In the Linux kernel, the following vulnerability has been resolved: virtio-fs: avoid double-free on failed queue setup virtio_fs_setup_vqs() allocates fs->vqs and fs->mq_map before calling virtio_find_vqs(). If virtio_find_vqs() fails, the error path frees both pointers and returns an error to virtio_fs_probe(). virtio_fs_probe() then drops the last kobject reference, and virtio_fs_ktype_release() frees fs->vqs and fs->mq_map again. This leaves dangling pointers in struct virtio_fs and can trigger a double-free during probe failure cleanup. Set fs->vqs and fs->mq_map to NULL immediately after kfree() in the virtio_fs_setup_vqs() error path so that the later kobject release sees an uninitialized state and kfree(NULL) becomes harmless. This can be reproduced when a broken virtio-fs device advertises more request queues than the transport actually provides. In that case virtio_find_vqs() fails while setting up the extra queue, and the probe path reaches the double-free cleanup sequence.

The Rocky Linux 10.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-2026_93413 advisory.

    * kernel: Kernel: Denial of Service in network socket error handling (CVE-2026-22977)

    * kernel: x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (CVE-2026-46174)

    * kernel: i2c: stub: Reject I2C block transfers with invalid length (CVE-2026-64191)

    * kernel: Linux kernel: PPP over L2TP Use-After-Free vulnerability (CVE-2026-68398)

    * kernel: mptcp: pm: userspace: fix use-after-free in get_local_id (CVE-2026-68169)

    * kernel: tipc: require net admin for TIPCv2 netlink mutators (CVE-2026-74283)

    * kernel: mptcp: options: reset DSS fields in case of unexpected size (CVE-2026-80586)

    * kernel: entry: Fix seccomp bypass after ptrace with TSYNC (CVE-2026-89603)

    * kernel: KVM: nVMX: Always flush vpid02 on first use (CVE-2026-89932)

    * kernel: scsi: target: iscsi: Reserve a terminator byte for the login payload (CVE-2026-90011)

    * kernel: virtio-fs: avoid double-free on failed queue setup (CVE-2026-93827)

    * kernel: smb: client: bound dirent name against end of SMB response in cifs_filldir (CVE-2026-93787)

    * kernel: KEYS: encrypted: fix integer overflow of datablob_len (CVE-2026-98222)

    * kernel: xfrm: hold net_device reference under RCU in bundle creation (CVE-2026-98364)

    * kernel: ipv4: free inet_opt and ireq_opt after an RCU grace period (CVE-2026-98432)

    * kernel: nvmet-auth: fix out-of-bounds write in nvmet_auth_challenge() (CVE-2026-98725)

    Bug Fix(es) and Enhancement(s):

    * ipv4: ip_gre: make ipgre_header() robust (rhel-10.2.z) (JIRA:Rocky Linux-270702)

    * ip6_gre: make ip6gre_header() robust (rhel-10.2.z) (JIRA:Rocky Linux-270721)

    * Rocky Linux is missing support for conntrack zone filtering in dump/delete requests (10.4) [rhel-10.2.z]     (JIRA:Rocky Linux-291348)

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-2026_93412 advisory.

    * kernel: sctp: stream: fully roll back denied add-stream state (CVE-2026-52929)

    * kernel: ipv6: sit: reload inner IPv6 header after GSO offloads (CVE-2026-53228)

    * kernel: ipvs: clear the svc scheduler ptr early on edit (CVE-2026-53270)

    * kernel: spi: fsl-lpspi: terminate the RX channel on TX prepare failure path (CVE-2026-64303)

    * kernel: mptcp: pm: userspace: fix use-after-free in get_local_id (CVE-2026-68169)

    * kernel: scsi: target: core: Fix iSCSI ISID use-after-free in REGISTER AND MOVE (CVE-2026-72083)

    * kernel: tipc: require net admin for TIPCv2 netlink mutators (CVE-2026-74283)

    * kernel: Bluetooth: mgmt: fix UAF in pair command cancellation (CVE-2026-74510)

    * kernel: packet: use consistent hard_header_len in non-ring send paths (CVE-2026-74582)

    * kernel: mptcp: options: reset DSS fields in case of unexpected size (CVE-2026-80586)

    * kernel: entry: Fix seccomp bypass after ptrace with TSYNC (CVE-2026-89603)

    * kernel: scsi: target: iscsi: Reserve a terminator byte for the login payload (CVE-2026-90011)

    * kernel: virtio-fs: avoid double-free on failed queue setup (CVE-2026-93827)

    * kernel: smb: client: bound dirent name against end of SMB response in cifs_filldir (CVE-2026-93787)

    * kernel: xfrm: hold net_device reference under RCU in bundle creation (CVE-2026-98364)

    * kernel: ipv4: free inet_opt and ireq_opt after an RCU grace period (CVE-2026-98432)

    * kernel: KVM: arm64: Transfer the hyp stack pages out of the host stage-2 (CVE-2026-98466)

    * kernel: nvmet-auth: fix out-of-bounds write in nvmet_auth_challenge() (CVE-2026-98725)

    * kernel: ZDI-CAN-33367: Linux Kernel skbuff skb_zerocopy Improper Ownership Management Local Privilege     Escalation Vulnerability ()

    Bug Fix(es) and Enhancement(s):

    * kernel panic in percpu_counter_add_batch() via submit_bio_noacct() due to NULL pointer (JIRA:Rocky     Linux-250378)

    * ipv4: ip_gre: make ipgre_header() robust (rhel-9.8.z) (JIRA:Rocky Linux-271127)

    * ip6_gre: make ip6gre_header() robust (rhel-9.8.z) (JIRA:Rocky Linux-271130)

    * Backport sched: The newidle balance regression series to rhel 9.8 [rhel-9.8.z] (JIRA:Rocky     Linux-288067)

    * Rocky Linux is missing support for conntrack zone filtering in dump/delete requests (9.10) [rhel-9.8.z]     (JIRA:Rocky Linux-291352)

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-93412 advisory.

    - ipv4: free inet_opt and ireq_opt after an RCU grace period (CKI Backport Bot) [RHEL-295635]     {CVE-2026-98432}
    - nvmet-auth: fix out-of-bounds write in nvmet_auth_challenge() (Maurizio Lombardi) [RHEL-290719]     {CVE-2026-98725}
    - spi: fsl-lpspi: terminate the RX channel on TX prepare failure path (Iker Pedrosa) [RHEL-234297]     {CVE-2026-64303}
    - spi: fsl-lpspi: replace dmaengine_terminate_all() with dmaengine_terminate_sync() (Iker Pedrosa)     [RHEL-234297] {CVE-2026-64303}
    - xfrm: hold net_device reference under RCU in bundle creation (Abhishek Rawal) [RHEL-277984]     {CVE-2026-98364}
    - entry: Fix seccomp bypass after ptrace with TSYNC (Audra Mitchell) [RHEL-271399] {CVE-2026-89603}
    - smb: client: bound dirent name against end of SMB response in cifs_filldir (CKI Backport Bot)     [RHEL-278331] {CVE-2026-93787}
    - sctp: stream: fully roll back denied add-stream state (CKI Backport Bot) [RHEL-277123] {CVE-2026-52929}
    - tipc: require net admin for TIPCv2 netlink mutators (CKI Backport Bot) [RHEL-273181] {CVE-2026-74283}
    - Bluetooth: mgmt: fix UAF in pair command cancellation (CKI Backport Bot) [RHEL-254650] {CVE-2026-74510}
    - ipvs: clear the svc scheduler ptr early on edit (CKI Backport Bot) [RHEL-225993] {CVE-2026-53270}
    - KVM: arm64: Transfer the hyp stack pages out of the host stage-2 (CKI Backport Bot) [RHEL-287053]     {CVE-2026-98466}
    - mptcp: pm: userspace: fix use-after-free in get_local_id (Prasenjit Mukherjee) [RHEL-236687]     {CVE-2026-68169}
    - mptcp: options: reset DSS fields in case of unexpected size (Prasenjit Mukherjee) [RHEL-250609]     {CVE-2026-80586}
    - virtio-fs: avoid double-free on failed queue setup (Miklos Szeredi) [RHEL-278131] {CVE-2026-93827}
    - scsi: target: iscsi: Reserve a terminator byte for the login payload (CKI Backport Bot) [RHEL-285602]     {CVE-2026-90011}
    - scsi: target: core: Fix iSCSI ISID use-after-free in REGISTER AND MOVE (CKI Backport Bot) [RHEL-283505]     {CVE-2026-72083}
    - packet: use consistent hard_header_len in non-ring send paths (Toke Hoiland-Jorgensen) [RHEL-244551]     {CVE-2026-74582}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:93412 advisory.

    * kernel: sctp: stream: fully roll back denied add-stream state (CVE-2026-52929)

    * kernel: ipv6: sit: reload inner IPv6 header after GSO offloads (CVE-2026-53228)

    * kernel: ipvs: clear the svc scheduler ptr early on edit (CVE-2026-53270)

    * kernel: spi: fsl-lpspi: terminate the RX channel on TX prepare failure path (CVE-2026-64303)

    * kernel: mptcp: pm: userspace: fix use-after-free in get_local_id (CVE-2026-68169)

    * kernel: scsi: target: core: Fix iSCSI ISID use-after-free in REGISTER AND MOVE (CVE-2026-72083)

    * kernel: tipc: require net admin for TIPCv2 netlink mutators (CVE-2026-74283)

    * kernel: Bluetooth: mgmt: fix UAF in pair command cancellation (CVE-2026-74510)

    * kernel: packet: use consistent hard_header_len in non-ring send paths (CVE-2026-74582)

    * kernel: mptcp: options: reset DSS fields in case of unexpected size (CVE-2026-80586)

    * kernel: entry: Fix seccomp bypass after ptrace with TSYNC (CVE-2026-89603)

    * kernel: scsi: target: iscsi: Reserve a terminator byte for the login payload (CVE-2026-90011)

    * kernel: virtio-fs: avoid double-free on failed queue setup (CVE-2026-93827)

    * kernel: smb: client: bound dirent name against end of SMB response in cifs_filldir (CVE-2026-93787)

    * kernel: xfrm: hold net_device reference under RCU in bundle creation (CVE-2026-98364)

    * kernel: ipv4: free inet_opt and ireq_opt after an RCU grace period (CVE-2026-98432)

    * kernel: KVM: arm64: Transfer the hyp stack pages out of the host stage-2 (CVE-2026-98466)

    * kernel: nvmet-auth: fix out-of-bounds write in nvmet_auth_challenge() (CVE-2026-98725)

    * kernel: ZDI-CAN-33367: Linux Kernel skbuff skb_zerocopy Improper Ownership Management Local Privilege     Escalation Vulnerability ()

    Bug Fix(es) and Enhancement(s):

    * kernel panic in percpu_counter_add_batch() via submit_bio_noacct() due to NULL pointer (JIRA:Rocky     Linux-250378)

    * ipv4: ip_gre: make ipgre_header() robust (rhel-9.8.z) (JIRA:Rocky Linux-271127)

    * ip6_gre: make ip6gre_header() robust (rhel-9.8.z) (JIRA:Rocky Linux-271130)

    * Backport sched: The newidle balance regression series to rhel 9.8 [rhel-9.8.z] (JIRA:Rocky     Linux-288067)

    * Rocky Linux is missing support for conntrack zone filtering in dump/delete requests (9.10) [rhel-9.8.z]     (JIRA:Rocky Linux-291352)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:93413 advisory.

    * kernel: Kernel: Denial of Service in network socket error handling (CVE-2026-22977)

    * kernel: x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (CVE-2026-46174)

    * kernel: i2c: stub: Reject I2C block transfers with invalid length (CVE-2026-64191)

    * kernel: Linux kernel: PPP over L2TP Use-After-Free vulnerability (CVE-2026-68398)

    * kernel: mptcp: pm: userspace: fix use-after-free in get_local_id (CVE-2026-68169)

    * kernel: tipc: require net admin for TIPCv2 netlink mutators (CVE-2026-74283)

    * kernel: mptcp: options: reset DSS fields in case of unexpected size (CVE-2026-80586)

    * kernel: entry: Fix seccomp bypass after ptrace with TSYNC (CVE-2026-89603)

    * kernel: KVM: nVMX: Always flush vpid02 on first use (CVE-2026-89932)

    * kernel: scsi: target: iscsi: Reserve a terminator byte for the login payload (CVE-2026-90011)

    * kernel: virtio-fs: avoid double-free on failed queue setup (CVE-2026-93827)

    * kernel: smb: client: bound dirent name against end of SMB response in cifs_filldir (CVE-2026-93787)

    * kernel: KEYS: encrypted: fix integer overflow of datablob_len (CVE-2026-98222)

    * kernel: xfrm: hold net_device reference under RCU in bundle creation (CVE-2026-98364)

    * kernel: ipv4: free inet_opt and ireq_opt after an RCU grace period (CVE-2026-98432)

    * kernel: nvmet-auth: fix out-of-bounds write in nvmet_auth_challenge() (CVE-2026-98725)

    Bug Fix(es) and Enhancement(s):

    * ipv4: ip_gre: make ipgre_header() robust (rhel-10.2.z) (JIRA:Rocky Linux-270702)

    * ip6_gre: make ip6gre_header() robust (rhel-10.2.z) (JIRA:Rocky Linux-270721)

    * Rocky Linux is missing support for conntrack zone filtering in dump/delete requests (10.4) [rhel-10.2.z]     (JIRA:Rocky Linux-291348)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-93413 advisory.

    - ipv4: free inet_opt and ireq_opt after an RCU grace period (CKI Backport Bot) [RHEL-295608]     {CVE-2026-98432}
    - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen)     [RHEL-230757] {CVE-2026-46174}
    - xfrm: hold net_device reference under RCU in bundle creation (Abhishek Rawal) [RHEL-277962]     {CVE-2026-98364}
    - tipc: require net admin for TIPCv2 netlink mutators (CKI Backport Bot) [RHEL-273184] {CVE-2026-74283}
    - entry: Fix seccomp bypass after ptrace with TSYNC (Audra Mitchell) [RHEL-271405] {CVE-2026-89603}
    - ppp: defer channel free to an RCU grace period to fix pppol2tp RX UAF (Abhishek Rawal) [RHEL-248847]     {CVE-2026-68398}
    - net: sock: fix hardened usercopy panic in sock_recv_errqueue (CKI Backport Bot) [RHEL-189611]     {CVE-2026-22977}
    - nvmet-auth: fix out-of-bounds write in nvmet_auth_challenge() (Maurizio Lombardi) [RHEL-290598]     {CVE-2026-98725}
    - smb: client: bound dirent name against end of SMB response in cifs_filldir (Paulo Alcantara)     [RHEL-278330] {CVE-2026-93787}
    - scsi: target: iscsi: Reserve a terminator byte for the login payload (CKI Backport Bot) [RHEL-285628]     {CVE-2026-90011}
    - virtio-fs: avoid double-free on failed queue setup (CKI Backport Bot) [RHEL-278134] {CVE-2026-93827}
    - KEYS: encrypted: fix integer overflow of datablob_len (Bruno Meneguele) [RHEL-279482] {CVE-2026-98222}
    - mptcp: options: reset DSS fields in case of unexpected size (Prasenjit Mukherjee) [RHEL-250579]     {CVE-2026-80586}
    - mptcp: pm: userspace: fix use-after-free in get_local_id (Prasenjit Mukherjee) [RHEL-236704]     {CVE-2026-68169}
    - KVM: nVM: Ensure INVVPID is emulated on the correct physical CPU (Rahul Kumar) [RHEL-270935]     {CVE-2026-89932}
    - KVM: nVMX: Decouple INVVPID operand checks from flushing of vpid02 (Rahul Kumar) [RHEL-270935]     {CVE-2026-89932}
    - KVM: nVMX: Always flush vpid02 on first use (Rahul Kumar) [RHEL-270935] {CVE-2026-89932}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the linux package has been released.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:93413 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: Kernel: Denial of Service in network socket error handling (CVE-2026-22977)

    * kernel: x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (CVE-2026-46174)

    * kernel: i2c: stub: Reject I2C block transfers with invalid length (CVE-2026-64191)

    * kernel: Linux kernel: PPP over L2TP Use-After-Free vulnerability (CVE-2026-68398)

    * kernel: mptcp: pm: userspace: fix use-after-free in get_local_id (CVE-2026-68169)

    * kernel: tipc: require net admin for TIPCv2 netlink mutators (CVE-2026-74283)

    * kernel: mptcp: options: reset DSS fields in case of unexpected size (CVE-2026-80586)

    * kernel: entry: Fix seccomp bypass after ptrace with TSYNC (CVE-2026-89603)

    * kernel: KVM: nVMX: Always flush vpid02 on first use (CVE-2026-89932)

    * kernel: scsi: target: iscsi: Reserve a terminator byte for the login payload (CVE-2026-90011)

    * kernel: virtio-fs: avoid double-free on failed queue setup (CVE-2026-93827)

    * kernel: smb: client: bound dirent name against end of SMB response in cifs_filldir (CVE-2026-93787)

    * kernel: KEYS: encrypted: fix integer overflow of datablob_len (CVE-2026-98222)

    * kernel: xfrm: hold net_device reference under RCU in bundle creation (CVE-2026-98364)

    * kernel: ipv4: free inet_opt and ireq_opt after an RCU grace period (CVE-2026-98432)

    * kernel: nvmet-auth: fix out-of-bounds write in nvmet_auth_challenge() (CVE-2026-98725)

    Bug Fix(es) and Enhancement(s):

    * ipv4: ip_gre: make ipgre_header() robust (rhel-10.2.z) (JIRA:RHEL-270702)

    * ip6_gre: make ip6gre_header() robust (rhel-10.2.z) (JIRA:RHEL-270721)

    * RHEL is missing support for conntrack zone filtering in dump/delete requests (10.4) [rhel-10.2.z]     (JIRA:RHEL-291348)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:93412 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: sctp: stream: fully roll back denied add-stream state (CVE-2026-52929)

    * kernel: ipv6: sit: reload inner IPv6 header after GSO offloads (CVE-2026-53228)

    * kernel: ipvs: clear the svc scheduler ptr early on edit (CVE-2026-53270)

    * kernel: spi: fsl-lpspi: terminate the RX channel on TX prepare failure path (CVE-2026-64303)

    * kernel: mptcp: pm: userspace: fix use-after-free in get_local_id (CVE-2026-68169)

    * kernel: scsi: target: core: Fix iSCSI ISID use-after-free in REGISTER AND MOVE (CVE-2026-72083)

    * kernel: tipc: require net admin for TIPCv2 netlink mutators (CVE-2026-74283)

    * kernel: Bluetooth: mgmt: fix UAF in pair command cancellation (CVE-2026-74510)

    * kernel: packet: use consistent hard_header_len in non-ring send paths (CVE-2026-74582)

    * kernel: mptcp: options: reset DSS fields in case of unexpected size (CVE-2026-80586)

    * kernel: entry: Fix seccomp bypass after ptrace with TSYNC (CVE-2026-89603)

    * kernel: scsi: target: iscsi: Reserve a terminator byte for the login payload (CVE-2026-90011)

    * kernel: virtio-fs: avoid double-free on failed queue setup (CVE-2026-93827)

    * kernel: smb: client: bound dirent name against end of SMB response in cifs_filldir (CVE-2026-93787)

    * kernel: xfrm: hold net_device reference under RCU in bundle creation (CVE-2026-98364)

    * kernel: ipv4: free inet_opt and ireq_opt after an RCU grace period (CVE-2026-98432)

    * kernel: KVM: arm64: Transfer the hyp stack pages out of the host stage-2 (CVE-2026-98466)

    * kernel: nvmet-auth: fix out-of-bounds write in nvmet_auth_challenge() (CVE-2026-98725)

    * kernel: ZDI-CAN-33367: Linux Kernel skbuff skb_zerocopy Improper Ownership Management Local Privilege     Escalation Vulnerability ()

    Bug Fix(es) and Enhancement(s):

    * kernel panic in percpu_counter_add_batch() via submit_bio_noacct() due to NULL pointer     (JIRA:RHEL-250378)

    * ipv4: ip_gre: make ipgre_header() robust (rhel-9.8.z) (JIRA:RHEL-271127)

    * ip6_gre: make ip6gre_header() robust (rhel-9.8.z) (JIRA:RHEL-271130)

    * Backport sched: The newidle balance regression series to rhel 9.8 [rhel-9.8.z] (JIRA:RHEL-288067)

    * RHEL is missing support for conntrack zone filtering in dump/delete requests (9.10) [rhel-9.8.z]     (JIRA:RHEL-291352)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1793370479 advisory.

  - In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: Fix buffer overflow in     debugfs If the user tries to write more than 32 bytes then it results in memory corruption. Fortunately,     this is debugfs so it's limited to root users. (CVE-2025-38317)

  - In the Linux kernel, the following vulnerability has been resolved: drm/xe/pf: Clear all LMTT pages on     alloc Our LMEM buffer objects are not cleared by default on alloc and during VF provisioning we only setup     LMTT PTEs for the actually provisioned LMEM range. But beyond that valid range we might leave some stale     data that could either point to some other VFs allocations or even to the PF pages. Explicitly clear all     new LMTT page to avoid the risk that a malicious VF would try to exploit that gap. While around add     asserts to catch any undesired PTE overwrites and low-level debug traces to track LMTT PT life-cycle.
    (cherry picked from commit 3fae6918a3e27cce20ded2551f863fb05d4bef8d) (CVE-2025-38511)

  - In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: fix memory leak in     ath12k_service_ready_ext_event Currently, in ath12k_service_ready_ext_event(), svc_rdy_ext.mac_phy_caps is     not freed in the failure case, causing a memory leak. The following trace is observed in kmemleak:
    unreferenced object 0xffff8b3eb5789c00 (size 1024): comm softirq, pid 0, jiffies 4294942577 hex dump     (first 32 bytes): 00 00 00 00 01 00 00 00 00 00 00 00 7b 00 00 10 ............{... 01 00 00 00 00 00 00 00     01 00 00 00 1f 38 00 00 .............8.. backtrace (crc 44e1c357): __kmalloc_noprof+0x30b/0x410     ath12k_wmi_mac_phy_caps_parse+0x84/0x100 [ath12k] ath12k_wmi_tlv_iter+0x5e/0x140 [ath12k]     ath12k_wmi_svc_rdy_ext_parse+0x308/0x4c0 [ath12k] ath12k_wmi_tlv_iter+0x5e/0x140 [ath12k]     ath12k_service_ready_ext_event.isra.0+0x44/0xd0 [ath12k] ath12k_wmi_op_rx+0x2eb/0xd70 [ath12k]     ath12k_htc_rx_completion_handler+0x1f4/0x330 [ath12k] ath12k_ce_recv_process_cb+0x218/0x300 [ath12k]     ath12k_pci_ce_workqueue+0x1b/0x30 [ath12k] process_one_work+0x219/0x680 bh_worker+0x198/0x1f0     tasklet_action+0x13/0x30 handle_softirqs+0xca/0x460 __irq_exit_rcu+0xbe/0x110 irq_exit_rcu+0x9/0x30 Free     svc_rdy_ext.mac_phy_caps in the error case to fix this memory leak. Tested-on: QCN9274 hw2.0 PCI     WLAN.WBE.1.4.1-00199-QCAHKSWPL_SILICONZ-1 (CVE-2025-39890)

  - In the Linux kernel, the following vulnerability has been resolved: bpf: Fix metadata_dst leak
    __bpf_redirect_neigh_v{4,6} Cilium has a BPF egress gateway feature which forces outgoing K8s Pod traffic     to pass through dedicated egress gateways which then SNAT the traffic in order to interact with stable IPs     outside the cluster. The traffic is directed to the gateway via vxlan tunnel in collect md mode. A recent     BPF change utilized the bpf_redirect_neigh() helper to forward packets after the arrival and decap on     vxlan, which turned out over time that the kmalloc-256 slab usage in kernel was ever-increasing. The issue     was that vxlan allocates the metadata_dst object and attaches it through a fake dst entry to the skb. The     latter was never released though given bpf_redirect_neigh() was merely setting the new dst entry via     skb_dst_set() without dropping an existing one first. (CVE-2025-40183)

  - In the Linux kernel, the following vulnerability has been resolved: mlxsw: spectrum_router: Fix neighbour     use-after-free We sometimes observe use-after-free when dereferencing a neighbour [1]. The problem seems     to be that the driver stores a pointer to the neighbour, but without holding a reference on it. A     reference is only taken when the neighbour is used by a nexthop. Fix by simplifying the reference counting     scheme. Always take a reference when storing a neighbour pointer in a neighbour entry. Avoid taking a     referencing when the neighbour is used by a nexthop as the neighbour entry associated with the nexthop     already holds a reference. Tested by running the test that uncovered the problem over 300 times. Without     this patch the problem was reproduced after a handful of iterations. [1] BUG: KASAN: slab-use-after-free     in mlxsw_sp_neigh_entry_update+0x2d4/0x310 Read of size 8 at addr ffff88817f8e3420 by task ip/3929 CPU: 3     UID: 0 PID: 3929 Comm: ip Not tainted 6.18.0-rc4-virtme-g36b21a067510 #3 PREEMPT(full) Hardware name:
    Nvidia SN5600/VMOD0013, BIOS 5.13 05/31/2023 Call Trace: <TASK> dump_stack_lvl+0x6f/0xa0     print_address_description.constprop.0+0x6e/0x300 print_report+0xfc/0x1fb kasan_report+0xe4/0x110     mlxsw_sp_neigh_entry_update+0x2d4/0x310 mlxsw_sp_router_rif_gone_sync+0x35f/0x510     mlxsw_sp_rif_destroy+0x1ea/0x730 mlxsw_sp_inetaddr_port_vlan_event+0xa1/0x1b0
    __mlxsw_sp_inetaddr_lag_event+0xcc/0x130 __mlxsw_sp_inetaddr_event+0xf5/0x3c0     mlxsw_sp_router_netdevice_event+0x1015/0x1580 notifier_call_chain+0xcc/0x150     call_netdevice_notifiers_info+0x7e/0x100 __netdev_upper_dev_unlink+0x10b/0x210     netdev_upper_dev_unlink+0x79/0xa0 vrf_del_slave+0x18/0x50 do_set_master+0x146/0x7d0     do_setlink.isra.0+0x9a0/0x2880 rtnl_newlink+0x637/0xb20 rtnetlink_rcv_msg+0x6fe/0xb90     netlink_rcv_skb+0x123/0x380 netlink_unicast+0x4a3/0x770 netlink_sendmsg+0x75b/0xc90
    __sock_sendmsg+0xbe/0x160 ____sys_sendmsg+0x5b2/0x7d0 ___sys_sendmsg+0xfd/0x180 __sys_sendmsg+0x124/0x1c0     do_syscall_64+0xbb/0xfd0 entry_SYSCALL_64_after_hwframe+0x4b/0x53 [...] Allocated by task 109:
    kasan_save_stack+0x30/0x50 kasan_save_track+0x14/0x30 __kasan_kmalloc+0x7b/0x90
    __kmalloc_noprof+0x2c1/0x790 neigh_alloc+0x6af/0x8f0 ___neigh_create+0x63/0xe90     mlxsw_sp_nexthop_neigh_init+0x430/0x7e0 mlxsw_sp_nexthop_type_init+0x212/0x960     mlxsw_sp_nexthop6_group_info_init.constprop.0+0x81f/0x1280 mlxsw_sp_nexthop6_group_get+0x392/0x6a0     mlxsw_sp_fib6_entry_create+0x46a/0xfd0 mlxsw_sp_router_fib6_replace+0x1ed/0x5f0     mlxsw_sp_router_fib6_event_work+0x10a/0x2a0 process_one_work+0xd57/0x1390 worker_thread+0x4d6/0xd40     kthread+0x355/0x5b0 ret_from_fork+0x1d4/0x270 ret_from_fork_asm+0x11/0x20 Freed by task 154:
    kasan_save_stack+0x30/0x50 kasan_save_track+0x14/0x30 __kasan_save_free_info+0x3b/0x60
    __kasan_slab_free+0x43/0x70 kmem_cache_free_bulk.part.0+0x1eb/0x5e0 kvfree_rcu_bulk+0x1f2/0x260     kfree_rcu_work+0x130/0x1b0 process_one_work+0xd57/0x1390 worker_thread+0x4d6/0xd40 kthread+0x355/0x5b0     ret_from_fork+0x1d4/0x270 ret_from_fork_asm+0x11/0x20 Last potentially related work creation:
    kasan_save_stack+0x30/0x50 kasan_record_aux_stack+0x8c/0xa0 kvfree_call_rcu+0x93/0x5b0     mlxsw_sp_router_neigh_event_work+0x67d/0x860 process_one_work+0xd57/0x1390 worker_thread+0x4d6/0xd40     kthread+0x355/0x5b0 ret_from_fork+0x1d4/0x270 ret_from_fork_asm+0x11/0x20 (CVE-2025-68801)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The AlmaLinux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1793370479 advisory.

  - In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: Fix buffer overflow in     debugfs If the user tries to write more than 32 bytes then it results in memory corruption. Fortunately,     this is debugfs so it's limited to root users. (CVE-2025-38317)

  - In the Linux kernel, the following vulnerability has been resolved: drm/xe/pf: Clear all LMTT pages on     alloc Our LMEM buffer objects are not cleared by default on alloc and during VF provisioning we only setup     LMTT PTEs for the actually provisioned LMEM range. But beyond that valid range we might leave some stale     data that could either point to some other VFs allocations or even to the PF pages. Explicitly clear all     new LMTT page to avoid the risk that a malicious VF would try to exploit that gap. While around add     asserts to catch any undesired PTE overwrites and low-level debug traces to track LMTT PT life-cycle.
    (cherry picked from commit 3fae6918a3e27cce20ded2551f863fb05d4bef8d) (CVE-2025-38511)

  - In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: fix memory leak in     ath12k_service_ready_ext_event Currently, in ath12k_service_ready_ext_event(), svc_rdy_ext.mac_phy_caps is     not freed in the failure case, causing a memory leak. The following trace is observed in kmemleak:
    unreferenced object 0xffff8b3eb5789c00 (size 1024): comm softirq, pid 0, jiffies 4294942577 hex dump     (first 32 bytes): 00 00 00 00 01 00 00 00 00 00 00 00 7b 00 00 10 ............{... 01 00 00 00 00 00 00 00     01 00 00 00 1f 38 00 00 .............8.. backtrace (crc 44e1c357): __kmalloc_noprof+0x30b/0x410     ath12k_wmi_mac_phy_caps_parse+0x84/0x100 [ath12k] ath12k_wmi_tlv_iter+0x5e/0x140 [ath12k]     ath12k_wmi_svc_rdy_ext_parse+0x308/0x4c0 [ath12k] ath12k_wmi_tlv_iter+0x5e/0x140 [ath12k]     ath12k_service_ready_ext_event.isra.0+0x44/0xd0 [ath12k] ath12k_wmi_op_rx+0x2eb/0xd70 [ath12k]     ath12k_htc_rx_completion_handler+0x1f4/0x330 [ath12k] ath12k_ce_recv_process_cb+0x218/0x300 [ath12k]     ath12k_pci_ce_workqueue+0x1b/0x30 [ath12k] process_one_work+0x219/0x680 bh_worker+0x198/0x1f0     tasklet_action+0x13/0x30 handle_softirqs+0xca/0x460 __irq_exit_rcu+0xbe/0x110 irq_exit_rcu+0x9/0x30 Free     svc_rdy_ext.mac_phy_caps in the error case to fix this memory leak. Tested-on: QCN9274 hw2.0 PCI     WLAN.WBE.1.4.1-00199-QCAHKSWPL_SILICONZ-1 (CVE-2025-39890)

  - In the Linux kernel, the following vulnerability has been resolved: bpf: Fix metadata_dst leak
    __bpf_redirect_neigh_v{4,6} Cilium has a BPF egress gateway feature which forces outgoing K8s Pod traffic     to pass through dedicated egress gateways which then SNAT the traffic in order to interact with stable IPs     outside the cluster. The traffic is directed to the gateway via vxlan tunnel in collect md mode. A recent     BPF change utilized the bpf_redirect_neigh() helper to forward packets after the arrival and decap on     vxlan, which turned out over time that the kmalloc-256 slab usage in kernel was ever-increasing. The issue     was that vxlan allocates the metadata_dst object and attaches it through a fake dst entry to the skb. The     latter was never released though given bpf_redirect_neigh() was merely setting the new dst entry via     skb_dst_set() without dropping an existing one first. (CVE-2025-40183)

  - In the Linux kernel, the following vulnerability has been resolved: mlxsw: spectrum_router: Fix neighbour     use-after-free We sometimes observe use-after-free when dereferencing a neighbour [1]. The problem seems     to be that the driver stores a pointer to the neighbour, but without holding a reference on it. A     reference is only taken when the neighbour is used by a nexthop. Fix by simplifying the reference counting     scheme. Always take a reference when storing a neighbour pointer in a neighbour entry. Avoid taking a     referencing when the neighbour is used by a nexthop as the neighbour entry associated with the nexthop     already holds a reference. Tested by running the test that uncovered the problem over 300 times. Without     this patch the problem was reproduced after a handful of iterations. [1] BUG: KASAN: slab-use-after-free     in mlxsw_sp_neigh_entry_update+0x2d4/0x310 Read of size 8 at addr ffff88817f8e3420 by task ip/3929 CPU: 3     UID: 0 PID: 3929 Comm: ip Not tainted 6.18.0-rc4-virtme-g36b21a067510 #3 PREEMPT(full) Hardware name:
    Nvidia SN5600/VMOD0013, BIOS 5.13 05/31/2023 Call Trace: <TASK> dump_stack_lvl+0x6f/0xa0     print_address_description.constprop.0+0x6e/0x300 print_report+0xfc/0x1fb kasan_report+0xe4/0x110     mlxsw_sp_neigh_entry_update+0x2d4/0x310 mlxsw_sp_router_rif_gone_sync+0x35f/0x510     mlxsw_sp_rif_destroy+0x1ea/0x730 mlxsw_sp_inetaddr_port_vlan_event+0xa1/0x1b0
    __mlxsw_sp_inetaddr_lag_event+0xcc/0x130 __mlxsw_sp_inetaddr_event+0xf5/0x3c0     mlxsw_sp_router_netdevice_event+0x1015/0x1580 notifier_call_chain+0xcc/0x150     call_netdevice_notifiers_info+0x7e/0x100 __netdev_upper_dev_unlink+0x10b/0x210     netdev_upper_dev_unlink+0x79/0xa0 vrf_del_slave+0x18/0x50 do_set_master+0x146/0x7d0     do_setlink.isra.0+0x9a0/0x2880 rtnl_newlink+0x637/0xb20 rtnetlink_rcv_msg+0x6fe/0xb90     netlink_rcv_skb+0x123/0x380 netlink_unicast+0x4a3/0x770 netlink_sendmsg+0x75b/0xc90
    __sock_sendmsg+0xbe/0x160 ____sys_sendmsg+0x5b2/0x7d0 ___sys_sendmsg+0xfd/0x180 __sys_sendmsg+0x124/0x1c0     do_syscall_64+0xbb/0xfd0 entry_SYSCALL_64_after_hwframe+0x4b/0x53 [...] Allocated by task 109:
    kasan_save_stack+0x30/0x50 kasan_save_track+0x14/0x30 __kasan_kmalloc+0x7b/0x90
    __kmalloc_noprof+0x2c1/0x790 neigh_alloc+0x6af/0x8f0 ___neigh_create+0x63/0xe90     mlxsw_sp_nexthop_neigh_init+0x430/0x7e0 mlxsw_sp_nexthop_type_init+0x212/0x960     mlxsw_sp_nexthop6_group_info_init.constprop.0+0x81f/0x1280 mlxsw_sp_nexthop6_group_get+0x392/0x6a0     mlxsw_sp_fib6_entry_create+0x46a/0xfd0 mlxsw_sp_router_fib6_replace+0x1ed/0x5f0     mlxsw_sp_router_fib6_event_work+0x10a/0x2a0 process_one_work+0xd57/0x1390 worker_thread+0x4d6/0xd40     kthread+0x355/0x5b0 ret_from_fork+0x1d4/0x270 ret_from_fork_asm+0x11/0x20 Freed by task 154:
    kasan_save_stack+0x30/0x50 kasan_save_track+0x14/0x30 __kasan_save_free_info+0x3b/0x60
    __kasan_slab_free+0x43/0x70 kmem_cache_free_bulk.part.0+0x1eb/0x5e0 kvfree_rcu_bulk+0x1f2/0x260     kfree_rcu_work+0x130/0x1b0 process_one_work+0xd57/0x1390 worker_thread+0x4d6/0xd40 kthread+0x355/0x5b0     ret_from_fork+0x1d4/0x270 ret_from_fork_asm+0x11/0x20 Last potentially related work creation:
    kasan_save_stack+0x30/0x50 kasan_record_aux_stack+0x8c/0xa0 kvfree_call_rcu+0x93/0x5b0     mlxsw_sp_router_neigh_event_work+0x67d/0x860 process_one_work+0xd57/0x1390 worker_thread+0x4d6/0xd40     kthread+0x355/0x5b0 ret_from_fork+0x1d4/0x270 ret_from_fork_asm+0x11/0x20 (CVE-2025-68801)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - virtio-fs: avoid double-free on failed queue setup virtio_fs_setup_vqs() allocates fs->vqs and fs->mq_map     before calling virtio_find_vqs(). If virtio_find_vqs() fails, the error path frees both pointers and     returns an error to virtio_fs_probe(). virtio_fs_probe() then drops the last kobject reference, and     virtio_fs_ktype_release() frees fs->vqs and fs->mq_map again. This leaves dangling pointers in struct     virtio_fs and can trigger a double-free during probe failure cleanup. Set fs->vqs and fs->mq_map to NULL     immediately after kfree() in the virtio_fs_setup_vqs() error path so that the later kobject release sees     an uninitialized state and kfree(NULL) becomes harmless. This can be reproduced when a broken virtio-fs     device advertises more request queues than the transport actually provides. In that case virtio_find_vqs()     fails while setting up the extra queue, and the probe path reaches the double-free cleanup sequence.
    (CVE-2026-93827)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
376443	Ubuntu 24.04 LTS / 26.04 LTS : Linux kernel vulnerabilities (USN-8959-1)	Nessus	Ubuntu Local Security Checks	Local	high
376398	Rocky Linux 10.2 [CIQ] Security Update: kernel / kernel-64k / kernel-64k-core / kernel-64k-debug / etc Multiple Vulnerabilities (crlsa-2026_93413)	Nessus	Rocky Linux Local Security Checks	Local	medium
376395	Rocky Linux 9 [CIQ] Security Update: kernel / kernel-64k / kernel-64k-core / kernel-64k-debug / etc Multiple Vulnerabilities (crlsa-2026_93412)	Nessus	Rocky Linux Local Security Checks	Local	critical
375516	Oracle Linux 9 : kernel (ELSA-2026-93412)	Nessus	Oracle Linux Local Security Checks	Local	critical
375444	RockyLinux 9 : kernel (RLSA-2026:93412)	Nessus	Rocky Linux Local Security Checks	Local	critical
375443	RockyLinux 10 : kernel (RLSA-2026:93413)	Nessus	Rocky Linux Local Security Checks	Local	medium
375175	Oracle Linux 10 : kernel (ELSA-2026-93413)	Nessus	Oracle Linux Local Security Checks	Local	medium
375113	Photon OS 5.0: Linux PHSA-2026-5.0-91-1014	Nessus	PhotonOS Local Security Checks	Local	high
375014	Photon OS 5.0: Linux PHSA-2026-5.0-92-1014	Nessus	PhotonOS Local Security Checks	Local	high
374862	RHEL 10 : kernel (RHSA-2026:93413)	Nessus	Red Hat Local Security Checks	Local	medium
374859	RHEL 9 : kernel (RHSA-2026:93412)	Nessus	Red Hat Local Security Checks	Local	critical
374300	Rocky Linux 9.6 [TuxCare] Security Update: kernel / kernel-64k / kernel-64k-core / kernel-64k-debug / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1793370479)	Nessus	Rocky Linux Local Security Checks	Local	high
374299	AlmaLinux 9.6 [TuxCare] Security Update: kernel / kernel-64k / kernel-64k-core / kernel-64k-debug / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1793370479)	Nessus	Alma Linux Local Security Checks	Local	high
365258	Amazon Linux 2023 : bpftool6.18, kernel6.18, kernel6.18-devel (ALAS2023-2026-3192)	Nessus	Amazon Linux Local Security Checks	Local	high
365209	Amazon Linux 2023 : bpftool6.12, kernel6.12, kernel6.12-devel (ALAS2023-2026-3193)	Nessus	Amazon Linux Local Security Checks	Local	medium
364137	Oracle Linux 10 / 9 : Unbreakable Enterprise kernel (ELSA-2026-500374)	Nessus	Oracle Linux Local Security Checks	Local	high
362907	Debian dla-4817 : ata-modules-6.12.107+deb12-armmp-di - security update	Nessus	Debian Local Security Checks	Local	high
351155	Debian dsa-6528 : ata-modules-6.12.111+deb13-armmp-di - security update	Nessus	Debian Local Security Checks	Local	high
349944	Linux Distros Unpatched Vulnerability : CVE-2026-93827	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2026-93827

high

Tenable Plugins

high

medium

critical

critical

critical

medium

medium

high

high

medium

critical

high

high

high

medium

high

high

high

high