct like:
    if (IS_SYNC(inode)) { sync_inode_metadata(inode, 1); } else { mark_inode_dirty(inode); } which leads to     lost inode updates for IS_SYNC inodes because sync_inode_metadata() does anything only if the inode is     already dirty and hence inode updates may be simply lost. Fix the problem by unconditionally marking the     inode dirty and *then* call sync_inode_metadata(). (CVE-2026-89601)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
377600	Ubuntu 24.04 LTS : Linux kernel (NVIDIA Tegra) vulnerabilities (USN-9002-1)	Nessus	Ubuntu Local Security Checks	Local	high
376443	Ubuntu 24.04 LTS / 26.04 LTS : Linux kernel vulnerabilities (USN-8959-1)	Nessus	Ubuntu Local Security Checks	Local	high
345294	Linux Distros Unpatched Vulnerability : CVE-2026-89601	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2026-89601

high

Tenable Plugins

high

high

high