In the Linux kernel, the following vulnerability has been resolved: KEYS: encrypted: fix integer overflow of datablob_len encrypted_key_alloc() stores datablob_len in a u16. It is computed from multiple string and payload lengths. If the result exceeds U16_MAX, the assignment truncates the allocation size. KASAN reports a 32760-byte slab-out-of-bounds write when __ekey_init() copies the master key description into the undersized buffer. The total payload length stored in key->datalen is also a u16. Use check_add_overflow() to reject values that do not fit either destination, and use kzalloc_flex() for the flexible-array allocation.

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:90365 advisory.

    * kernel: udp: Deal with race between UDP socket address change and rehash (CVE-2024-57974)
      * kernel: fuse: re-lock request before replacing page cache folio (CVE-2026-53388)
      * kernel: net/handshake: hand off the pinned file reference to accept_doit (CVE-2026-63979)
      * kernel: net/handshake: Drain pending requests at net namespace exit (CVE-2026-63978)
      * kernel: fuse: re-lock request before returning from fuse_ref_folio() (CVE-2026-64266)
      * kernel: net/handshake: Take a long-lived file reference at submit (CVE-2026-64523)
      * kernel: ipvs: reload ip header after head reallocation (CVE-2026-68476)
      * kernel: selinux: avoid sk_socket dereference in selinux_sctp_bind_connect() (CVE-2026-72242)
      * kernel: KVM: s390: pci: Reject adapter interrupt forwarding if already enabled (CVE-2026-74515)
      * kernel: usb: usbfs: fix use-after-free of usb_device in usbdev_release() (CVE-2026-80824)
      * kernel: smb: client: clear setuid/setgid bit on write with cifsacl/modefromsid/posix extensions     (CVE-2026-89638)
      * kernel: vfio/pci: clear vdev->msi_perm after freeing it on init failure (CVE-2026-89777)
      * kernel: md/raid5-ppl: fix use-after-free in ppl_do_flush() (CVE-2026-93262)
      * kernel: KEYS: encrypted: fix integer overflow of datablob_len (CVE-2026-98222)
      * kernel: netfilter: flowtable: hold reference on ct until flow is released (CVE-2026-98320)


    Bug Fix(es) and Enhancement(s):

      * kernel panic at __crypto_xor+0x2 after a number of out-of-bounds read and use-after-free read     (JIRA:AlmaLinux-257205)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS-STREAM8:CLSA-2026:1792759740 advisory.

  - In the Linux kernel, the following vulnerability has been resolved: mrp: introduce active flags to prevent     UAF when applicant uninit The caller of del_timer_sync must prevent restarting of the timer, If we have no     this synchronization, there is a small probability that the cancellation will not be successful. And     syzbot report the fellowing crash: ================================================================== BUG:
    KASAN: use-after-free in hlist_add_head include/linux/list.h:929 [inline] BUG: KASAN: use-after-free in     enqueue_timer+0x18/0xa4 kernel/time/timer.c:605 Write at addr f9ff000024df6058 by task syz-fuzzer/2256     Pointer tag: [f9], memory tag: [fe] CPU: 1 PID: 2256 Comm: syz-fuzzer Not tainted     6.1.0-rc5-syzkaller-00008- ge01d50cbd6ee #0 Hardware name: linux,dummy-virt (DT) Call trace:
    dump_backtrace.part.0+0xe0/0xf0 arch/arm64/kernel/stacktrace.c:156 dump_backtrace     arch/arm64/kernel/stacktrace.c:162 [inline] show_stack+0x18/0x40 arch/arm64/kernel/stacktrace.c:163
    __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x68/0x84 lib/dump_stack.c:106     print_address_description mm/kasan/report.c:284 [inline] print_report+0x1a8/0x4a0 mm/kasan/report.c:395     kasan_report+0x94/0xb4 mm/kasan/report.c:495 __do_kernel_fault+0x164/0x1e0 arch/arm64/mm/fault.c:320     do_bad_area arch/arm64/mm/fault.c:473 [inline] do_tag_check_fault+0x78/0x8c arch/arm64/mm/fault.c:749     do_mem_abort+0x44/0x94 arch/arm64/mm/fault.c:825 el1_abort+0x40/0x60 arch/arm64/kernel/entry-common.c:367     el1h_64_sync_handler+0xd8/0xe4 arch/arm64/kernel/entry-common.c:427 el1h_64_sync+0x64/0x68     arch/arm64/kernel/entry.S:576 hlist_add_head include/linux/list.h:929 [inline] enqueue_timer+0x18/0xa4     kernel/time/timer.c:605 mod_timer+0x14/0x20 kernel/time/timer.c:1161 mrp_periodic_timer_arm     net/802/mrp.c:614 [inline] mrp_periodic_timer+0xa0/0xc0 net/802/mrp.c:627     call_timer_fn.constprop.0+0x24/0x80 kernel/time/timer.c:1474 expire_timers+0x98/0xc4     kernel/time/timer.c:1519 To fix it, we can introduce a new active flags to make sure the timer will not     restart. (CVE-2022-50697)

  - In the Linux kernel, the following vulnerability has been resolved: ubi: Fix use-after-free when volume     resizing failed There is an use-after-free problem reported by KASAN:
    ================================================================== BUG: KASAN: use-after-free in     ubi_eba_copy_table+0x11f/0x1c0 [ubi] Read of size 8 at addr ffff888101eec008 by task ubirsvol/4735 CPU: 2     PID: 4735 Comm: ubirsvol Not tainted 6.1.0-rc1-00003-g84fa3304a7fc-dirty #14 Hardware name: QEMU Standard     PC (i440FX + PIIX, 1996), BIOS 1.14.0-1.fc33 04/01/2014 Call Trace: <TASK> dump_stack_lvl+0x34/0x44     print_report+0x171/0x472 kasan_report+0xad/0x130 ubi_eba_copy_table+0x11f/0x1c0 [ubi]     ubi_resize_volume+0x4f9/0xbc0 [ubi] ubi_cdev_ioctl+0x701/0x1850 [ubi] __x64_sys_ioctl+0x11d/0x170     do_syscall_64+0x35/0x80 entry_SYSCALL_64_after_hwframe+0x46/0xb0 </TASK> When ubi_change_vtbl_record()     returns an error in ubi_resize_volume(), new_eba_tbl will be freed on error handing path, but it is     holded by vol->eba_tbl in ubi_eba_replace_table(). It means that the liftcycle of vol->eba_tbl and     vol are different, so when resizing volume in next time, it causing an use-after-free fault. Fix it by     not freeing new_eba_tbl after it replaced in ubi_eba_replace_table(), while will be freed in next volume     resizing. (CVE-2023-53800)

  - In the Linux kernel, the following vulnerability has been resolved: RDMA/uverbs: Validate wqe_size before     using it in ib_uverbs_post_send ib_uverbs_post_send() uses cmd.wqe_size from userspace without any     validation before passing it to kmalloc() and using the allocated buffer as struct ib_uverbs_send_wr. If a     user provides a small wqe_size value (e.g., 1), kmalloc() will succeed, but subsequent accesses to     user_wr->opcode, user_wr->num_sge, and other fields will read beyond the allocated buffer, resulting in an     out-of-bounds read from kernel heap memory. This could potentially leak sensitive kernel information to     userspace. Additionally, providing an excessively large wqe_size can trigger a WARNING in the memory     allocation path, as reported by syzkaller. This is inconsistent with ib_uverbs_unmarshall_recv() which     properly validates that wqe_size >= sizeof(struct ib_uverbs_recv_wr) before proceeding. Add the same     validation for ib_uverbs_post_send() to ensure wqe_size is at least sizeof(struct ib_uverbs_send_wr).
    (CVE-2026-45856)

  - In the Linux kernel, the following vulnerability has been resolved: gfs2: Fix slab-use-after-free in     qd_put Commit a475c5dd16e5 (gfs2: Free quota data objects synchronously) started freeing quota data     objects during filesystem shutdown instead of putting them back onto the LRU list, but it failed to remove     these objects from the LRU list, causing LRU list corruption. This caused use-after-free when the shrinker     (gfs2_qd_shrink_scan) tried to access already-freed objects on the LRU list. Fix this by removing qd     objects from the LRU list before freeing them in qd_put(). Initial fix from Deepanshu Kartikey     <kartikey406@gmail.com>. (CVE-2026-45861)

  - In the Linux kernel, the following vulnerability has been resolved: gfs2: Fix use-after-free in iomap     inline data write path The inline data buffer head (dibh) is being released prematurely in     gfs2_iomap_begin() via release_metapath() while iomap->inline_data still points to dibh->b_data. This     causes a use-after-free when iomap_write_end_inline() later attempts to write to the inline data area. The     bug sequence: 1. gfs2_iomap_begin() calls gfs2_meta_inode_buffer() to read inode metadata into dibh 2.
    Sets iomap->inline_data = dibh->b_data + sizeof(struct gfs2_dinode) 3. Calls release_metapath() which     calls brelse(dibh), dropping refcount to 0 4. kswapd reclaims the page (~39ms later in the syzbot report)     5. iomap_write_end_inline() tries to memcpy() to iomap->inline_data 6. KASAN detects use-after-free write     to freed memory Fix by storing dibh in iomap->private and incrementing its refcount with get_bh() in     gfs2_iomap_begin(). The buffer is then properly released in gfs2_iomap_end() after the inline write     completes, ensuring the page stays alive for the entire iomap operation. Note: A C reproducer is not     available for this issue. The fix is based on analysis of the KASAN report and code review showing the     buffer head is freed before use. [agruenba: Take buffer head reference in gfs2_iomap_begin() to avoid     leaks in gfs2_iomap_get() and gfs2_iomap_alloc().] (CVE-2026-45984)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The CentOS Linux 8.4 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS8.4:CLSA-2026:1792749577 advisory.

  - In the Linux kernel, the following vulnerability has been resolved: cifs: fix session state check in     reconnect to avoid use-after-free issue Don't collect exiting session in smb2_reconnect_server(), because     it will be released soon. Note that the exiting session will stay in server->smb_ses_list until it     complete the cifs_free_ipc() and logoff() and then delete itself from the list. (CVE-2023-53794)

  - In the Linux kernel, the following vulnerability has been resolved: net: skbuff: propagate shared-frag     marker through frag-transfer helpers Two frag-transfer helpers (__pskb_copy_fclone() and skb_shift()) fail     to propagate the SKBFL_SHARED_FRAG bit in skb_shinfo()->flags when moving frags from source to     destination. __pskb_copy_fclone() defers the rest of the shinfo metadata to skb_copy_header() after     copying frag descriptors, but that helper only carries over gso_{size,segs, type} and never touches     skb_shinfo()->flags; skb_shift() moves frag descriptors directly and leaves flags untouched. As a result,     the destination skb keeps a reference to the same externally-owned or page-cache-backed pages while     reporting skb_has_shared_frag() as false. The mismatch is harmful in any in-place writer that uses     skb_has_shared_frag() to decide whether shared pages must be detoured through skb_cow_data(). ESP input is     one such writer (esp4.c, esp6.c), and a single nft 'dup to <local>' rule -- or any other nf_dup_ipv4() /     xt_TEE caller -- is enough to land a pskb_copy()'d skb in esp_input() with the marker stripped, letting an     unprivileged user write into the page cache of a root-owned read-only file via authencesn-ESN stray     writes. Set SKBFL_SHARED_FRAG on the destination whenever frag descriptors were actually moved from the     source. skb_copy() and skb_copy_expand() share skb_copy_header() too but linearize all paged data into     freshly allocated head storage and emerge with nr_frags == 0, so skb_has_shared_frag() returns false on     its own; they need no change. The same omission exists in skb_gro_receive() and skb_gro_receive_list().
    The former moves the incoming skb's frag descriptors into the accumulator's last sub-skb via two paths (a     direct frag-move loop and the head_frag + memcpy path); the latter chains the incoming skb whole onto p's     frag_list. Downstream skb_segment() reads only skb_shinfo(p)->flags, and skb_segment_list() reuses each     sub-skb's shinfo as the nskb -- both p and lp must carry the marker. The same omission also exists in     tcp_clone_payload(), which builds an MTU probe skb by moving frag descriptors from skbs on sk_write_queue     into a freshly allocated nskb. The helper falls into the same family and warrants the same fix for     consistency; no TCP TX-side in-place writer is currently known to reach a user page through this gap, but     a future consumer depending on the marker would regress silently. The same omission exists in     skb_segment(): the per-iteration flag merge takes only head_skb's flag, and the inner switch that rebinds     frag_skb to list_skb on head_skb-frags exhaustion does not fold the new frag_skb's flag into nskb. Fold     frag_skb's flag at both sites so segments drawing frags from frag_list members carry the marker.
    (CVE-2026-43503)

  - In the Linux kernel, the following vulnerability has been resolved: RDMA/uverbs: Validate wqe_size before     using it in ib_uverbs_post_send ib_uverbs_post_send() uses cmd.wqe_size from userspace without any     validation before passing it to kmalloc() and using the allocated buffer as struct ib_uverbs_send_wr. If a     user provides a small wqe_size value (e.g., 1), kmalloc() will succeed, but subsequent accesses to     user_wr->opcode, user_wr->num_sge, and other fields will read beyond the allocated buffer, resulting in an     out-of-bounds read from kernel heap memory. This could potentially leak sensitive kernel information to     userspace. Additionally, providing an excessively large wqe_size can trigger a WARNING in the memory     allocation path, as reported by syzkaller. This is inconsistent with ib_uverbs_unmarshall_recv() which     properly validates that wqe_size >= sizeof(struct ib_uverbs_recv_wr) before proceeding. Add the same     validation for ib_uverbs_post_send() to ensure wqe_size is at least sizeof(struct ib_uverbs_send_wr).
    (CVE-2026-45856)

  - In the Linux kernel, the following vulnerability has been resolved: crypto: authencesn - reject short     ahash digests during instance creation authencesn requires either a zero authsize or an authsize of at     least 4 bytes because the ESN encrypt/decrypt paths always move 4 bytes of high-order sequence number data     at the end of the authenticated data. While crypto_authenc_esn_setauthsize() already rejects explicit non-     zero authsizes in the range 1..3, crypto_authenc_esn_create() still copied auth->digestsize into     inst->alg.maxauthsize without validating it. The AEAD core then initialized the tfm's default authsize     from that value. As a result, selecting an ahash with digest size 1..3, such as cbcmac(cipher_null),     exposed authencesn instances whose default authsize was invalid even though setauthsize() would have     rejected the same value. AF_ALG could then trigger the ESN tail handling with a too-short tag and hit an     out-of-bounds access. Reject authencesn instances whose ahash digest size is in the invalid non-zero range     1..3 so that no tfm can inherit an unsupported default authsize. (CVE-2026-46033)

  - In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Validate pad and ICRC before     payload_size() in rxe_rcv rxe_rcv() currently checks only that the incoming packet is at least     header_size(pkt) bytes long before payload_size() is used. However, payload_size() subtracts both the     attacker-controlled BTH pad field and RXE_ICRC_SIZE from pkt->paylen: payload_size = pkt->paylen -     offset[RXE_PAYLOAD] - bth_pad(pkt) - RXE_ICRC_SIZE This means a short packet can still make payload_size()     underflow even if it includes enough bytes for the fixed headers. Simply requiring header_size(pkt) +     RXE_ICRC_SIZE is not sufficient either, because a packet with a forged non-zero BTH pad can still leave     payload_size() negative and pass an underflowed value to later receive-path users. Fix this by validating     pkt->paylen against the full minimum length required by payload_size(): header_size(pkt) + bth_pad(pkt) +     RXE_ICRC_SIZE. (CVE-2026-46043)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The CentOS Linux 8.5 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS8.5:CLSA-2026:1792750763 advisory.

  - In the Linux kernel, the following vulnerability has been resolved: RDMA: Fix use-after-free in     rxe_queue_cleanup On error handling path in rxe_qp_from_init() qp->sq.queue is freed and then     rxe_create_qp() will drop last reference to this object. qp clean up function will try to free this queue     one time and it causes UAF bug. Fix it by zeroing queue pointer after freeing queue in rxe_qp_from_init().
    (CVE-2021-47616)

  - In the Linux kernel, the following vulnerability has been resolved: mrp: introduce active flags to prevent     UAF when applicant uninit The caller of del_timer_sync must prevent restarting of the timer, If we have no     this synchronization, there is a small probability that the cancellation will not be successful. And     syzbot report the fellowing crash: ================================================================== BUG:
    KASAN: use-after-free in hlist_add_head include/linux/list.h:929 [inline] BUG: KASAN: use-after-free in     enqueue_timer+0x18/0xa4 kernel/time/timer.c:605 Write at addr f9ff000024df6058 by task syz-fuzzer/2256     Pointer tag: [f9], memory tag: [fe] CPU: 1 PID: 2256 Comm: syz-fuzzer Not tainted     6.1.0-rc5-syzkaller-00008- ge01d50cbd6ee #0 Hardware name: linux,dummy-virt (DT) Call trace:
    dump_backtrace.part.0+0xe0/0xf0 arch/arm64/kernel/stacktrace.c:156 dump_backtrace     arch/arm64/kernel/stacktrace.c:162 [inline] show_stack+0x18/0x40 arch/arm64/kernel/stacktrace.c:163
    __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x68/0x84 lib/dump_stack.c:106     print_address_description mm/kasan/report.c:284 [inline] print_report+0x1a8/0x4a0 mm/kasan/report.c:395     kasan_report+0x94/0xb4 mm/kasan/report.c:495 __do_kernel_fault+0x164/0x1e0 arch/arm64/mm/fault.c:320     do_bad_area arch/arm64/mm/fault.c:473 [inline] do_tag_check_fault+0x78/0x8c arch/arm64/mm/fault.c:749     do_mem_abort+0x44/0x94 arch/arm64/mm/fault.c:825 el1_abort+0x40/0x60 arch/arm64/kernel/entry-common.c:367     el1h_64_sync_handler+0xd8/0xe4 arch/arm64/kernel/entry-common.c:427 el1h_64_sync+0x64/0x68     arch/arm64/kernel/entry.S:576 hlist_add_head include/linux/list.h:929 [inline] enqueue_timer+0x18/0xa4     kernel/time/timer.c:605 mod_timer+0x14/0x20 kernel/time/timer.c:1161 mrp_periodic_timer_arm     net/802/mrp.c:614 [inline] mrp_periodic_timer+0xa0/0xc0 net/802/mrp.c:627     call_timer_fn.constprop.0+0x24/0x80 kernel/time/timer.c:1474 expire_timers+0x98/0xc4     kernel/time/timer.c:1519 To fix it, we can introduce a new active flags to make sure the timer will not     restart. (CVE-2022-50697)

  - In the Linux kernel, the following vulnerability has been resolved: mm/khugepaged: fix ->anon_vma race If     an ->anon_vma is attached to the VMA, collapse_and_free_pmd() requires it to be locked. Page table     traversal is allowed under any one of the mmap lock, the anon_vma lock (if the VMA is associated with an     anon_vma), and the mapping lock (if the VMA is associated with a mapping); and so to be able to remove     page tables, we must hold all three of them. retract_page_tables() bails out if an ->anon_vma is attached,     but does this check before holding the mmap lock (as the comment above the check explains). If we racily     merged an existing ->anon_vma (shared with a child process) from a neighboring VMA, subsequent rmap     traversals on pages belonging to the child will be able to see the page tables that we are concurrently     removing while assuming that nothing else can access them. Repeat the ->anon_vma check once we hold the     mmap lock to ensure that there really is no concurrent page table access. Hitting this bug causes a     lockdep warning in collapse_and_free_pmd(), in the line     lockdep_assert_held_write(&vma->anon_vma->root->rwsem). It can also lead to use-after-free access.
    (CVE-2023-52935)

  - In the Linux kernel, the following vulnerability has been resolved: SUNRPC: make sure cache entry active     before cache_show The function `c_show` was called with protection from RCU. This only ensures that `cp`     will not be freed. Therefore, the reference count for `cp` can drop to zero, which will trigger a refcount     use-after-free warning when `cache_get` is called. To resolve this issue, use `cache_get_rcu` to ensure     that `cp` remains active. ------------[ cut here ]------------ refcount_t: addition on 0; use-after-free.
    WARNING: CPU: 7 PID: 822 at lib/refcount.c:25 refcount_warn_saturate+0xb1/0x120 CPU: 7 UID: 0 PID: 822     Comm: cat Not tainted 6.12.0-rc3+ #1 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS     1.16.1-2.fc37 04/01/2014 RIP: 0010:refcount_warn_saturate+0xb1/0x120 Call Trace: <TASK> c_show+0x2fc/0x380     [sunrpc] seq_read_iter+0x589/0x770 seq_read+0x1e5/0x270 proc_reg_read+0xe1/0x140 vfs_read+0x125/0x530     ksys_read+0xc1/0x160 do_syscall_64+0x5f/0x170 entry_SYSCALL_64_after_hwframe+0x76/0x7e (CVE-2024-53174)

  - In the Linux kernel, the following vulnerability has been resolved: net: skbuff: propagate shared-frag     marker through frag-transfer helpers Two frag-transfer helpers (__pskb_copy_fclone() and skb_shift()) fail     to propagate the SKBFL_SHARED_FRAG bit in skb_shinfo()->flags when moving frags from source to     destination. __pskb_copy_fclone() defers the rest of the shinfo metadata to skb_copy_header() after     copying frag descriptors, but that helper only carries over gso_{size,segs, type} and never touches     skb_shinfo()->flags; skb_shift() moves frag descriptors directly and leaves flags untouched. As a result,     the destination skb keeps a reference to the same externally-owned or page-cache-backed pages while     reporting skb_has_shared_frag() as false. The mismatch is harmful in any in-place writer that uses     skb_has_shared_frag() to decide whether shared pages must be detoured through skb_cow_data(). ESP input is     one such writer (esp4.c, esp6.c), and a single nft 'dup to <local>' rule -- or any other nf_dup_ipv4() /     xt_TEE caller -- is enough to land a pskb_copy()'d skb in esp_input() with the marker stripped, letting an     unprivileged user write into the page cache of a root-owned read-only file via authencesn-ESN stray     writes. Set SKBFL_SHARED_FRAG on the destination whenever frag descriptors were actually moved from the     source. skb_copy() and skb_copy_expand() share skb_copy_header() too but linearize all paged data into     freshly allocated head storage and emerge with nr_frags == 0, so skb_has_shared_frag() returns false on     its own; they need no change. The same omission exists in skb_gro_receive() and skb_gro_receive_list().
    The former moves the incoming skb's frag descriptors into the accumulator's last sub-skb via two paths (a     direct frag-move loop and the head_frag + memcpy path); the latter chains the incoming skb whole onto p's     frag_list. Downstream skb_segment() reads only skb_shinfo(p)->flags, and skb_segment_list() reuses each     sub-skb's shinfo as the nskb -- both p and lp must carry the marker. The same omission also exists in     tcp_clone_payload(), which builds an MTU probe skb by moving frag descriptors from skbs on sk_write_queue     into a freshly allocated nskb. The helper falls into the same family and warrants the same fix for     consistency; no TCP TX-side in-place writer is currently known to reach a user page through this gap, but     a future consumer depending on the marker would regress silently. The same omission exists in     skb_segment(): the per-iteration flag merge takes only head_skb's flag, and the inner switch that rebinds     frag_skb to list_skb on head_skb-frags exhaustion does not fold the new frag_skb's flag into nskb. Fold     frag_skb's flag at both sites so segments drawing frags from frag_list members carry the marker.
    (CVE-2026-43503)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4850 advisory.

    -------------------------------------------------------------------------     Debian LTS Advisory DLA-4850-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                        Ben Hutchings     October 22, 2026                              https://wiki.debian.org/LTS
    -------------------------------------------------------------------------

    Package        : linux-6.12     Version        : 6.12.113-1~deb12u1     CVE ID         : CVE-2025-38204 CVE-2025-40158 CVE-2026-52988 CVE-2026-72315                      CVE-2026-72463 CVE-2026-74347 CVE-2026-80935 CVE-2026-80937                      CVE-2026-80939 CVE-2026-80980 CVE-2026-81016 CVE-2026-89437                      CVE-2026-89441 CVE-2026-89445 CVE-2026-89452 CVE-2026-89467                      CVE-2026-89500 CVE-2026-89503 CVE-2026-89520 CVE-2026-89527                      CVE-2026-89633 CVE-2026-89638 CVE-2026-89766 CVE-2026-89795                      CVE-2026-89797 CVE-2026-89806 CVE-2026-89827 CVE-2026-89832                      CVE-2026-89837 CVE-2026-89838 CVE-2026-89840 CVE-2026-89859                      CVE-2026-89868 CVE-2026-89912 CVE-2026-89921 CVE-2026-89956                      CVE-2026-89971 CVE-2026-89972 CVE-2026-89996 CVE-2026-90002                      CVE-2026-90013 CVE-2026-90016 CVE-2026-90023 CVE-2026-90029                      CVE-2026-90030 CVE-2026-90146 CVE-2026-93179 CVE-2026-93196                      CVE-2026-93199 CVE-2026-93200 CVE-2026-93231 CVE-2026-93243                      CVE-2026-93244 CVE-2026-93285 CVE-2026-97527 CVE-2026-97528                      CVE-2026-97529 CVE-2026-97530 CVE-2026-97531 CVE-2026-97532                      CVE-2026-97534 CVE-2026-97535 CVE-2026-97536 CVE-2026-97537                      CVE-2026-97549 CVE-2026-97558 CVE-2026-97559 CVE-2026-97566                      CVE-2026-97567 CVE-2026-97571 CVE-2026-97574 CVE-2026-97594                      CVE-2026-97597 CVE-2026-97603 CVE-2026-97609 CVE-2026-97615                      CVE-2026-97618 CVE-2026-97619 CVE-2026-97620 CVE-2026-97901                      CVE-2026-97906 CVE-2026-97918 CVE-2026-97919 CVE-2026-97933                      CVE-2026-97934 CVE-2026-97935 CVE-2026-97938 CVE-2026-97939                      CVE-2026-97949 CVE-2026-97950 CVE-2026-98101 CVE-2026-98161                      CVE-2026-98167 CVE-2026-98168 CVE-2026-98169 CVE-2026-98170                      CVE-2026-98171 CVE-2026-98172 CVE-2026-98173 CVE-2026-98174                      CVE-2026-98175 CVE-2026-98179 CVE-2026-98181 CVE-2026-98182                      CVE-2026-98184 CVE-2026-98185 CVE-2026-98186 CVE-2026-98187                      CVE-2026-98188 CVE-2026-98189 CVE-2026-98190 CVE-2026-98191                      CVE-2026-98192 CVE-2026-98193 CVE-2026-98194 CVE-2026-98195                      CVE-2026-98196 CVE-2026-98197 CVE-2026-98198 CVE-2026-98199                      CVE-2026-98200 CVE-2026-98201 CVE-2026-98202 CVE-2026-98203                      CVE-2026-98204 CVE-2026-98205 CVE-2026-98206 CVE-2026-98207                      CVE-2026-98208 CVE-2026-98209 CVE-2026-98210 CVE-2026-98211                      CVE-2026-98212 CVE-2026-98213 CVE-2026-98214 CVE-2026-98215                      CVE-2026-98216 CVE-2026-98217 CVE-2026-98218 CVE-2026-98221                      CVE-2026-98222 CVE-2026-98227 CVE-2026-98229 CVE-2026-98230                      CVE-2026-98231 CVE-2026-98232 CVE-2026-98233 CVE-2026-98234                      CVE-2026-98235 CVE-2026-98236 CVE-2026-98237 CVE-2026-98238                      CVE-2026-98239 CVE-2026-98241 CVE-2026-98245 CVE-2026-98246                      CVE-2026-98247 CVE-2026-98248 CVE-2026-98249 CVE-2026-98251                      CVE-2026-98252 CVE-2026-98253 CVE-2026-98254 CVE-2026-98255                      CVE-2026-98257 CVE-2026-98260 CVE-2026-98261 CVE-2026-98262                      CVE-2026-98263 CVE-2026-98264 CVE-2026-98265 CVE-2026-98266                      CVE-2026-98267 CVE-2026-98269 CVE-2026-98270 CVE-2026-98271                      CVE-2026-98272 CVE-2026-98275 CVE-2026-98276 CVE-2026-98282                      CVE-2026-98283 CVE-2026-98287 CVE-2026-98290 CVE-2026-98291                      CVE-2026-98293 CVE-2026-98295 CVE-2026-98297 CVE-2026-98298                      CVE-2026-98299 CVE-2026-98300 CVE-2026-98301 CVE-2026-98302                      CVE-2026-98303 CVE-2026-98306 CVE-2026-98307 CVE-2026-98308                      CVE-2026-98309 CVE-2026-98311 CVE-2026-98312 CVE-2026-98314                      CVE-2026-98316 CVE-2026-98319 CVE-2026-98320 CVE-2026-98322                      CVE-2026-98323 CVE-2026-98325 CVE-2026-98326 CVE-2026-98327                      CVE-2026-98328 CVE-2026-98329 CVE-2026-98331 CVE-2026-98334                      CVE-2026-98335 CVE-2026-98336 CVE-2026-98337 CVE-2026-98339                      CVE-2026-98340 CVE-2026-98342 CVE-2026-98343 CVE-2026-98344                      CVE-2026-98345 CVE-2026-98346 CVE-2026-98347 CVE-2026-98348                      CVE-2026-98349 CVE-2026-98351 CVE-2026-98352 CVE-2026-98354                      CVE-2026-98357 CVE-2026-98358 CVE-2026-98359 CVE-2026-98360                      CVE-2026-98362 CVE-2026-98363 CVE-2026-98365 CVE-2026-98366                      CVE-2026-98367 CVE-2026-98368 CVE-2026-98369 CVE-2026-98370                      CVE-2026-98373 CVE-2026-98374 CVE-2026-98375 CVE-2026-98377                      CVE-2026-98378 CVE-2026-98379 CVE-2026-98380 CVE-2026-98381                      CVE-2026-98382 CVE-2026-98383 CVE-2026-98384 CVE-2026-98386                      CVE-2026-98403 CVE-2026-98406 CVE-2026-98407 CVE-2026-98409                      CVE-2026-98410 CVE-2026-98411 CVE-2026-98412 CVE-2026-98413                      CVE-2026-98416 CVE-2026-98417 CVE-2026-98419 CVE-2026-98421                      CVE-2026-98422 CVE-2026-98423 CVE-2026-98425 CVE-2026-98426                      CVE-2026-98428 CVE-2026-98429 CVE-2026-98430 CVE-2026-98432                      CVE-2026-98433 CVE-2026-98435 CVE-2026-98440 CVE-2026-98441                      CVE-2026-98442 CVE-2026-98443 CVE-2026-98445 CVE-2026-98448                      CVE-2026-98450 CVE-2026-98451 CVE-2026-98452 CVE-2026-98453                      CVE-2026-98454 CVE-2026-98455 CVE-2026-98456 CVE-2026-98457                      CVE-2026-98458 CVE-2026-98459 CVE-2026-98460 CVE-2026-98461                      CVE-2026-98462 CVE-2026-98464 CVE-2026-98465 CVE-2026-98468                      CVE-2026-98473 CVE-2026-98475 CVE-2026-98476 CVE-2026-98477                      CVE-2026-98479 CVE-2026-98481 CVE-2026-98482 CVE-2026-98483                      CVE-2026-98484 CVE-2026-98485 CVE-2026-98486 CVE-2026-98487                      CVE-2026-98488 CVE-2026-98489 CVE-2026-98490 CVE-2026-98491                      CVE-2026-98493 CVE-2026-98494 CVE-2026-98495 CVE-2026-98498                      CVE-2026-98499 CVE-2026-98501 CVE-2026-98502 CVE-2026-98503                      CVE-2026-98504 CVE-2026-98505 CVE-2026-98506 CVE-2026-98507                      CVE-2026-98508 CVE-2026-98509 CVE-2026-98510 CVE-2026-98511                      CVE-2026-98512 CVE-2026-98513 CVE-2026-98514 CVE-2026-98515                      CVE-2026-98516 CVE-2026-98517 CVE-2026-98519 CVE-2026-98521                      CVE-2026-98522 CVE-2026-98523 CVE-2026-98524 CVE-2026-98525                      CVE-2026-98526 CVE-2026-98527 CVE-2026-98528 CVE-2026-98529                      CVE-2026-98531 CVE-2026-98532 CVE-2026-98533 CVE-2026-98534                      CVE-2026-98535 CVE-2026-98536 CVE-2026-98537 CVE-2026-98538                      CVE-2026-98539 CVE-2026-98541 CVE-2026-98544 CVE-2026-98545                      CVE-2026-98546 CVE-2026-98547 CVE-2026-98548 CVE-2026-98549                      CVE-2026-98550 CVE-2026-98553 CVE-2026-98554 CVE-2026-98555                      CVE-2026-98559 CVE-2026-98561 CVE-2026-98565 CVE-2026-98566                      CVE-2026-98567 CVE-2026-98568 CVE-2026-98569 CVE-2026-98572                      CVE-2026-98573 CVE-2026-98575 CVE-2026-98576 CVE-2026-98577                      CVE-2026-98578 CVE-2026-98579 CVE-2026-98580 CVE-2026-98581                      CVE-2026-98582 CVE-2026-98583 CVE-2026-98586 CVE-2026-98588                      CVE-2026-98590 CVE-2026-98591 CVE-2026-98593 CVE-2026-98594                      CVE-2026-98596 CVE-2026-98597 CVE-2026-98600 CVE-2026-98601                      CVE-2026-98602 CVE-2026-98605 CVE-2026-98606 CVE-2026-98607                      CVE-2026-98608 CVE-2026-98609 CVE-2026-98610 CVE-2026-98611                      CVE-2026-98612 CVE-2026-98613 CVE-2026-98614 CVE-2026-98615                      CVE-2026-98618 CVE-2026-98620 CVE-2026-98621 CVE-2026-98622                      CVE-2026-98623 CVE-2026-98624 CVE-2026-98625 CVE-2026-98626                      CVE-2026-98629 CVE-2026-98631 CVE-2026-98632 CVE-2026-98634                      CVE-2026-98636 CVE-2026-98640 CVE-2026-98641 CVE-2026-98642                      CVE-2026-98643 CVE-2026-98644 CVE-2026-98646 CVE-2026-98647                      CVE-2026-98655 CVE-2026-98656 CVE-2026-98657 CVE-2026-98658                      CVE-2026-98660 CVE-2026-98661 CVE-2026-98662 CVE-2026-98663                      CVE-2026-98664 CVE-2026-98665 CVE-2026-98666 CVE-2026-98668                      CVE-2026-98669 CVE-2026-98670 CVE-2026-98671 CVE-2026-98672                      CVE-2026-98673 CVE-2026-98677 CVE-2026-98679 CVE-2026-98680                      CVE-2026-98681 CVE-2026-98686 CVE-2026-98687 CVE-2026-98694                      CVE-2026-98695 CVE-2026-98696 CVE-2026-98697 CVE-2026-98698                      CVE-2026-98699 CVE-2026-98700 CVE-2026-98701 CVE-2026-98702                      CVE-2026-98703 CVE-2026-98704 CVE-2026-98705 CVE-2026-98706                      CVE-2026-98707 CVE-2026-98708 CVE-2026-98709 CVE-2026-98710                      CVE-2026-98711 CVE-2026-98713 CVE-2026-98716 CVE-2026-98717                      CVE-2026-98720 CVE-2026-98721 CVE-2026-98722 CVE-2026-98725                      CVE-2026-98726 CVE-2026-98727 CVE-2026-98728 CVE-2026-98730                      CVE-2026-98731 CVE-2026-98732 CVE-2026-98733 CVE-2026-98734                      CVE-2026-98735 CVE-2026-98736 CVE-2026-98737 CVE-2026-98738                      CVE-2026-98739 CVE-2026-98741 CVE-2026-98742 CVE-2026-98743                      CVE-2026-98744 CVE-2026-98745 CVE-2026-98746 CVE-2026-98748                      CVE-2026-98749 CVE-2026-98750 CVE-2026-98751 CVE-2026-98752                      CVE-2026-98753 CVE-2026-98754 CVE-2026-98755 CVE-2026-98756                      CVE-2026-98757 CVE-2026-98758 CVE-2026-98760 CVE-2026-98761                      CVE-2026-98762 CVE-2026-98763 CVE-2026-98764 CVE-2026-98765                      CVE-2026-98766 CVE-2026-98767 CVE-2026-98768 CVE-2026-98769                      CVE-2026-98770 CVE-2026-98771 CVE-2026-98772 CVE-2026-98773                      CVE-2026-98775 CVE-2026-98777 CVE-2026-98778 CVE-2026-98779                      CVE-2026-98780 CVE-2026-98781 CVE-2026-98782 CVE-2026-98783                      CVE-2026-98784 CVE-2026-98785 CVE-2026-98790 CVE-2026-98791                      CVE-2026-98792 CVE-2026-98793 CVE-2026-98794 CVE-2026-98796                      CVE-2026-98797 CVE-2026-98798 CVE-2026-98801 CVE-2026-98805                      CVE-2026-98807 CVE-2026-98808 CVE-2026-98809 CVE-2026-98811                      CVE-2026-98812 CVE-2026-98819 CVE-2026-98822 CVE-2026-98823                      CVE-2026-98825 CVE-2026-98826 CVE-2026-98827 CVE-2026-98828                      CVE-2026-98830 CVE-2026-98831 CVE-2026-98833 CVE-2026-98835                      CVE-2026-98836 CVE-2026-98837 CVE-2026-98838 CVE-2026-98840                      CVE-2026-98841 CVE-2026-98844 CVE-2026-98845 CVE-2026-98846                      CVE-2026-98847 CVE-2026-98848 CVE-2026-98849 CVE-2026-98850                      CVE-2026-98851 CVE-2026-98852 CVE-2026-98854 CVE-2026-98855                      CVE-2026-98856 CVE-2026-98857 CVE-2026-98858 CVE-2026-98859                      CVE-2026-98860 CVE-2026-98862 CVE-2026-99999     Debian Bug     : 1149499 1149564 1150891

    Several vulnerabilities have been discovered in the Linux kernel that     may lead to a privilege escalation, denial of service or information     leaks.

    For Debian 12 bookworm, these problems have been fixed in version     6.12.113-1~deb12u1.  This update additionally includes many more bug     fixes from stable updates 6.12.112 and 6.12.113.

    We recommend that you upgrade your linux-6.12 packages.

    For the detailed security status of linux-6.12 please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/linux-6.12

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS     Attachment:
    signature.asc     Description: PGP signature

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS7:CLSA-2026:1792234299 advisory.

  - nfqnl_mangle in net/netfilter/nfnetlink_queue.c in the Linux kernel through 5.18.14 allows remote     attackers to cause a denial of service (panic) because, in the case of an nf_queue verdict with a one-byte     nfta_payload attribute, an skb_pull can encounter a negative skb->len. (CVE-2022-36946)

  - In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mvm: Fix a memory     corruption issue A few lines above, space is kzalloc()'ed for: sizeof(struct iwl_nvm_data) + sizeof(struct     ieee80211_channel) + sizeof(struct ieee80211_rate) 'mvm->nvm_data' is a 'struct iwl_nvm_data', so it is     fine. At the end of this structure, there is the 'channels' flex array. Each element is of type 'struct     ieee80211_channel'. So only 1 element is allocated in this array. When doing:
    mvm->nvm_data->bands[0].channels = mvm->nvm_data->channels; We point at the first element of the     'channels' flex array. So this is fine. However, when doing: mvm->nvm_data->bands[0].bitrates = (void
    *)((u8 *)mvm->nvm_data->channels + 1); because of the (u8 *) cast, we add only 1 to the address of the     beginning of the flex array. It is likely that we want point at the 'struct ieee80211_rate' allocated just     after. Remove the spurious casting so that the pointer arithmetic works as expected. (CVE-2023-52531)

  - In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Don't (re)check L1     intercepts when completing userspace I/O When completing emulation of instruction that generated a     userspace exit for I/O, don't recheck L1 intercepts as KVM has already finished that phase of instruction     execution, i.e. has already committed to allowing L2 to perform I/O. If L1 (or host userspace) modifies     the I/O permission bitmaps during the exit to userspace, KVM will treat the access as being intercepted     despite already having emulated the I/O access. Pivot on EMULTYPE_NO_DECODE to detect that KVM is     completing emulation. Of the three users of EMULTYPE_NO_DECODE, only complete_emulated_io() (the intended     recipient) can reach the code in question. gp_interception()'s use is mutually exclusive with     is_guest_mode(), and complete_emulated_insn_gp() unconditionally pairs EMULTYPE_NO_DECODE with     EMULTYPE_SKIP. The bad behavior was detected by a syzkaller program that toggles port I/O interception     during the userspace I/O exit, ultimately resulting in a WARN on vcpu->arch.pio.count being non-zero due     to KVM no completing emulation of the I/O instruction. WARNING: CPU: 23 PID: 1083 at     arch/x86/kvm/x86.c:8039 emulator_pio_in_out+0x154/0x170 [kvm] Modules linked in: kvm_intel kvm irqbypass     CPU: 23 UID: 1000 PID: 1083 Comm: repro Not tainted 6.16.0-rc5-c1610d2d66b1-next-vm #74 NONE Hardware     name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015 RIP: 0010:emulator_pio_in_out+0x154/0x170     [kvm] PKRU: 55555554 Call Trace: <TASK> kvm_fast_pio+0xd6/0x1d0 [kvm] vmx_handle_exit+0x149/0x610     [kvm_intel] kvm_arch_vcpu_ioctl_run+0xda8/0x1ac0 [kvm] kvm_vcpu_ioctl+0x244/0x8c0 [kvm]
    __x64_sys_ioctl+0x8a/0xd0 do_syscall_64+0x5d/0xc60 entry_SYSCALL_64_after_hwframe+0x4b/0x53 </TASK>     (CVE-2025-40026)

  - In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btusb: fix use-after-free     on registration failure Make sure to release the sibling interfaces in case controller registration fails     to avoid use-after-free and double-free when they are eventually disconnected. This issue was reported by     Sashiko while reviewing a fix for a wakeup source leak in the btusb probe errors paths. (CVE-2026-64471)

  - In the Linux kernel, the following vulnerability has been resolved: ALSA: firewire: isight: bound the     sample count to the packet payload isight_packet() takes the frame count from the device iso packet and     checks it only against the device claimed iso length. count = be32_to_cpu(payload->sample_count); if     (likely(count <= (length - 16) / 4)) isight_samples(isight, payload->samples, count); length is the iso     header data_length. It can be up to 0xffff. So the gate allows a count up to about 16379. isight_samples()     then copies count frames out of payload->samples into the PCM DMA buffer. payload->samples holds only 2 *     MAX_FRAMES_PER_PACKET values. The device multiplexes two samples per frame. A count past     MAX_FRAMES_PER_PACKET reads past the payload. A count past the buffer size writes past runtime->dma_area.
    The smallest PCM buffer is larger than MAX_FRAMES_PER_PACKET. Bounding the count to MAX_FRAMES_PER_PACKET     keeps both the read and the write in range. A malicious or faulty Apple iSight on the FireWire bus reaches     this during a normal capture. Add the MAX_FRAMES_PER_PACKET bound to the gate. (CVE-2026-64483)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6568 advisory.

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-6568-1                   security@debian.org     https://www.debian.org/security/                     Salvatore Bonaccorso     October 16, 2026                      https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : linux     CVE ID         : CVE-2025-38204 CVE-2025-40158 CVE-2026-52988 CVE-2026-72315                      CVE-2026-72463 CVE-2026-74347 CVE-2026-80935 CVE-2026-80937                      CVE-2026-80939 CVE-2026-80980 CVE-2026-81016 CVE-2026-89437                      CVE-2026-89441 CVE-2026-89445 CVE-2026-89452 CVE-2026-89467                      CVE-2026-89500 CVE-2026-89503 CVE-2026-89520 CVE-2026-89527                      CVE-2026-89633 CVE-2026-89638 CVE-2026-89766 CVE-2026-89795                      CVE-2026-89797 CVE-2026-89806 CVE-2026-89827 CVE-2026-89832                      CVE-2026-89837 CVE-2026-89838 CVE-2026-89840 CVE-2026-89859                      CVE-2026-89868 CVE-2026-89912 CVE-2026-89921 CVE-2026-89956                      CVE-2026-89971 CVE-2026-89972 CVE-2026-89996 CVE-2026-90002                      CVE-2026-90013 CVE-2026-90016 CVE-2026-90023 CVE-2026-90029                      CVE-2026-90030 CVE-2026-90146 CVE-2026-93179 CVE-2026-93196                      CVE-2026-93199 CVE-2026-93200 CVE-2026-93231 CVE-2026-93243                      CVE-2026-93244 CVE-2026-93285 CVE-2026-97527 CVE-2026-97528                      CVE-2026-97529 CVE-2026-97530 CVE-2026-97531 CVE-2026-97532                      CVE-2026-97534 CVE-2026-97535 CVE-2026-97536 CVE-2026-97537                      CVE-2026-97549 CVE-2026-97558 CVE-2026-97559 CVE-2026-97566                      CVE-2026-97567 CVE-2026-97571 CVE-2026-97574 CVE-2026-97594                      CVE-2026-97597 CVE-2026-97603 CVE-2026-97609 CVE-2026-97615                      CVE-2026-97618 CVE-2026-97619 CVE-2026-97620 CVE-2026-97901                      CVE-2026-97906 CVE-2026-97918 CVE-2026-97919 CVE-2026-97933                      CVE-2026-97934 CVE-2026-97935 CVE-2026-97938 CVE-2026-97939                      CVE-2026-97949 CVE-2026-97950 CVE-2026-98101 CVE-2026-98161                      CVE-2026-98167 CVE-2026-98168 CVE-2026-98169 CVE-2026-98170                      CVE-2026-98171 CVE-2026-98172 CVE-2026-98173 CVE-2026-98174                      CVE-2026-98175 CVE-2026-98179 CVE-2026-98181 CVE-2026-98182                      CVE-2026-98184 CVE-2026-98185 CVE-2026-98186 CVE-2026-98187                      CVE-2026-98188 CVE-2026-98189 CVE-2026-98190 CVE-2026-98191                      CVE-2026-98192 CVE-2026-98193 CVE-2026-98194 CVE-2026-98195                      CVE-2026-98196 CVE-2026-98197 CVE-2026-98198 CVE-2026-98199                      CVE-2026-98200 CVE-2026-98201 CVE-2026-98202 CVE-2026-98203                      CVE-2026-98204 CVE-2026-98205 CVE-2026-98206 CVE-2026-98207                      CVE-2026-98208 CVE-2026-98209 CVE-2026-98210 CVE-2026-98211                      CVE-2026-98212 CVE-2026-98213 CVE-2026-98214 CVE-2026-98215                      CVE-2026-98216 CVE-2026-98217 CVE-2026-98218 CVE-2026-98221                      CVE-2026-98222 CVE-2026-98227 CVE-2026-98229 CVE-2026-98230                      CVE-2026-98231 CVE-2026-98232 CVE-2026-98233 CVE-2026-98234                      CVE-2026-98235 CVE-2026-98236 CVE-2026-98237 CVE-2026-98238                      CVE-2026-98239 CVE-2026-98241 CVE-2026-98245 CVE-2026-98246                      CVE-2026-98247 CVE-2026-98248 CVE-2026-98249 CVE-2026-98251                      CVE-2026-98252 CVE-2026-98253 CVE-2026-98254 CVE-2026-98255                      CVE-2026-98257 CVE-2026-98260 CVE-2026-98261 CVE-2026-98262                      CVE-2026-98263 CVE-2026-98264 CVE-2026-98265 CVE-2026-98266                      CVE-2026-98267 CVE-2026-98269 CVE-2026-98270 CVE-2026-98271                      CVE-2026-98272 CVE-2026-98275 CVE-2026-98276 CVE-2026-98282                      CVE-2026-98283 CVE-2026-98287 CVE-2026-98290 CVE-2026-98291                      CVE-2026-98293 CVE-2026-98295 CVE-2026-98297 CVE-2026-98298                      CVE-2026-98299 CVE-2026-98300 CVE-2026-98301 CVE-2026-98302                      CVE-2026-98303 CVE-2026-98306 CVE-2026-98307 CVE-2026-98308                      CVE-2026-98309 CVE-2026-98311 CVE-2026-98312 CVE-2026-98314                      CVE-2026-98316 CVE-2026-98319 CVE-2026-98320 CVE-2026-98322                      CVE-2026-98323 CVE-2026-98325 CVE-2026-98326 CVE-2026-98327                      CVE-2026-98328 CVE-2026-98329 CVE-2026-98331 CVE-2026-98334                      CVE-2026-98335 CVE-2026-98336 CVE-2026-98337 CVE-2026-98339                      CVE-2026-98340 CVE-2026-98342 CVE-2026-98343 CVE-2026-98344                      CVE-2026-98345 CVE-2026-98346 CVE-2026-98347 CVE-2026-98348                      CVE-2026-98349 CVE-2026-98351 CVE-2026-98352 CVE-2026-98354                      CVE-2026-98357 CVE-2026-98358 CVE-2026-98359 CVE-2026-98360                      CVE-2026-98362 CVE-2026-98363 CVE-2026-98365 CVE-2026-98366                      CVE-2026-98367 CVE-2026-98368 CVE-2026-98369 CVE-2026-98370                      CVE-2026-98373 CVE-2026-98374 CVE-2026-98375 CVE-2026-98377                      CVE-2026-98378 CVE-2026-98379 CVE-2026-98380 CVE-2026-98381                      CVE-2026-98382 CVE-2026-98383 CVE-2026-98384 CVE-2026-98386                      CVE-2026-98403 CVE-2026-98406 CVE-2026-98407 CVE-2026-98409                      CVE-2026-98410 CVE-2026-98411 CVE-2026-98412 CVE-2026-98413                      CVE-2026-98416 CVE-2026-98417 CVE-2026-98419 CVE-2026-98421                      CVE-2026-98422 CVE-2026-98423 CVE-2026-98425 CVE-2026-98426                      CVE-2026-98428 CVE-2026-98429 CVE-2026-98430 CVE-2026-98432                      CVE-2026-99999     Debian Bug     : 1149499 1149564 1150891

    Several vulnerabilities have been discovered in the Linux kernel that     may lead to a privilege escalation, denial of service or information     leaks.

    For the stable distribution (trixie), these problems have been fixed in     version 6.12.113-1.

    We recommend that you upgrade your linux packages.

    For the detailed security status of linux please refer to its security     tracker page at:
    https://security-tracker.debian.org/tracker/linux

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - KEYS: encrypted: fix integer overflow of datablob_len encrypted_key_alloc() stores datablob_len in a u16.
    It is computed from multiple string and payload lengths. If the result exceeds U16_MAX, the assignment     truncates the allocation size. KASAN reports a 32760-byte slab-out-of-bounds write when __ekey_init()     copies the master key description into the undersized buffer. The total payload length stored in     key->datalen is also a u16. Use check_add_overflow() to reject values that do not fit either destination,     and use kzalloc_flex() for the flexible-array allocation. (CVE-2026-98222)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
372449	AlmaLinux 9 : kernel (ALSA-2026:90365)	Nessus	Alma Linux Local Security Checks	Local	medium
371420	CentOS Linux 8 [TuxCare] Security Update: bpftool / kernel / kernel-core / kernel-cross-headers / etc Multiple Vulnerabilities (CENTOS-STREAM8:CLSA-2026:1792759740)	Nessus	CentOS Local Security Checks	Local	high
371225	CentOS Linux 8.4 [TuxCare] Security Update: bpftool / kernel / kernel-core / kernel-cross-headers / etc Multiple Vulnerabilities (CENTOS8.4:CLSA-2026:1792749577)	Nessus	CentOS Local Security Checks	Local	high
371224	CentOS Linux 8.5 [TuxCare] Security Update: bpftool / kernel / kernel-core / kernel-cross-headers / etc Multiple Vulnerabilities (CENTOS8.5:CLSA-2026:1792750763)	Nessus	CentOS Local Security Checks	Local	high
370518	Debian dla-4850 : ata-modules-6.12.107+deb12-armmp-di - security update	Nessus	Debian Local Security Checks	Local	high
369489	CentOS Linux 7 [TuxCare] Security Update: bpftool / kernel / kernel-debug / kernel-debug-devel / kernel-devel / etc Multiple Vulnerabilities (CENTOS7:CLSA-2026:1792234299)	Nessus	CentOS Local Security Checks	Local	high
366507	Debian dsa-6568 : ata-modules-6.12.111+deb13-armmp-di - security update	Nessus	Debian Local Security Checks	Local	high
365258	Amazon Linux 2023 : bpftool6.18, kernel6.18, kernel6.18-devel (ALAS2023-2026-3192)	Nessus	Amazon Linux Local Security Checks	Local	medium
363303	Linux Distros Unpatched Vulnerability : CVE-2026-98222	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2026-98222

high

Tenable Plugins

medium

high

high

high

high

high

high

medium

high