In the Linux kernel, the following vulnerability has been resolved: signal: Prevent exec() race Hyunwoo debugged the following KASAN UAF splat: BUG: KASAN: slab-use-after-free in __send_signal_locked+0xb27/0xba0 Write of size 8 at addr ffff888007ed80c8 by task poc/79 ... Call Trace: __send_signal_locked+0xb27/0xba0 do_send_sig_info+0xa7/0x160 do_send_specific+0x76/0xa0 __x64_sys_tgkill+0x193/0x270 ... Allocated by task 80: do_timer_create+0x1a4/0x1030 __x64_sys_timer_create+0x145/0x190 ... Freed by task 12: kmem_cache_free_bulk+0x1f8/0x4a0 kvfree_rcu_bulk+0x14f/0x1c0 kfree_rcu_work+0x128/0x1a0 ... Last potentially related work creation: kvfree_call_rcu+0x39/0x390 __flush_itimer_signals+0x211/0x320 flush_itimer_signals+0x47/0x90 begin_new_exec+0xa6b/0x28c0 It turned out that this happens with a non-leader exec() as Hyunwoo explained: de_thread() calls exchange_tids() before release_task(leader), so the struct pid held by a SIGEV_THREAD_ID timer created against the leader's tid now points to the thread which called execve(). pid_task() returns that thread and lock_task_sighand() on it succeeds. If the timer signal is blocked, its sigqueue stays queued on the leader's task::pending. The next expiry of that timer can then run while release_task() flushes the queue. posixtimer_send_sigqueue() checks whether the sigqueue is already queued with a plain list_empty(), which only reads list_head::next. list_del_init() is not atomic and INIT_LIST_HEAD() stores list_head::next before list_head::prev, so the check can pass in between. list_add_tail() queues the entry on the task::pending of the live thread, and the list_head::prev store from the flush then overwrites the list_head::prev link that list_add_tail() has just set. __flush_itimer_signals() does not undo that either. With list_head::prev pointing at the entry itself, its list_del_init() only stores the same values again, so the entry is not removed from the list. It is still there after the last reference is dropped and the timer is freed by RCU, and the list_add_tail() of a later tgkill() follows that list_head::prev into the freed timer. This problem surfaced with the recent commit which moved the sigqueue flush out of the sighand lock held region. Hyonwoo proposed to fix this by using list_del_init_careful(), but that just papers over the problem. After some disucssions and various attempts to solve it, Eric pointed out that there is no reason to flush task::pending late in release_task() and it should be done in exit_signals() already. As nothing can collect and deliver signals which are queued in a dying task's pending queue, there is no reason to delay it further. But it has to be ensured that no signals can be queued into it after that point. exit_signals() sets PF_EXITING in task::flags, which can be used as an indicator for this. Cure it by: - Preventing signal queueing for task private signals (PIDTYPE_PID) when the task has PF_EXITING set in __send_signal_locked() and in posixtimer_send_sigqueue(). - Protecting the unlocked setting of PF_EXITING in exit_signals() for the task group empty and the group exit case with sighand lock - Flushing task::pending signals right there. Optimize that by moving the whole pending list to an on-stack list head under sighand lock and free the signals without the lock held. There has been quite some discussion about the lockless flush and the non-leader exec case on weakly ordered systems. The problem is that a third party which tries to send a posix timer signal relies on the PID lookup to find the target task and that lookup might result in the new leader when the signal was originaly directed to the old leader. In case that the signal was queued on the old leader then the lockless flush raised a concern over the following situation: old_leader new_leader third party A: flush_list() // list_del_in ---truncated---

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-85321 advisory.

    - ipv4: validate checksum_start before completing checksum (CKI Backport Bot) [RHEL-280590]     {CVE-2026-99999}
    - signal: Prevent exec() race (Phil Auld) [RHEL-282048] {CVE-2026-98256}
    - exec: Cleanup POSIX timers right after de_thread() (Luiz Capitulino) [RHEL-282070] {CVE-2026-98260}
    - smb: client: reject a tree connect response whose byte count is too small (CKI Backport Bot)     [RHEL-271291] {CVE-2026-89631}
    - smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (Frank Sorenson)     [RHEL-271484] {CVE-2026-89633}
    - sctp: validate cookie AUTH state before use (Xin Long) [RHEL-254315] {CVE-2026-74752}
    - sctp: stop processing a packet once its association is deleted (Xin Long) [RHEL-254315] {CVE-2026-89479}
    - sctp: avoid auth_enable sysctl UAF during netns teardown (Xin Long) [RHEL-258778] {CVE-2026-68162}
    - sctp: keep chunk->transport in step with the list it is queued on (Xin Long) [RHEL-254353]     {CVE-2026-74588}
    - usb: typec: ucsi: validate connector number in ucsi_connector_change() (Desnes Nunes) [RHEL-259412]     {CVE-2026-63958}
    - usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (Desnes Nunes)     [RHEL-259412] {CVE-2026-63962}
    - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (Desnes Nunes) [RHEL-259412]     {CVE-2026-63963}
    - usb: typec: altmodes/displayport: validate count before reading Status Update VDO (Desnes Nunes)     [RHEL-259412] {CVE-2026-63961}
    - Bluetooth: hci_sync: Fix advertising data UAFs (CKI Backport Bot) [RHEL-254672] {CVE-2026-74509}
    - openvswitch: vport: fix self-deadlock on release of tunnel ports (CKI Backport Bot) [RHEL-253867]     {CVE-2026-31678}
    - openvswitch: defer tunnel netdev_put to RCU release (CKI Backport Bot) [RHEL-253867] {CVE-2026-31678}
    - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228912] {CVE-2026-63801}
    - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238046]     {CVE-2026-68117}
    - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229479] {CVE-2026-63971}
    - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231579] {CVE-2026-52917}
    - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236158] {CVE-2026-68315}
    - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237097] {CVE-2026-68376}
    - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237097] {CVE-2026-68300}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Rocky Linux 10.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-2026_85321 advisory.

    * kernel: openvswitch: defer tunnel netdev_put to RCU release (CVE-2026-31678)

    * kernel: xfrm: espintcp: do not reuse an in-progress partial send (CVE-2026-52935)

    * kernel: sctp: diag: reject stale associations in dump_one path (CVE-2026-52917)

    * kernel: tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (CVE-2026-63801)

    * kernel: sctp: fix race between sctp_wait_for_connect and peeloff (CVE-2026-63971)

    * kernel: usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (CVE-2026-63962)

    * kernel: sctp: avoid auth_enable sysctl UAF during netns teardown (CVE-2026-68162)

    * kernel: tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (CVE-2026-68117)

    * kernel: sctp: auth: verify auth requirement when auth_chunk is NULL (CVE-2026-68300)

    * kernel: sctp: validate stream count in sctp_process_strreset_inreq() (CVE-2026-68315)

    * kernel: Bluetooth: hci_sync: Fix advertising data UAFs (CVE-2026-74509)

    * kernel: sctp: keep chunk->transport in step with the list it is queued on (CVE-2026-74588)

    * kernel: sctp: validate cookie AUTH state before use (CVE-2026-74752)

    * kernel: smb: client: reject a tree connect response whose byte count is too small (CVE-2026-89631)

    * kernel: smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (CVE-2026-89633)

    * kernel: signal: Prevent exec() race (CVE-2026-98256)

    * kernel: exec: Cleanup POSIX timers right after de_thread() (CVE-2026-98260)

    Bug Fix(es) and Enhancement(s):

    * [10.2.z] kselftests: mm: hugepage-mremap: Bail out! mremap: Expected failure, but call succeeded     (JIRA:Rocky Linux-181987)

    * [IBM 10.3 FEAT] zcrypt driver overwrite  function - kernel part [rhel-10.2.z] (JIRA:Rocky Linux-245336)

    * Batch: z-stream xfrm - rhel-10.2.z (NST-Core-26W38) (JIRA:Rocky Linux-256678)

    * RHIVOS - [backport] S32G Driver Enablement - USB (JIRA:Rocky Linux-257228)

    * Fix pending kernel issues for L1VH GA - Kernel (JIRA:Rocky Linux-267038)

    * Backport 6785011f8b16 (ipv4: validate checksum_start before completing checksum) [rhel-10.2.z]     (JIRA:Rocky Linux-280590)

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:85321 advisory.

    * kernel: openvswitch: defer tunnel netdev_put to RCU release (CVE-2026-31678)
      * kernel: xfrm: espintcp: do not reuse an in-progress partial send (CVE-2026-52935)
      * kernel: sctp: diag: reject stale associations in dump_one path (CVE-2026-52917)
      * kernel: tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (CVE-2026-63801)
      * kernel: sctp: fix race between sctp_wait_for_connect and peeloff (CVE-2026-63971)
      * kernel: usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (CVE-2026-63962)
      * kernel: sctp: avoid auth_enable sysctl UAF during netns teardown (CVE-2026-68162)
      * kernel: tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (CVE-2026-68117)
      * kernel: sctp: auth: verify auth requirement when auth_chunk is NULL (CVE-2026-68300)
      * kernel: sctp: validate stream count in sctp_process_strreset_inreq() (CVE-2026-68315)
      * kernel: Bluetooth: hci_sync: Fix advertising data UAFs (CVE-2026-74509)
      * kernel: sctp: keep chunk->transport in step with the list it is queued on (CVE-2026-74588)
      * kernel: sctp: validate cookie AUTH state before use (CVE-2026-74752)
      * kernel: smb: client: reject a tree connect response whose byte count is too small (CVE-2026-89631)
      * kernel: smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (CVE-2026-89633)
      * kernel: signal: Prevent exec() race (CVE-2026-98256)
      * kernel: exec: Cleanup POSIX timers right after de_thread() (CVE-2026-98260)


    Bug Fix(es) and Enhancement(s):

      * [10.2.z] kselftests: mm: hugepage-mremap: Bail out! mremap: Expected failure, but call succeeded     (JIRA:AlmaLinux-181987)
      * [IBM 10.3 FEAT] zcrypt driver overwrite function - kernel part [almalinux-10.2.z]     (JIRA:AlmaLinux-245336)
      * Batch: z-stream xfrm - rhel-10.2.z (NST-Core-26W38) (JIRA:AlmaLinux-256678)
      * RHIVOS - [backport] S32G Driver Enablement - USB (JIRA:AlmaLinux-257228)
      * Fix pending kernel issues for L1VH GA - Kernel (JIRA:AlmaLinux-267038)
      * Backport 6785011f8b16 (ipv4: validate checksum_start before completing checksum) [almalinux-10.2.z]     (JIRA:AlmaLinux-280590)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:85321 advisory.

    * kernel: openvswitch: defer tunnel netdev_put to RCU release (CVE-2026-31678)

    * kernel: xfrm: espintcp: do not reuse an in-progress partial send (CVE-2026-52935)

    * kernel: sctp: diag: reject stale associations in dump_one path (CVE-2026-52917)

    * kernel: tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (CVE-2026-63801)

    * kernel: sctp: fix race between sctp_wait_for_connect and peeloff (CVE-2026-63971)

    * kernel: usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (CVE-2026-63962)

    * kernel: sctp: avoid auth_enable sysctl UAF during netns teardown (CVE-2026-68162)

    * kernel: tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (CVE-2026-68117)

    * kernel: sctp: auth: verify auth requirement when auth_chunk is NULL (CVE-2026-68300)

    * kernel: sctp: validate stream count in sctp_process_strreset_inreq() (CVE-2026-68315)

    * kernel: Bluetooth: hci_sync: Fix advertising data UAFs (CVE-2026-74509)

    * kernel: sctp: keep chunk->transport in step with the list it is queued on (CVE-2026-74588)

    * kernel: sctp: validate cookie AUTH state before use (CVE-2026-74752)

    * kernel: smb: client: reject a tree connect response whose byte count is too small (CVE-2026-89631)

    * kernel: smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (CVE-2026-89633)

    * kernel: signal: Prevent exec() race (CVE-2026-98256)

    * kernel: exec: Cleanup POSIX timers right after de_thread() (CVE-2026-98260)

    Bug Fix(es) and Enhancement(s):

    * [10.2.z] kselftests: mm: hugepage-mremap: Bail out! mremap: Expected failure, but call succeeded     (JIRA:Rocky Linux-181987)

    * [IBM 10.3 FEAT] zcrypt driver overwrite  function - kernel part [rhel-10.2.z] (JIRA:Rocky Linux-245336)

    * Batch: z-stream xfrm - rhel-10.2.z (NST-Core-26W38) (JIRA:Rocky Linux-256678)

    * RHIVOS - [backport] S32G Driver Enablement - USB (JIRA:Rocky Linux-257228)

    * Fix pending kernel issues for L1VH GA - Kernel (JIRA:Rocky Linux-267038)

    * Backport 6785011f8b16 (ipv4: validate checksum_start before completing checksum) [rhel-10.2.z]     (JIRA:Rocky Linux-280590)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:85321 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: openvswitch: defer tunnel netdev_put to RCU release (CVE-2026-31678)

    * kernel: xfrm: espintcp: do not reuse an in-progress partial send (CVE-2026-52935)

    * kernel: sctp: diag: reject stale associations in dump_one path (CVE-2026-52917)

    * kernel: tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (CVE-2026-63801)

    * kernel: sctp: fix race between sctp_wait_for_connect and peeloff (CVE-2026-63971)

    * kernel: usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (CVE-2026-63962)

    * kernel: sctp: avoid auth_enable sysctl UAF during netns teardown (CVE-2026-68162)

    * kernel: tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (CVE-2026-68117)

    * kernel: sctp: auth: verify auth requirement when auth_chunk is NULL (CVE-2026-68300)

    * kernel: sctp: validate stream count in sctp_process_strreset_inreq() (CVE-2026-68315)

    * kernel: Bluetooth: hci_sync: Fix advertising data UAFs (CVE-2026-74509)

    * kernel: sctp: keep chunk->transport in step with the list it is queued on (CVE-2026-74588)

    * kernel: sctp: validate cookie AUTH state before use (CVE-2026-74752)

    * kernel: smb: client: reject a tree connect response whose byte count is too small (CVE-2026-89631)

    * kernel: smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (CVE-2026-89633)

    * kernel: signal: Prevent exec() race (CVE-2026-98256)

    * kernel: exec: Cleanup POSIX timers right after de_thread() (CVE-2026-98260)

    Bug Fix(es) and Enhancement(s):

    * [10.2.z] kselftests: mm: hugepage-mremap: Bail out! mremap: Expected failure, but call succeeded     (JIRA:RHEL-181987)

    * [IBM 10.3 FEAT] zcrypt driver overwrite  function - kernel part [rhel-10.2.z] (JIRA:RHEL-245336)

    * Batch: z-stream xfrm - rhel-10.2.z (NST-Core-26W38) (JIRA:RHEL-256678)

    * RHIVOS - [backport] S32G Driver Enablement - USB (JIRA:RHEL-257228)

    * Fix pending kernel issues for L1VH GA - Kernel (JIRA:RHEL-267038)

    * Backport 6785011f8b16 (ipv4: validate checksum_start before completing checksum) [rhel-10.2.z]     (JIRA:RHEL-280590)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - In the Linux kernel, the following vulnerability has been resolved: signal: Prevent exec() race Hyunwoo
    debugged the following KASAN UAF splat: BUG: KASAN: slab-use-after-free in
    __send_signal_locked+0xb27/0xba0 Write of size 8 at addr ffff888007ed80c8 by task poc/79 ... Call Trace:
    __send_signal_locked+0xb27/0xba0 do_send_sig_info+0xa7/0x160 do_send_specific+0x76/0xa0
    __x64_sys_tgkill+0x193/0x270 ... Allocated by task 80: do_timer_create+0x1a4/0x1030
    __x64_sys_timer_create+0x145/0x190 ... Freed by task 12: kmem_cache_free_bulk+0x1f8/0x4a0
    kvfree_rcu_bulk+0x14f/0x1c0 kfree_rcu_work+0x128/0x1a0 ... Last potentially related work creation:
    kvfree_call_rcu+0x39/0x390 __flush_itimer_signals+0x211/0x320 flush_itimer_signals+0x47/0x90
    begin_new_exec+0xa6b/0x28c0 It turned out that this happens with a non-leader exec() as Hyunwoo explained:
    de_thread() calls exchange_tids() before release_task(leader), so the struct pid held by a SIGEV_THREAD_ID
    timer created against the leader's tid now points to the thread which called execve(). pid_task() returns
    that thread and lock_task_sighand() on it succeeds. If the timer signal is blocked, its sigqueue stays
    queued on the leader's task::pending. The next expiry of that timer can then run while release_task()
    flushes the queue. posixtimer_send_sigqueue() checks whether the sigqueue is already queued with a plain
    list_empty(), which only reads list_head::next. list_del_init() is not atomic and INIT_LIST_HEAD() stores
    list_head::next before list_head::prev, so the check can pass in between. list_add_tail() queues the entry
    on the task::pending of the live thread, and the list_head::prev store from the flush then overwrites the
    list_head::prev link that list_add_tail() has just set. __flush_itimer_signals() does not undo that
    either. With list_head::prev pointing at the entry itself, its list_del_init() only stores the same values
    again, so the entry is not removed from the list. It is still there after the last reference is dropped
    and the timer is freed by RCU, and the list_add_tail() of a later tgkill() follows that list_head::prev
    into the freed timer. This problem surfaced with the recent commit which moved the sigqueue flush out of
    the sighand lock held region. Hyonwoo proposed to fix this by using list_del_init_careful(), but that just
    papers over the problem. After some disucssions and various attempts to solve it, Eric pointed out that
    there is no reason to flush task::pending late in release_task() and it should be done in exit_signals()
    already. As nothing can collect and deliver signals which are queued in a dying task's pending queue,
    there is no reason to delay it further. But it has to be ensured that no signals can be queued into it
    after that point. exit_signals() sets PF_EXITING in task::flags, which can be used as an indicator for
    this. Cure it by: - Preventing signal queueing for task private signals (PIDTYPE_PID) when the task has
    PF_EXITING set in __send_signal_locked() and in posixtimer_send_sigqueue(). - Protecting the unlocked
    setting of PF_EXITING in exit_signals() for the task group empty and the group exit case with sighand lock
    - Flushing task::pending signals right there. Optimize that by moving the whole pending list to an on-
    stack list head under sighand lock and free the signals without the lock held. There has been quite some
    discussion about the lockless flush and the non-leader exec case on weakly ordered systems. The problem is
    that a third party which tries to send a posix timer signal relies on the PID lookup to find the target
    task and that lookup might result in the new leader when the signal was originaly directed to the old
    leader. In case that the signal was queued on the old leader then the lockless flush raised a concern over
    the following situation: old_leader new_leader third party A: flush_list() // list_del_in ---truncated---
    (CVE-2026-98256)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - signal: Prevent exec() race Hyunwoo debugged the following KASAN UAF splat: BUG: KASAN: slab-use-after-     free in __send_signal_locked+0xb27/0xba0 Write of size 8 at addr ffff888007ed80c8 by task poc/79 ... Call     Trace: __send_signal_locked+0xb27/0xba0 do_send_sig_info+0xa7/0x160 do_send_specific+0x76/0xa0
    __x64_sys_tgkill+0x193/0x270 ... Allocated by task 80: do_timer_create+0x1a4/0x1030
    __x64_sys_timer_create+0x145/0x190 ... Freed by task 12: kmem_cache_free_bulk+0x1f8/0x4a0     kvfree_rcu_bulk+0x14f/0x1c0 kfree_rcu_work+0x128/0x1a0 ... Last potentially related work creation:
    kvfree_call_rcu+0x39/0x390 __flush_itimer_signals+0x211/0x320 flush_itimer_signals+0x47/0x90     begin_new_exec+0xa6b/0x28c0 It turned out that this happens with a non-leader exec() as Hyunwoo explained:
    de_thread() calls exchange_tids() before release_task(leader), so the struct pid held by a SIGEV_THREAD_ID     timer created against the leader's tid now points to the thread which called execve(). pid_task() returns     that thread and lock_task_sighand() on it succeeds. If the timer signal is blocked, its sigqueue stays     queued on the leader's task::pending. The next expiry of that timer can then run while release_task()     flushes the queue. posixtimer_send_sigqueue() checks whether the sigqueue is already queued with a plain     list_empty(), which only reads list_head::next. list_del_init() is not atomic and INIT_LIST_HEAD() stores     list_head::next before list_head::prev, so the check can pass in between. list_add_tail() queues the entry     on the task::pending of the live thread, and the list_head::prev store from the flush then overwrites the     list_head::prev link that list_add_tail() has just set. __flush_itimer_signals() does not undo that     either. With list_head::prev pointing at the entry itself, its list_del_init() only stores the same values     again, so the entry is not removed from the list. It is still there after the last reference is dropped     and the timer is freed by RCU, and the list_add_tail() of a later tgkill() follows that list_head::prev     into the freed timer. This problem surfaced with the recent commit which moved the sigqueue flush out of     the sighand lock held region. Hyonwoo proposed to fix this by using list_del_init_careful(), but that just     papers over the problem. After some disucssions and various attempts to solve it, Eric pointed out that     there is no reason to flush task::pending late in release_task() and it should be done in exit_signals()     already. As nothing can collect and deliver signals which are queued in a dying task's pending queue,     there is no reason to delay it further. But it has to be ensured that no signals can be queued into it     after that point. exit_signals() sets PF_EXITING in task::flags, which can be used as an indicator for     this. Cure it by: - Preventing signal queueing for task private signals (PIDTYPE_PID) when the task has     PF_EXITING set in __send_signal_locked() and in posixtimer_send_sigqueue(). - Protecting the unlocked     setting of PF_EXITING in exit_signals() for the task group empty and the group exit case with sighand lock
    - Flushing task::pending signals right there. Optimize that by moving the whole pending list to an on-     stack list head under sighand lock and free the signals without the lock held. There has been quite some     discussion about the lockless flush and the non-leader exec case on weakly ordered systems. The problem is     that a third party which tries to send a posix timer signal relies on the PID lookup to find the target     task and that lookup might result in the new leader when the signal was originaly directed to the old     leader. In case that the signal was queued on the old leader then the lockless flush raised a concern over     the following situation: old_leader new_leader third party A: flush_list() // list_del_in ---truncated---     (CVE-2026-98256)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
372930	Oracle Linux 10 : kernel (ELSA-2026-85321)	Nessus	Oracle Linux Local Security Checks	Local	critical
370337	Rocky Linux 10.2 [CIQ] Security Update: kernel / kernel-64k / kernel-64k-core / kernel-64k-debug / etc Multiple Vulnerabilities (crlsa-2026_85321)	Nessus	Rocky Linux Local Security Checks	Local	critical
369541	AlmaLinux 10 : kernel (ALSA-2026:85321)	Nessus	Alma Linux Local Security Checks	Local	critical
369524	RockyLinux 10 : kernel (RLSA-2026:85321)	Nessus	Rocky Linux Local Security Checks	Local	critical
367411	RHEL 10 : kernel (RHSA-2026:85321)	Nessus	Red Hat Local Security Checks	Local	critical
475758	Google: sys-kernel/cchost-kernel-6_18, sys-kernel/csql-kernel-6_18, sys-kernel/lakitu-kernel-6_18, sys-kernel/lakitu-nc-kernel-6_18: security update to 20198.0.0	Tenable Cloud Security	Google COS Security Checks	Local	high
475758	Google: sys-kernel/cchost-kernel-6_18, sys-kernel/csql-kernel-6_18, sys-kernel/lakitu-kernel-6_18, sys-kernel/lakitu-nc-kernel-6_18: security update to 20198.0.0	Tenable Self-Hosted Container Security	Google COS Security Checks	Local	high
365258	Amazon Linux 2023 : bpftool6.18, kernel6.18, kernel6.18-devel (ALAS2023-2026-3192)	Nessus	Amazon Linux Local Security Checks	Local	high
364267	Linux Distros Unpatched Vulnerability : CVE-2026-98256	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2026-98256

high

Tenable Plugins

critical

critical

critical

critical

critical

high

high

high

high