The CentOS Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS6:CLSA-2026:1783789658 advisory.

  - In the Linux kernel through 4.19.6, a local user could exploit a use-after-free in the ALSA driver by     supplying a malicious USB Sound device (with zero interfaces) that is mishandled in usb_audio_probe in     sound/usb/card.c. (CVE-2018-19824)

  - An issue was discovered in net/wireless/nl80211.c in the Linux kernel through 5.2.17. It does not check     the length of variable elements in a beacon head, leading to a buffer overflow. (CVE-2019-16746)

  - In the Linux kernel through 5.3.2, cfg80211_mgd_wext_giwessid in net/wireless/wext-sme.c does not reject a     long SSID IE, leading to a Buffer Overflow. (CVE-2019-17133)

  - The Broadcom brcmfmac WiFi driver prior to commit a4176ec356c73a46c07c181c6d04039fafa34a9f is vulnerable     to a frame validation bypass. If the brcmfmac driver receives a firmware event frame from a remote source,     the is_wlc_event_frame function will cause this frame to be discarded and unprocessed. If the driver     receives the firmware event frame from the host, the appropriate handler is called. This frame validation     can be bypassed if the bus used is USB (for instance by a wifi dongle). This can allow firmware event     frames from a remote source to be processed. In the worst case scenario, by sending specially-crafted WiFi     packets, a remote, unauthenticated attacker may be able to execute arbitrary code on a vulnerable system.
    More typically, this vulnerability will result in denial-of-service conditions. (CVE-2019-9503)

  - In the Linux kernel, the following vulnerability has been resolved: media: dvb-net: fix OOB access in ULE     extension header tables The ule_mandatory_ext_handlers[] and ule_optional_ext_handlers[] tables in     handle_one_ule_extension() are declared with 255 elements (valid indices 0-254), but the index htype is     derived from network-controlled data as (ule_sndu_type & 0x00FF), giving a range of 0-255. When htype     equals 255, an out-of-bounds read occurs on the function pointer table, and the OOB value may be called as     a function pointer. Add a bounds check on htype against the array size before either table is accessed.
    Out-of-range values now cause the SNDU to be discarded. (CVE-2026-31405)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

CentOS Linux 6 [TuxCare] Security Update: kernel / kernel-abi-whitelists / kernel-debug / kernel-debug-devel / etc Multiple Vulnerabilities (CENTOS6:CLSA-2026:1783789658)

critical Nessus Plugin ID 360374

Version 1.3