In the Linux kernel, the following vulnerability has been resolved: sunrpc: xprtsock: annotate shared socket callbacks with READ_ONCE/WRITE_ONCE xprtsock replaces and restores sk->sk_data_ready and sk->sk_write_space on live sockets with plain stores, and xs_udp_do_set_buffer_size() invokes sk->sk_write_space via a plain load. These callback pointers are shared with generic socket and protocol paths that may read or invoke them concurrently, so xprtsock needs the same READ_ONCE()/WRITE_ONCE() callback visibility contract that the validated 4022 family applied elsewhere. When SUNRPC takes over an AF_LOCAL, UDP, or TCP socket and later restores the lower-socket callbacks during teardown, another CPU may still hold an earlier callback snapshot. The plain replace/restore pattern leaves the same visibility hole as the validated 4022 family, so a stale snapshot can still invoke xs_data_ready() or xs_udp_write_space() after the live callback fields have already been restored to the lower-socket handlers. Use WRITE_ONCE() for the shared sk_data_ready and sk_write_space stores in xs_local_finish_connecting(), xs_udp_finish_connecting(), xs_tcp_finish_connecting(), and xs_restore_old_callbacks(). Use READ_ONCE() for the direct sk_write_space invocation in xs_udp_do_set_buffer_size(). This matches the required callback visibility contract while leaving adjacent sk_state_change and sk_error_report handling unchanged.

The CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS7:CLSA-2026:1792976962 advisory.

  - In the Linux kernel, the following vulnerability has been resolved: wifi: ath9k: avoid uninit memory read     in ath9k_htc_rx_msg() syzbot is reporting uninit value at ath9k_htc_rx_msg() [1], for     ioctl(USB_RAW_IOCTL_EP_WRITE) can call ath9k_hif_usb_rx_stream() with pkt_len = 0 but     ath9k_hif_usb_rx_stream() uses __dev_alloc_skb(pkt_len + 32, GFP_ATOMIC) based on an assumption that     pkt_len is valid. As a result, ath9k_hif_usb_rx_stream() allocates skb with uninitialized memory and     ath9k_htc_rx_msg() is reading from uninitialized memory. Since bytes accessed by ath9k_htc_rx_msg() is not     known until ath9k_htc_rx_msg() is called, it would be difficult to check minimal valid pkt_len at if     (pkt_len > 2 * MAX_RX_BUF_SIZE) { line in ath9k_hif_usb_rx_stream(). We have two choices. One is to     workaround by adding __GFP_ZERO so that ath9k_htc_rx_msg() sees 0 if pkt_len is invalid. The other is to     let ath9k_htc_rx_msg() validate pkt_len before accessing. This patch chose the latter. Note that I'm not     sure threshold condition is correct, for I can't find details on possible packet length used by this     protocol. (CVE-2022-50709)

  - In the Linux kernel, the following vulnerability has been resolved: configfs: fix possible memory leak in     configfs_create_dir() kmemleak reported memory leaks in configfs_create_dir(): unreferenced object     0xffff888009f6af00 (size 192): comm modprobe, pid 3777, jiffies 4295537735 (age 233.784s) backtrace:
    kmem_cache_alloc (mm/slub.c:3250 mm/slub.c:3256 mm/slub.c:3263 mm/slub.c:3273) new_fragment     (./include/linux/slab.h:600 fs/configfs/dir.c:163) configfs_register_subsystem (fs/configfs/dir.c:1857)     basic_write (drivers/hwtracing/stm/p_basic.c:14) stm_p_basic do_one_initcall (init/main.c:1296)     do_init_module (kernel/module/main.c:2455) ... unreferenced object 0xffff888003ba7180 (size 96): comm     modprobe, pid 3777, jiffies 4295537735 (age 233.784s) backtrace: kmem_cache_alloc (mm/slub.c:3250     mm/slub.c:3256 mm/slub.c:3263 mm/slub.c:3273) configfs_new_dirent (./include/linux/slab.h:723     fs/configfs/dir.c:194) configfs_make_dirent (fs/configfs/dir.c:248) configfs_create_dir     (fs/configfs/dir.c:296) configfs_attach_group.isra.28 (fs/configfs/dir.c:816 fs/configfs/dir.c:852)     configfs_register_subsystem (fs/configfs/dir.c:1881) basic_write (drivers/hwtracing/stm/p_basic.c:14)     stm_p_basic do_one_initcall (init/main.c:1296) do_init_module (kernel/module/main.c:2455) ... This is     because the refcount is not correct in configfs_make_dirent(). For normal stage, the refcount is changing     as: configfs_register_subsystem() configfs_create_dir() configfs_make_dirent() configfs_new_dirent() # set     s_count = 1 dentry->d_fsdata = configfs_get(sd); # s_count = 2 ... configfs_unregister_subsystem()     configfs_remove_dir() remove_dir() configfs_remove_dirent() # s_count = 1 dput() ...
    *dentry_unlink_inode()* configfs_d_iput() # s_count = 0, release However, if we failed in     configfs_create(): configfs_register_subsystem() configfs_create_dir() configfs_make_dirent() # s_count =     2 ... configfs_create() # fail ->out_remove: configfs_remove_dirent(dentry) configfs_put(sd) # s_count = 1     return PTR_ERR(inode); There is no inode in the error path, so the configfs_d_iput() is lost and makes sd     and fragment memory leaked. To fix this, when we failed in configfs_create(), manually call     configfs_put(sd) to keep the refcount correct. (CVE-2022-50751)

  - In the Linux kernel, the following vulnerability has been resolved: pstore: Avoid kcore oops by vmap()ing     with VM_IOREMAP An oops can be induced by running 'cat /proc/kcore > /dev/null' on devices using pstore     with the ram backend because kmap_atomic() assumes lowmem pages are accessible with __va(). Unable to     handle kernel paging request at virtual address ffffff807ff2b000 Mem abort info: ESR = 0x96000006 EC =     0x25: DABT (current EL), IL = 32 bits SET = 0, FnV = 0 EA = 0, S1PTW = 0 FSC = 0x06: level 2 translation     fault Data abort info: ISV = 0, ISS = 0x00000006 CM = 0, WnR = 0 swapper pgtable: 4k pages, 39-bit VAs,     pgdp=0000000081d87000 [ffffff807ff2b000] pgd=180000017fe18003, p4d=180000017fe18003, pud=180000017fe18003,     pmd=0000000000000000 Internal error: Oops: 96000006 [#1] PREEMPT SMP Modules linked in: dm_integrity CPU:
    7 PID: 21179 Comm: perf Not tainted 5.15.67-10882-ge4eb2eb988cd #1     baa443fb8e8477896a370b31a821eb2009f9bfba Hardware name: Google Lazor (rev3 - 8) (DT) pstate: a0400009     (NzCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : __memcpy+0x110/0x260 lr : vread+0x194/0x294 sp :
    ffffffc013ee39d0 x29: ffffffc013ee39f0 x28: 0000000000001000 x27: ffffff807ff2b000 x26: 0000000000001000     x25: ffffffc0085a2000 x24: ffffff802d4b3000 x23: ffffff80f8a60000 x22: ffffff802d4b3000 x21:
    ffffffc0085a2000 x20: ffffff8080b7bc68 x19: 0000000000001000 x18: 0000000000000000 x17: 0000000000000000     x16: 0000000000000000 x15: ffffffd3073f2e60 x14: ffffffffad588000 x13: 0000000000000000 x12:
    0000000000000001 x11: 00000000000001a2 x10: 00680000fff2bf0b x9 : 03fffffff807ff2b x8 : 0000000000000001     x7 : 0000000000000000 x6 : 0000000000000000 x5 : ffffff802d4b4000 x4 : ffffff807ff2c000 x3 :
    ffffffc013ee3a78 x2 : 0000000000001000 x1 : ffffff807ff2b000 x0 : ffffff802d4b3000 Call trace:
    __memcpy+0x110/0x260 read_kcore+0x584/0x778 proc_reg_read+0xb4/0xe4 During early boot, memblock reserves     the pages for the ramoops reserved memory node in DT that would otherwise be part of the direct lowmem     mapping. Pstore's ram backend reuses those reserved pages to change the memory type (writeback or non-     cached) by passing the pages to vmap() (see pfn_to_page() usage in persistent_ram_vmap() for more details)     with specific flags. When read_kcore() starts iterating over the vmalloc region, it runs over the virtual     address that vmap() returned for ramoops. In aligned_vread() the virtual address is passed to     vmalloc_to_page() which returns the page struct for the reserved lowmem area. That lowmem page is passed     to kmap_atomic(), which effectively calls page_to_virt() that assumes a lowmem page struct must be     directly accessible with __va() and friends. These pages are mapped via vmap() though, and the lowmem     mapping was never made, so accessing them via the lowmem virtual address oopses like above. Let's side-     step this problem by passing VM_IOREMAP to vmap(). This will tell vread() to not include the ramoops     region in the kcore. Instead the area will look like a bunch of zeros. The alternative is to teach kmap()     about vmalloc areas that intersect with lowmem. Presumably such a change isn't a one-liner, and there     isn't much interest in inspecting the ramoops region in kcore files anyway, so the most expedient route is     taken for now. (CVE-2022-50849)

  - In the Linux kernel, the following vulnerability has been resolved: hwrng: amd - Fix PCI device refcount     leak for_each_pci_dev() is implemented by pci_get_device(). The comment of pci_get_device() says that it     will increase the reference count for the returned pci_dev and also decrease the reference count for the     input pci_dev @from if it is not NULL. If we break for_each_pci_dev() loop with pdev not NULL, we need to     call pci_dev_put() to decrease the reference count. Add the missing pci_dev_put() for the normal and error     path. (CVE-2022-50868)

  - In the Linux kernel, the following vulnerability has been resolved: RDMA/srp: Do not call scsi_done() from     srp_abort() After scmd_eh_abort_handler() has called the SCSI LLD eh_abort_handler callback, it performs     one of the following actions: * Call scsi_queue_insert(). * Call scsi_finish_command(). * Call     scsi_eh_scmd_add(). Hence, SCSI abort handlers must not call scsi_done(). Otherwise all the above actions     would trigger a use-after-free. Hence remove the scsi_done() call from srp_abort(). Keep the     srp_free_req() call before returning SUCCESS because we may not see the command again if SUCCESS is     returned. (CVE-2023-52515)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - In the Linux kernel, the following vulnerability has been resolved: sunrpc: xprtsock: annotate shared
    socket callbacks with READ_ONCE/WRITE_ONCE xprtsock replaces and restores sk->sk_data_ready and
    sk->sk_write_space on live sockets with plain stores, and xs_udp_do_set_buffer_size() invokes
    sk->sk_write_space via a plain load. These callback pointers are shared with generic socket and protocol
    paths that may read or invoke them concurrently, so xprtsock needs the same READ_ONCE()/WRITE_ONCE()
    callback visibility contract that the validated 4022 family applied elsewhere. When SUNRPC takes over an
    AF_LOCAL, UDP, or TCP socket and later restores the lower-socket callbacks during teardown, another CPU
    may still hold an earlier callback snapshot. The plain replace/restore pattern leaves the same visibility
    hole as the validated 4022 family, so a stale snapshot can still invoke xs_data_ready() or
    xs_udp_write_space() after the live callback fields have already been restored to the lower-socket
    handlers. Use WRITE_ONCE() for the shared sk_data_ready and sk_write_space stores in
    xs_local_finish_connecting(), xs_udp_finish_connecting(), xs_tcp_finish_connecting(), and
    xs_restore_old_callbacks(). Use READ_ONCE() for the direct sk_write_space invocation in
    xs_udp_do_set_buffer_size(). This matches the required callback visibility contract while leaving adjacent
    sk_state_change and sk_error_report handling unchanged. (CVE-2026-90235)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - sunrpc: xprtsock: annotate shared socket callbacks with READ_ONCE/WRITE_ONCE xprtsock replaces and     restores sk->sk_data_ready and sk->sk_write_space on live sockets with plain stores, and     xs_udp_do_set_buffer_size() invokes sk->sk_write_space via a plain load. These callback pointers are     shared with generic socket and protocol paths that may read or invoke them concurrently, so xprtsock needs     the same READ_ONCE()/WRITE_ONCE() callback visibility contract that the validated 4022 family applied     elsewhere. When SUNRPC takes over an AF_LOCAL, UDP, or TCP socket and later restores the lower-socket     callbacks during teardown, another CPU may still hold an earlier callback snapshot. The plain     replace/restore pattern leaves the same visibility hole as the validated 4022 family, so a stale snapshot     can still invoke xs_data_ready() or xs_udp_write_space() after the live callback fields have already been     restored to the lower-socket handlers. Use WRITE_ONCE() for the shared sk_data_ready and sk_write_space     stores in xs_local_finish_connecting(), xs_udp_finish_connecting(), xs_tcp_finish_connecting(), and     xs_restore_old_callbacks(). Use READ_ONCE() for the direct sk_write_space invocation in     xs_udp_do_set_buffer_size(). This matches the required callback visibility contract while leaving adjacent     sk_state_change and sk_error_report handling unchanged. (CVE-2026-90235)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
374124	CentOS Linux 7 [TuxCare] Security Update: bpftool / kernel / kernel-debug / kernel-debug-devel / kernel-devel / etc Multiple Vulnerabilities (CENTOS7:CLSA-2026:1792976962)	Nessus	CentOS Local Security Checks	Local	high
365279	Amazon Linux 2023 : bpftool6.12, kernel6.12, kernel6.12-devel (ALAS2023-2026-3196)	Nessus	Amazon Linux Local Security Checks	Local	medium
365258	Amazon Linux 2023 : bpftool6.18, kernel6.18, kernel6.18-devel (ALAS2023-2026-3192)	Nessus	Amazon Linux Local Security Checks	Local	high
364137	Oracle Linux 10 / 9 : Unbreakable Enterprise kernel (ELSA-2026-500374)	Nessus	Oracle Linux Local Security Checks	Local	high
362907	Debian dla-4817 : ata-modules-6.12.107+deb12-armmp-di - security update	Nessus	Debian Local Security Checks	Local	high
468329	Google: sys-kernel/cchost-kernel-6_12, sys-kernel/csql-kernel-6_12, sys-kernel/csql-kernel-6_6, sys-kernel/lakitu-kernel-6_12, sys-kernel/lakitu-kernel-6_6, sys-kernel/lakitu-nc-kernel-6_12, sys-kernel/lakitu-nc-kernel-6_6, sys-kernel/lakitu-vgpu-kernel-6_6: security update to 19216.700.7	Tenable Cloud Security	Google COS Security Checks	Local	critical
468329	Google: sys-kernel/cchost-kernel-6_12, sys-kernel/csql-kernel-6_12, sys-kernel/csql-kernel-6_6, sys-kernel/lakitu-kernel-6_12, sys-kernel/lakitu-kernel-6_6, sys-kernel/lakitu-nc-kernel-6_12, sys-kernel/lakitu-nc-kernel-6_6, sys-kernel/lakitu-vgpu-kernel-6_6: security update to 19216.700.7	Tenable Self-Hosted Container Security	Google COS Security Checks	Local	critical
351155	Debian dsa-6528 : ata-modules-6.12.111+deb13-armmp-di - security update	Nessus	Debian Local Security Checks	Local	high
347504	Linux Distros Unpatched Vulnerability : CVE-2026-90235	Nessus	Misc.	Local	critical

Detections

Analytics

CVE-2026-90235

critical

Tenable Plugins

high

medium

high

high

high

critical

critical

high

critical