The remote Oracle Linux 10 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-500150 advisory.

    - x86/bugs: Make Safe-RET robust against interrupt injection (Borislav Petkov (AMD))  [Orabug: 39844812]     {CVE-2026-68480}
    - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Sean Christopherson)     [Orabug: 39844799]  {CVE-2026-64561}
    - net: openvswitch: reject oversized nested action attrs (Asim Viladi Oglu Manizada)  [Orabug: 39816011]     {CVE-2026-64531}
    - xfrm: hold dev ref until after transport_finish NF_HOOK (Qi Tang)  [Orabug: 39262397]  {CVE-2026-31663}
    - KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (Hyunwoo Kim)     [Orabug: 39531622]  {CVE-2026-46316}
    - ipv6: account for fraggap on the paged allocation path (Wongi Lee)  [Orabug: 39686467]  {CVE-2026-53362}
    - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [Orabug:
    39673856,39686459] {CVE-2026-53359}
    - net/sched: fix pedit partial COW leading to page cache corruption (Rajat Gupta) [Orabug:
    39567285,39668752] {CVE-2026-46331}
    - net_sched: act_pedit: use RCU in tcf_pedit_dump() (Eric Dumazet) [Orabug: 39567285] {CVE-2026-46331}
    - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Christian Brauner) [Orabug: 39466882]     {CVE-2026-46242}
    - eventpoll: move epi_fget() up (Christian Brauner) [Orabug: 39466882] {CVE-2026-46242}
    - eventpoll: rename ep_remove_safe() back to ep_remove() (Christian Brauner) [Orabug: 39466882]     {CVE-2026-46242}
    - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Christian Brauner) [Orabug: 39466882]     {CVE-2026-46242}
    - eventpoll: kill __ep_remove() (Christian Brauner) [Orabug: 39466882] {CVE-2026-46242}
    - eventpoll: split __ep_remove() (Christian Brauner) [Orabug: 39466882] {CVE-2026-46242}
    - eventpoll: use hlist_is_singular_node() in __ep_remove() (Christian Brauner) [Orabug: 39466882]     {CVE-2026-46242}
    - md: fix array_state=clear sysfs deadlock (Yu Kuai) [Orabug: 39190489,39668924] {CVE-2026-53125}
    - md: avoid repeated calls to del_gendisk (Xiao Ni) [Orabug: 39190489,39668918] {CVE-2025-68373}
    - net: skbuff: fix missing zerocopy reference in pskb_carve helpers (Minh Nguyen) [Orabug:
    39619387,39639984,39656679] {CVE-2026-52943}
    - net/mlx5: Fix crash when moving to switchdev mode (Patrisious Haddad) [Orabug: 38667152,39344020]     {CVE-2026-43467}
    - net/mlx5: Fix double unregister of HCA_PORTS component (Gerd Bayer) [Orabug: 38667152,39590860]     {CVE-2025-68790}
    - net/mlx5: Fix IPsec cleanup over MPV device (Patrisious Haddad) [Orabug: 38667152,38730559]     {CVE-2025-40238}
    - net/mlx5: HWS, fix complex rules rehash error flow (Yevgeny Kliteynik) [Orabug: 38667152,39590850]     {CVE-2025-39768}
    - macsec: sync features on RTM_NEWLINK (Stanislav Fomichev) [Orabug: 38667152,39590858] {CVE-2025-39874}
    - net: dev_ioctl: take ops lock in hwtstamp lower paths (Carolina Jubran) [Orabug: 38667152,39590854]     {CVE-2025-39908}
    - team: replace team lock with rtnl lock (Stanislav Fomichev) [Orabug: 38667152,39590857] {CVE-2025-39733}
    - net: prevent a NULL deref in rtnl_create_link() (Eric Dumazet) [Orabug: 38667152,39590851]     {CVE-2025-38271}
    - virtio-pci: Fix result size returned for the admin command completion (Israel Rukshin) [Orabug:
    38667152,39590859] {CVE-2025-38314}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

Oracle Linux 10 / 9 : Unbreakable Enterprise kernel (ELSA-2026-500150)

medium Nessus Plugin ID 334160

Version 1.2

Version 1.1

Version 1.2 Aug 28, 2026, 12:16 PM CVSS temporal metrics ("CVSSv2 temporal vector" set to "CVSS2#E:F/RL:OF/RC:C") CVSS temporal metrics ("CVSSv3 temporal vector" set to "CVSS:3.0/E:F/RL:O/RC:C") Plugin Feed: 202608281216
Version 1.1 Aug 10, 2026, 11:58 PM New Plugin Feed: 202608102358