Detections
Analytics

AlmaLinux 9.2 [TuxCare] Security Update: bpftool / kernel / kernel-64k / kernel-64k-core / kernel-64k-debug / etc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1791741836)

critical Nessus Plugin ID 364688

Synopsis

The AlmaLinux host is missing one or more security updates.

Description

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1791741836 advisory.

 - In the Linux kernel, the following vulnerability has been resolved: vhost: fix hung thread due to erroneous iotlb entries In vhost_iotlb_add_range_ctx(), range size can overflow to 0 when start is 0 and last is ULONG_MAX. One instance where it can happen is when userspace sends an IOTLB message with iova=size=uaddr=0 (vhost_process_iotlb_msg). So, an entry with size = 0, start = 0, last = ULONG_MAX ends up in the iotlb. Next time a packet is sent, iotlb_access_ok() loops indefinitely due to that erroneous entry. Call Trace: <TASK> iotlb_access_ok+0x21b/0x3e0 drivers/vhost/vhost.c:1340 vq_meta_prefetch+0xbc/0x280 drivers/vhost/vhost.c:1366 vhost_transport_do_send_pkt+0xe0/0xfd0 drivers/vhost/vsock.c:104 vhost_worker+0x23d/0x3d0 drivers/vhost/vhost.c:372 kthread+0x2e9/0x3a0 kernel/kthread.c:377 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295 </TASK> Reported by syzbot at:
 https://syzkaller.appspot.com/bug?extid=0abd373e2e50d704db87 To fix this, do two things: 1. Return -EINVAL in vhost_chr_write_iter() when userspace asks to map a range with size 0. 2. Fix vhost_iotlb_add_range_ctx() to handle the range [0, ULONG_MAX] by splitting it into two entries.
 (CVE-2022-48862)

 - In the Linux kernel, the following vulnerability has been resolved: net: hns3: add vlan list lock to protect vlan list When adding port base VLAN, vf VLAN need to remove from HW and modify the vlan state in vf VLAN list as false. If the periodicity task is freeing the same node, it may cause use after free error. This patch adds a vlan list lock to protect the vlan list. (CVE-2022-49182)

 - In the Linux kernel, the following vulnerability has been resolved: perf/x86/amd: Fix crash due to race between amd_pmu_enable_all, perf NMI and throttling amd_pmu_enable_all() does: if (!test_bit(idx, cpuc->active_mask)) continue; amd_pmu_enable_event(cpuc->events[idx]); A perf NMI of another event can come between these two steps. Perf NMI handler internally disables and enables _all_ events, including the one which nmi-intercepted amd_pmu_enable_all() was in process of enabling. If that unintentionally enabled event has very low sampling period and causes immediate successive NMI, causing the event to be throttled, cpuc->events[idx] and cpuc->active_mask gets cleared by x86_pmu_stop(). This will result in amd_pmu_enable_event() getting called with event=NULL when amd_pmu_enable_all() resumes after handling the NMIs. This causes a kernel crash: BUG: kernel NULL pointer dereference, address: 0000000000000198 #PF:
 supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page [...] Call Trace: <TASK> amd_pmu_enable_all+0x68/0xb0 ctx_resched+0xd9/0x150 event_function+0xb8/0x130 ? hrtimer_start_range_ns+0x141/0x4a0 ? perf_duration_warn+0x30/0x30 remote_function+0x4d/0x60
 __flush_smp_call_function_queue+0xc4/0x500 flush_smp_call_function_queue+0x11d/0x1b0 do_idle+0x18f/0x2d0 cpu_startup_entry+0x19/0x20 start_secondary+0x121/0x160 secondary_startup_64_no_verify+0xe5/0xeb </TASK> amd_pmu_disable_all()/amd_pmu_enable_all() calls inside perf NMI handler were recently added as part of BRS enablement but I'm not sure whether we really need them. We can just disable BRS in the beginning and enable it back while returning from NMI. This will solve the issue by not enabling those events whose active_masks are set but are not yet enabled in hw pmu. (CVE-2022-49781)

 - In the Linux kernel, the following vulnerability has been resolved: blk-iolatency: Fix memory leak on add_disk() failures When a gendisk is successfully initialized but add_disk() fails such as when a loop device has invalid number of minor device numbers specified, blkcg_init_disk() is called during init and then blkcg_exit_disk() during error handling. Unfortunately, iolatency gets initialized in the former but doesn't get cleaned up in the latter. This is because, in non-error cases, the cleanup is performed by del_gendisk() calling rq_qos_exit(), the assumption being that rq_qos policies, iolatency being one of them, can only be activated once the disk is fully registered and visible. That assumption is true for wbt and iocost, but not so for iolatency as it gets initialized before add_disk() is called. It is desirable to lazy-init rq_qos policies because they are optional features and add to hot path overhead once initialized - each IO has to walk all the registered rq_qos policies. So, we want to switch iolatency to lazy init too. However, that's a bigger change. As a fix for the immediate problem, let's just add an extra call to rq_qos_exit() in blkcg_exit_disk(). This is safe because duplicate calls to rq_qos_exit() become noop's. (CVE-2022-50550)

 - In the Linux kernel, the following vulnerability has been resolved: usb: roles: fix NULL pointer issue when put module's reference In current design, usb role class driver will get usb_role_switch parent's module reference after the user get usb_role_switch device and put the reference after the user put the usb_role_switch device. However, the parent device of usb_role_switch may be removed before the user put the usb_role_switch. If so, then, NULL pointer issue will be met when the user put the parent module's reference. This will save the module pointer in structure of usb_role_switch. Then, we don't need to find module by iterating long relations. (CVE-2024-26747)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected packages based on the guidance in TuxCare advisory ALMALINUX9.2:CLSA-2026:1791741836.

See Also

https://cve.tuxcare.com/els/releases/CLSA-2026:1791741836

http://www.nessus.org/u?a42c3ffa

Plugin Details

Severity: Critical

ID: 364688

File Name: tuxcare_alma_linux_9.2_CLSA-2026-1791741836.nasl

Version: 1.1

Type: Local

Published: 10/12/2026

Updated: 10/12/2026

Supported Sensors: Nessus Agent, Continuous Assessment, Nessus

Risk Information

VPR

Risk Factor: Critical

Score: 9.4

Percentile: 99.82

Vendor

Vendor Severity: Critical

CVSS v2

Risk Factor: Critical

Base Score: 10

Temporal Score: 8.7

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS Score Source: CVE-2025-39682

CVSS v3

Risk Factor: Critical

Base Score: 9.8

Temporal Score: 9.4

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:H/RL:O/RC:C

Vulnerability Information

Required KB Items: Host/local_checks_enabled, Host/cpu, Host/AlmaLinux/release, Host/AlmaLinux/rpm-list, Host/OS/extended-third-party

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 10/11/2026

Vulnerability Publication Date: 7/21/2021

CISA Known Exploited Vulnerability Due Dates: 4/30/2025, 9/21/2026

Reference Information

CVE: CVE-2022-3542, CVE-2022-48862, CVE-2022-49182, CVE-2022-49781, CVE-2022-50550, CVE-2024-26747, CVE-2024-26830, CVE-2024-49891, CVE-2024-49940, CVE-2024-50280, CVE-2024-53197, CVE-2024-55881, CVE-2024-56770, CVE-2025-21938, CVE-2025-21978, CVE-2025-22097, CVE-2025-22125, CVE-2025-37889, CVE-2025-38170, CVE-2025-38455, CVE-2025-38465, CVE-2025-39682, CVE-2025-39964, CVE-2025-39969, CVE-2025-39980, CVE-2025-40019, CVE-2025-40026, CVE-2025-40049, CVE-2025-40103, CVE-2025-40115, CVE-2025-40173, CVE-2025-40178, CVE-2025-40198, CVE-2025-40231, CVE-2025-40252, CVE-2025-40254, CVE-2025-68241, CVE-2025-68264, CVE-2025-68740, CVE-2025-68764, CVE-2026-100075, CVE-2026-23310, CVE-2026-23475, CVE-2026-31446, CVE-2026-31505, CVE-2026-31570, CVE-2026-31678, CVE-2026-31680, CVE-2026-43253, CVE-2026-43309, CVE-2026-43333, CVE-2026-43405, CVE-2026-43428, CVE-2026-46199, CVE-2026-46230, CVE-2026-46327, CVE-2026-52910, CVE-2026-52961, CVE-2026-52984, CVE-2026-53060, CVE-2026-53069, CVE-2026-53221, CVE-2026-53266, CVE-2026-63919, CVE-2026-63946, CVE-2026-63971, CVE-2026-64034, CVE-2026-64097, CVE-2026-64319, CVE-2026-64379, CVE-2026-64438, CVE-2026-64545, CVE-2026-68123, CVE-2026-68162, CVE-2026-68201, CVE-2026-68236, CVE-2026-68273, CVE-2026-68288, CVE-2026-68362, CVE-2026-68436, CVE-2026-68446, CVE-2026-72098, CVE-2026-72129, CVE-2026-72130, CVE-2026-72243, CVE-2026-72261, CVE-2026-74287, CVE-2026-74469, CVE-2026-74480, CVE-2026-74635, CVE-2026-74637, CVE-2026-74657, CVE-2026-74671, CVE-2026-74680, CVE-2026-74701, CVE-2026-74717, CVE-2026-74726, CVE-2026-74736, CVE-2026-74743, CVE-2026-74748, CVE-2026-80534, CVE-2026-80574, CVE-2026-80589, CVE-2026-80726, CVE-2026-80844, CVE-2026-89643, CVE-2026-89682, CVE-2026-89711, CVE-2026-89817, CVE-2026-89846, CVE-2026-90067, CVE-2026-90228, CVE-2026-90413, CVE-2026-93185, CVE-2026-93228, CVE-2026-97417, CVE-2026-97517, CVE-2026-97555, CVE-2026-97964, CVE-2026-97991, CVE-2026-98016, CVE-2026-98031, CVE-2026-98075, CVE-2026-98154, CVE-2026-98161, CVE-2026-98374

CLSA: 2026:1791741836