Detections
Analytics

Rocky Linux 9.6 [TuxCare] Security Update: kernel / kernel-abi-stablelists / kernel-core / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1777633439)

high Nessus Plugin ID 360870

Synopsis

The Rocky Linux host is missing one or more security updates.

Description

The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1777633439 advisory.

 - In the Linux kernel, the following vulnerability has been resolved: capabilities: fix undefined behavior in bit shift for CAP_TO_MASK Shifting signed 32-bit value by 31 bits is undefined, so changing significant bit to unsigned. The UBSAN warning calltrace like below: UBSAN: shift-out-of-bounds in security/commoncap.c:1252:2 left shift of 1 by 31 places cannot be represented in type 'int' Call Trace:
 <TASK> dump_stack_lvl+0x7d/0xa5 dump_stack+0x15/0x1b ubsan_epilogue+0xe/0x4e
 __ubsan_handle_shift_out_of_bounds+0x1e7/0x20c cap_task_prctl+0x561/0x6f0 security_task_prctl+0x5a/0xb0
 __x64_sys_prctl+0x61/0x8f0 do_syscall_64+0x58/0x80 entry_SYSCALL_64_after_hwframe+0x63/0xcd </TASK> (CVE-2022-49870)

 - In the Linux kernel, the following vulnerability has been resolved: intel_th: Fix a resource leak in an error handling path If an error occurs after calling 'pci_alloc_irq_vectors()', 'pci_free_irq_vectors()' must be called as already done in the remove function. (CVE-2022-50143)

 - In the Linux kernel, the following vulnerability has been resolved: xsk: Fix xsk_diag use-after-free error during socket cleanup Fix a use-after-free error that is possible if the xsk_diag interface is used after the socket has been unbound from the device. This can happen either due to the socket being closed or the device disappearing. In the early days of AF_XDP, the way we tested that a socket was not bound to a device was to simply check if the netdevice pointer in the xsk socket structure was NULL. Later, a better system was introduced by having an explicit state variable in the xsk socket struct. For example, the state of a socket that is on the way to being closed and has been unbound from the device is XSK_UNBOUND.
 The commit in the Fixes tag below deleted the old way of signalling that a socket is unbound, setting dev to NULL. This in the belief that all code using the old way had been exterminated. That was unfortunately not true as the xsk diagnostics code was still using the old way and thus does not work as intended when a socket is going down. Fix this by introducing a test against the state variable. If the socket is in the state XSK_UNBOUND, simply abort the diagnostic's netlink operation. (CVE-2023-53426)

 - In the Linux kernel, the following vulnerability has been resolved: VMCI: Fix use-after-free when removing resource in vmci_resource_remove() When removing a resource from vmci_resource_table in vmci_resource_remove(), the search is performed using the resource handle by comparing context and resource fields. It is possible though to create two resources with different types but same handle (same context and resource fields). When trying to remove one of the resources, vmci_resource_remove() may not remove the intended one, but the object will still be freed as in the case of the datagram type in vmci_datagram_destroy_handle(). vmci_resource_table will still hold a pointer to this freed resource leading to a use-after-free vulnerability. BUG: KASAN: use-after-free in vmci_handle_is_equal include/linux/vmw_vmci_defs.h:142 [inline] BUG: KASAN: use-after-free in vmci_resource_remove+0x3a1/0x410 drivers/misc/vmw_vmci/vmci_resource.c:147 Read of size 4 at addr ffff88801c16d800 by task syz- executor197/1592 Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x82/0xa9 lib/dump_stack.c:106 print_address_description.constprop.0+0x21/0x366 mm/kasan/report.c:239
 __kasan_report.cold+0x7f/0x132 mm/kasan/report.c:425 kasan_report+0x38/0x51 mm/kasan/report.c:442 vmci_handle_is_equal include/linux/vmw_vmci_defs.h:142 [inline] vmci_resource_remove+0x3a1/0x410 drivers/misc/vmw_vmci/vmci_resource.c:147 vmci_qp_broker_detach+0x89a/0x11b9 drivers/misc/vmw_vmci/vmci_queue_pair.c:2182 ctx_free_ctx+0x473/0xbe1 drivers/misc/vmw_vmci/vmci_context.c:444 kref_put include/linux/kref.h:65 [inline] vmci_ctx_put drivers/misc/vmw_vmci/vmci_context.c:497 [inline] vmci_ctx_destroy+0x170/0x1d6 drivers/misc/vmw_vmci/vmci_context.c:195 vmci_host_close+0x125/0x1ac drivers/misc/vmw_vmci/vmci_host.c:143
 __fput+0x261/0xa34 fs/file_table.c:282 task_work_run+0xf0/0x194 kernel/task_work.c:164 tracehook_notify_resume include/linux/tracehook.h:189 [inline] exit_to_user_mode_loop+0x184/0x189 kernel/entry/common.c:187 exit_to_user_mode_prepare+0x11b/0x123 kernel/entry/common.c:220
 __syscall_exit_to_user_mode_work kernel/entry/common.c:302 [inline] syscall_exit_to_user_mode+0x18/0x42 kernel/entry/common.c:313 do_syscall_64+0x41/0x85 arch/x86/entry/common.c:86 entry_SYSCALL_64_after_hwframe+0x6e/0x0 This change ensures the type is also checked when removing the resource from vmci_resource_table in vmci_resource_remove(). (CVE-2024-46738)

 - In the Linux kernel, the following vulnerability has been resolved: tracing: Consider the NULL character when validating the event length strlen() returns a string length excluding the null byte. If the string length equals to the maximum buffer length, the buffer will have no space for the NULL terminating character. This commit checks this condition and returns failure for it. (CVE-2024-50131)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected packages based on the guidance in TuxCare advisory ALMALINUX9.6:CLSA-2026:1777633439.

See Also

https://cve.tuxcare.com/els/releases/CLSA-2026:1777633439

http://www.nessus.org/u?eec5aa05

Plugin Details

Severity: High

ID: 360870

File Name: tuxcare_rocky_linux_9.6_CLSA-2026-1777633439.nasl

Version: 1.1

Type: Local

Published: 10/1/2026

Updated: 10/1/2026

Supported Sensors: Nessus Agent, Continuous Assessment, Nessus

Risk Information

VPR

Risk Factor: Critical

Score: 9.5

Percentile: 99.87

Vendor

Vendor Severity: Important

CVSS v2

Risk Factor: Medium

Base Score: 6.8

Temporal Score: 5.9

Vector: CVSS2#AV:L/AC:L/Au:S/C:C/I:C/A:C

CVSS Score Source: CVE-2026-23231

CVSS v3

Risk Factor: High

Base Score: 7.8

Temporal Score: 7.5

Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:H/RL:O/RC:C

CVSS v4

Risk Factor: High

Base Score: 8.6

Threat Score: 8.6

Threat Vector: CVSS:4.0/E:A

Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

CVSS Score Source: CVE-2026-31431

Vulnerability Information

Required KB Items: Host/local_checks_enabled, Host/cpu, Host/RockyLinux/release, Host/RockyLinux/rpm-list, Host/OS/extended-third-party

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 5/1/2026

Vulnerability Publication Date: 7/21/2021

CISA Known Exploited Vulnerability Due Dates: 5/15/2026

Reference Information

CVE: CVE-2022-49870, CVE-2022-49900, CVE-2022-50143, CVE-2022-50422, CVE-2023-53426, CVE-2023-54119, CVE-2024-40994, CVE-2024-46738, CVE-2024-50131, CVE-2025-37940, CVE-2025-37949, CVE-2025-37959, CVE-2025-37967, CVE-2025-37985, CVE-2025-37990, CVE-2025-37995, CVE-2025-37997, CVE-2025-37998, CVE-2025-38009, CVE-2025-38023, CVE-2025-38035, CVE-2025-38037, CVE-2025-38040, CVE-2025-38043, CVE-2025-38044, CVE-2025-38058, CVE-2025-38061, CVE-2025-38063, CVE-2025-38066, CVE-2025-38071, CVE-2025-38072, CVE-2025-38083, CVE-2025-38095, CVE-2025-38100, CVE-2025-38112, CVE-2025-38115, CVE-2025-38122, CVE-2025-38125, CVE-2025-38148, CVE-2025-38166, CVE-2025-38174, CVE-2025-38181, CVE-2025-38184, CVE-2025-38190, CVE-2025-38214, CVE-2025-38215, CVE-2025-38222, CVE-2025-38231, CVE-2025-38251, CVE-2025-38285, CVE-2025-38293, CVE-2025-38310, CVE-2025-38312, CVE-2025-38319, CVE-2025-38324, CVE-2025-38334, CVE-2025-38337, CVE-2025-38344, CVE-2025-38345, CVE-2025-38363, CVE-2025-38386, CVE-2025-38387, CVE-2025-38514, CVE-2025-38515, CVE-2025-38528, CVE-2025-38540, CVE-2025-38553, CVE-2025-38563, CVE-2025-38581, CVE-2025-38601, CVE-2025-38602, CVE-2025-38608, CVE-2025-38609, CVE-2025-38617, CVE-2025-38622, CVE-2025-38644, CVE-2025-38668, CVE-2025-38671, CVE-2025-38695, CVE-2025-38700, CVE-2025-38701, CVE-2025-38706, CVE-2025-38721, CVE-2025-38730, CVE-2025-39675, CVE-2025-39676, CVE-2025-39703, CVE-2025-39706, CVE-2025-39713, CVE-2025-39736, CVE-2025-39737, CVE-2025-39742, CVE-2025-39756, CVE-2025-39773, CVE-2025-39782, CVE-2025-39795, CVE-2025-39798, CVE-2025-39808, CVE-2025-39812, CVE-2025-39813, CVE-2025-39835, CVE-2025-39844, CVE-2025-39845, CVE-2025-39847, CVE-2025-39876, CVE-2025-39929, CVE-2025-39932, CVE-2025-39937, CVE-2025-39953, CVE-2025-40096, CVE-2025-40322, CVE-2025-68223, CVE-2025-68340, CVE-2025-68725, CVE-2025-68741, CVE-2025-68800, CVE-2025-71089, CVE-2025-71091, CVE-2025-71112, CVE-2025-71147, CVE-2025-71154, CVE-2026-22977, CVE-2026-22980, CVE-2026-22984, CVE-2026-22990, CVE-2026-22991, CVE-2026-22992, CVE-2026-23001, CVE-2026-23060, CVE-2026-23061, CVE-2026-23084, CVE-2026-23089, CVE-2026-23097, CVE-2026-23111, CVE-2026-23133, CVE-2026-23144, CVE-2026-23191, CVE-2026-23193, CVE-2026-23204, CVE-2026-23216, CVE-2026-23231, CVE-2026-31431

CLSA: 2026:1777633439