The CentOS Linux 8.5 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS8.5:CLSA-2026:1783414155 advisory.

  - In the Linux kernel, the following vulnerability has been resolved: blk-cgroup: fix UAF by grabbing blkcg     lock before destroying blkg pd KASAN reports a use-after-free report when doing fuzz test: [693354.104835]     ================================================================== [693354.105094] BUG: KASAN: use-after-     free in bfq_io_set_weight_legacy+0xd3/0x160 [693354.105336] Read of size 4 at addr ffff888be0a35664 by     task sh/1453338 [693354.105607] CPU: 41 PID: 1453338 Comm: sh Kdump: loaded Not tainted 4.18.0-147     [693354.105610] Hardware name: Huawei 2288H V5/BC11SPSCB0, BIOS 0.81 07/02/2018 [693354.105612] Call     Trace: [693354.105621] dump_stack+0xf1/0x19b [693354.105626] ? show_regs_print_info+0x5/0x5     [693354.105634] ? printk+0x9c/0xc3 [693354.105638] ? cpumask_weight+0x1f/0x1f [693354.105648]     print_address_description+0x70/0x360 [693354.105654] kasan_report+0x1b2/0x330 [693354.105659] ?     bfq_io_set_weight_legacy+0xd3/0x160 [693354.105665] ? bfq_io_set_weight_legacy+0xd3/0x160 [693354.105670]     bfq_io_set_weight_legacy+0xd3/0x160 [693354.105675] ? bfq_cpd_init+0x20/0x20 [693354.105683]     cgroup_file_write+0x3aa/0x510 [693354.105693] ? ___slab_alloc+0x507/0x540 [693354.105698] ?     cgroup_file_poll+0x60/0x60 [693354.105702] ? 0xffffffff89600000 [693354.105708] ? usercopy_abort+0x90/0x90     [693354.105716] ? mutex_lock+0xef/0x180 [693354.105726] kernfs_fop_write+0x1ab/0x280 [693354.105732] ?     cgroup_file_poll+0x60/0x60 [693354.105738] vfs_write+0xe7/0x230 [693354.105744] ksys_write+0xb0/0x140     [693354.105749] ? __ia32_sys_read+0x50/0x50 [693354.105760] do_syscall_64+0x112/0x370 [693354.105766] ?     syscall_return_slowpath+0x260/0x260 [693354.105772] ? do_page_fault+0x9b/0x270 [693354.105779] ?     prepare_exit_to_usermode+0xf9/0x1a0 [693354.105784] ? enter_from_user_mode+0x30/0x30 [693354.105793]     entry_SYSCALL_64_after_hwframe+0x65/0xca [693354.105875] Allocated by task 1453337: [693354.106001]     kasan_kmalloc+0xa0/0xd0 [693354.106006] kmem_cache_alloc_node_trace+0x108/0x220 [693354.106010]     bfq_pd_alloc+0x96/0x120 [693354.106015] blkcg_activate_policy+0x1b7/0x2b0 [693354.106020]     bfq_create_group_hierarchy+0x1e/0x80 [693354.106026] bfq_init_queue+0x678/0x8c0 [693354.106031]     blk_mq_init_sched+0x1f8/0x460 [693354.106037] elevator_switch_mq+0xe1/0x240 [693354.106041]     elevator_switch+0x25/0x40 [693354.106045] elv_iosched_store+0x1a1/0x230 [693354.106049]     queue_attr_store+0x78/0xb0 [693354.106053] kernfs_fop_write+0x1ab/0x280 [693354.106056]     vfs_write+0xe7/0x230 [693354.106060] ksys_write+0xb0/0x140 [693354.106064] do_syscall_64+0x112/0x370     [693354.106069] entry_SYSCALL_64_after_hwframe+0x65/0xca [693354.106114] Freed by task 1453336:
    [693354.106225] __kasan_slab_free+0x130/0x180 [693354.106229] kfree+0x90/0x1b0 [693354.106233]     blkcg_deactivate_policy+0x12c/0x220 [693354.106238] bfq_exit_queue+0xf5/0x110 [693354.106241]     blk_mq_exit_sched+0x104/0x130 [693354.106245] __elevator_exit+0x45/0x60 [693354.106249]     elevator_switch_mq+0xd6/0x240 [693354.106253] elevator_switch+0x25/0x40 [693354.106257]     elv_iosched_store+0x1a1/0x230 [693354.106261] queue_attr_store+0x78/0xb0 [693354.106264]     kernfs_fop_write+0x1ab/0x280 [693354.106268] vfs_write+0xe7/0x230 [693354.106271] ksys_write+0xb0/0x140     [693354.106275] do_syscall_64+0x112/0x370 [693354.106280] entry_SYSCALL_64_after_hwframe+0x65/0xca     [693354.106329] The buggy address belongs to the object at ffff888be0a35580 which belongs to the cache     kmalloc-1k of size 1024 [693354.106736] The buggy address is located 228 bytes inside of 1024-byte region     [ffff888be0a35580, ffff888be0a35980) [693354.107114] The buggy address belongs to the page:
    [693354.107273] page:ffffea002f828c00 count:1 mapcount:0 mapping:ffff888107c17080 index:0x0     compound_mapcount: 0 [693354.107606] flags: 0x17ffffc0008100(slab|head) [693354.107760] raw:
    0017ffffc0008100 ffffea002fcbc808 ffffea0030bd3a08 ffff888107c17080 [693354.108020] r ---truncated---     (CVE-2021-47379)

  - A flaw was found in the Netfilter subsystem in the Linux kernel. The nfnl_osf_add_callback function did     not validate the user mode controlled opt_num field. This flaw allows a local privileged (CAP_NET_ADMIN)     attacker to trigger an out-of-bounds read, leading to a crash or information disclosure. (CVE-2023-39189)

  - In the Linux kernel, the following vulnerability has been resolved: can: bcm: add locking for bcm_op     runtime updates The CAN broadcast manager (CAN BCM) can send a sequence of CAN frames via hrtimer. The     content and also the length of the sequence can be changed resp reduced at runtime where the 'currframe'     counter is then set to zero. Although this appeared to be a safe operation the updates of 'currframe' can     be triggered from user space and hrtimer context in bcm_can_tx(). Anderson Nascimento created a proof of     concept that triggered a KASAN slab-out-of-bounds read access which can be prevented with a spin_lock_bh.
    At the rework of bcm_can_tx() the 'count' variable has been moved into the protected section as this     variable can be modified from both contexts too. (CVE-2025-38004)

  - In the Linux kernel, the following vulnerability has been resolved: smb3: fix for slab out of bounds on     mount to ksmbd With KASAN enabled, it is possible to get a slab out of bounds during mount to ksmbd due to     missing check in parse_server_interfaces() (see below): BUG: KASAN: slab-out-of-bounds in     parse_server_interfaces+0x14ee/0x1880 [cifs] Read of size 4 at addr ffff8881433dba98 by task mount/9827     CPU: 5 UID: 0 PID: 9827 Comm: mount Tainted: G OE 6.16.0-rc2-kasan #2 PREEMPT(voluntary) Tainted:
    [O]=OOT_MODULE, [E]=UNSIGNED_MODULE Hardware name: Dell Inc. Precision Tower 3620/0MWYPT, BIOS 2.13.1     06/14/2019 Call Trace: <TASK> dump_stack_lvl+0x9f/0xf0 print_report+0xd1/0x670
    __virt_addr_valid+0x22c/0x430 ? parse_server_interfaces+0x14ee/0x1880 [cifs] ?     kasan_complete_mode_report_info+0x2a/0x1f0 ? parse_server_interfaces+0x14ee/0x1880 [cifs]     kasan_report+0xd6/0x110 parse_server_interfaces+0x14ee/0x1880 [cifs]
    __asan_report_load_n_noabort+0x13/0x20 parse_server_interfaces+0x14ee/0x1880 [cifs] ?
    __pfx_parse_server_interfaces+0x10/0x10 [cifs] ? trace_hardirqs_on+0x51/0x60     SMB3_request_interfaces+0x1ad/0x3f0 [cifs] ? __pfx_SMB3_request_interfaces+0x10/0x10 [cifs] ?     SMB2_tcon+0x23c/0x15d0 [cifs] smb3_qfs_tcon+0x173/0x2b0 [cifs] ? __pfx_smb3_qfs_tcon+0x10/0x10 [cifs] ?     cifs_get_tcon+0x105d/0x2120 [cifs] ? do_raw_spin_unlock+0x5d/0x200 ? cifs_get_tcon+0x105d/0x2120 [cifs] ?
    __pfx_smb3_qfs_tcon+0x10/0x10 [cifs] cifs_mount_get_tcon+0x369/0xb90 [cifs] ? dfs_cache_find+0xe7/0x150     [cifs] dfs_mount_share+0x985/0x2970 [cifs] ? check_path.constprop.0+0x28/0x50 ? save_trace+0x54/0x370 ?
    __pfx_dfs_mount_share+0x10/0x10 [cifs] ? __lock_acquire+0xb82/0x2ba0 ? __kasan_check_write+0x18/0x20     cifs_mount+0xbc/0x9e0 [cifs] ? __pfx_cifs_mount+0x10/0x10 [cifs] ? do_raw_spin_unlock+0x5d/0x200 ?     cifs_setup_cifs_sb+0x29d/0x810 [cifs] cifs_smb3_do_mount+0x263/0x1990 [cifs] (CVE-2025-38728)

  - In the Linux kernel, the following vulnerability has been resolved: iommu: disable SVA when CONFIG_X86 is     set Patch series Fix stale IOTLB entries for kernel address space, v7. This proposes a fix for a     security vulnerability related to IOMMU Shared Virtual Addressing (SVA). In an SVA context, an IOMMU can     cache kernel page table entries. When a kernel page table page is freed and reallocated for another     purpose, the IOMMU might still hold stale, incorrect entries. This can be exploited to cause a use-after-     free or write-after-free condition, potentially leading to privilege escalation or data corruption. This     solution introduces a deferred freeing mechanism for kernel page table pages, which provides a safe window     to notify the IOMMU to invalidate its caches before the page is reused. This patch (of 8): In the IOMMU     Shared Virtual Addressing (SVA) context, the IOMMU hardware shares and walks the CPU's page tables. The     x86 architecture maps the kernel's virtual address space into the upper portion of every process's page     table. Consequently, in an SVA context, the IOMMU hardware can walk and cache kernel page table entries.
    The Linux kernel currently lacks a notification mechanism for kernel page table changes, specifically when     page table pages are freed and reused. The IOMMU driver is only notified of changes to user virtual     address mappings. This can cause the IOMMU's internal caches to retain stale entries for kernel VA. Use-     After-Free (UAF) and Write-After-Free (WAF) conditions arise when kernel page table pages are freed and     later reallocated. The IOMMU could misinterpret the new data as valid page table entries. The IOMMU might     then walk into attacker-controlled memory, leading to arbitrary physical memory DMA access or privilege     escalation. This is also a Write-After-Free issue, as the IOMMU will potentially continue to write     Accessed and Dirty bits to the freed memory while attempting to walk the stale page tables. Currently, SVA     contexts are unprivileged and cannot access kernel mappings. However, the IOMMU will still walk kernel-     only page tables all the way down to the leaf entries, where it realizes the mapping is for the kernel and     errors out. This means the IOMMU still caches these intermediate page table entries, making the described     vulnerability a real concern. Disable SVA on x86 architecture until the IOMMU can receive notification to     flush the paging cache before freeing the CPU kernel page table pages. (CVE-2025-71089)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

CentOS Linux 8.5 [TuxCare] Security Update: bpftool / kernel / kernel-core / kernel-cross-headers / etc Multiple Vulnerabilities (CENTOS8.5:CLSA-2026:1783414155)

high Nessus Plugin ID 351793

Version 1.2

Version 1.1

Version 1.2 Oct 18, 2026, 10:57 AM CVE (set "CVE" coverage to "CVE-2021-47379,CVE-2023-39189,CVE-2025-38004,CVE-2025-38728,CVE-2025-71089,CVE-2026-23397,CVE-2026-31527,CVE-2026-43037,CVE-2026-43038,CVE-2026-43088,CVE-2026-46113,CVE-2026-53359") CVSS temporal metrics ("CVSSv2 temporal vector" set to "CVSS2#E:POC/RL:OF/RC:C") CVSS temporal metrics ("CVSSv3 temporal vector" set to "CVSS:3.0/E:P/RL:O/RC:C") Detection (updated detection logic) Exploit attributes ("Exploit available" set to "True") Exploit attributes ("Exploitability ease" changed from "No known exploits are available" to "Exploits are available") Plugin Feed: 202610181057
Version 1.1 Sep 30, 2026, 9:32 PM New Plugin Feed: 202609302132