In the Linux kernel, the following vulnerability has been resolved: IB/isert: reject PDUs declaring more data than was received isert_recv_done() hands each received PDU to the opcode handlers without ever looking at wc->byte_len, the number of bytes the HCA actually placed in the receive descriptor. The handlers then copy that many bytes - the data-segment length the initiator declared in the BHS (ntoh24(hdr->dlength), via the derived unsol_data_len / imm_data_len) - out of the fixed-size descriptor: isert_handle_iscsi_dataout(): sg_copy_from_buffer(sg_start, sg_nents, isert_get_data(rx_desc), unsol_data_len); isert_handle_scsi_cmd(): sg_copy_from_buffer(cmd->se_cmd.t_data_sg, sg_nents, isert_get_data(rx_desc), imm_data_len); Because the declared length is never checked against wc->byte_len, an initiator can declare a data segment larger than the bytes it actually sent (and larger than the descriptor) and cause an out-of-bounds read of the receive buffer. Nothing upstream of isert closes this door: - __iscsit_check_dataout_hdr() bounds the inbound payload against conn_ops->MaxXmitDataSegmentLength (MXDSL) - a transmit parameter, used here for the inbound check. - iscsi_set_connection_parameters() sets ops->MaxXmitDataSegmentLength = ops->TargetRecvDataSegmentLength; and TARGETRECVDATASEGMENTLENGTH is absent from the min()-clamp list in iscsi_check_acceptor_state(), so the value the initiator declares is adopted verbatim (type range 512..16777215). The initiator effectively raises its own ceiling. - isert never clamps the negotiated value to its own fixed receive descriptor (ISER_RX_SIZE, 9216 bytes), so the target core's bound and the descriptor size are unrelated. The imm_data_len == data_len path is more than an over-read: it aliases the receive descriptor via sg_set_buf() and passes it to the backend as the data source for the SCSI WRITE, so an over-declared length causes heap contents past the descriptor to be written through the backend to the backing store. The backend is the victim of the oversized scatterlist isert hands it, not the cause; no read-back of the written bytes was demonstrated. Trigger: after login completes (full feature phase), an initiator that has declared a large TargetRecvDataSegmentLength and a FirstBurstLength that permits unsolicited/immediate data sends a PDU whose declared data-segment length exceeds what was received. With KASAN: BUG: KASAN: slab-out-of-bounds in sg_copy_buffer+0x150/0x1c0 Read of size 4096 at addr ffff888109720800 by task kworker/1:0H/25 Workqueue: ib-comp-wq ib_cq_poll_work Call Trace: sg_copy_buffer+0x150/0x1c0 isert_recv_done+0xba6/0x2390 __ib_process_cq+0xe1/0x390 ib_cq_poll_work+0x46/0x150 isert_recv_done+0xba6 resolves to isert_handle_iscsi_dataout() (ib_isert.c:1160), inlined through isert_rx_opcode(). Validate wc->byte_len against the framing in isert_recv_done() before the PDU reaches any handler, and reinstate the connection if it is short. Because the test compares without subtracting the header length, it also rejects PDUs shorter than the iSER and iSCSI headers, which would otherwise be parsed out of stale descriptor contents. The login handler rejects PDUs shorter than ISER_HEADERS_LEN (commit 29e7b925ae6d ("IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN")) but does not bound the declared length either; that is fixed in the next patch. The data handlers had no length check at all. isert reads the data segment from a fixed offset: isert_get_data() returns the iSER header plus ISER_HEADERS_LEN and makes no adjustment for an AHS. The bytes the handlers touch are therefore exactly [ISER_HEADERS_LEN, ISER_HEADERS_LEN + dlength), and comparing that sum against wc->byte_len bounds precisely the region that is read. An AHS term would only make the test stricter without bounding anything furth ---truncated---

tuxcare CENTOS8.4:CLSA-2026:1791858083: kernel: Fix of 94 CVEs (Critical)

The CentOS Linux 8.5 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS8.5:CLSA-2026:1791852988 advisory.

  - In the Linux kernel, the following vulnerability has been resolved: ACPI: processor: idle: Check     acpi_fetch_acpi_dev() return value The return value of acpi_fetch_acpi_dev() could be NULL, which would     cause a NULL pointer dereference to occur in acpi_device_hid(). [ rjw: Subject and changelog edits, added     empty line after if () ] (CVE-2022-50327)

  - In the Linux kernel, the following vulnerability has been resolved: ext4: fix null-ptr-deref in     ext4_write_info I caught a null-ptr-deref bug as follows:
    ================================================================== KASAN: null-ptr-deref in range     [0x0000000000000068-0x000000000000006f] CPU: 1 PID: 1589 Comm: umount Not tainted 5.10.0-02219-dirty #339     RIP: 0010:ext4_write_info+0x53/0x1b0 [...] Call Trace: dquot_writeback_dquots+0x341/0x9a0     ext4_sync_fs+0x19e/0x800 __sync_filesystem+0x83/0x100 sync_filesystem+0x89/0xf0     generic_shutdown_super+0x79/0x3e0 kill_block_super+0xa1/0x110 deactivate_locked_super+0xac/0x130     deactivate_super+0xb6/0xd0 cleanup_mnt+0x289/0x400 __cleanup_mnt+0x16/0x20 task_work_run+0x11c/0x1c0     exit_to_user_mode_prepare+0x203/0x210 syscall_exit_to_user_mode+0x5b/0x3a0 do_syscall_64+0x59/0x70     entry_SYSCALL_64_after_hwframe+0x44/0xa9     ================================================================== Above issue may happen as follows:
    ------------------------------------- exit_to_user_mode_prepare task_work_run __cleanup_mnt cleanup_mnt     deactivate_super deactivate_locked_super kill_block_super generic_shutdown_super shrink_dcache_for_umount     dentry = sb->s_root sb->s_root = NULL <--- Here set NULL sync_filesystem __sync_filesystem     sb->s_op->sync_fs > ext4_sync_fs dquot_writeback_dquots sb->dq_op->write_info > ext4_write_info     ext4_journal_start(d_inode(sb->s_root), EXT4_HT_QUOTA, 2) d_inode(sb->s_root) s_root->d_inode <--- Null     pointer dereference To solve this problem, we use ext4_journal_start_sb directly to avoid s_root being     used. (CVE-2022-50344)

  - In the Linux kernel, the following vulnerability has been resolved: drm/vkms: Fix null-ptr-deref in     vkms_release() A null-ptr-deref is triggered when it tries to destroy the workqueue in     vkms->output.composer_workq in vkms_release(). KASAN: null-ptr-deref in range     [0x0000000000000118-0x000000000000011f] CPU: 5 PID: 17193 Comm: modprobe Not tainted     6.0.0-11331-gd465bff130bf #24 RIP: 0010:destroy_workqueue+0x2f/0x710 ... Call Trace: <TASK> ?     vkms_config_debugfs_init+0x50/0x50 [vkms] __devm_drm_dev_alloc+0x15a/0x1c0 [drm] vkms_init+0x245/0x1000     [vkms] do_one_initcall+0xd0/0x4f0 do_init_module+0x1a4/0x680 load_module+0x6249/0x7110
    __do_sys_finit_module+0x140/0x200 do_syscall_64+0x35/0x80 entry_SYSCALL_64_after_hwframe+0x46/0xb0 The     reason is that an OOM happened which triggers the destroy of the workqueue, however, the workqueue is     alloced in the later process, thus a null-ptr-deref happened. A simple call graph is shown as below:
    vkms_init() vkms_create() devm_drm_dev_alloc() __devm_drm_dev_alloc() devm_drm_dev_init()     devm_add_action_or_reset() devm_add_action() # an error happened devm_drm_dev_init_release() drm_dev_put()     kref_put() drm_dev_release() vkms_release() destroy_workqueue() # null-ptr-deref happened     vkms_modeset_init() vkms_output_init() vkms_crtc_init() # where the workqueue get allocated Fix this by     checking if composer_workq is NULL before passing it to the destroy_workqueue() in vkms_release().
    (CVE-2022-50369)

  - In the Linux kernel, the following vulnerability has been resolved: nfsd: under NFSv4.1, fix double     svc_xprt_put on rpc_create failure On error situation `clp->cl_cb_conn.cb_xprt` should not be given a     reference to the xprt otherwise both client cleanup and the error handling path of the caller call to put     it. Better to delay handing over the reference to a later branch. [ 72.530665] refcount_t: underflow; use-     after-free. [ 72.531933] WARNING: CPU: 0 PID: 173 at lib/refcount.c:28 refcount_warn_saturate+0xcf/0x120 [     72.533075] Modules linked in: nfsd(OE) nfsv4(OE) nfsv3(OE) nfs(OE) lockd(OE) compat_nfs_ssc(OE)     nfs_acl(OE) rpcsec_gss_krb5(OE) auth_rpcgss(OE) rpcrdma(OE) dns_resolver fscache netfs grace rdma_cm iw_cm     ib_cm sunrpc(OE) mlx5_ib mlx5_core mlxfw pci_hyperv_intf ib_uverbs ib_core xt_MASQUERADE     nf_conntrack_netlink nft_counter xt_addrtype nft_compat br_netfilter bridge stp llc nft_reject_inet     nf_reject_ipv4 nf_reject_ipv6 nft_reject nft_ct nft_chain_nat nf_nat nf_conntrack nf_defrag_ipv6     nf_defrag_ipv4 ip_set overlay nf_tables nfnetlink crct10dif_pclmul crc32_pclmul ghash_clmulni_intel xfs     serio_raw virtio_net virtio_blk net_failover failover fuse [last unloaded: sunrpc] [ 72.540389] CPU: 0     PID: 173 Comm: kworker/u16:5 Tainted: G OE 5.15.82-dan #1 [ 72.541511] Hardware name: Red Hat KVM/RHEL-AV,     BIOS 1.16.0-3.module+el8.7.0+1084+97b81f61 04/01/2014 [ 72.542717] Workqueue: nfsd4_callbacks     nfsd4_run_cb_work [nfsd] [ 72.543575] RIP: 0010:refcount_warn_saturate+0xcf/0x120 [ 72.544299] Code: 55 00     0f 0b 5d e9 01 50 98 00 80 3d 75 9e 39 08 00 0f 85 74 ff ff ff 48 c7 c7 e8 d1 60 8e c6 05 61 9e 39 08 01     e8 f6 51 55 00 <0f> 0b 5d e9 d9 4f 98 00 80 3d 4b 9e 39 08 00 0f 85 4c ff ff ff 48 [ 72.546666] RSP:
    0018:ffffb3f841157cf0 EFLAGS: 00010286 [ 72.547393] RAX: 0000000000000026 RBX: ffff89ac6231d478 RCX:
    0000000000000000 [ 72.548324] RDX: ffff89adb7c2c2c0 RSI: ffff89adb7c205c0 RDI: ffff89adb7c205c0 [     72.549271] RBP: ffffb3f841157cf0 R08: 0000000000000000 R09: c0000000ffefffff [ 72.550209] R10:
    0000000000000001 R11: ffffb3f841157ad0 R12: ffff89ac6231d180 [ 72.551142] R13: ffff89ac6231d478 R14:
    ffff89ac40c06180 R15: ffff89ac6231d4b0 [ 72.552089] FS: 0000000000000000(0000) GS:ffff89adb7c00000(0000)     knlGS:0000000000000000 [ 72.553175] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 72.553934] CR2:
    0000563a310506a8 CR3: 0000000109a66000 CR4: 0000000000350ef0 [ 72.554874] Call Trace: [ 72.555278] <TASK>     [ 72.555614] svc_xprt_put+0xaf/0xe0 [sunrpc] [ 72.556276] nfsd4_process_cb_update.isra.11+0xb7/0x410     [nfsd] [ 72.557087] ? update_load_avg+0x82/0x610 [ 72.557652] ? cpuacct_charge+0x60/0x70 [ 72.558212] ?     dequeue_entity+0xdb/0x3e0 [ 72.558765] ? queued_spin_unlock+0x9/0x20 [ 72.559358]     nfsd4_run_cb_work+0xfc/0x270 [nfsd] [ 72.560031] process_one_work+0x1df/0x390 [ 72.560600]     worker_thread+0x37/0x3b0 [ 72.561644] ? process_one_work+0x390/0x390 [ 72.562247] kthread+0x12f/0x150 [     72.562710] ? set_kthread_struct+0x50/0x50 [ 72.563309] ret_from_fork+0x22/0x30 [ 72.563818] </TASK> [     72.564189] ---[ end trace 031117b1c72ec616 ]--- [ 72.566019] list_add corruption. next->prev should be     prev (ffff89ac4977e538), but was ffff89ac4763e018. (next=ffff89ac4763e018). [ 72.567647] ------------[ cut     here ]------------ (CVE-2022-50401)

  - In the Linux kernel, the following vulnerability has been resolved: bpf: Propagate error from     htab_lock_bucket() to userspace In __htab_map_lookup_and_delete_batch() if htab_lock_bucket() returns
    -EBUSY, it will go to next bucket. Going to next bucket may not only skip the elements in current bucket     silently, but also incur out-of-bound memory access or expose kernel memory to userspace if current     bucket_cnt is greater than bucket_size or zero. Fixing it by stopping batch operation and returning -EBUSY     when htab_lock_bucket() fails, and the application can retry or skip the busy batch as needed.
    (CVE-2022-50490)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - IB/isert: reject PDUs declaring more data than was received isert_recv_done() hands each received PDU to     the opcode handlers without ever looking at wc->byte_len, the number of bytes the HCA actually placed in     the receive descriptor. The handlers then copy that many bytes - the data-segment length the initiator     declared in the BHS (ntoh24(hdr->dlength), via the derived unsol_data_len / imm_data_len) - out of the     fixed-size descriptor: isert_handle_iscsi_dataout(): sg_copy_from_buffer(sg_start, sg_nents,     isert_get_data(rx_desc), unsol_data_len); isert_handle_scsi_cmd():
    sg_copy_from_buffer(cmd->se_cmd.t_data_sg, sg_nents, isert_get_data(rx_desc), imm_data_len); Because the     declared length is never checked against wc->byte_len, an initiator can declare a data segment larger than     the bytes it actually sent (and larger than the descriptor) and cause an out-of-bounds read of the receive     buffer. Nothing upstream of isert closes this door: - __iscsit_check_dataout_hdr() bounds the inbound     payload against conn_ops->MaxXmitDataSegmentLength (MXDSL) - a transmit parameter, used here for the     inbound check. - iscsi_set_connection_parameters() sets ops->MaxXmitDataSegmentLength =     ops->TargetRecvDataSegmentLength; and TARGETRECVDATASEGMENTLENGTH is absent from the min()-clamp list in     iscsi_check_acceptor_state(), so the value the initiator declares is adopted verbatim (type range     512..16777215). The initiator effectively raises its own ceiling. - isert never clamps the negotiated     value to its own fixed receive descriptor (ISER_RX_SIZE, 9216 bytes), so the target core's bound and the     descriptor size are unrelated. The imm_data_len == data_len path is more than an over-read: it aliases the     receive descriptor via sg_set_buf() and passes it to the backend as the data source for the SCSI WRITE, so     an over-declared length causes heap contents past the descriptor to be written through the backend to the     backing store. The backend is the victim of the oversized scatterlist isert hands it, not the cause; no     read-back of the written bytes was demonstrated. Trigger: after login completes (full feature phase), an     initiator that has declared a large TargetRecvDataSegmentLength and a FirstBurstLength that permits     unsolicited/immediate data sends a PDU whose declared data-segment length exceeds what was received. With     KASAN: BUG: KASAN: slab-out-of-bounds in sg_copy_buffer+0x150/0x1c0 Read of size 4096 at addr     ffff888109720800 by task kworker/1:0H/25 Workqueue: ib-comp-wq ib_cq_poll_work Call Trace:
    sg_copy_buffer+0x150/0x1c0 isert_recv_done+0xba6/0x2390 __ib_process_cq+0xe1/0x390     ib_cq_poll_work+0x46/0x150 isert_recv_done+0xba6 resolves to isert_handle_iscsi_dataout()     (ib_isert.c:1160), inlined through isert_rx_opcode(). Validate wc->byte_len against the framing in     isert_recv_done() before the PDU reaches any handler, and reinstate the connection if it is short. Because     the test compares without subtracting the header length, it also rejects PDUs shorter than the iSER and     iSCSI headers, which would otherwise be parsed out of stale descriptor contents. The login handler rejects     PDUs shorter than ISER_HEADERS_LEN (commit 29e7b925ae6d (IB/isert: Reject login PDUs shorter than     ISER_HEADERS_LEN)) but does not bound the declared length either; that is fixed in the next patch. The     data handlers had no length check at all. isert reads the data segment from a fixed offset:
    isert_get_data() returns the iSER header plus ISER_HEADERS_LEN and makes no adjustment for an AHS. The     bytes the handlers touch are therefore exactly [ISER_HEADERS_LEN, ISER_HEADERS_LEN + dlength), and     comparing that sum against wc->byte_len bounds precisely the region that is read. An AHS term would only     make the test stricter without bounding anything furth ---truncated--- (CVE-2026-90414)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
365299	CentOS Linux 8.5 [TuxCare] Security Update: bpftool / kernel / kernel-core / kernel-cross-headers / etc Multiple Vulnerabilities (CENTOS8.5:CLSA-2026:1791852988)	Nessus	CentOS Local Security Checks	Local	high
364137	Oracle Linux 10 / 9 : Unbreakable Enterprise kernel (ELSA-2026-500374)	Nessus	Oracle Linux Local Security Checks	Local	high
362907	Debian dla-4817 : ata-modules-6.12.107+deb12-armmp-di - security update	Nessus	Debian Local Security Checks	Local	high
351155	Debian dsa-6528 : ata-modules-6.12.111+deb13-armmp-di - security update	Nessus	Debian Local Security Checks	Local	high
347716	Linux Distros Unpatched Vulnerability : CVE-2026-90414	Nessus	Misc.	Local	critical

Detections

Analytics

CVE-2026-90414

critical

Tenable Plugins

Coming Soon

high

high

high

high

critical