In the Linux kernel, the following vulnerability has been resolved: nvmet-auth: fix out-of-bounds write in nvmet_auth_challenge() nvmet_auth_challenge() receives its output buffer as a void pointer. sizeof(*d) therefore evaluates to one with GCC and undercounts the fixed challenge header by 15 bytes. A short AUTH_RECEIVE buffer can pass the check before the challenge is copied past the end of its allocation. Use the typed challenge pointer when calculating the response size. BUG: KASAN: slab-out-of-bounds in nvmet_execute_auth_receive (drivers/nvme/target/fabrics-cmd-auth.c:442 drivers/nvme/target/fabrics-cmd-auth.c:569) Write of size 32 by task kworker/1:1H/64 Workqueue: nvmet_tcp_wq nvmet_tcp_io_work Call Trace: nvmet_execute_auth_receive (drivers/nvme/target/fabrics-cmd-auth.c:442 drivers/nvme/target/fabrics-cmd-auth.c:569) nvmet_tcp_try_recv_pdu (drivers/nvme/target/tcp.c:1119 drivers/nvme/target/tcp.c:1243) nvmet_tcp_io_work (drivers/nvme/target/tcp.c:1350 drivers/nvme/target/tcp.c:1382 drivers/nvme/target/tcp.c:1445) process_one_work (kernel/workqueue.c:3322) worker_thread (kernel/workqueue.c:3405 kernel/workqueue.c:3486) kthread (kernel/kthread.c:436) ret_from_fork (arch/x86/kernel/process.c:158) ret_from_fork_asm (arch/x86/entry/entry_64.S:245) The buggy address is located 16 bytes inside of allocated 33-byte region [ffff888000554e80, ffff888000554ea1) Kernel panic - not syncing: KASAN: panic_on_warn set ...

The Rocky Linux 10.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-2026_93413 advisory.

    * kernel: Kernel: Denial of Service in network socket error handling (CVE-2026-22977)

    * kernel: x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (CVE-2026-46174)

    * kernel: i2c: stub: Reject I2C block transfers with invalid length (CVE-2026-64191)

    * kernel: Linux kernel: PPP over L2TP Use-After-Free vulnerability (CVE-2026-68398)

    * kernel: mptcp: pm: userspace: fix use-after-free in get_local_id (CVE-2026-68169)

    * kernel: tipc: require net admin for TIPCv2 netlink mutators (CVE-2026-74283)

    * kernel: mptcp: options: reset DSS fields in case of unexpected size (CVE-2026-80586)

    * kernel: entry: Fix seccomp bypass after ptrace with TSYNC (CVE-2026-89603)

    * kernel: KVM: nVMX: Always flush vpid02 on first use (CVE-2026-89932)

    * kernel: scsi: target: iscsi: Reserve a terminator byte for the login payload (CVE-2026-90011)

    * kernel: virtio-fs: avoid double-free on failed queue setup (CVE-2026-93827)

    * kernel: smb: client: bound dirent name against end of SMB response in cifs_filldir (CVE-2026-93787)

    * kernel: KEYS: encrypted: fix integer overflow of datablob_len (CVE-2026-98222)

    * kernel: xfrm: hold net_device reference under RCU in bundle creation (CVE-2026-98364)

    * kernel: ipv4: free inet_opt and ireq_opt after an RCU grace period (CVE-2026-98432)

    * kernel: nvmet-auth: fix out-of-bounds write in nvmet_auth_challenge() (CVE-2026-98725)

    Bug Fix(es) and Enhancement(s):

    * ipv4: ip_gre: make ipgre_header() robust (rhel-10.2.z) (JIRA:Rocky Linux-270702)

    * ip6_gre: make ip6gre_header() robust (rhel-10.2.z) (JIRA:Rocky Linux-270721)

    * Rocky Linux is missing support for conntrack zone filtering in dump/delete requests (10.4) [rhel-10.2.z]     (JIRA:Rocky Linux-291348)

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-2026_93412 advisory.

    * kernel: sctp: stream: fully roll back denied add-stream state (CVE-2026-52929)

    * kernel: ipv6: sit: reload inner IPv6 header after GSO offloads (CVE-2026-53228)

    * kernel: ipvs: clear the svc scheduler ptr early on edit (CVE-2026-53270)

    * kernel: spi: fsl-lpspi: terminate the RX channel on TX prepare failure path (CVE-2026-64303)

    * kernel: mptcp: pm: userspace: fix use-after-free in get_local_id (CVE-2026-68169)

    * kernel: scsi: target: core: Fix iSCSI ISID use-after-free in REGISTER AND MOVE (CVE-2026-72083)

    * kernel: tipc: require net admin for TIPCv2 netlink mutators (CVE-2026-74283)

    * kernel: Bluetooth: mgmt: fix UAF in pair command cancellation (CVE-2026-74510)

    * kernel: packet: use consistent hard_header_len in non-ring send paths (CVE-2026-74582)

    * kernel: mptcp: options: reset DSS fields in case of unexpected size (CVE-2026-80586)

    * kernel: entry: Fix seccomp bypass after ptrace with TSYNC (CVE-2026-89603)

    * kernel: scsi: target: iscsi: Reserve a terminator byte for the login payload (CVE-2026-90011)

    * kernel: virtio-fs: avoid double-free on failed queue setup (CVE-2026-93827)

    * kernel: smb: client: bound dirent name against end of SMB response in cifs_filldir (CVE-2026-93787)

    * kernel: xfrm: hold net_device reference under RCU in bundle creation (CVE-2026-98364)

    * kernel: ipv4: free inet_opt and ireq_opt after an RCU grace period (CVE-2026-98432)

    * kernel: KVM: arm64: Transfer the hyp stack pages out of the host stage-2 (CVE-2026-98466)

    * kernel: nvmet-auth: fix out-of-bounds write in nvmet_auth_challenge() (CVE-2026-98725)

    * kernel: ZDI-CAN-33367: Linux Kernel skbuff skb_zerocopy Improper Ownership Management Local Privilege     Escalation Vulnerability ()

    Bug Fix(es) and Enhancement(s):

    * kernel panic in percpu_counter_add_batch() via submit_bio_noacct() due to NULL pointer (JIRA:Rocky     Linux-250378)

    * ipv4: ip_gre: make ipgre_header() robust (rhel-9.8.z) (JIRA:Rocky Linux-271127)

    * ip6_gre: make ip6gre_header() robust (rhel-9.8.z) (JIRA:Rocky Linux-271130)

    * Backport sched: The newidle balance regression series to rhel 9.8 [rhel-9.8.z] (JIRA:Rocky     Linux-288067)

    * Rocky Linux is missing support for conntrack zone filtering in dump/delete requests (9.10) [rhel-9.8.z]     (JIRA:Rocky Linux-291352)

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-2261:117 advisory.

    * kernel: sctp: stream: fully roll back denied add-stream state (CVE-2026-52929)
      * kernel: ipv6: sit: reload inner IPv6 header after GSO offloads (CVE-2026-53228)
      * kernel: ipvs: clear the svc scheduler ptr early on edit (CVE-2026-53270)
      * kernel: spi: fsl-lpspi: terminate the RX channel on TX prepare failure path (CVE-2026-64303)
      * kernel: mptcp: pm: userspace: fix use-after-free in get_local_id (CVE-2026-68169)
      * kernel: scsi: target: core: Fix iSCSI ISID use-after-free in REGISTER AND MOVE (CVE-2026-72083)
      * kernel: tipc: require net admin for TIPCv2 netlink mutators (CVE-2026-74283)
      * kernel: Bluetooth: mgmt: fix UAF in pair command cancellation (CVE-2026-74510)
      * kernel: packet: use consistent hard_header_len in non-ring send paths (CVE-2026-74582)
      * kernel: mptcp: options: reset DSS fields in case of unexpected size (CVE-2026-80586)
      * kernel: entry: Fix seccomp bypass after ptrace with TSYNC (CVE-2026-89603)
      * kernel: scsi: target: iscsi: Reserve a terminator byte for the login payload (CVE-2026-90011)
      * kernel: virtio-fs: avoid double-free on failed queue setup (CVE-2026-93827)
      * kernel: smb: client: bound dirent name against end of SMB response in cifs_filldir (CVE-2026-93787)
      * kernel: xfrm: hold net_device reference under RCU in bundle creation (CVE-2026-98364)
      * kernel: ipv4: free inet_opt and ireq_opt after an RCU grace period (CVE-2026-98432)
      * kernel: KVM: arm64: Transfer the hyp stack pages out of the host stage-2 (CVE-2026-98466)
      * kernel: nvmet-auth: fix out-of-bounds write in nvmet_auth_challenge() (CVE-2026-98725)
      * kernel: ZDI-CAN-33367: Linux Kernel skbuff skb_zerocopy Improper Ownership Management Local Privilege     Escalation Vulnerability ()

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-93412 advisory.

    - ipv4: free inet_opt and ireq_opt after an RCU grace period (CKI Backport Bot) [RHEL-295635]     {CVE-2026-98432}
    - nvmet-auth: fix out-of-bounds write in nvmet_auth_challenge() (Maurizio Lombardi) [RHEL-290719]     {CVE-2026-98725}
    - spi: fsl-lpspi: terminate the RX channel on TX prepare failure path (Iker Pedrosa) [RHEL-234297]     {CVE-2026-64303}
    - spi: fsl-lpspi: replace dmaengine_terminate_all() with dmaengine_terminate_sync() (Iker Pedrosa)     [RHEL-234297] {CVE-2026-64303}
    - xfrm: hold net_device reference under RCU in bundle creation (Abhishek Rawal) [RHEL-277984]     {CVE-2026-98364}
    - entry: Fix seccomp bypass after ptrace with TSYNC (Audra Mitchell) [RHEL-271399] {CVE-2026-89603}
    - smb: client: bound dirent name against end of SMB response in cifs_filldir (CKI Backport Bot)     [RHEL-278331] {CVE-2026-93787}
    - sctp: stream: fully roll back denied add-stream state (CKI Backport Bot) [RHEL-277123] {CVE-2026-52929}
    - tipc: require net admin for TIPCv2 netlink mutators (CKI Backport Bot) [RHEL-273181] {CVE-2026-74283}
    - Bluetooth: mgmt: fix UAF in pair command cancellation (CKI Backport Bot) [RHEL-254650] {CVE-2026-74510}
    - ipvs: clear the svc scheduler ptr early on edit (CKI Backport Bot) [RHEL-225993] {CVE-2026-53270}
    - KVM: arm64: Transfer the hyp stack pages out of the host stage-2 (CKI Backport Bot) [RHEL-287053]     {CVE-2026-98466}
    - mptcp: pm: userspace: fix use-after-free in get_local_id (Prasenjit Mukherjee) [RHEL-236687]     {CVE-2026-68169}
    - mptcp: options: reset DSS fields in case of unexpected size (Prasenjit Mukherjee) [RHEL-250609]     {CVE-2026-80586}
    - virtio-fs: avoid double-free on failed queue setup (Miklos Szeredi) [RHEL-278131] {CVE-2026-93827}
    - scsi: target: iscsi: Reserve a terminator byte for the login payload (CKI Backport Bot) [RHEL-285602]     {CVE-2026-90011}
    - scsi: target: core: Fix iSCSI ISID use-after-free in REGISTER AND MOVE (CKI Backport Bot) [RHEL-283505]     {CVE-2026-72083}
    - packet: use consistent hard_header_len in non-ring send paths (Toke Hoiland-Jorgensen) [RHEL-244551]     {CVE-2026-74582}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:93412 advisory.

    * kernel: sctp: stream: fully roll back denied add-stream state (CVE-2026-52929)

    * kernel: ipv6: sit: reload inner IPv6 header after GSO offloads (CVE-2026-53228)

    * kernel: ipvs: clear the svc scheduler ptr early on edit (CVE-2026-53270)

    * kernel: spi: fsl-lpspi: terminate the RX channel on TX prepare failure path (CVE-2026-64303)

    * kernel: mptcp: pm: userspace: fix use-after-free in get_local_id (CVE-2026-68169)

    * kernel: scsi: target: core: Fix iSCSI ISID use-after-free in REGISTER AND MOVE (CVE-2026-72083)

    * kernel: tipc: require net admin for TIPCv2 netlink mutators (CVE-2026-74283)

    * kernel: Bluetooth: mgmt: fix UAF in pair command cancellation (CVE-2026-74510)

    * kernel: packet: use consistent hard_header_len in non-ring send paths (CVE-2026-74582)

    * kernel: mptcp: options: reset DSS fields in case of unexpected size (CVE-2026-80586)

    * kernel: entry: Fix seccomp bypass after ptrace with TSYNC (CVE-2026-89603)

    * kernel: scsi: target: iscsi: Reserve a terminator byte for the login payload (CVE-2026-90011)

    * kernel: virtio-fs: avoid double-free on failed queue setup (CVE-2026-93827)

    * kernel: smb: client: bound dirent name against end of SMB response in cifs_filldir (CVE-2026-93787)

    * kernel: xfrm: hold net_device reference under RCU in bundle creation (CVE-2026-98364)

    * kernel: ipv4: free inet_opt and ireq_opt after an RCU grace period (CVE-2026-98432)

    * kernel: KVM: arm64: Transfer the hyp stack pages out of the host stage-2 (CVE-2026-98466)

    * kernel: nvmet-auth: fix out-of-bounds write in nvmet_auth_challenge() (CVE-2026-98725)

    * kernel: ZDI-CAN-33367: Linux Kernel skbuff skb_zerocopy Improper Ownership Management Local Privilege     Escalation Vulnerability ()

    Bug Fix(es) and Enhancement(s):

    * kernel panic in percpu_counter_add_batch() via submit_bio_noacct() due to NULL pointer (JIRA:Rocky     Linux-250378)

    * ipv4: ip_gre: make ipgre_header() robust (rhel-9.8.z) (JIRA:Rocky Linux-271127)

    * ip6_gre: make ip6gre_header() robust (rhel-9.8.z) (JIRA:Rocky Linux-271130)

    * Backport sched: The newidle balance regression series to rhel 9.8 [rhel-9.8.z] (JIRA:Rocky     Linux-288067)

    * Rocky Linux is missing support for conntrack zone filtering in dump/delete requests (9.10) [rhel-9.8.z]     (JIRA:Rocky Linux-291352)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:93413 advisory.

    * kernel: Kernel: Denial of Service in network socket error handling (CVE-2026-22977)

    * kernel: x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (CVE-2026-46174)

    * kernel: i2c: stub: Reject I2C block transfers with invalid length (CVE-2026-64191)

    * kernel: Linux kernel: PPP over L2TP Use-After-Free vulnerability (CVE-2026-68398)

    * kernel: mptcp: pm: userspace: fix use-after-free in get_local_id (CVE-2026-68169)

    * kernel: tipc: require net admin for TIPCv2 netlink mutators (CVE-2026-74283)

    * kernel: mptcp: options: reset DSS fields in case of unexpected size (CVE-2026-80586)

    * kernel: entry: Fix seccomp bypass after ptrace with TSYNC (CVE-2026-89603)

    * kernel: KVM: nVMX: Always flush vpid02 on first use (CVE-2026-89932)

    * kernel: scsi: target: iscsi: Reserve a terminator byte for the login payload (CVE-2026-90011)

    * kernel: virtio-fs: avoid double-free on failed queue setup (CVE-2026-93827)

    * kernel: smb: client: bound dirent name against end of SMB response in cifs_filldir (CVE-2026-93787)

    * kernel: KEYS: encrypted: fix integer overflow of datablob_len (CVE-2026-98222)

    * kernel: xfrm: hold net_device reference under RCU in bundle creation (CVE-2026-98364)

    * kernel: ipv4: free inet_opt and ireq_opt after an RCU grace period (CVE-2026-98432)

    * kernel: nvmet-auth: fix out-of-bounds write in nvmet_auth_challenge() (CVE-2026-98725)

    Bug Fix(es) and Enhancement(s):

    * ipv4: ip_gre: make ipgre_header() robust (rhel-10.2.z) (JIRA:Rocky Linux-270702)

    * ip6_gre: make ip6gre_header() robust (rhel-10.2.z) (JIRA:Rocky Linux-270721)

    * Rocky Linux is missing support for conntrack zone filtering in dump/delete requests (10.4) [rhel-10.2.z]     (JIRA:Rocky Linux-291348)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-93413 advisory.

    - ipv4: free inet_opt and ireq_opt after an RCU grace period (CKI Backport Bot) [RHEL-295608]     {CVE-2026-98432}
    - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen)     [RHEL-230757] {CVE-2026-46174}
    - xfrm: hold net_device reference under RCU in bundle creation (Abhishek Rawal) [RHEL-277962]     {CVE-2026-98364}
    - tipc: require net admin for TIPCv2 netlink mutators (CKI Backport Bot) [RHEL-273184] {CVE-2026-74283}
    - entry: Fix seccomp bypass after ptrace with TSYNC (Audra Mitchell) [RHEL-271405] {CVE-2026-89603}
    - ppp: defer channel free to an RCU grace period to fix pppol2tp RX UAF (Abhishek Rawal) [RHEL-248847]     {CVE-2026-68398}
    - net: sock: fix hardened usercopy panic in sock_recv_errqueue (CKI Backport Bot) [RHEL-189611]     {CVE-2026-22977}
    - nvmet-auth: fix out-of-bounds write in nvmet_auth_challenge() (Maurizio Lombardi) [RHEL-290598]     {CVE-2026-98725}
    - smb: client: bound dirent name against end of SMB response in cifs_filldir (Paulo Alcantara)     [RHEL-278330] {CVE-2026-93787}
    - scsi: target: iscsi: Reserve a terminator byte for the login payload (CKI Backport Bot) [RHEL-285628]     {CVE-2026-90011}
    - virtio-fs: avoid double-free on failed queue setup (CKI Backport Bot) [RHEL-278134] {CVE-2026-93827}
    - KEYS: encrypted: fix integer overflow of datablob_len (Bruno Meneguele) [RHEL-279482] {CVE-2026-98222}
    - mptcp: options: reset DSS fields in case of unexpected size (Prasenjit Mukherjee) [RHEL-250579]     {CVE-2026-80586}
    - mptcp: pm: userspace: fix use-after-free in get_local_id (Prasenjit Mukherjee) [RHEL-236704]     {CVE-2026-68169}
    - KVM: nVM: Ensure INVVPID is emulated on the correct physical CPU (Rahul Kumar) [RHEL-270935]     {CVE-2026-89932}
    - KVM: nVMX: Decouple INVVPID operand checks from flushing of vpid02 (Rahul Kumar) [RHEL-270935]     {CVE-2026-89932}
    - KVM: nVMX: Always flush vpid02 on first use (Rahul Kumar) [RHEL-270935] {CVE-2026-89932}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the linux package has been released.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:93413 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: Kernel: Denial of Service in network socket error handling (CVE-2026-22977)

    * kernel: x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (CVE-2026-46174)

    * kernel: i2c: stub: Reject I2C block transfers with invalid length (CVE-2026-64191)

    * kernel: Linux kernel: PPP over L2TP Use-After-Free vulnerability (CVE-2026-68398)

    * kernel: mptcp: pm: userspace: fix use-after-free in get_local_id (CVE-2026-68169)

    * kernel: tipc: require net admin for TIPCv2 netlink mutators (CVE-2026-74283)

    * kernel: mptcp: options: reset DSS fields in case of unexpected size (CVE-2026-80586)

    * kernel: entry: Fix seccomp bypass after ptrace with TSYNC (CVE-2026-89603)

    * kernel: KVM: nVMX: Always flush vpid02 on first use (CVE-2026-89932)

    * kernel: scsi: target: iscsi: Reserve a terminator byte for the login payload (CVE-2026-90011)

    * kernel: virtio-fs: avoid double-free on failed queue setup (CVE-2026-93827)

    * kernel: smb: client: bound dirent name against end of SMB response in cifs_filldir (CVE-2026-93787)

    * kernel: KEYS: encrypted: fix integer overflow of datablob_len (CVE-2026-98222)

    * kernel: xfrm: hold net_device reference under RCU in bundle creation (CVE-2026-98364)

    * kernel: ipv4: free inet_opt and ireq_opt after an RCU grace period (CVE-2026-98432)

    * kernel: nvmet-auth: fix out-of-bounds write in nvmet_auth_challenge() (CVE-2026-98725)

    Bug Fix(es) and Enhancement(s):

    * ipv4: ip_gre: make ipgre_header() robust (rhel-10.2.z) (JIRA:RHEL-270702)

    * ip6_gre: make ip6gre_header() robust (rhel-10.2.z) (JIRA:RHEL-270721)

    * RHEL is missing support for conntrack zone filtering in dump/delete requests (10.4) [rhel-10.2.z]     (JIRA:RHEL-291348)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:93412 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: sctp: stream: fully roll back denied add-stream state (CVE-2026-52929)

    * kernel: ipv6: sit: reload inner IPv6 header after GSO offloads (CVE-2026-53228)

    * kernel: ipvs: clear the svc scheduler ptr early on edit (CVE-2026-53270)

    * kernel: spi: fsl-lpspi: terminate the RX channel on TX prepare failure path (CVE-2026-64303)

    * kernel: mptcp: pm: userspace: fix use-after-free in get_local_id (CVE-2026-68169)

    * kernel: scsi: target: core: Fix iSCSI ISID use-after-free in REGISTER AND MOVE (CVE-2026-72083)

    * kernel: tipc: require net admin for TIPCv2 netlink mutators (CVE-2026-74283)

    * kernel: Bluetooth: mgmt: fix UAF in pair command cancellation (CVE-2026-74510)

    * kernel: packet: use consistent hard_header_len in non-ring send paths (CVE-2026-74582)

    * kernel: mptcp: options: reset DSS fields in case of unexpected size (CVE-2026-80586)

    * kernel: entry: Fix seccomp bypass after ptrace with TSYNC (CVE-2026-89603)

    * kernel: scsi: target: iscsi: Reserve a terminator byte for the login payload (CVE-2026-90011)

    * kernel: virtio-fs: avoid double-free on failed queue setup (CVE-2026-93827)

    * kernel: smb: client: bound dirent name against end of SMB response in cifs_filldir (CVE-2026-93787)

    * kernel: xfrm: hold net_device reference under RCU in bundle creation (CVE-2026-98364)

    * kernel: ipv4: free inet_opt and ireq_opt after an RCU grace period (CVE-2026-98432)

    * kernel: KVM: arm64: Transfer the hyp stack pages out of the host stage-2 (CVE-2026-98466)

    * kernel: nvmet-auth: fix out-of-bounds write in nvmet_auth_challenge() (CVE-2026-98725)

    * kernel: ZDI-CAN-33367: Linux Kernel skbuff skb_zerocopy Improper Ownership Management Local Privilege     Escalation Vulnerability ()

    Bug Fix(es) and Enhancement(s):

    * kernel panic in percpu_counter_add_batch() via submit_bio_noacct() due to NULL pointer     (JIRA:RHEL-250378)

    * ipv4: ip_gre: make ipgre_header() robust (rhel-9.8.z) (JIRA:RHEL-271127)

    * ip6_gre: make ip6gre_header() robust (rhel-9.8.z) (JIRA:RHEL-271130)

    * Backport sched: The newidle balance regression series to rhel 9.8 [rhel-9.8.z] (JIRA:RHEL-288067)

    * RHEL is missing support for conntrack zone filtering in dump/delete requests (9.10) [rhel-9.8.z]     (JIRA:RHEL-291352)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Rocky Linux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-2026_1744 advisory.

    This advisory aggregates security fixes for the kernel SRPM in CIQ FIPS 9.2 Compliant. It addresses 7     CVEs: CVE-2026-72130, CVE-2026-98725, CVE-2026-98432, CVE-2026-64530, CVE-2026-64319, and 2 more.

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-2026_1745 advisory.

    This advisory aggregates security fixes for the kernel SRPM in CIQ FIPS 9.6 Compliant. It addresses 18     CVEs: CVE-2026-64439, CVE-2026-72130, CVE-2026-31418, CVE-2025-30156, CVE-2026-98725, and 13 more.

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4850 advisory.

    -------------------------------------------------------------------------     Debian LTS Advisory DLA-4850-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                        Ben Hutchings     October 22, 2026                              https://wiki.debian.org/LTS
    -------------------------------------------------------------------------

    Package        : linux-6.12     Version        : 6.12.113-1~deb12u1     CVE ID         : CVE-2025-38204 CVE-2025-40158 CVE-2026-52988 CVE-2026-72315                      CVE-2026-72463 CVE-2026-74347 CVE-2026-80935 CVE-2026-80937                      CVE-2026-80939 CVE-2026-80980 CVE-2026-81016 CVE-2026-89437                      CVE-2026-89441 CVE-2026-89445 CVE-2026-89452 CVE-2026-89467                      CVE-2026-89500 CVE-2026-89503 CVE-2026-89520 CVE-2026-89527                      CVE-2026-89633 CVE-2026-89638 CVE-2026-89766 CVE-2026-89795                      CVE-2026-89797 CVE-2026-89806 CVE-2026-89827 CVE-2026-89832                      CVE-2026-89837 CVE-2026-89838 CVE-2026-89840 CVE-2026-89859                      CVE-2026-89868 CVE-2026-89912 CVE-2026-89921 CVE-2026-89956                      CVE-2026-89971 CVE-2026-89972 CVE-2026-89996 CVE-2026-90002                      CVE-2026-90013 CVE-2026-90016 CVE-2026-90023 CVE-2026-90029                      CVE-2026-90030 CVE-2026-90146 CVE-2026-93179 CVE-2026-93196                      CVE-2026-93199 CVE-2026-93200 CVE-2026-93231 CVE-2026-93243                      CVE-2026-93244 CVE-2026-93285 CVE-2026-97527 CVE-2026-97528                      CVE-2026-97529 CVE-2026-97530 CVE-2026-97531 CVE-2026-97532                      CVE-2026-97534 CVE-2026-97535 CVE-2026-97536 CVE-2026-97537                      CVE-2026-97549 CVE-2026-97558 CVE-2026-97559 CVE-2026-97566                      CVE-2026-97567 CVE-2026-97571 CVE-2026-97574 CVE-2026-97594                      CVE-2026-97597 CVE-2026-97603 CVE-2026-97609 CVE-2026-97615                      CVE-2026-97618 CVE-2026-97619 CVE-2026-97620 CVE-2026-97901                      CVE-2026-97906 CVE-2026-97918 CVE-2026-97919 CVE-2026-97933                      CVE-2026-97934 CVE-2026-97935 CVE-2026-97938 CVE-2026-97939                      CVE-2026-97949 CVE-2026-97950 CVE-2026-98101 CVE-2026-98161                      CVE-2026-98167 CVE-2026-98168 CVE-2026-98169 CVE-2026-98170                      CVE-2026-98171 CVE-2026-98172 CVE-2026-98173 CVE-2026-98174                      CVE-2026-98175 CVE-2026-98179 CVE-2026-98181 CVE-2026-98182                      CVE-2026-98184 CVE-2026-98185 CVE-2026-98186 CVE-2026-98187                      CVE-2026-98188 CVE-2026-98189 CVE-2026-98190 CVE-2026-98191                      CVE-2026-98192 CVE-2026-98193 CVE-2026-98194 CVE-2026-98195                      CVE-2026-98196 CVE-2026-98197 CVE-2026-98198 CVE-2026-98199                      CVE-2026-98200 CVE-2026-98201 CVE-2026-98202 CVE-2026-98203                      CVE-2026-98204 CVE-2026-98205 CVE-2026-98206 CVE-2026-98207                      CVE-2026-98208 CVE-2026-98209 CVE-2026-98210 CVE-2026-98211                      CVE-2026-98212 CVE-2026-98213 CVE-2026-98214 CVE-2026-98215                      CVE-2026-98216 CVE-2026-98217 CVE-2026-98218 CVE-2026-98221                      CVE-2026-98222 CVE-2026-98227 CVE-2026-98229 CVE-2026-98230                      CVE-2026-98231 CVE-2026-98232 CVE-2026-98233 CVE-2026-98234                      CVE-2026-98235 CVE-2026-98236 CVE-2026-98237 CVE-2026-98238                      CVE-2026-98239 CVE-2026-98241 CVE-2026-98245 CVE-2026-98246                      CVE-2026-98247 CVE-2026-98248 CVE-2026-98249 CVE-2026-98251                      CVE-2026-98252 CVE-2026-98253 CVE-2026-98254 CVE-2026-98255                      CVE-2026-98257 CVE-2026-98260 CVE-2026-98261 CVE-2026-98262                      CVE-2026-98263 CVE-2026-98264 CVE-2026-98265 CVE-2026-98266                      CVE-2026-98267 CVE-2026-98269 CVE-2026-98270 CVE-2026-98271                      CVE-2026-98272 CVE-2026-98275 CVE-2026-98276 CVE-2026-98282                      CVE-2026-98283 CVE-2026-98287 CVE-2026-98290 CVE-2026-98291                      CVE-2026-98293 CVE-2026-98295 CVE-2026-98297 CVE-2026-98298                      CVE-2026-98299 CVE-2026-98300 CVE-2026-98301 CVE-2026-98302                      CVE-2026-98303 CVE-2026-98306 CVE-2026-98307 CVE-2026-98308                      CVE-2026-98309 CVE-2026-98311 CVE-2026-98312 CVE-2026-98314                      CVE-2026-98316 CVE-2026-98319 CVE-2026-98320 CVE-2026-98322                      CVE-2026-98323 CVE-2026-98325 CVE-2026-98326 CVE-2026-98327                      CVE-2026-98328 CVE-2026-98329 CVE-2026-98331 CVE-2026-98334                      CVE-2026-98335 CVE-2026-98336 CVE-2026-98337 CVE-2026-98339                      CVE-2026-98340 CVE-2026-98342 CVE-2026-98343 CVE-2026-98344                      CVE-2026-98345 CVE-2026-98346 CVE-2026-98347 CVE-2026-98348                      CVE-2026-98349 CVE-2026-98351 CVE-2026-98352 CVE-2026-98354                      CVE-2026-98357 CVE-2026-98358 CVE-2026-98359 CVE-2026-98360                      CVE-2026-98362 CVE-2026-98363 CVE-2026-98365 CVE-2026-98366                      CVE-2026-98367 CVE-2026-98368 CVE-2026-98369 CVE-2026-98370                      CVE-2026-98373 CVE-2026-98374 CVE-2026-98375 CVE-2026-98377                      CVE-2026-98378 CVE-2026-98379 CVE-2026-98380 CVE-2026-98381                      CVE-2026-98382 CVE-2026-98383 CVE-2026-98384 CVE-2026-98386                      CVE-2026-98403 CVE-2026-98406 CVE-2026-98407 CVE-2026-98409                      CVE-2026-98410 CVE-2026-98411 CVE-2026-98412 CVE-2026-98413                      CVE-2026-98416 CVE-2026-98417 CVE-2026-98419 CVE-2026-98421                      CVE-2026-98422 CVE-2026-98423 CVE-2026-98425 CVE-2026-98426                      CVE-2026-98428 CVE-2026-98429 CVE-2026-98430 CVE-2026-98432                      CVE-2026-98433 CVE-2026-98435 CVE-2026-98440 CVE-2026-98441                      CVE-2026-98442 CVE-2026-98443 CVE-2026-98445 CVE-2026-98448                      CVE-2026-98450 CVE-2026-98451 CVE-2026-98452 CVE-2026-98453                      CVE-2026-98454 CVE-2026-98455 CVE-2026-98456 CVE-2026-98457                      CVE-2026-98458 CVE-2026-98459 CVE-2026-98460 CVE-2026-98461                      CVE-2026-98462 CVE-2026-98464 CVE-2026-98465 CVE-2026-98468                      CVE-2026-98473 CVE-2026-98475 CVE-2026-98476 CVE-2026-98477                      CVE-2026-98479 CVE-2026-98481 CVE-2026-98482 CVE-2026-98483                      CVE-2026-98484 CVE-2026-98485 CVE-2026-98486 CVE-2026-98487                      CVE-2026-98488 CVE-2026-98489 CVE-2026-98490 CVE-2026-98491                      CVE-2026-98493 CVE-2026-98494 CVE-2026-98495 CVE-2026-98498                      CVE-2026-98499 CVE-2026-98501 CVE-2026-98502 CVE-2026-98503                      CVE-2026-98504 CVE-2026-98505 CVE-2026-98506 CVE-2026-98507                      CVE-2026-98508 CVE-2026-98509 CVE-2026-98510 CVE-2026-98511                      CVE-2026-98512 CVE-2026-98513 CVE-2026-98514 CVE-2026-98515                      CVE-2026-98516 CVE-2026-98517 CVE-2026-98519 CVE-2026-98521                      CVE-2026-98522 CVE-2026-98523 CVE-2026-98524 CVE-2026-98525                      CVE-2026-98526 CVE-2026-98527 CVE-2026-98528 CVE-2026-98529                      CVE-2026-98531 CVE-2026-98532 CVE-2026-98533 CVE-2026-98534                      CVE-2026-98535 CVE-2026-98536 CVE-2026-98537 CVE-2026-98538                      CVE-2026-98539 CVE-2026-98541 CVE-2026-98544 CVE-2026-98545                      CVE-2026-98546 CVE-2026-98547 CVE-2026-98548 CVE-2026-98549                      CVE-2026-98550 CVE-2026-98553 CVE-2026-98554 CVE-2026-98555                      CVE-2026-98559 CVE-2026-98561 CVE-2026-98565 CVE-2026-98566                      CVE-2026-98567 CVE-2026-98568 CVE-2026-98569 CVE-2026-98572                      CVE-2026-98573 CVE-2026-98575 CVE-2026-98576 CVE-2026-98577                      CVE-2026-98578 CVE-2026-98579 CVE-2026-98580 CVE-2026-98581                      CVE-2026-98582 CVE-2026-98583 CVE-2026-98586 CVE-2026-98588                      CVE-2026-98590 CVE-2026-98591 CVE-2026-98593 CVE-2026-98594                      CVE-2026-98596 CVE-2026-98597 CVE-2026-98600 CVE-2026-98601                      CVE-2026-98602 CVE-2026-98605 CVE-2026-98606 CVE-2026-98607                      CVE-2026-98608 CVE-2026-98609 CVE-2026-98610 CVE-2026-98611                      CVE-2026-98612 CVE-2026-98613 CVE-2026-98614 CVE-2026-98615                      CVE-2026-98618 CVE-2026-98620 CVE-2026-98621 CVE-2026-98622                      CVE-2026-98623 CVE-2026-98624 CVE-2026-98625 CVE-2026-98626                      CVE-2026-98629 CVE-2026-98631 CVE-2026-98632 CVE-2026-98634                      CVE-2026-98636 CVE-2026-98640 CVE-2026-98641 CVE-2026-98642                      CVE-2026-98643 CVE-2026-98644 CVE-2026-98646 CVE-2026-98647                      CVE-2026-98655 CVE-2026-98656 CVE-2026-98657 CVE-2026-98658                      CVE-2026-98660 CVE-2026-98661 CVE-2026-98662 CVE-2026-98663                      CVE-2026-98664 CVE-2026-98665 CVE-2026-98666 CVE-2026-98668                      CVE-2026-98669 CVE-2026-98670 CVE-2026-98671 CVE-2026-98672                      CVE-2026-98673 CVE-2026-98677 CVE-2026-98679 CVE-2026-98680                      CVE-2026-98681 CVE-2026-98686 CVE-2026-98687 CVE-2026-98694                      CVE-2026-98695 CVE-2026-98696 CVE-2026-98697 CVE-2026-98698                      CVE-2026-98699 CVE-2026-98700 CVE-2026-98701 CVE-2026-98702                      CVE-2026-98703 CVE-2026-98704 CVE-2026-98705 CVE-2026-98706                      CVE-2026-98707 CVE-2026-98708 CVE-2026-98709 CVE-2026-98710                      CVE-2026-98711 CVE-2026-98713 CVE-2026-98716 CVE-2026-98717                      CVE-2026-98720 CVE-2026-98721 CVE-2026-98722 CVE-2026-98725                      CVE-2026-98726 CVE-2026-98727 CVE-2026-98728 CVE-2026-98730                      CVE-2026-98731 CVE-2026-98732 CVE-2026-98733 CVE-2026-98734                      CVE-2026-98735 CVE-2026-98736 CVE-2026-98737 CVE-2026-98738                      CVE-2026-98739 CVE-2026-98741 CVE-2026-98742 CVE-2026-98743                      CVE-2026-98744 CVE-2026-98745 CVE-2026-98746 CVE-2026-98748                      CVE-2026-98749 CVE-2026-98750 CVE-2026-98751 CVE-2026-98752                      CVE-2026-98753 CVE-2026-98754 CVE-2026-98755 CVE-2026-98756                      CVE-2026-98757 CVE-2026-98758 CVE-2026-98760 CVE-2026-98761                      CVE-2026-98762 CVE-2026-98763 CVE-2026-98764 CVE-2026-98765                      CVE-2026-98766 CVE-2026-98767 CVE-2026-98768 CVE-2026-98769                      CVE-2026-98770 CVE-2026-98771 CVE-2026-98772 CVE-2026-98773                      CVE-2026-98775 CVE-2026-98777 CVE-2026-98778 CVE-2026-98779                      CVE-2026-98780 CVE-2026-98781 CVE-2026-98782 CVE-2026-98783                      CVE-2026-98784 CVE-2026-98785 CVE-2026-98790 CVE-2026-98791                      CVE-2026-98792 CVE-2026-98793 CVE-2026-98794 CVE-2026-98796                      CVE-2026-98797 CVE-2026-98798 CVE-2026-98801 CVE-2026-98805                      CVE-2026-98807 CVE-2026-98808 CVE-2026-98809 CVE-2026-98811                      CVE-2026-98812 CVE-2026-98819 CVE-2026-98822 CVE-2026-98823                      CVE-2026-98825 CVE-2026-98826 CVE-2026-98827 CVE-2026-98828                      CVE-2026-98830 CVE-2026-98831 CVE-2026-98833 CVE-2026-98835                      CVE-2026-98836 CVE-2026-98837 CVE-2026-98838 CVE-2026-98840                      CVE-2026-98841 CVE-2026-98844 CVE-2026-98845 CVE-2026-98846                      CVE-2026-98847 CVE-2026-98848 CVE-2026-98849 CVE-2026-98850                      CVE-2026-98851 CVE-2026-98852 CVE-2026-98854 CVE-2026-98855                      CVE-2026-98856 CVE-2026-98857 CVE-2026-98858 CVE-2026-98859                      CVE-2026-98860 CVE-2026-98862 CVE-2026-99999     Debian Bug     : 1149499 1149564 1150891

    Several vulnerabilities have been discovered in the Linux kernel that     may lead to a privilege escalation, denial of service or information     leaks.

    For Debian 12 bookworm, these problems have been fixed in version     6.12.113-1~deb12u1.  This update additionally includes many more bug     fixes from stable updates 6.12.112 and 6.12.113.

    We recommend that you upgrade your linux-6.12 packages.

    For the detailed security status of linux-6.12 please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/linux-6.12

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS     Attachment:
    signature.asc     Description: PGP signature

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - nvmet-auth: fix out-of-bounds write in nvmet_auth_challenge() nvmet_auth_challenge() receives its output     buffer as a void pointer. sizeof(*d) therefore evaluates to one with GCC and undercounts the fixed     challenge header by 15 bytes. A short AUTH_RECEIVE buffer can pass the check before the challenge is     copied past the end of its allocation. Use the typed challenge pointer when calculating the response size.
    BUG: KASAN: slab-out-of-bounds in nvmet_execute_auth_receive (drivers/nvme/target/fabrics-cmd-auth.c:442     drivers/nvme/target/fabrics-cmd-auth.c:569) Write of size 32 by task kworker/1:1H/64 Workqueue:
    nvmet_tcp_wq nvmet_tcp_io_work Call Trace: nvmet_execute_auth_receive (drivers/nvme/target/fabrics-cmd-     auth.c:442 drivers/nvme/target/fabrics-cmd-auth.c:569) nvmet_tcp_try_recv_pdu     (drivers/nvme/target/tcp.c:1119 drivers/nvme/target/tcp.c:1243) nvmet_tcp_io_work     (drivers/nvme/target/tcp.c:1350 drivers/nvme/target/tcp.c:1382 drivers/nvme/target/tcp.c:1445)     process_one_work (kernel/workqueue.c:3322) worker_thread (kernel/workqueue.c:3405 kernel/workqueue.c:3486)     kthread (kernel/kthread.c:436) ret_from_fork (arch/x86/kernel/process.c:158) ret_from_fork_asm     (arch/x86/entry/entry_64.S:245) The buggy address is located 16 bytes inside of allocated 33-byte region     [ffff888000554e80, ffff888000554ea1) Kernel panic - not syncing: KASAN: panic_on_warn set ...
    (CVE-2026-98725)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
376398	Rocky Linux 10.2 [CIQ] Security Update: kernel / kernel-64k / kernel-64k-core / kernel-64k-debug / etc Multiple Vulnerabilities (crlsa-2026_93413)	Nessus	Rocky Linux Local Security Checks	Local	medium
376395	Rocky Linux 9 [CIQ] Security Update: kernel / kernel-64k / kernel-64k-core / kernel-64k-debug / etc Multiple Vulnerabilities (crlsa-2026_93412)	Nessus	Rocky Linux Local Security Checks	Local	critical
376292	MiracleLinux 9 : kernel-5.14.0-687.64.1.el9_8 (AXSA:2026-2261:117)	Nessus	Miracle Linux Local Security Checks	Local	critical
375516	Oracle Linux 9 : kernel (ELSA-2026-93412)	Nessus	Oracle Linux Local Security Checks	Local	critical
375444	RockyLinux 9 : kernel (RLSA-2026:93412)	Nessus	Rocky Linux Local Security Checks	Local	critical
375443	RockyLinux 10 : kernel (RLSA-2026:93413)	Nessus	Rocky Linux Local Security Checks	Local	medium
375175	Oracle Linux 10 : kernel (ELSA-2026-93413)	Nessus	Oracle Linux Local Security Checks	Local	medium
375086	Photon OS 5.0: Linux PHSA-2026-5.0-92-1044	Nessus	PhotonOS Local Security Checks	Local	critical
374862	RHEL 10 : kernel (RHSA-2026:93413)	Nessus	Red Hat Local Security Checks	Local	medium
374859	RHEL 9 : kernel (RHSA-2026:93412)	Nessus	Red Hat Local Security Checks	Local	critical
374839	Rocky Linux 9.2 [CIQ] Security Update: bpftool / kernel / kernel-64k / kernel-64k-core / kernel-64k-debug / etc Multiple Vulnerabilities (ciqsa-2026_1744)	Nessus	Rocky Linux Local Security Checks	Local	critical
374838	Rocky Linux 9.6 [CIQ] Security Update: kernel / kernel-64k / kernel-64k-core / kernel-64k-debug / etc Multiple Vulnerabilities (ciqsa-2026_1745)	Nessus	Rocky Linux Local Security Checks	Local	medium
370518	Debian dla-4850 : ata-modules-6.12.107+deb12-armmp-di - security update	Nessus	Debian Local Security Checks	Local	high
366999	Linux Distros Unpatched Vulnerability : CVE-2026-98725	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2026-98725

high

Tenable Plugins

medium

critical

critical

critical

critical

medium

medium

critical

medium

critical

critical

medium

high

high