In the Linux kernel, the following vulnerability has been resolved: ipv6: sr: restore network header before routing and forwarding ipv6_srh_rcv() runs with skb->data at the Segment Routing Header (SRH) while skb_network_header() points at the IPv6 header. When segments_left > 0, ipv6_srh_rcv() previously restored the skb->data position by pushing sizeof(struct ipv6hdr), assuming the SRH immediately followed the fixed IPv6 header. If another extension header (such as a Hop-by-Hop options header) precedes the SRH, skb_network_offset() remained negative. This led to two problems: 1. During ip6_route_input(), fib6_rules_early_flow_dissect() invokes __skb_flow_dissect() which passes the negative skb_network_offset() to flow dissection, breaking BPF and C flow dissector logic. 2. If forwarded via ip6_forward() or redirected via act_mirred, downstream handlers (like sch_fragment() or neighbour output) pass the negative offset as an unsigned length, triggering OOB memcpy or buffer overflows. Fix this by pushing -skb_network_offset(skb) before routing, ensuring skb_network_offset(skb) is 0 for route lookup / flow dissection as well as downstream forwarding. On the loopback path, pull skb_transport_offset(skb) to restore skb->data to the SRH before looping back.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - In the Linux kernel, the following vulnerability has been resolved: ipv6: sr: restore network header
    before routing and forwarding ipv6_srh_rcv() runs with skb->data at the Segment Routing Header (SRH) while
    skb_network_header() points at the IPv6 header. When segments_left > 0, ipv6_srh_rcv() previously restored
    the skb->data position by pushing sizeof(struct ipv6hdr), assuming the SRH immediately followed the fixed
    IPv6 header. If another extension header (such as a Hop-by-Hop options header) precedes the SRH,
    skb_network_offset() remained negative. This led to two problems: 1. During ip6_route_input(),
    fib6_rules_early_flow_dissect() invokes __skb_flow_dissect() which passes the negative
    skb_network_offset() to flow dissection, breaking BPF and C flow dissector logic. 2. If forwarded via
    ip6_forward() or redirected via act_mirred, downstream handlers (like sch_fragment() or neighbour output)
    pass the negative offset as an unsigned length, triggering OOB memcpy or buffer overflows. Fix this by
    pushing -skb_network_offset(skb) before routing, ensuring skb_network_offset(skb) is 0 for route lookup /
    flow dissection as well as downstream forwarding. On the loopback path, pull skb_transport_offset(skb) to
    restore skb->data to the SRH before looping back. (CVE-2026-98096)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3192 advisory.

    An issue in the Linux kernel's virtio-net/TAP networking path could allow an actor with privileged access     inside a guest virtual machine to send specially crafted network packets that corrupt host kernel memory     on KVM-based hypervisors running unpatched Linux kernel versions 4.4 through 6.18. This could result in     disclosure of host memory or a denial of service.



    In the Linux kernel, the following vulnerability has been resolved:

    sctp: fix err_chunk memory leaks in INIT handling (CVE-2026-72413)

    In the Linux kernel, the following vulnerability has been resolved:

    xfrm: Fix dev use-after-free in xfrm async resumption (CVE-2026-72463)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf: Guard __get_user acesss with access_ok for uprobe_multi data (CVE-2026-74258)

    In the Linux kernel, the following vulnerability has been resolved:

    ipv4: fib: Don't dump dying fib_info in fib_leaf_notify(). (CVE-2026-74289)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: cttimeout: detach dataplane timeout policy and repurpose refcount (CVE-2026-74347)

    In the Linux kernel, the following vulnerability has been resolved:

    fou: Fix use-after-free in fou_create() (CVE-2026-74496)

    In the Linux kernel, the following vulnerability has been resolved:

    vfio/pci: clear vdev->msi_perm after freeing it on init failure (CVE-2026-89777)

    In the Linux kernel, the following vulnerability has been resolved:

    isofs: fix out-of-bounds page array access on empty zisofs block (CVE-2026-89778)

    In the Linux kernel, the following vulnerability has been resolved:

    perf: Fix use-after-free when perf mmap() revival races with the last munmap() (CVE-2026-89791)

    In the Linux kernel, the following vulnerability has been resolved:

    nvme: skip the zoned limits update if the zone info query failed (CVE-2026-89971)

    In the Linux kernel, the following vulnerability has been resolved:

    tcp: reject non zerocopy devmem tx (CVE-2026-90051)

    In the Linux kernel, the following vulnerability has been resolved:

    net/sched: sch_htb: limit htb_classify inner-class filter hops (CVE-2026-90053)

    In the Linux kernel, the following vulnerability has been resolved:

    net/sched: bound qdisc_pkt_len to prevent qdisc soft lockup (CVE-2026-90058)

    In the Linux kernel, the following vulnerability has been resolved:

    virtio-net: Ensure that TCP packets don't overflow gso_segs (CVE-2026-90063)

    In the Linux kernel, the following vulnerability has been resolved:

    net/sched: sfq: clamp quantum to avoid signed overflow soft lockup (CVE-2026-90072)

    In the Linux kernel, the following vulnerability has been resolved:

    net/sched: hhf: clamp quantum before hhf_change() to avoid overflow (CVE-2026-90073)

    In the Linux kernel, the following vulnerability has been resolved:

    net/sched: fq_codel: clamp default quantum and mtu (CVE-2026-90075)

    In the Linux kernel, the following vulnerability has been resolved:

    net/sched: fq: add overflow bounds to quantum and initial quantum (CVE-2026-90076)

    In the Linux kernel, the following vulnerability has been resolved:

    NFSv4/pnfs: key the data server cache on the NFS version (CVE-2026-90102)

    In the Linux kernel, the following vulnerability has been resolved:

    NFSv4.2: fix LAYOUTSTATS send buffer exhaustion (CVE-2026-90103)

    In the Linux kernel, the following vulnerability has been resolved:

    xsk: fix NULL pointer dereference in __xsk_rcv() (CVE-2026-90115)

    In the Linux kernel, the following vulnerability has been resolved:

    vsock: don't check the listener's sk_err in vsock_accept() (CVE-2026-90138)

    In the Linux kernel, the following vulnerability has been resolved:

    null_blk: register configfs subsystem after creating default devices (CVE-2026-90189)

    In the Linux kernel, the following vulnerability has been resolved:

    fs/ntfs3: reject out-of-range evcn in mi_enum_attr() (CVE-2026-90199)

    In the Linux kernel, the following vulnerability has been resolved:

    nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CVE-2026-90227)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf: Check load-acquire src ptr type before the load (CVE-2026-90312)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf, cgroup: Fix invalid storage access after __cgroup_bpf_attach failed (CVE-2026-90313)

    In the Linux kernel, the following vulnerability has been resolved:

    dm-integrity: replace forgeable discard filler with a keyed sector marker (CVE-2026-90333)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf, x86: Fix trampoline stack size for 128-bit arguments (CVE-2026-90358)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf: Fix potential UAF in bpf_netns_link_update_prog (CVE-2026-90393)

    In the Linux kernel, the following vulnerability has been resolved:

    iommu/tegra241-cmdqv: Synchronize the error ISR against VINTF (de)init (CVE-2026-90429)

    In the Linux kernel, the following vulnerability has been resolved:

    RDMA/mlx5: Fix integer overflow of user QP buffer size (CVE-2026-90435)

    In the Linux kernel, the following vulnerability has been resolved:

    RDMA/core: Fix potential use after free in ib_dealloc_pd_user() (CVE-2026-92507)

    In the Linux kernel, the following vulnerability has been resolved:

    software node: Fix software_node_get_reference_args() with index -1 (CVE-2026-93046)

    In the Linux kernel, the following vulnerability has been resolved:

    uio: Fix stale info pointer in failed registration path (CVE-2026-93054)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf: Reject rdonly/rdwr_buf_size kfunc arguments that exceed u32 max (CVE-2026-93125)

    In the Linux kernel, the following vulnerability has been resolved:

    mm/secretmem: properly account locked pages (CVE-2026-93243)

    In the Linux kernel, the following vulnerability has been resolved:

    vxlan: mdb: Fix use-after-free in vxlan_mdb_flush() (CVE-2026-93250)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: skip extra isize expansion during mount to prevent deadlock (CVE-2026-93268)

    In the Linux kernel, the following vulnerability has been resolved:

    i2c: smbus: reject oversized block transfers in the common path (CVE-2026-93287)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CVE-2026-93288)

    In the Linux kernel, the following vulnerability has been resolved:

    smb/client: zero-initialize stack-allocated cifs_open_info_data (CVE-2026-93801)

    In the Linux kernel, the following vulnerability has been resolved:

    btrfs: tree-checker: validate INODE_REF's namelen (CVE-2026-93813)

    In the Linux kernel, the following vulnerability has been resolved:

    perf: Fix addr_filter_ranges lifetime (CVE-2026-93817)

    In the Linux kernel, the following vulnerability has been resolved:

    tls: reject the combination of TLS and sockmap (CVE-2026-93824)

    In the Linux kernel, the following vulnerability has been resolved:

    virtio-fs: avoid double-free on failed queue setup (CVE-2026-93827)

    In the Linux kernel, the following vulnerability has been resolved:

    exfat: fix handling of damaged volume in exfat_create_upcase_table() (CVE-2026-93828)

    In the Linux kernel, the following vulnerability has been resolved:

    btrfs: tree-checker: validate names in ROOT_REF and ROOT_BACKREF (CVE-2026-97415)

    In the Linux kernel, the following vulnerability has been resolved:

    RDMA/umem: Be careful about boundary conditions in ib_umem_find_best_pgsz() (CVE-2026-97421)

    In the Linux kernel, the following vulnerability has been resolved:

    fs/ntfs3: validate index entry key bounds (CVE-2026-97438)

    In the Linux kernel, the following vulnerability has been resolved:

    fs/ntfs3: preserve non-DOS attribute bits in system.dos_attrib (CVE-2026-97439)

    In the Linux kernel, the following vulnerability has been resolved:

    ACPICA: Fix use-after-free in acpi_ds_terminate_control_method() (CVE-2026-97455)

    In the Linux kernel, the following vulnerability has been resolved:

    mptcp: avoid unneeded actions on subflow reset (CVE-2026-97524)

    In the Linux kernel, the following vulnerability has been resolved:

    x86/mm/pat: Acquire init_mm read lock on attribute changes to avoid UAF (CVE-2026-97533)

    In the Linux kernel, the following vulnerability has been resolved:

    smb: client: fix heap overflow in DACL owner/group rewrite (CVE-2026-97555)

    In the Linux kernel, the following vulnerability has been resolved:

    smb: client: reject short READ responses in CIFSSMBRead() (CVE-2026-97565)

    In the Linux kernel, the following vulnerability has been resolved:

    landlock: Fix use-after-free of the source's parent directory (CVE-2026-97594)

    In the Linux kernel, the following vulnerability has been resolved:

    ipvs: reject invalid states in connection template sync records (CVE-2026-97596)

    In the Linux kernel, the following vulnerability has been resolved:

    ipv6: flowlabel: cap duplicate leases per socket (CVE-2026-97597)

    In the Linux kernel, the following vulnerability has been resolved:

    inet: frags: invalidate queues before flushing them (CVE-2026-97602)

    In the Linux kernel, the following vulnerability has been resolved:

    net: openvswitch: fix use-after-free of the flow table mask array (CVE-2026-97611)

    In the Linux kernel, the following vulnerability has been resolved:

    ipv6: fix fib6 walker UAF on seq stop (CVE-2026-97940)

    In the Linux kernel, the following vulnerability has been resolved:

    x86/mm/pat: Acquire init_mm write lock on collapse to avoid UAF (CVE-2026-97943)

    In the Linux kernel, the following vulnerability has been resolved:

    configfs: unhash the dentry before dropping the item in rmdir (CVE-2026-97949)

    In the Linux kernel, the following vulnerability has been resolved:

    scsi: target: iscsi: Fix hang for aborted WRITE_PENDING commands (CVE-2026-97951)

    In the Linux kernel, the following vulnerability has been resolved:

    net/sched: drr: clamp quantum in change class (CVE-2026-98010)

    In the Linux kernel, the following vulnerability has been resolved:

    net/sched: hhf: clamp quantum in change and init paths (CVE-2026-98011)

    In the Linux kernel, the following vulnerability has been resolved:

    net/sched: sfq: clamp quantum in change path (CVE-2026-98012)

    In the Linux kernel, the following vulnerability has been resolved:

    net/mlx5: E-Switch: fix use-after-free in mlx5_eswitch_termtbl_put (CVE-2026-98015)

    In the Linux kernel, the following vulnerability has been resolved:

    net/mlx5e: Fix use-after-free race in sample_restore_put() (CVE-2026-98016)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf: Reject untrusted allocated-object pointers (CVE-2026-98037)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf: Require MEM_PERCPU for percpu kptr stores (CVE-2026-98039)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf: Don't predict JMP32 pointer vs zero comparisons (CVE-2026-98041)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf: Check ancestor frames for rbtree callbacks (CVE-2026-98047)

    In the Linux kernel, the following vulnerability has been resolved:

    nvme: remove stale namespaces by NSID range during scan (CVE-2026-98056)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf: Reject resilient lock operations in rbtree callbacks (CVE-2026-98060)

    In the Linux kernel, the following vulnerability has been resolved:

    net/rds: acquire RDS_IN_XMIT in rds_tcp_reset_callbacks() (CVE-2026-98070)

    In the Linux kernel, the following vulnerability has been resolved:

    ipvs: fix reversed sequence option serialization (CVE-2026-98078)

    In the Linux kernel, the following vulnerability has been resolved:

    af_packet: Don't cast tpacket_hdr.tp_len to int in tpacket_parse_header(). (CVE-2026-98095)

    In the Linux kernel, the following vulnerability has been resolved:

    ipv6: sr: restore network header before routing and forwarding (CVE-2026-98096)

    In the Linux kernel, the following vulnerability has been resolved:

    net/sched: cls_u32: fix duplicate handle when node ID pool is exhausted (CVE-2026-98104)

    In the Linux kernel, the following vulnerability has been resolved:

    netfs: Fix subreq ref leak (CVE-2026-98120)

    In the Linux kernel, the following vulnerability has been resolved:

    vxlan: mdb: Fix use-after-free in vxlan_mdb_remote_src_del() (CVE-2026-98122)

    In the Linux kernel, the following vulnerability has been resolved:

    sctp: fix soft lockup from unpadded ASCONF-ACK parameter iteration (CVE-2026-98123)

    In the Linux kernel, the following vulnerability has been resolved:

    sctp: fix a TOCTOU race in SCTP_CMD_TIMER_START (CVE-2026-98130)

    In the Linux kernel, the following vulnerability has been resolved:

    drm/virtio: use the DMA API for resource backing on Xen (CVE-2026-98156)

    In the Linux kernel, the following vulnerability has been resolved: ipv4: validate checksum_start before     completing checksum If a packet with bad checksum metadata gets into the ipv4 stack, skb_checksum_help can     corrupt the network header and cause a bunch of mischief. This was discovered and reported by Paulos, and     has been reporoduced by others independently since. We really shouldn't allow such packets in, but as a     defence in depth measure, let's also check before we complete the checksum. A more complete validation at     input is forthcoming, but needs more work. (CVE-2026-99999)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3183 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    smb: client: fix UAF and buffer leak in cifs_check_trans2() for malformed secondary T2 (CVE-2026-89637)

    In the Linux kernel, the following vulnerability has been resolved:

    ceph: bound copied dentry name length in NFS export get_name

    ceph_get_name() copies the MDS-supplied name into the caller'sNAME_MAX-sized buffer with memcpy(name,     rinfo->dname, rinfo->dname_len)and then writes name[rinfo->dname_len] = 0, without checking     dname_lenagainst NAME_MAX. A malicious or buggy MDS that returns a LOOKUPNAME replywith dname_len >     NAME_MAX overflows the buffer. __get_snap_name() copiesrde->name / rde->name_len the same unchecked way.

    Impact: a malicious or compromised Ceph MDS overflows the NAME_MAX namebuffer in a client's NFS-export     get_name path, a slab out-of-bounds writereported by KASAN. Reachable when a CephFS mount is re-exported     over NFS.

    Add ceph_export_copy_name(), which rejects lengths above NAME_MAX with-ENAMETOOLONG before the copy, and     use it in both ceph_get_name() and__get_snap_name(). (CVE-2026-89652)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf: Reject rdonly/rdwr_buf_size kfunc arguments that exceed u32 max (CVE-2026-93125)

    In the Linux kernel, the following vulnerability has been resolved:

    ipv6: sr: restore network header before routing and forwarding (CVE-2026-98096)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS-STREAM8:CLSA-2026:1791780738 advisory.

  - In the Linux kernel, the following vulnerability has been resolved: mm/khugepaged: invoke MMU notifiers in     shmem/file collapse paths Any codepath that zaps page table entries must invoke MMU notifiers to ensure     that secondary MMUs (like KVM) don't keep accessing pages which aren't mapped anymore. Secondary MMUs     don't hold their own references to pages that are mirrored over, so failing to notify them can lead to     page use-after-free. I'm marking this as addressing an issue introduced in commit f3f0e1d2150b     (khugepaged: add support of collapse for tmpfs/shmem pages), but most of the security impact of this     only came in commit 27e1f8273113 (khugepaged: enable collapse pmd for pte-mapped THP), which actually     omitted flushes for the removal of present PTEs, not just for the removal of empty page tables.
    (CVE-2022-48991)

  - In the Linux kernel, the following vulnerability has been resolved: virtio_net: fix xdp_rxq_info bug after     suspend/resume The following sequence currently causes a driver bug warning when using virtio_net: # ip     link set eth0 up # echo mem > /sys/power/state (or e.g. # rtcwake -s 10 -m mem) <resume> # ip link set     eth0 down Missing register, driver bug WARNING: CPU: 0 PID: 375 at net/core/xdp.c:138     xdp_rxq_info_unreg+0x58/0x60 Call trace: xdp_rxq_info_unreg+0x58/0x60 virtnet_close+0x58/0xac
    __dev_close_many+0xac/0x140 __dev_change_flags+0xd8/0x210 dev_change_flags+0x24/0x64     do_setlink+0x230/0xdd0 ... This happens because virtnet_freeze() frees the receive_queue completely     (including struct xdp_rxq_info) but does not call xdp_rxq_info_unreg(). Similarly, virtnet_restore() sets     up the receive_queue again but does not call xdp_rxq_info_reg(). Actually, parts of virtnet_freeze_down()     and virtnet_restore_up() are almost identical to virtnet_close() and virtnet_open(): only the calls to     xdp_rxq_info_(un)reg() are missing. This means that we can fix this easily and avoid such problems in the     future by just calling virtnet_close()/open() from the freeze/restore handlers. Aside from adding the     missing xdp_rxq_info calls the only difference is that the refill work is only cancelled if     netif_running(). However, this should not make any functional difference since the refill work should only     be active if the network interface is actually up. (CVE-2022-49687)

  - In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: Fix repeated calls to     sock_put() when msg has more_data In tcp_bpf_send_verdict() redirection, the eval variable is assigned to
    __SK_REDIRECT after the apply_bytes data is sent, if msg has more_data, sock_put() will be called multiple     times. We should reset the eval variable to __SK_NONE every time more_data starts. This causes: IPv4:
    Attempt to release TCP socket in state 1 00000000b4c925d7 ------------[ cut here ]------------ refcount_t:
    addition on 0; use-after-free. WARNING: CPU: 5 PID: 4482 at lib/refcount.c:25     refcount_warn_saturate+0x7d/0x110 Modules linked in: CPU: 5 PID: 4482 Comm: sockhash_bypass Kdump: loaded     Not tainted 6.0.0 #1 Hardware name: Red Hat KVM, BIOS 1.11.0-2.el7 04/01/2014 Call Trace: <TASK>
    __tcp_transmit_skb+0xa1b/0xb90 ? __alloc_skb+0x8c/0x1a0 ? __kmalloc_node_track_caller+0x184/0x320     tcp_write_xmit+0x22a/0x1110 __tcp_push_pending_frames+0x32/0xf0 do_tcp_sendpages+0x62d/0x640     tcp_bpf_push+0xae/0x2c0 tcp_bpf_sendmsg_redir+0x260/0x410 ? preempt_count_add+0x70/0xa0     tcp_bpf_send_verdict+0x386/0x4b0 tcp_bpf_sendmsg+0x21b/0x3b0 sock_sendmsg+0x58/0x70
    __sys_sendto+0xfa/0x170 ? xfd_validate_state+0x1d/0x80 ? switch_fpu_return+0x59/0xe0
    __x64_sys_sendto+0x24/0x30 do_syscall_64+0x37/0x90 entry_SYSCALL_64_after_hwframe+0x63/0xcd     (CVE-2022-50536)

  - In the Linux kernel, the following vulnerability has been resolved: crypto: scomp - fix req->dst buffer     overflow The req->dst buffer size should be checked before copying from the scomp_scratch->dst to avoid     req->dst buffer overflow problem. (CVE-2023-52612)

  - In the Linux kernel, the following vulnerability has been resolved: net: atlantic: eliminate double free     in error handling logic Driver has a logic leak in ring data allocation/free, where aq_ring_free could be     called multiple times on same ring, if system is under stress and got memory allocation error. Ring     pointer was used as an indicator of failure, but this is not correct since only ring data is     allocated/deallocated. Ring itself is an array member. Changing ring allocation functions to return error     code directly. This simplifies error handling and eliminates aq_ring_free on higher layer.
    (CVE-2023-52664)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - ipv6: sr: restore network header before routing and forwarding ipv6_srh_rcv() runs with skb->data at the     Segment Routing Header (SRH) while skb_network_header() points at the IPv6 header. When segments_left > 0,     ipv6_srh_rcv() previously restored the skb->data position by pushing sizeof(struct ipv6hdr), assuming the     SRH immediately followed the fixed IPv6 header. If another extension header (such as a Hop-by-Hop options     header) precedes the SRH, skb_network_offset() remained negative. This led to two problems: 1. During     ip6_route_input(), fib6_rules_early_flow_dissect() invokes __skb_flow_dissect() which passes the negative     skb_network_offset() to flow dissection, breaking BPF and C flow dissector logic. 2. If forwarded via     ip6_forward() or redirected via act_mirred, downstream handlers (like sch_fragment() or neighbour output)     pass the negative offset as an unsigned length, triggering OOB memcpy or buffer overflows. Fix this by     pushing -skb_network_offset(skb) before routing, ensuring skb_network_offset(skb) is 0 for route lookup /     flow dissection as well as downstream forwarding. On the loopback path, pull skb_transport_offset(skb) to     restore skb->data to the SRH before looping back. (CVE-2026-98096)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
475445	Google: sys-kernel/cchost-kernel-6_12, sys-kernel/cchost-kernel-6_18, sys-kernel/csql-kernel-6_12, sys-kernel/csql-kernel-6_18, sys-kernel/lakitu-kernel-6_12, sys-kernel/lakitu-kernel-6_18, sys-kernel/lakitu-nc-kernel-6_12, sys-kernel/lakitu-nc-kernel-6_18: security update to 19999.44.106	Tenable Cloud Security	Google COS Security Checks	Local	high
475445	Google: sys-kernel/cchost-kernel-6_12, sys-kernel/cchost-kernel-6_18, sys-kernel/csql-kernel-6_12, sys-kernel/csql-kernel-6_18, sys-kernel/lakitu-kernel-6_12, sys-kernel/lakitu-kernel-6_18, sys-kernel/lakitu-nc-kernel-6_12, sys-kernel/lakitu-nc-kernel-6_18: security update to 19999.44.106	Tenable Self-Hosted Container Security	Google COS Security Checks	Local	high
365680	Oracle Linux 8 / 9 : Unbreakable Enterprise kernel (ELSA-2026-500385)	Nessus	Oracle Linux Local Security Checks	Local	medium
365258	Amazon Linux 2023 : bpftool6.18, kernel6.18, kernel6.18-devel (ALAS2023-2026-3192)	Nessus	Amazon Linux Local Security Checks	Local	medium
365240	Amazon Linux 2023 : bpftool, kernel, kernel-devel (ALAS2023-2026-3183)	Nessus	Amazon Linux Local Security Checks	Local	critical
365209	Amazon Linux 2023 : bpftool6.12, kernel6.12, kernel6.12-devel (ALAS2023-2026-3193)	Nessus	Amazon Linux Local Security Checks	Local	medium
364675	CentOS Linux 8 [TuxCare] Security Update: bpftool / kernel / kernel-core / kernel-cross-headers / etc Multiple Vulnerabilities (CENTOS-STREAM8:CLSA-2026:1791780738)	Nessus	CentOS Local Security Checks	Local	high
364137	Oracle Linux 10 / 9 : Unbreakable Enterprise kernel (ELSA-2026-500374)	Nessus	Oracle Linux Local Security Checks	Local	high
362907	Debian dla-4817 : ata-modules-6.12.107+deb12-armmp-di - security update	Nessus	Debian Local Security Checks	Local	high
351155	Debian dsa-6528 : ata-modules-6.12.111+deb13-armmp-di - security update	Nessus	Debian Local Security Checks	Local	high
350656	Linux Distros Unpatched Vulnerability : CVE-2026-98096	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2026-98096

high

Tenable Plugins

high

high

medium

medium

critical

medium

high

high

high

high

high