In the Linux kernel, the following vulnerability has been resolved: nfsd: don't free session slots that are still in use nfsd4_sequence() can free the very slot it is currently processing. When the session shrinker has reduced se_target_maxslots below se_fchannel.maxreqs, the shrink path checks three conditions before calling free_session_slots(): 1. se_target_maxslots < maxreqs (shrink was advertised) 2. slot->sl_generation == se_slot_gen (slot is up-to-date) 3. seq->maxslots <= se_target_maxslots (client acknowledges) However, seq->slotid is never checked against se_target_maxslots. A client using a slot in the range [se_target_maxslots, maxreqs) can satisfy all three conditions: its slot has the current generation (set by a prior SEQUENCE), and it sends sa_highest_slotid <= se_target_maxslots to acknowledge the reduction. free_session_slots() then kfrees every slot at index >= se_target_maxslots, including the caller's own slot. The function continues to write sl_seqid, sl_flags, sl_generation, and stores the dangling pointer in cstate->slot. Later, nfsd4_store_cache_entry() copies up to maxresp_cached bytes of the compound reply into the freed sl_data[] array, corrupting whatever slab object now occupies that address. Additionally, a concurrent thread processing SEQUENCE on a different high-numbered slot can have its slot freed out from under it. NFSD4_SLOT_INUSE is set under nn->client_lock before the lock is released, so any concurrent thread past SEQUENCE will have its slot marked. However, free_session_slots() does not check NFSD4_SLOT_INUSE before freeing. Fix both problems by: 1. Checking that the current request's slotid is below the shrink boundary. 2. Scanning slots in the to-be-freed range for NFSD4_SLOT_INUSE and deferring the shrink if any are active.

The remote AlmaLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:83207 advisory.

    * kernel: netfilter: nfnetlink_queue: do shared-unconfirmed check before segmentation (CVE-2026-45859)
      * kernel: net/sched: act_ct: Only release RCU read lock after ct_ft (CVE-2026-46319)
      * kernel: net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CVE-2026-53011)
      * kernel: USB: serial: mxuport: fix memory corruption with small endpoint (CVE-2026-63899)
      * kernel: bridge: mcast: Fix a possible use-after-free when removing a bridge port (CVE-2026-64032)
      * kernel: wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (CVE-2026-64030)
      * kernel: Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CVE-2026-63974)
      * kernel: idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (CVE-2026-64162)
      * kernel: Linux kernel: Denial of Service due to use-after-free in act_tunnel_key (CVE-2026-68377)
      * kernel: net/iucv: fix use-after-free of a severed iucv_path (CVE-2026-68140)
      * kernel: ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CVE-2026-72262)
      * kernel: dmaengine: idxd: fix fdev setup failure cleanup in idxd_cdev_open() (CVE-2026-74574)
      * kernel: ALSA: usx2y: bound the hwdep mmap fault offset (CVE-2026-74641)
      * kernel: net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (CVE-2026-80985)
      * kernel: svcrdma: Validate Read chunk positions before reconstruction (CVE-2026-89526)
      * kernel: nfsd: don't free session slots that are still in use (CVE-2026-89689)
      * kernel: NFSD: Prevent client use-after-free during blocked-lock reaping (CVE-2026-90036)
      * kernel: media: cx231xx: reject geometry changes while the VBI queue is busy (CVE-2026-89894)
      * kernel: SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (CVE-2026-93207)
      * kernel: svcrdma: Reject Write/Reply chunks with segcount 0 (CVE-2026-93228)


    Bug Fix(es) and Enhancement(s):

      * cannot use VFs of i40e/ice NIC in bond device (JIRA:AlmaLinux-143410)
      * ionic: commit backported to 9.8 missing in 10.2 (JIRA:AlmaLinux-165657)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Rocky Linux 10.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-2026_83207 advisory.

    * kernel: netfilter: nfnetlink_queue: do shared-unconfirmed check before segmentation (CVE-2026-45859)

    * kernel: net/sched: act_ct: Only release RCU read lock after ct_ft (CVE-2026-46319)

    * kernel: net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CVE-2026-53011)

    * kernel: USB: serial: mxuport: fix memory corruption with small endpoint (CVE-2026-63899)

    * kernel: bridge: mcast: Fix a possible use-after-free when removing a bridge port (CVE-2026-64032)

    * kernel: wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (CVE-2026-64030)

    * kernel: Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CVE-2026-63974)

    * kernel: idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (CVE-2026-64162)

    * kernel: Linux kernel: Denial of Service due to use-after-free in act_tunnel_key (CVE-2026-68377)

    * kernel: net/iucv: fix use-after-free of a severed iucv_path (CVE-2026-68140)

    * kernel: ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CVE-2026-72262)

    * kernel: dmaengine: idxd: fix fdev setup failure cleanup in idxd_cdev_open() (CVE-2026-74574)

    * kernel: ALSA: usx2y: bound the hwdep mmap fault offset (CVE-2026-74641)

    * kernel: net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (CVE-2026-80985)

    * kernel: svcrdma: Validate Read chunk positions before reconstruction (CVE-2026-89526)

    * kernel: nfsd: don't free session slots that are still in use (CVE-2026-89689)

    * kernel: NFSD: Prevent client use-after-free during blocked-lock reaping (CVE-2026-90036)

    * kernel: media: cx231xx: reject geometry changes while the VBI queue is busy (CVE-2026-89894)

    * kernel: SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (CVE-2026-93207)

    * kernel: svcrdma: Reject Write/Reply chunks with segcount 0 (CVE-2026-93228)

    Bug Fix(es) and Enhancement(s):

    * cannot use VFs of i40e/ice NIC in bond device (JIRA:Rocky Linux-143410)

    * ionic: commit backported to 9.8 missing in 10.2 (JIRA:Rocky Linux-165657)

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - In the Linux kernel, the following vulnerability has been resolved: nfsd: don't free session slots that
    are still in use nfsd4_sequence() can free the very slot it is currently processing. When the session
    shrinker has reduced se_target_maxslots below se_fchannel.maxreqs, the shrink path checks three conditions
    before calling free_session_slots(): 1. se_target_maxslots < maxreqs (shrink was advertised) 2.
    slot->sl_generation == se_slot_gen (slot is up-to-date) 3. seq->maxslots <= se_target_maxslots (client
    acknowledges) However, seq->slotid is never checked against se_target_maxslots. A client using a slot in
    the range [se_target_maxslots, maxreqs) can satisfy all three conditions: its slot has the current
    generation (set by a prior SEQUENCE), and it sends sa_highest_slotid <= se_target_maxslots to acknowledge
    the reduction. free_session_slots() then kfrees every slot at index >= se_target_maxslots, including the
    caller's own slot. The function continues to write sl_seqid, sl_flags, sl_generation, and stores the
    dangling pointer in cstate->slot. Later, nfsd4_store_cache_entry() copies up to maxresp_cached bytes of
    the compound reply into the freed sl_data[] array, corrupting whatever slab object now occupies that
    address. Additionally, a concurrent thread processing SEQUENCE on a different high-numbered slot can have
    its slot freed out from under it. NFSD4_SLOT_INUSE is set under nn->client_lock before the lock is
    released, so any concurrent thread past SEQUENCE will have its slot marked. However, free_session_slots()
    does not check NFSD4_SLOT_INUSE before freeing. Fix both problems by: 1. Checking that the current
    request's slotid is below the shrink boundary. 2. Scanning slots in the to-be-freed range for
    NFSD4_SLOT_INUSE and deferring the shrink if any are active. (CVE-2026-89689)

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-83207 advisory.

    - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271473]     {CVE-2026-80985}
    - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271473]     {CVE-2026-80985}
    - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271473]     {CVE-2026-80985}
    - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275057]     {CVE-2026-93207}
    - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275073] {CVE-2026-93228}
    - nfsd: don't free session slots that are still in use (Olga Kornievskaia) [RHEL-270850] {CVE-2026-89689}
    - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270946]     {CVE-2026-90036}
    - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270946]     {CVE-2026-89659}
    - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271459]     {CVE-2026-89526}
    - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262501]     {CVE-2026-89894}
    - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261677]     {CVE-2026-72262}
    - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260529] {CVE-2026-68140}
    - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (CKI Backport Bot) [RHEL-259554]     {CVE-2026-64030}
    - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259316]     {CVE-2026-63956}
    - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259316]     {CVE-2026-63957}
    - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259316]     {CVE-2026-63928}
    - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259316]     {CVE-2026-63899}
    - netfilter: nfnetlink_queue: do shared-unconfirmed check before segmentation (Phil Sutter) [RHEL-230721]     {CVE-2026-45859}
    - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256452] {CVE-2026-74641}
    - dmaengine: idxd: fix fdev setup failure cleanup in idxd_cdev_open() (CKI Backport Bot) [RHEL-254620]     {CVE-2026-74574}
    - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243402]     {CVE-2026-68291}
    - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243402]     {CVE-2026-53286}
    - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243402]     {CVE-2026-64162}
    - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243402]     {CVE-2026-31647}
    - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244763]     {CVE-2026-63974}
    - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244763]     {CVE-2026-63974}
    - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-240917]     {CVE-2026-68377}
    - bridge: mcast: Fix a possible use-after-free when removing a bridge port (CKI Backport Bot)     [RHEL-232531] {CVE-2026-64032}
    - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229655]     {CVE-2026-46319}
    - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot)     [RHEL-226492] {CVE-2026-53011}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:83207 advisory.

    * kernel: netfilter: nfnetlink_queue: do shared-unconfirmed check before segmentation (CVE-2026-45859)

    * kernel: net/sched: act_ct: Only release RCU read lock after ct_ft (CVE-2026-46319)

    * kernel: net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CVE-2026-53011)

    * kernel: USB: serial: mxuport: fix memory corruption with small endpoint (CVE-2026-63899)

    * kernel: bridge: mcast: Fix a possible use-after-free when removing a bridge port (CVE-2026-64032)

    * kernel: wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (CVE-2026-64030)

    * kernel: Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CVE-2026-63974)

    * kernel: idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (CVE-2026-64162)

    * kernel: Linux kernel: Denial of Service due to use-after-free in act_tunnel_key (CVE-2026-68377)

    * kernel: net/iucv: fix use-after-free of a severed iucv_path (CVE-2026-68140)

    * kernel: ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CVE-2026-72262)

    * kernel: dmaengine: idxd: fix fdev setup failure cleanup in idxd_cdev_open() (CVE-2026-74574)

    * kernel: ALSA: usx2y: bound the hwdep mmap fault offset (CVE-2026-74641)

    * kernel: net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (CVE-2026-80985)

    * kernel: svcrdma: Validate Read chunk positions before reconstruction (CVE-2026-89526)

    * kernel: nfsd: don't free session slots that are still in use (CVE-2026-89689)

    * kernel: NFSD: Prevent client use-after-free during blocked-lock reaping (CVE-2026-90036)

    * kernel: media: cx231xx: reject geometry changes while the VBI queue is busy (CVE-2026-89894)

    * kernel: SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (CVE-2026-93207)

    * kernel: svcrdma: Reject Write/Reply chunks with segcount 0 (CVE-2026-93228)

    Bug Fix(es) and Enhancement(s):

    * cannot use VFs of i40e/ice NIC in bond device (JIRA:Rocky Linux-143410)

    * ionic: commit backported to 9.8 missing in 10.2 (JIRA:Rocky Linux-165657)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:83207 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: netfilter: nfnetlink_queue: do shared-unconfirmed check before segmentation (CVE-2026-45859)

    * kernel: net/sched: act_ct: Only release RCU read lock after ct_ft (CVE-2026-46319)

    * kernel: net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CVE-2026-53011)

    * kernel: USB: serial: mxuport: fix memory corruption with small endpoint (CVE-2026-63899)

    * kernel: bridge: mcast: Fix a possible use-after-free when removing a bridge port (CVE-2026-64032)

    * kernel: wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (CVE-2026-64030)

    * kernel: Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CVE-2026-63974)

    * kernel: idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (CVE-2026-64162)

    * kernel: Linux kernel: Denial of Service due to use-after-free in act_tunnel_key (CVE-2026-68377)

    * kernel: net/iucv: fix use-after-free of a severed iucv_path (CVE-2026-68140)

    * kernel: ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CVE-2026-72262)

    * kernel: dmaengine: idxd: fix fdev setup failure cleanup in idxd_cdev_open() (CVE-2026-74574)

    * kernel: ALSA: usx2y: bound the hwdep mmap fault offset (CVE-2026-74641)

    * kernel: net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (CVE-2026-80985)

    * kernel: svcrdma: Validate Read chunk positions before reconstruction (CVE-2026-89526)

    * kernel: nfsd: don't free session slots that are still in use (CVE-2026-89689)

    * kernel: NFSD: Prevent client use-after-free during blocked-lock reaping (CVE-2026-90036)

    * kernel: media: cx231xx: reject geometry changes while the VBI queue is busy (CVE-2026-89894)

    * kernel: SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (CVE-2026-93207)

    * kernel: svcrdma: Reject Write/Reply chunks with segcount 0 (CVE-2026-93228)

    Bug Fix(es) and Enhancement(s):

    * cannot use VFs of i40e/ice NIC in bond device (JIRA:RHEL-143410)

    * ionic: commit backported to 9.8 missing in 10.2 (JIRA:RHEL-165657)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - nfsd: don't free session slots that are still in use nfsd4_sequence() can free the very slot it is     currently processing. When the session shrinker has reduced se_target_maxslots below se_fchannel.maxreqs,     the shrink path checks three conditions before calling free_session_slots(): 1. se_target_maxslots <     maxreqs (shrink was advertised) 2. slot->sl_generation == se_slot_gen (slot is up-to-date) 3.
    seq->maxslots <= se_target_maxslots (client acknowledges) However, seq->slotid is never checked against     se_target_maxslots. A client using a slot in the range [se_target_maxslots, maxreqs) can satisfy all three     conditions: its slot has the current generation (set by a prior SEQUENCE), and it sends sa_highest_slotid     <= se_target_maxslots to acknowledge the reduction. free_session_slots() then kfrees every slot at index     >= se_target_maxslots, including the caller's own slot. The function continues to write sl_seqid,     sl_flags, sl_generation, and stores the dangling pointer in cstate->slot. Later, nfsd4_store_cache_entry()     copies up to maxresp_cached bytes of the compound reply into the freed sl_data[] array, corrupting     whatever slab object now occupies that address. Additionally, a concurrent thread processing SEQUENCE on a     different high-numbered slot can have its slot freed out from under it. NFSD4_SLOT_INUSE is set under     nn->client_lock before the lock is released, so any concurrent thread past SEQUENCE will have its slot     marked. However, free_session_slots() does not check NFSD4_SLOT_INUSE before freeing. Fix both problems     by: 1. Checking that the current request's slotid is below the shrink boundary. 2. Scanning slots in the     to-be-freed range for NFSD4_SLOT_INUSE and deferring the shrink if any are active. (CVE-2026-89689)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
367179	AlmaLinux 10 : kernel (ALSA-2026:83207)	Nessus	Alma Linux Local Security Checks	Local	critical
366772	Rocky Linux 10.2 [CIQ] Security Update: kernel / kernel-64k / kernel-64k-core / kernel-64k-debug / etc Multiple Vulnerabilities (crlsa-2026_83207)	Nessus	Rocky Linux Local Security Checks	Local	critical
475574	Google: sys-kernel/cchost-kernel-6_18, sys-kernel/csql-kernel-6_18, sys-kernel/lakitu-kernel-6_18, sys-kernel/lakitu-nc-kernel-6_18: security update to 19999.44.106	Tenable Cloud Security	Google COS Security Checks	Local	critical
475574	Google: sys-kernel/cchost-kernel-6_18, sys-kernel/csql-kernel-6_18, sys-kernel/lakitu-kernel-6_18, sys-kernel/lakitu-nc-kernel-6_18: security update to 19999.44.106	Tenable Self-Hosted Container Security	Google COS Security Checks	Local	critical
366667	Oracle Linux 10 : kernel (ELSA-2026-83207)	Nessus	Oracle Linux Local Security Checks	Local	critical
366498	RockyLinux 10 : kernel (RLSA-2026:83207)	Nessus	Rocky Linux Local Security Checks	Local	critical
366024	RHEL 10 : kernel (RHSA-2026:83207)	Nessus	Red Hat Local Security Checks	Local	critical
365283	Amazon Linux 2023 : bpftool6.18, kernel6.18, kernel6.18-devel (ALAS2023-2026-3187)	Nessus	Amazon Linux Local Security Checks	Local	medium
345028	Linux Distros Unpatched Vulnerability : CVE-2026-89689	Nessus	Misc.	Local	critical

Detections

Analytics

CVE-2026-89689

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

medium

critical