In the Linux kernel, the following vulnerability has been resolved: ceph: bound copied dentry name length in NFS export get_name ceph_get_name() copies the MDS-supplied name into the caller's NAME_MAX-sized buffer with memcpy(name, rinfo->dname, rinfo->dname_len) and then writes name[rinfo->dname_len] = 0, without checking dname_len against NAME_MAX. A malicious or buggy MDS that returns a LOOKUPNAME reply with dname_len > NAME_MAX overflows the buffer. __get_snap_name() copies rde->name / rde->name_len the same unchecked way. Impact: a malicious or compromised Ceph MDS overflows the NAME_MAX name buffer in a client's NFS-export get_name path, a slab out-of-bounds write reported by KASAN. Reachable when a CephFS mount is re-exported over NFS. Add ceph_export_copy_name(), which rejects lengths above NAME_MAX with -ENAMETOOLONG before the copy, and use it in both ceph_get_name() and __get_snap_name().

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3183 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    smb: client: fix UAF and buffer leak in cifs_check_trans2() for malformed secondary T2 (CVE-2026-89637)

    In the Linux kernel, the following vulnerability has been resolved:

    ceph: bound copied dentry name length in NFS export get_name

    ceph_get_name() copies the MDS-supplied name into the caller'sNAME_MAX-sized buffer with memcpy(name,     rinfo->dname, rinfo->dname_len)and then writes name[rinfo->dname_len] = 0, without checking     dname_lenagainst NAME_MAX. A malicious or buggy MDS that returns a LOOKUPNAME replywith dname_len >     NAME_MAX overflows the buffer. __get_snap_name() copiesrde->name / rde->name_len the same unchecked way.

    Impact: a malicious or compromised Ceph MDS overflows the NAME_MAX namebuffer in a client's NFS-export     get_name path, a slab out-of-bounds writereported by KASAN. Reachable when a CephFS mount is re-exported     over NFS.

    Add ceph_export_copy_name(), which rejects lengths above NAME_MAX with-ENAMETOOLONG before the copy, and     use it in both ceph_get_name() and__get_snap_name(). (CVE-2026-89652)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf: Reject rdonly/rdwr_buf_size kfunc arguments that exceed u32 max (CVE-2026-93125)

    In the Linux kernel, the following vulnerability has been resolved:

    ipv6: sr: restore network header before routing and forwarding (CVE-2026-98096)

    In the Linux kernel, the following vulnerability has been resolved:

    writeback: bound cleanup_offline_cgwb() rescans by rotating scanned inodes (CVE-2026-98538)

    In the Linux kernel, the following vulnerability has been resolved:

    nitro_enclaves: fix use-after-free on SLOT_ALLOC failure (CVE-2026-98775)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - ceph: bound copied dentry name length in NFS export get_name ceph_get_name() copies the MDS-supplied name     into the caller's NAME_MAX-sized buffer with memcpy(name, rinfo->dname, rinfo->dname_len) and then writes     name[rinfo->dname_len] = 0, without checking dname_len against NAME_MAX. A malicious or buggy MDS that     returns a LOOKUPNAME reply with dname_len > NAME_MAX overflows the buffer. __get_snap_name() copies     rde->name / rde->name_len the same unchecked way. Impact: a malicious or compromised Ceph MDS overflows     the NAME_MAX name buffer in a client's NFS-export get_name path, a slab out-of-bounds write reported by     KASAN. Reachable when a CephFS mount is re-exported over NFS. Add ceph_export_copy_name(), which rejects     lengths above NAME_MAX with -ENAMETOOLONG before the copy, and use it in both ceph_get_name() and
    __get_snap_name(). (CVE-2026-89652)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
366741	Amazon Linux 2 : kernel (ALASKERNEL-5.10-2026-135)	Nessus	Amazon Linux Local Security Checks	Local	medium
365283	Amazon Linux 2023 : bpftool6.18, kernel6.18, kernel6.18-devel (ALAS2023-2026-3187)	Nessus	Amazon Linux Local Security Checks	Local	medium
365279	Amazon Linux 2023 : bpftool6.12, kernel6.12, kernel6.12-devel (ALAS2023-2026-3196)	Nessus	Amazon Linux Local Security Checks	Local	medium
365240	Amazon Linux 2023 : bpftool, kernel, kernel-devel (ALAS2023-2026-3183)	Nessus	Amazon Linux Local Security Checks	Local	critical
364137	Oracle Linux 10 / 9 : Unbreakable Enterprise kernel (ELSA-2026-500374)	Nessus	Oracle Linux Local Security Checks	Local	high
362907	Debian dla-4817 : ata-modules-6.12.107+deb12-armmp-di - security update	Nessus	Debian Local Security Checks	Local	high
351155	Debian dsa-6528 : ata-modules-6.12.111+deb13-armmp-di - security update	Nessus	Debian Local Security Checks	Local	high
345126	Linux Distros Unpatched Vulnerability : CVE-2026-89652	Nessus	Misc.	Local	critical

Detections

Analytics

CVE-2026-89652

critical

Tenable Plugins

medium

medium

medium

critical

high

high

high

critical