In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Bound GPIO I2C table entry count from VBIOS Reject undersized tables and cap the derived entry count to AMDGPU_MAX_I2C_BUS so we do not overrun adev->i2c_bus[] or walk an absurd number of entries on corrupt size fields.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:99031 advisory.

    The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with     extremely high determinism requirements.

    Security Fix(es):

    * kernel: drm/amdkfd: hold event_mutex while checkpointing CRIU events (CVE-2026-74446)

    * kernel: drm/amdkfd: fix SMI event cross-process information leak (CVE-2026-97422)

    * kernel: drm/amd/pm: bound pp_dpm_set_pp_table() memcpy (CVE-2026-97427)

    * kernel: drm/amdkfd: Check bounds for allocate_sdma_queue restore_sdma_id (CVE-2026-97497)

    * kernel: drm/amdgpu: validate and share PSP fw_pri_buf copies via psp_copy_fw (CVE-2026-97494)

    * kernel: drm/amdkfd: Check bounds on allocate_doorbell (CVE-2026-97495)

    * kernel: drm/amdgpu: Bound GPIO I2C table entry count from VBIOS (CVE-2026-97493)

    * kernel: drm/amdgpu: fix buffer overflow during vBIOS update (CVE-2026-97425)

    * kernel: net/smc: protect clcsock lifetime in smc_getname (CVE-2026-99032)

    * kernel: kernel: Denial of Service via use-after-free race condition in SCSI tape driver (CVE-2026-99156)

    Bug Fix(es) and Enhancement(s):

    * soft lockup occurs during iomap_finish_ioends (JIRA:RHEL-258946)

    * gfs2: BUG during withdraw [RHEL-8] (JIRA:RHEL-298310)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:99015 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: drm/amdkfd: hold event_mutex while checkpointing CRIU events (CVE-2026-74446)

    * kernel: drm/amdkfd: fix SMI event cross-process information leak (CVE-2026-97422)

    * kernel: drm/amd/pm: bound pp_dpm_set_pp_table() memcpy (CVE-2026-97427)

    * kernel: drm/amdkfd: Check bounds for allocate_sdma_queue restore_sdma_id (CVE-2026-97497)

    * kernel: drm/amdgpu: validate and share PSP fw_pri_buf copies via psp_copy_fw (CVE-2026-97494)

    * kernel: drm/amdkfd: Check bounds on allocate_doorbell (CVE-2026-97495)

    * kernel: drm/amdgpu: Bound GPIO I2C table entry count from VBIOS (CVE-2026-97493)

    * kernel: drm/amdgpu: fix buffer overflow during vBIOS update (CVE-2026-97425)

    * kernel: net/smc: protect clcsock lifetime in smc_getname (CVE-2026-99032)

    * kernel: kernel: Denial of Service via use-after-free race condition in SCSI tape driver (CVE-2026-99156)

    Bug Fix(es) and Enhancement(s):

    * soft lockup occurs during iomap_finish_ioends (JIRA:RHEL-258946)

    * gfs2: BUG during withdraw [RHEL-8] (JIRA:RHEL-298310)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1793333110 advisory.

  - In the Linux kernel, the following vulnerability has been resolved: dma-debug: don't call
    __dma_entry_alloc_check_leak() under free_entries_lock __dma_entry_alloc_check_leak() calls into printk ->     serial console output (qcom geni) and grabs port->lock under free_entries_lock spin lock, which is a     reverse locking dependency chain as qcom_geni IRQ handler can call into dma-debug code and grab     free_entries_lock under port->lock. Move __dma_entry_alloc_check_leak() call out of free_entries_lock     scope so that we don't acquire serial console's port->lock under it. Trimmed-down lockdep splat: The     existing dependency chain (in reverse order) is: -> #2 (free_entries_lock){-.-.}-{2:2}:
    _raw_spin_lock_irqsave+0x60/0x80 dma_entry_alloc+0x38/0x110 debug_dma_map_page+0x60/0xf8     dma_map_page_attrs+0x1e0/0x230 dma_map_single_attrs.constprop.0+0x6c/0xc8 geni_se_rx_dma_prep+0x40/0xcc     qcom_geni_serial_isr+0x310/0x510 __handle_irq_event_percpu+0x110/0x244 handle_irq_event_percpu+0x20/0x54     handle_irq_event+0x50/0x88 handle_fasteoi_irq+0xa4/0xcc handle_irq_desc+0x28/0x40     generic_handle_domain_irq+0x24/0x30 gic_handle_irq+0xc4/0x148 do_interrupt_handler+0xa4/0xb0     el1_interrupt+0x34/0x64 el1h_64_irq_handler+0x18/0x24 el1h_64_irq+0x64/0x68 arch_local_irq_enable+0x4/0x8
    ____do_softirq+0x18/0x24 ... -> #1 (&port_lock_key){-.-.}-{2:2}: _raw_spin_lock_irqsave+0x60/0x80     qcom_geni_serial_console_write+0x184/0x1dc console_flush_all+0x344/0x454 console_unlock+0x94/0xf0     vprintk_emit+0x238/0x24c vprintk_default+0x3c/0x48 vprintk+0xb4/0xbc _printk+0x68/0x90     register_console+0x230/0x38c uart_add_one_port+0x338/0x494 qcom_geni_serial_probe+0x390/0x424     platform_probe+0x70/0xc0 really_probe+0x148/0x280 __driver_probe_device+0xfc/0x114     driver_probe_device+0x44/0x100 __device_attach_driver+0x64/0xdc bus_for_each_drv+0xb0/0xd8
    __device_attach+0xe4/0x140 device_initial_probe+0x1c/0x28 bus_probe_device+0x44/0xb0     device_add+0x538/0x668 of_device_add+0x44/0x50 of_platform_device_create_pdata+0x94/0xc8     of_platform_bus_create+0x270/0x304 of_platform_populate+0xac/0xc4 devm_of_platform_populate+0x60/0xac     geni_se_probe+0x154/0x160 platform_probe+0x70/0xc0 ... -> #0 (console_owner){-...}-{0:0}:
    __lock_acquire+0xdf8/0x109c lock_acquire+0x234/0x284 console_flush_all+0x330/0x454     console_unlock+0x94/0xf0 vprintk_emit+0x238/0x24c vprintk_default+0x3c/0x48 vprintk+0xb4/0xbc
    _printk+0x68/0x90 dma_entry_alloc+0xb4/0x110 debug_dma_map_sg+0xdc/0x2f8 __dma_map_sg_attrs+0xac/0xe4     dma_map_sgtable+0x30/0x4c get_pages+0x1d4/0x1e4 [msm] msm_gem_pin_pages_locked+0x38/0xac [msm]     msm_gem_pin_vma_locked+0x58/0x88 [msm] msm_ioctl_gem_submit+0xde4/0x13ac [msm] drm_ioctl_kernel+0xe0/0x15c     drm_ioctl+0x2e8/0x3f4 vfs_ioctl+0x30/0x50 ... Chain exists of: console_owner --> &port_lock_key -->     free_entries_lock Possible unsafe locking scenario: CPU0 CPU1 ---- ---- lock(free_entries_lock);
    lock(&port_lock_key); lock(free_entries_lock); lock(console_owner); *** DEADLOCK *** Call trace:
    dump_backtrace+0xb4/0xf0 show_stack+0x20/0x30 dump_stack_lvl+0x60/0x84 dump_stack+0x18/0x24     print_circular_bug+0x1cc/0x234 check_noncircular+0x78/0xac __lock_acquire+0xdf8/0x109c     lock_acquire+0x234/0x284 console_flush_all+0x330/0x454 consol ---truncated--- (CVE-2023-52516)

  - In the Linux kernel, the following vulnerability has been resolved: USB: sisusbvga: Add endpoint checks     The syzbot fuzzer was able to provoke a WARNING from the sisusbvga driver: ------------[ cut here     ]------------ usb 1-1: BOGUS urb xfer, pipe 3 != type 1 WARNING: CPU: 1 PID: 26 at     drivers/usb/core/urb.c:504 usb_submit_urb+0xed6/0x1880 drivers/usb/core/urb.c:504 Modules linked in: CPU:
    1 PID: 26 Comm: kworker/1:1 Not tainted 6.2.0-rc5-syzkaller-00199-g5af6ce704936 #0 Hardware name: Google     Google Compute Engine/Google Compute Engine, BIOS Google 01/12/2023 Workqueue: usb_hub_wq hub_event RIP:
    0010:usb_submit_urb+0xed6/0x1880 drivers/usb/core/urb.c:504 Code: 7c 24 18 e8 6c 50 80 fb 48 8b 7c 24 18     e8 62 1a 01 ff 41 89 d8 44 89 e1 4c 89 ea 48 89 c6 48 c7 c7 60 b1 fa 8a e8 84 b0 be 03 <0f> 0b e9 58 f8 ff     ff e8 3e 50 80 fb 48 81 c5 c0 05 00 00 e9 84 f7 RSP: 0018:ffffc90000a1ed18 EFLAGS: 00010282 RAX:
    0000000000000000 RBX: 0000000000000001 RCX: 0000000000000000 RDX: ffff888012783a80 RSI: ffffffff816680ec     RDI: fffff52000143d95 RBP: ffff888079020000 R08: 0000000000000005 R09: 0000000000000000 R10:
    0000000080000000 R11: 0000000000000000 R12: 0000000000000003 R13: ffff888017d33370 R14: 0000000000000003     R15: ffff888021213600 FS: 0000000000000000(0000) GS:ffff8880b9900000(0000) knlGS:0000000000000000 CS: 0010     DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00005592753a60b0 CR3: 0000000022899000 CR4: 00000000003506e0     DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6:
    00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> sisusb_bulkout_msg     drivers/usb/misc/sisusbvga/sisusbvga.c:224 [inline] sisusb_send_bulk_msg.constprop.0+0x904/0x1230     drivers/usb/misc/sisusbvga/sisusbvga.c:379 sisusb_send_bridge_packet     drivers/usb/misc/sisusbvga/sisusbvga.c:567 [inline] sisusb_do_init_gfxdevice     drivers/usb/misc/sisusbvga/sisusbvga.c:2077 [inline] sisusb_init_gfxdevice+0x87b/0x4000     drivers/usb/misc/sisusbvga/sisusbvga.c:2177 sisusb_probe+0x9cd/0xbe2     drivers/usb/misc/sisusbvga/sisusbvga.c:2869 ... The problem was caused by the fact that the driver does     not check whether the endpoints it uses are actually present and have the appropriate types. This can be     fixed by adding a simple check of the endpoints. (CVE-2023-54213)

  - In the Linux kernel, the following vulnerability has been resolved: net/sched: act_mirred: use the backlog     for mirred ingress The test Davide added in commit ca22da2fbd69 (act_mirred: use the backlog for nested     calls to mirred ingress) hangs our testing VMs every 10 or so runs, with the familiar tcp_v4_rcv ->     tcp_v4_rcv deadlock reported by lockdep. The problem as previously described by Davide (see Link) is that     if we reverse flow of traffic with the redirect (egress -> ingress) we may reach the same socket which     generated the packet. And we may still be holding its socket lock. The common solution to such deadlocks     is to put the packet in the Rx backlog, rather than run the Rx path inline. Do that for all egress ->     ingress reversals, not just once we started to nest mirred calls. In the past there was a concern that the     backlog indirection will lead to loss of error reporting / less accurate stats. But the current workaround     does not seem to address the issue. (CVE-2024-26740)

  - In the Linux kernel, the following vulnerability has been resolved: mm/vmscan: fix a bug calling     wakeup_kswapd() with a wrong zone index With numa balancing on, when a numa system is running where a numa     node doesn't have its local memory so it has no managed zones, the following oops has been observed. It's     because wakeup_kswapd() is called with a wrong zone index, -1. Fixed it by checking the index before     calling wakeup_kswapd(). > BUG: unable to handle page fault for address: 00000000000033f3 > #PF:
    supervisor read access in kernel mode > #PF: error_code(0x0000) - not-present page > PGD 0 P4D 0 > Oops:
    0000 [#1] PREEMPT SMP NOPTI > CPU: 2 PID: 895 Comm: masim Not tainted 6.6.0-dirty #255 > Hardware name:
    QEMU Standard PC (i440FX + PIIX, 1996), BIOS > rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014 >     RIP: 0010:wakeup_kswapd (./linux/mm/vmscan.c:7812) > Code: (omitted) > RSP: 0000:ffffc90004257d58 EFLAGS:
    00010286 > RAX: ffffffffffffffff RBX: ffff88883fff0480 RCX: 0000000000000003 > RDX: 0000000000000000 RSI:
    0000000000000000 RDI: ffff88883fff0480 > RBP: ffffffffffffffff R08: ff0003ffffffffff R09: ffffffffffffffff     > R10: ffff888106c95540 R11: 0000000055555554 R12: 0000000000000003 > R13: 0000000000000000 R14:
    0000000000000000 R15: ffff88883fff0940 > FS: 00007fc4b8124740(0000) GS:ffff888827c00000(0000)     knlGS:0000000000000000 > CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 > CR2: 00000000000033f3 CR3:
    000000026cc08004 CR4: 0000000000770ee0 > DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000     > DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 > PKRU: 55555554 > Call Trace: >     <TASK> > ? __die > ? page_fault_oops > ? __pte_offset_map_lock > ? exc_page_fault > ? asm_exc_page_fault >     ? wakeup_kswapd > migrate_misplaced_page > __handle_mm_fault > handle_mm_fault > do_user_addr_fault >     exc_page_fault > asm_exc_page_fault > RIP: 0033:0x55b897ba0808 > Code: (omitted) > RSP:
    002b:00007ffeefa821a0 EFLAGS: 00010287 > RAX: 000055b89983acd0 RBX: 00007ffeefa823f8 RCX: 000055b89983acd0     > RDX: 00007fc2f8122010 RSI: 0000000000020000 RDI: 000055b89983acd0 > RBP: 00007ffeefa821a0 R08:
    0000000000000037 R09: 0000000000000075 > R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000000     > R13: 00007ffeefa82410 R14: 000055b897ba5dd8 R15: 00007fc4b8340000 > </TASK> (CVE-2024-26783)

  - In the Linux kernel, the following vulnerability has been resolved: vfs: Don't evict inode under the inode     lru traversing context The inode reclaiming process(See function prune_icache_sb) collects all reclaimable     inodes and mark them with I_FREEING flag at first, at that time, other processes will be stuck if they try     getting these inodes (See function find_inode_fast), then the reclaiming process destroy the inodes by     function dispose_list(). Some filesystems(eg. ext4 with ea_inode feature, ubifs with xattr) may do inode     lookup in the inode evicting callback function, if the inode lookup is operated under the inode lru     traversing context, deadlock problems may happen. Case 1: In function ext4_evict_inode(), the ea inode     lookup could happen if ea_inode feature is enabled, the lookup process will be stuck under the evicting     context like this: 1. File A has inode i_reg and an ea inode i_ea 2. getfattr(A, xattr_buf) // i_ea is     added into lru // lru->i_ea 3. Then, following three processes running like this: PA PB echo 2 >     /proc/sys/vm/drop_caches shrink_slab prune_dcache_sb // i_reg is added into lru, lru->i_ea->i_reg     prune_icache_sb list_lru_walk_one inode_lru_isolate i_ea->i_state |= I_FREEING // set inode state     inode_lru_isolate __iget(i_reg) spin_unlock(&i_reg->i_lock) spin_unlock(lru_lock) rm file A i_reg->nlink =     0 iput(i_reg) // i_reg->nlink is 0, do evict ext4_evict_inode ext4_xattr_delete_inode     ext4_xattr_inode_dec_ref_all ext4_xattr_inode_iget ext4_iget(i_ea->i_ino) iget_locked find_inode_fast
    __wait_on_freeing_inode(i_ea) ---- AA deadlock dispose_list // cannot be executed by prune_icache_sb     wake_up_bit(&i_ea->i_state) Case 2: In deleted inode writing function ubifs_jnl_write_inode(), file     deleting process holds BASEHD's wbuf->io_mutex while getting the xattr inode, which could race with inode     reclaiming process(The reclaiming process could try locking BASEHD's wbuf->io_mutex in inode evicting     function), then an ABBA deadlock problem would happen as following: 1. File A has inode ia and a     xattr(with inode ixa), regular file B has inode ib and a xattr. 2. getfattr(A, xattr_buf) // ixa is added     into lru // lru->ixa 3. Then, following three processes running like this: PA PB PC echo 2 >     /proc/sys/vm/drop_caches shrink_slab prune_dcache_sb // ib and ia are added into lru, lru->ixa->ib->ia     prune_icache_sb list_lru_walk_one inode_lru_isolate ixa->i_state |= I_FREEING // set inode state     inode_lru_isolate __iget(ib) spin_unlock(&ib->i_lock) spin_unlock(lru_lock) rm file B ib->nlink = 0 rm     file A iput(ia) ubifs_evict_inode(ia) ubifs_jnl_delete_inode(ia) ubifs_jnl_write_inode(ia)     make_reservation(BASEHD) // Lock wbuf->io_mutex ubifs_iget(ixa->i_ino) iget_locked find_inode_fast
    __wait_on_freeing_inode(ixa) | iput(ib) // ib->nlink is 0, do evict | ubifs_evict_inode |     ubifs_jnl_delete_inode(ib)  ubifs_jnl_write_inode ABBA deadlock -----make_reservation(BASEHD)     dispose_list // cannot be executed by prune_icache_sb wake_up_bit(&ixa->i_state) Fix the possible deadlock     by using new inode state flag I_LRU_ISOLATING to pin the inode in memory while inode_lru_isolate(
    ---truncated--- (CVE-2024-45003)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-88477 advisory.

    - drm/amdgpu: Bound GPIO I2C table entry count from VBIOS (Anusha Srivatsa) [RHEL-278280] {CVE-2026-97493}
    - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (CKI Backport Bot) [RHEL-262095]     {CVE-2026-89811}
    - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260540] {CVE-2026-68236}
    - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258141]     {CVE-2026-80887}
    - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236244]     {CVE-2026-68245}
    - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240855]     {CVE-2026-68278}
    - xfs: bounds-check buffer log item's dirty bitmap (Pavel Reichl) [RHEL-253369] {CVE-2026-80536}
    - Fix use-after-free when perf mmap() revival races with the last munmap() (Vratislav Bendel)     [RHEL-270808] {CVE-2026-89791}
    - perf: Fix addr_filter_ranges lifetime (Vratislav Bendel) [RHEL-271846] {CVE-2026-93817}
    - ovl: check access to copy_file_range source with src mounter creds (Miklos Szeredi) [RHEL-238867]     {CVE-2026-68448}
    - inet: frags: strip GSO state from fragments before reassembly (Jamie Bainbridge) [RHEL-254213]     {CVE-2026-80590}
    - ipv4: fib: free fib_alias with kfree_rcu() on insert error path (Jamie Bainbridge) [RHEL-233130]     {CVE-2026-64572}
    - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (Jamie Bainbridge) [RHEL-225476] {CVE-2026-64114}
    - ALSA: seq: close a re-opened queue timer in the destructor (CKI Backport Bot) [RHEL-263699]     {CVE-2026-68202}
    - calipso: unlock rcu before returning -EAFNOSUPPORT (CKI Backport Bot) [RHEL-257678] {CVE-2025-38147}
    - calipso: Don't call calipso functions for AF_INET sk. (CKI Backport Bot) [RHEL-257678] {CVE-2025-38147}
    - fuse: re-lock request before returning from fuse_ref_folio() (CKI Backport Bot) [RHEL-234249]     {CVE-2026-64266}
    - ALSA: hda/cs35l41: Fix firmware load work teardown (CKI Backport Bot) [RHEL-234100] {CVE-2026-64481}
    - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230097]     {CVE-2026-64048}
    - ipv4: validate checksum_start before completing checksum (CKI Backport Bot) [RHEL-280590]     {CVE-2026-99999}
    - signal: Prevent exec() race (Phil Auld) [RHEL-282048] {CVE-2026-98256}
    - exec: Cleanup POSIX timers right after de_thread() (Luiz Capitulino) [RHEL-282070] {CVE-2026-98260}
    - smb: client: reject a tree connect response whose byte count is too small (CKI Backport Bot)     [RHEL-271291] {CVE-2026-89631}
    - smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (Frank Sorenson)     [RHEL-271484] {CVE-2026-89633}
    - sctp: validate cookie AUTH state before use (Xin Long) [RHEL-254315] {CVE-2026-74752}
    - sctp: stop processing a packet once its association is deleted (Xin Long) [RHEL-254315] {CVE-2026-89479}
    - sctp: avoid auth_enable sysctl UAF during netns teardown (Xin Long) [RHEL-258778] {CVE-2026-68162}
    - sctp: keep chunk->transport in step with the list it is queued on (Xin Long) [RHEL-254353]     {CVE-2026-74588}
    - usb: typec: ucsi: validate connector number in ucsi_connector_change() (Desnes Nunes) [RHEL-259412]     {CVE-2026-63958}
    - usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (Desnes Nunes)     [RHEL-259412] {CVE-2026-63962}
    - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (Desnes Nunes) [RHEL-259412]     {CVE-2026-63963}
    - usb: typec: altmodes/displayport: validate count before reading Status Update VDO (Desnes Nunes)     [RHEL-259412] {CVE-2026-63961}
    - Bluetooth: hci_sync: Fix advertising data UAFs (CKI Backport Bot) [RHEL-254672] {CVE-2026-74509}
    - openvswitch: vport: fix self-deadlock on release of tunnel ports (CKI Backport Bot) [RHEL-253867]     {CVE-2026-31678}
    - openvswitch: defer tunnel netdev_put to RCU release (CKI Backport Bot) [RHEL-253867] {CVE-2026-31678}
    - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228912] {CVE-2026-63801}
    - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238046]     {CVE-2026-68117}
    - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229479] {CVE-2026-63971}
    - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231579] {CVE-2026-52917}
    - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236158] {CVE-2026-68315}
    - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237097] {CVE-2026-68376}
    - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237097] {CVE-2026-68300}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Rocky Linux 10.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-2026_88477 advisory.

    * kernel: calipso: Don't call calipso functions for AF_INET sk. (CVE-2025-38147)

    * kernel: ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (CVE-2026-64114)

    * kernel: net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CVE-2026-64048)

    * kernel: ALSA: hda/cs35l41: Fix firmware load work teardown (CVE-2026-64481)

    * kernel: fuse: re-lock request before returning from fuse_ref_folio() (CVE-2026-64266)

    * kernel: ipv4: fib: free fib_alias with kfree_rcu() on insert error path (CVE-2026-64572)

    * kernel: drm/amd/display: set new_stream to NULL after release (CVE-2026-68236)

    * kernel: ALSA: seq: close a re-opened queue timer in the destructor (CVE-2026-68202)

    * kernel: drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CVE-2026-68278)

    * kernel: drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CVE-2026-68245)

    * kernel: ovl: check access to copy_file_range source with src mounter creds (CVE-2026-68448)

    * kernel: xfs: bounds-check buffer log item's dirty bitmap (CVE-2026-80536)

    * kernel: inet: frags: strip GSO state from fragments before reassembly (CVE-2026-80590)

    * kernel: drm/vmwgfx: use check_add_overflow for shader size+offset bound (CVE-2026-80887)

    * kernel: perf: Fix use-after-free when perf mmap() revival races with the last munmap() (CVE-2026-89791)

    * kernel: drm/amdkfd: Add TLB flush after MES queue eviction/suspension (CVE-2026-89811)

    * kernel: perf: Fix addr_filter_ranges lifetime (CVE-2026-93817)

    * kernel: drm/amdgpu: Bound GPIO I2C table entry count from VBIOS (CVE-2026-97493)

    Bug Fix(es) and Enhancement(s):

    * Backport request: bonding: only set speed/duplex to unknown, if getting speed failed [rhel-10.2.z]     (JIRA:Rocky Linux-179066)

    * RTLA segfaults on freed memory access on double SIGINT [rhel-10.2.z] (JIRA:Rocky Linux-193031)

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:88477 advisory.

    * kernel: calipso: Don't call calipso functions for AF_INET sk. (CVE-2025-38147)

    * kernel: ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (CVE-2026-64114)

    * kernel: net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CVE-2026-64048)

    * kernel: ALSA: hda/cs35l41: Fix firmware load work teardown (CVE-2026-64481)

    * kernel: fuse: re-lock request before returning from fuse_ref_folio() (CVE-2026-64266)

    * kernel: ipv4: fib: free fib_alias with kfree_rcu() on insert error path (CVE-2026-64572)

    * kernel: drm/amd/display: set new_stream to NULL after release (CVE-2026-68236)

    * kernel: ALSA: seq: close a re-opened queue timer in the destructor (CVE-2026-68202)

    * kernel: drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CVE-2026-68278)

    * kernel: drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CVE-2026-68245)

    * kernel: ovl: check access to copy_file_range source with src mounter creds (CVE-2026-68448)

    * kernel: xfs: bounds-check buffer log item's dirty bitmap (CVE-2026-80536)

    * kernel: inet: frags: strip GSO state from fragments before reassembly (CVE-2026-80590)

    * kernel: drm/vmwgfx: use check_add_overflow for shader size+offset bound (CVE-2026-80887)

    * kernel: perf: Fix use-after-free when perf mmap() revival races with the last munmap() (CVE-2026-89791)

    * kernel: drm/amdkfd: Add TLB flush after MES queue eviction/suspension (CVE-2026-89811)

    * kernel: perf: Fix addr_filter_ranges lifetime (CVE-2026-93817)

    * kernel: drm/amdgpu: Bound GPIO I2C table entry count from VBIOS (CVE-2026-97493)

    Bug Fix(es) and Enhancement(s):

    * Backport request: bonding: only set speed/duplex to unknown, if getting speed failed [rhel-10.2.z]     (JIRA:Rocky Linux-179066)

    * RTLA segfaults on freed memory access on double SIGINT [rhel-10.2.z] (JIRA:Rocky Linux-193031)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:88477 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: calipso: Don't call calipso functions for AF_INET sk. (CVE-2025-38147)

    * kernel: ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (CVE-2026-64114)

    * kernel: net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CVE-2026-64048)

    * kernel: ALSA: hda/cs35l41: Fix firmware load work teardown (CVE-2026-64481)

    * kernel: fuse: re-lock request before returning from fuse_ref_folio() (CVE-2026-64266)

    * kernel: ipv4: fib: free fib_alias with kfree_rcu() on insert error path (CVE-2026-64572)

    * kernel: drm/amd/display: set new_stream to NULL after release (CVE-2026-68236)

    * kernel: ALSA: seq: close a re-opened queue timer in the destructor (CVE-2026-68202)

    * kernel: drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CVE-2026-68278)

    * kernel: drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CVE-2026-68245)

    * kernel: ovl: check access to copy_file_range source with src mounter creds (CVE-2026-68448)

    * kernel: xfs: bounds-check buffer log item's dirty bitmap (CVE-2026-80536)

    * kernel: inet: frags: strip GSO state from fragments before reassembly (CVE-2026-80590)

    * kernel: drm/vmwgfx: use check_add_overflow for shader size+offset bound (CVE-2026-80887)

    * kernel: perf: Fix use-after-free when perf mmap() revival races with the last munmap() (CVE-2026-89791)

    * kernel: drm/amdkfd: Add TLB flush after MES queue eviction/suspension (CVE-2026-89811)

    * kernel: perf: Fix addr_filter_ranges lifetime (CVE-2026-93817)

    * kernel: drm/amdgpu: Bound GPIO I2C table entry count from VBIOS (CVE-2026-97493)

    Bug Fix(es) and Enhancement(s):

    * Backport request: bonding: only set speed/duplex to unknown, if getting speed failed [rhel-10.2.z]     (JIRA:RHEL-179066)

    * RTLA segfaults on freed memory access on double SIGINT [rhel-10.2.z] (JIRA:RHEL-193031)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - drm/amdgpu: Bound GPIO I2C table entry count from VBIOS Reject undersized tables and cap the derived entry     count to AMDGPU_MAX_I2C_BUS so we do not overrun adev->i2c_bus[] or walk an absurd number of entries on     corrupt size fields. (CVE-2026-97493)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
379068	RHEL 8 : kernel-rt (RHSA-2026:99031)	Nessus	Red Hat Local Security Checks	Local	high
379034	RHEL 8 : kernel (RHSA-2026:99015)	Nessus	Red Hat Local Security Checks	Local	high
376443	Ubuntu 24.04 LTS / 26.04 LTS : Linux kernel vulnerabilities (USN-8959-1)	Nessus	Ubuntu Local Security Checks	Local	high
374135	AlmaLinux 9.2 [TuxCare] Security Update: bpftool / kernel / kernel-64k / kernel-64k-core / kernel-64k-debug / etc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1793333110)	Nessus	Alma Linux Local Security Checks	Local	high
372070	Oracle Linux 10 : kernel (ELSA-2026-88477)	Nessus	Oracle Linux Local Security Checks	Local	medium
371917	Rocky Linux 10.2 [CIQ] Security Update: kernel / kernel-64k / kernel-64k-core / kernel-64k-debug / etc Multiple Vulnerabilities (crlsa-2026_88477)	Nessus	Rocky Linux Local Security Checks	Local	medium
371704	RockyLinux 10 : kernel (RLSA-2026:88477)	Nessus	Rocky Linux Local Security Checks	Local	medium
371117	RHEL 10 : kernel (RHSA-2026:88477)	Nessus	Red Hat Local Security Checks	Local	medium
350073	Linux Distros Unpatched Vulnerability : CVE-2026-97493	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2026-97493

high

Tenable Plugins

high

high

high

high

medium

medium

medium

medium

high