The CentOS Linux 8.5 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS8.5:CLSA-2026:1778756179 advisory.

  - In the Linux kernel, the following vulnerability has been resolved: nfsd: fix use-after-free due to     delegation race A delegation break could arrive as soon as we've called vfs_setlease. A delegation break     runs a callback which immediately (in nfsd4_cb_recall_prepare) adds the delegation to del_recall_lru. If     we then exit nfs4_set_delegation without hashing the delegation, it will be freed as soon as the callback     is done with it, without ever being removed from del_recall_lru. Symptoms show up later as use-after-free     or list corruption warnings, usually in the laundromat thread. I suspect aba2072f4523 nfsd: grant read     delegations to clients holding writes made this bug easier to hit, but I looked as far back as v3.0 and     it looks to me it already had the same problem. So I'm not sure where the bug was introduced; it may have     been there from the beginning. (CVE-2021-47506)

  - In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btusb: revert use of     devm_kzalloc in btusb This reverts commit 98921dbd00c4e (Bluetooth: Use devm_kzalloc in btusb.c file).
    In btusb_probe(), we use devm_kzalloc() to allocate the btusb data. This ties the lifetime of all the     btusb data to the binding of a driver to one interface, INTF. In a driver that binds to other interfaces,     ISOC and DIAG, this is an accident waiting to happen. The issue is revealed in btusb_disconnect(), where     calling usb_driver_release_interface(&btusb_driver, data->intf) will have devm free the data that is also     being used by the other interfaces of the driver that may not be released yet. To fix this, revert the use     of devm and go back to freeing memory explicitly. (CVE-2025-71082)

  - In the Linux kernel, the following vulnerability has been resolved: net: skbuff: preserve shared-frag     marker during coalescing skb_try_coalesce() can attach paged frags from @from to @to. If @from has     SKBFL_SHARED_FRAG set, the resulting @to skb can contain the same externally-owned or page-cache-backed     frags, but the shared-frag marker is currently lost. That breaks the invariant relied on by later in-place     writers. In particular, ESP input checks skb_has_shared_frag() before deciding whether an uncloned     nonlinear skb can skip skb_cow_data(). If TCP receive coalescing has moved shared frags into an unmarked     skb, ESP can see skb_has_shared_frag() as false and decrypt in place over page-cache backed frags.
    Propagate SKBFL_SHARED_FRAG when skb_try_coalesce() transfers paged frags. The tailroom copy path does not     need the marker because it copies bytes into @to's linear data rather than transferring frag descriptors.
    (CVE-2026-46300)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

CentOS Linux 8.5 [TuxCare] Security Update: bpftool / kernel / kernel-core / kernel-cross-headers / etc Multiple Vulnerabilities (CENTOS8.5:CLSA-2026:1778756179)

high Nessus Plugin ID 359960

Version 1.3

Version 1.2

Version 1.1

Version 1.3 Oct 18, 2026, 10:57 AM Detection (updated detection logic) Plugin Feed: 202610181057
Version 1.2 Oct 2, 2026, 8:05 AM Exploit attributes ("Exploit framework core" set to "True") Exploit attributes ("Exploit framework metasploit" set to "True") Exploit attributes ("Exploited by malware" set to "True") Plugin Feed: 202610020805
Version 1.1 Oct 1, 2026, 9:59 PM New Plugin Feed: 202610012159