The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1783793262 advisory.

  - In the Linux kernel, the following vulnerability has been resolved: rtmutex: Use waiter::task instead of     current in remove_waiter() remove_waiter() is used by the slowlock paths, but it is also used for proxy-     lock rollback in rt_mutex_start_proxy_lock() when invoked from futex_requeue(). In the latter case     waiter::task is not current, but remove_waiter() operates on current for the dequeue operation. That     results in several problems: 1) the rbtree dequeue happens without waiter::task::pi_lock being held 2) the     waiter task's pi_blocked_on state is not cleared, which leaves a dangling pointer primed for UAF around.
    3) rt_mutex_adjust_prio_chain() operates on the wrong top priority waiter task Use waiter::task instead of     current in all related operations in remove_waiter() to cure those problems. [ tglx: Fixup     rt_mutex_adjust_prio_chain(), add a comment and amend the changelog ] (CVE-2026-43499)

  - In the Linux kernel, the following vulnerability has been resolved: eventpoll: fix ep_remove struct     eventpoll / struct file UAF ep_remove() (via ep_remove_file()) cleared file->f_ep under file->f_lock but     then kept using @file inside the critical section (is_file_epoll(), hlist_del_rcu() through the head,     spin_unlock). A concurrent __fput() taking the eventpoll_release() fastpath in that window observed the     transient NULL, skipped eventpoll_release_file() and ran to f_op->release / file_free(). For the epoll-     watches-epoll case, f_op->release is ep_eventpoll_release() -> ep_clear_and_put() -> ep_free(), which     kfree()s the watched struct eventpoll. Its embedded ->refs hlist_head is exactly where epi->fllink.pprev     points, so the subsequent hlist_del_rcu()'s *pprev = next scribbles into freed kmalloc-192 memory. In     addition, struct file is SLAB_TYPESAFE_BY_RCU, so the slot backing @file could be recycled by     alloc_empty_file() -- reinitializing f_lock and f_ep -- while ep_remove() is still nominally inside that     lock. The upshot is an attacker-controllable kmem_cache_free() against the wrong slab cache. Pin @file via     epi_fget() at the top of ep_remove() and gate the critical section on the pin succeeding. With the pin     held @file cannot reach refcount zero, which holds __fput() off and transitively keeps the watched struct     eventpoll alive across the hlist_del_rcu() and the f_lock use, closing both UAFs. If the pin fails @file     has already reached refcount zero and its __fput() is in flight. Because we bailed before clearing f_ep,     that path takes the eventpoll_release() slow path into eventpoll_release_file() and blocks on ep->mtx     until the waiter side's ep_clear_and_put() drops it. The bailed epi's share of ep->refcount stays intact,     so the trailing ep_refcount_dec_and_test() in ep_clear_and_put() cannot free the eventpoll out from under     eventpoll_release_file(); the orphaned epi is then cleaned up there. A successful pin also proves we are     not racing eventpoll_release_file() on this epi, so drop the now-redundant re-check of epi->dying under     f_lock. The cheap lockless READ_ONCE(epi->dying) fast-path bailout stays. (CVE-2026-46242)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

Rocky Linux 9.6 [TuxCare] Security Update: kernel / kernel-64k / kernel-64k-core / kernel-64k-debug / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1783793262)

high Nessus Plugin ID 359559

Version 1.3