The CentOS Linux 8.5 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS8.5:CLSA-2026:1786436146 advisory.

  - In the Linux kernel, the following vulnerability has been resolved: bpf: Reject variable offset alu on     PTR_TO_FLOW_KEYS For PTR_TO_FLOW_KEYS, check_flow_keys_access() only uses fixed off for validation.
    However, variable offset ptr alu is not prohibited for this ptr kind. So the variable offset is not     checked. The following prog is accepted: func#0 @0 0: R1=ctx() R10=fp0 0: (bf) r6 = r1 ; R1=ctx()     R6_w=ctx() 1: (79) r7 = *(u64 *)(r6 +144) ; R6_w=ctx() R7_w=flow_keys() 2: (b7) r8 = 1024 ; R8_w=1024 3:
    (37) r8 /= 1 ; R8_w=scalar() 4: (57) r8 &= 1024 ; R8_w=scalar(smin=smin32=0,     smax=umax=smax32=umax32=1024,var_off=(0x0; 0x400)) 5: (0f) r7 += r8 mark_precise: frame0: last_idx 5     first_idx 0 subseq_idx -1 mark_precise: frame0: regs=r8 stack= before 4: (57) r8 &= 1024 mark_precise:
    frame0: regs=r8 stack= before 3: (37) r8 /= 1 mark_precise: frame0: regs=r8 stack= before 2: (b7) r8 =     1024 6: R7_w=flow_keys(smin=smin32=0,smax=umax=smax32=umax32=1024,var_off =(0x0; 0x400))     R8_w=scalar(smin=smin32=0,smax=umax=smax32=umax32=1024, var_off=(0x0; 0x400)) 6: (79) r0 = *(u64 *)(r7 +0)     ; R0_w=scalar() 7: (95) exit This prog loads flow_keys to r7, and adds the variable offset r8 to r7, and     finally causes out-of-bounds access: BUG: unable to handle page fault for address: ffffc90014c80038 [...]     Call Trace: <TASK> bpf_dispatcher_nop_func include/linux/bpf.h:1231 [inline] __bpf_prog_run     include/linux/filter.h:651 [inline] bpf_prog_run include/linux/filter.h:658 [inline]     bpf_prog_run_pin_on_cpu include/linux/filter.h:675 [inline] bpf_flow_dissect+0x15f/0x350     net/core/flow_dissector.c:991 bpf_prog_test_run_flow_dissector+0x39d/0x620 net/bpf/test_run.c:1359     bpf_prog_test_run kernel/bpf/syscall.c:4107 [inline] __sys_bpf+0xf8f/0x4560 kernel/bpf/syscall.c:5475
    __do_sys_bpf kernel/bpf/syscall.c:5561 [inline] __se_sys_bpf kernel/bpf/syscall.c:5559 [inline]
    __x64_sys_bpf+0x73/0xb0 kernel/bpf/syscall.c:5559 do_syscall_x64 arch/x86/entry/common.c:52 [inline]     do_syscall_64+0x3f/0x110 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x63/0x6b Fix this by     rejecting ptr alu with variable offset on flow_keys. Applying the patch rejects the program with R7     pointer arithmetic on flow_keys prohibited. (CVE-2024-26589)

  - In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_conntrack_h323: fix OOB     read in decode_choice() In decode_choice(), the boundary check before get_len() uses the variable `len`,     which is still 0 from its initialization at the top of the function: unsigned int type, ext, len = 0; ...
    if (ext || (son->attr & OPEN)) { BYTE_ALIGN(bs); if (nf_h323_error_boundary(bs, len, 0)) /* len is 0 here
    */ return H323_ERROR_BOUND; len = get_len(bs); /* OOB read */ When the bitstream is exactly consumed     (bs->cur == bs->end), the check nf_h323_error_boundary(bs, 0, 0) evaluates to (bs->cur + 0 > bs->end),     which is false. The subsequent get_len() call then dereferences *bs->cur++, reading 1 byte past the end of     the buffer. If that byte has bit 7 set, get_len() reads a second byte as well. This can be triggered     remotely by sending a crafted Q.931 SETUP message with a User-User Information Element containing exactly     2 bytes of PER-encoded data ({0x08, 0x00}) to port 1720 through a firewall with the nf_conntrack_h323     helper active. The decoder fully consumes the PER buffer before reaching this code path, resulting in a     1-2 byte heap-buffer-overflow read confirmed by AddressSanitizer. Fix this by checking for 2 bytes (the     maximum that get_len() may read) instead of the uninitialized `len`. This matches the pattern used at     every other get_len() call site in the same file, where the caller checks for 2 bytes of available data     before calling get_len(). (CVE-2026-43233)

  - In the Linux kernel, the following vulnerability has been resolved: Bluetooth: SMP: force responder MITM     requirements before building the pairing response smp_cmd_pairing_req() currently builds the pairing     response from the initiator auth_req before enforcing the local BT_SECURITY_HIGH requirement. If the     initiator omits SMP_AUTH_MITM, the response can also omit it even though the local side still requires     MITM. tk_request() then sees an auth value without SMP_AUTH_MITM and may select JUST_CFM, making method     selection inconsistent with the pairing policy the responder already enforces. When the local side     requires HIGH security, first verify that MITM can be achieved from the IO capabilities and then force     SMP_AUTH_MITM in the response in both rsp.auth_req and auth. This keeps the responder auth bits and later     method selection aligned. (CVE-2026-43334)

  - In the Linux kernel, the following vulnerability has been resolved: ipv6: prevent possible UaF in     addrconf_permanent_addr() The mentioned helper try to warn the user about an exceptional condition, but     the message is delivered too late, accessing the ipv6 after its possible deletion. Reorder the statement     to avoid the possible UaF; while at it, place the warning outside the idev->lock as it needs no     protection. (CVE-2026-43339)

  - In the Linux kernel, the following vulnerability has been resolved: vsock: fix buffer size clamping order     In vsock_update_buffer_size(), the buffer size was being clamped to the maximum first, and then to the     minimum. If a user sets a minimum buffer size larger than the maximum, the minimum check overrides the     maximum check, inverting the constraint. This breaks the intended socket memory boundaries by allowing the     vsk->buffer_size to grow beyond the configured vsk->buffer_max_size. Fix this by checking the minimum     first, and then the maximum. This ensures the buffer size never exceeds the buffer_max_size.
    (CVE-2026-46234)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

CentOS Linux 8.5 [TuxCare] Security Update: bpftool / kernel / kernel-core / kernel-cross-headers / etc Multiple Vulnerabilities (CENTOS8.5:CLSA-2026:1786436146)

high Nessus Plugin ID 361319

Version 1.2

Version 1.1

Version 1.2 Oct 18, 2026, 10:57 AM CVE (set "CVE" coverage to "CVE-2024-26589,CVE-2026-43233,CVE-2026-43334,CVE-2026-43339,CVE-2026-46234,CVE-2026-53112,CVE-2026-63807,CVE-2026-64561") Detection (updated detection logic) Plugin Feed: 202610181057
Version 1.1 Oct 1, 2026, 9:59 PM New Plugin Feed: 202610012159