Detections
Analytics

Oracle Linux 8 / 9 : Unbreakable Enterprise kernel (ELSA-2026-500398)

critical Nessus Plugin ID 366663

Synopsis

The remote Oracle Linux host is missing one or more security updates.

Description

The remote Oracle Linux 8 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-500398 advisory.

 - ipv4: free inet_opt and ireq_opt after an RCU grace period (Eric Dumazet) [Orabug: 40167661] {CVE-2026-98432}
 - ipv4: validate checksum_start before completing checksum (Michael S. Tsirkin) [Orabug: 40167656] {CVE-2026-99999}
 - exec: Cleanup POSIX timers right after de_thread() (Hyunwoo Kim) [Orabug: 40157515] {CVE-2026-98260}
 - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Christian Brauner) [Orabug: 39784995] {CVE-2026-46242}
 - landlock: Require LANDLOCK_ACCESS_FS_MAKE_REG for whiteout creation (Gunther Noack) [Orabug: 40021203] {CVE-2026-89560}
 - ppp_synctty: ensure a writeable skb header (Qingfang Deng) [Orabug: 40079220] {CVE-2026-97964}
 - netfilter: nfnetlink_log: cope with concurrent instance destruction (Florian Westphal) [Orabug:
 40079360] {CVE-2026-97998}
 - vxlan: reject dynamic fdb entries that reference a nexthop id (Seungwon Bae) [Orabug: 40079448] {CVE-2026-98023}
 - ipvs: fix reversed sequence option serialization (Kyle Zeng) [Orabug: 40079626] {CVE-2026-98078}
 - ipv6: sr: restore network header before routing and forwarding (Eric Dumazet) [Orabug: 40079700] {CVE-2026-98096}
 - hsr: broadcast netlink notifications in the device's net namespace (Maoyi Xie) [Orabug: 40073495] {CVE-2026-97419}
 - fs/ntfs3: validate index entry key bounds (ZhengYuan Huang) [Orabug: 40073603] {CVE-2026-97438}
 - KVM: x86/mmu: WARN and clear role.invalid when creating a child shadow page (Sean Christopherson) [Orabug: 40127747] {CVE-2026-80726}
 - nvmet-rdma: fix queue leak when connect backlog is exceeded (Xixin Liu) [Orabug: 40109663] {CVE-2026-98152}
 - nvme: target: rdma: fix ndev refcount leak on queue connect (Xu Wang) [Orabug: 40109645] {CVE-2026-64321}
 - net/sched: sch_htb: limit htb_classify inner-class filter hops (Jamal Hadi Salim) [Orabug: 40041294] {CVE-2026-90053}
 - tcp: fix corruption of urgent data on multi-segment retransmit (Jiayuan Chen) [Orabug: 40041302] {CVE-2026-90054}
 - usb: atm: usbatm: fix invalid ci_range initialization (Deepanshu Kartikey) [Orabug: 40041309] {CVE-2026-90055}
 - net/sched: bound qdisc_pkt_len to prevent qdisc soft lockup (Jamal Hadi Salim) [Orabug: 40041332] {CVE-2026-90058}
 - netfilter: nf_tables: move hardware offload step after building the chain blob (Pablo Neira Ayuso) [Orabug: 40041352] {CVE-2026-90062}
 - libceph: validate banner payload length (Aleksandr Nogikh) [Orabug: 40041367] {CVE-2026-90067}
 - ASoC: dapm: Fix off-by-one check on the second enum channel (Hyeongjun An) [Orabug: 40041370] {CVE-2026-90068}
 - tpm: st33zp24: Return zero on status read failure (Ruoyu Wang) [Orabug: 40041376] {CVE-2026-90070}
 - net/sched: sch_teql: restore skb->dev on the slave failure path (Victor Nogueira) [Orabug: 40043380] {CVE-2026-90071}
 - net/sched: sfq: clamp quantum to avoid signed overflow soft lockup (Jamal Hadi Salim) [Orabug: 40041382] {CVE-2026-90072}
 - net/sched: hhf: clamp quantum before hhf_change() to avoid overflow (Jamal Hadi Salim) [Orabug:
 40041386] {CVE-2026-90073}
 - net/sched: fq_codel: clamp default quantum and mtu (Jamal Hadi Salim) [Orabug: 40041393] {CVE-2026-90075}
 - net/sched: act_skbmod: fix length calculations and avoid invalid header warnings (Eric Dumazet) [Orabug:
 40041404] {CVE-2026-90078}
 - gtp: add synchronize_net() in gtp_newlink() error path to prevent use-after-free (Cen Zhang) [Orabug:
 40033100] {CVE-2026-89789}
 - Bluetooth: RFCOMM: Validate MTU in rfcomm_apply_pn() to prevent infinite loop (Hyunwoo Kim) [Orabug:
 40041441] {CVE-2026-90088}
 - NFSv4/pnfs: key the data server cache on the NFS version (Junrui Luo) [Orabug: 40041480] {CVE-2026-90102}
 - NFSv4.2: fix LAYOUTSTATS send buffer exhaustion (Junrui Luo) [Orabug: 40041487] {CVE-2026-90103}
 - net: bridge: Reject descending VLAN tunnel ranges (Ruoyu Wang) [Orabug: 40041549] {CVE-2026-90114}
 - rtc: pcf8563: fix clock provider leak on unbind (Yi Ding) [Orabug: 40041589] {CVE-2026-90126}
 - vdpa/mlx5: fix wrong list iterated in add_direct_chain error path (Li Rongqing) [Orabug: 40041595] {CVE-2026-90128}
 - cuse: wait for pending RCU callbacks on module exit (Baokun Li) [Orabug: 40041629] {CVE-2026-90140}
 - ipvs: fix integer overflow in ftp helper port/address parsing (Joas Antonio Dos Santos) [Orabug:
 40041632] {CVE-2026-90141}
 - NFSv4: remove callback IDR entry on client allocation failure (Ruoyu Wang) [Orabug: 40041663] {CVE-2026-90151}
 - bpf: Reject negative optlen in cgroup getsockopt hook (Junseo Lim) [Orabug: 40041688] {CVE-2026-90157}
 - lwt_bpf: Restore reserved headroom after xmit program (Junseo Lim) [Orabug: 40041697] {CVE-2026-90160}
 - ALSA: core: Fix use-after-free in snd_card_do_free() (Aleksandr Nogikh) [Orabug: 40041815] {CVE-2026-90198}
 - scsi: mpt3sas: Avoid freeing unallocated PCIe SGL buffers (Chandrakanth Patil) [Orabug: 40041829] {CVE-2026-90202}
 - Squashfs: check block offset is not negative (Phillip Lougher) [Orabug: 40041835] {CVE-2026-90203}
 - ocfs2: fix circular locking dependency in ocfs2_init_acl() (Krystian Kaniewski) [Orabug: 40072807] {CVE-2026-93252}
 - ubi: Fix rollback for explicit UBI device numbers (Yuho Choi) [Orabug: 40041884] {CVE-2026-90216}
 - RDMA/cma: Fix WARNING in res_to_rt (Zhu Yanjun) [Orabug: 40041894] {CVE-2026-90218}
 - RDMA/cxgb4: Free debugfs on registration failure (Fan Wu) [Orabug: 40041898] {CVE-2026-90219}
 - nvmet: fix NULL pointer dereference in nvmet_execute_identify_ns_zns() (Guixin Liu) [Orabug: 40041940] {CVE-2026-90228}
 - SUNRPC: check rpc_sockaddr2uaddr() return value in rpcb_register_inet4/6 (Weiming Shi) [Orabug:
 40033069] {CVE-2026-89784}
 - net/sched: cls_api: fix teardown of an adopted proto on insert-race loss (Victor Nogueira) [Orabug:
 40042005] {CVE-2026-90248}
 - coresight: etm4x: fix underflow for usage of (nrseqstate - 1) (Levi Yun) [Orabug: 40042071] {CVE-2026-90274}
 - hugetlbfs: release subpool on fill_super failure (Chenyichong) [Orabug: 40042091] {CVE-2026-90283}
 - firmware_loader: do not queue completed sysfs fallback requests (Mukesh Ojha) [Orabug: 40042095] {CVE-2026-90284}
 - scsi: qla2xxx: Remove redundant VPD flash read in sysfs read path (Manish Rangankar) [Orabug: 40042099] {CVE-2026-90285}
 - arm64: hibernate: Restore DAIF state on error (Vladimir Murzin) [Orabug: 40042117] {CVE-2026-90290}
 - arm64: hibernate: mask DAIF before restoring hibernated kernel (Ada Couprie Diaz) [Orabug: 40072826] {CVE-2026-93256}
 - IB/isert: post the full-feature receive buffers after session registration (Yehyeong Lee) [Orabug:
 40042126] {CVE-2026-90293}
 - IB/isert: delay the final Login Response until the session is registered (Yehyeong Lee) [Orabug:
 40042130] {CVE-2026-90294}
 - ocfs2: synchronize heartbeat callbacks with o2net teardown (Cen Zhang) [Orabug: 40042163] {CVE-2026-90302}
 - RDMA/srp: fix heap information leak on a truncated SRP_CRED_REQ (Yehyeong Lee) [Orabug: 40042182] {CVE-2026-90307}
 - remoteproc: fix OOB read via signed offset in rsc_table_for_each_entry() (Mukesh Ojha) [Orabug:
 40042202] {CVE-2026-90314}
 - drm/omap: dsi: Do not copy isr table (Andreas Kemnade) [Orabug: 40042212] {CVE-2026-90316}
 - fat: release buffer head after rebuilding parent (Chenyichong) [Orabug: 40042220] {CVE-2026-90318}
 - phonet: pep: do not write beyond optlen in getsockopt (Breno Leitao) [Orabug: 40042250] {CVE-2026-90327}
 - HID: synchronize input before cleaning up a failed probe (Yousef Alhouseen) [Orabug: 40042260] {CVE-2026-90329}
 - tty: clear cdev pointer after cdev_add() failure (Karl Mehltretter) [Orabug: 40042274] {CVE-2026-90334}
 - regulator: core: use system_freezable_wq for init complete work (Joy Zou) [Orabug: 40042349] {CVE-2026-90360}
 - wifi: ath11k: fix leak in ath11k_service_ready_ext_event() (Jeff Johnson) [Orabug: 40042353] {CVE-2026-90361}
 - drm/msm/dsi: Drop dev_pm_opp_set_rate(0) (Konrad Dybcio) [Orabug: 40042356] {CVE-2026-90362}
 - wifi: mt76: mt7915: avoid nss underflow in mt7915_mcu_get_sta_nss (Felix Fietkau) [Orabug: 40042387] {CVE-2026-90372}
 - wifi: mt76: mt76x02: do not WARN on invalid rx descriptor length (Lucid Duck) [Orabug: 40042410] {CVE-2026-90382}
 - iommu/dma: Check atomic pool allocation result directly (Aneesh Kumar K V) [Orabug: 40042431] {CVE-2026-90388}
 - bpf: Fix potential UAF in bpf_netns_link_update_prog (Pu Lehui) [Orabug: 40042447] {CVE-2026-90393}
 - power: supply: isp1704_charger: cancel work on remove (Hongyan Xu) [Orabug: 40042457] {CVE-2026-90395}
 - md/raid5-ppl: fix use-after-free in ppl_do_flush() (Sajal Gupta) [Orabug: 40072849] {CVE-2026-93262}
 - wifi: rtlwifi: pci: fix error path in rtl_pci_probe() (Abdun Nihaal) [Orabug: 40042478] {CVE-2026-90403}
 - nvme-fc: unmap cmd_iu DMA on rsp_iu mapping failure in init_request (Guixin Liu) [Orabug: 40042499] {CVE-2026-90411}
 - IB/isert: reject login PDUs declaring more data than was received (Yehyeong Lee) [Orabug: 40042504] {CVE-2026-90413}
 - IB/isert: reject PDUs declaring more data than was received (Yehyeong Lee) [Orabug: 40042508] {CVE-2026-90414}
 - RDMA/cxgb4: free STAG index when TPT entry write fails (Leon Romanovsky) [Orabug: 40042512] {CVE-2026-90415}
 - RDMA/mlx5: Fix stack out-of-bounds read in cc_params debugfs (Leon Romanovsky) [Orabug: 40042520] {CVE-2026-90416}
 - RDMA/efa: Fix PBL chunk length computation (Yonatan Nachum) [Orabug: 40072858] {CVE-2026-93264}
 - remoteproc: Prevent crash handling to race with rproc_del() (Bjorn Andersson) [Orabug: 40042566] {CVE-2026-90431}
 - isofs: release zisofs block pointer buffer head (Chenyichong) [Orabug: 40042576] {CVE-2026-90434}
 - RDMA/mlx5: Fix integer overflow of user QP buffer size (Maher Sanalla) [Orabug: 40042580] {CVE-2026-90435}
 - netfilter: nf_nat_sip: rewind offset when NAT shrinks the packet (Florian Westphal) [Orabug: 40079958] {CVE-2026-100070}
 - ext4: check dir entry fits before reading the hash trailer in ext4_search_dir() (Xiang Mei) [Orabug:
 40033090] {CVE-2026-89787}
 - ext4: fix buffer_head leak in ext4_init_orphan_info (Guanghui Yang) [Orabug: 40042631] {CVE-2026-92494}
 - wifi: ath11k: Avoid buffer overread in ath11k_wmi_tlv_op_rx() (Jeff Johnson) [Orabug: 40042636] {CVE-2026-92496}
 - wifi: ath6kl: avoid buffer overreads in WMI event handlers (Jeff Johnson) [Orabug: 40042641] {CVE-2026-92498}
 - ext4: drain in-flight DIO before buffered write fallback (Baokun Li) [Orabug: 40042653] {CVE-2026-92501}
 - thermal: intel: int3400: clean up ODVP on probe failures (Pengpeng Hou) [Orabug: 40042661] {CVE-2026-92504}
 - RDMA/core: Fix potential use after free in ib_free_cq() (Patrisious Haddad) [Orabug: 40042671] {CVE-2026-92508}
 - ext4: skip extra isize expansion during mount to prevent deadlock (Yun Zhou) [Orabug: 40072874] {CVE-2026-93268}
 - ext4: fix out-of-bounds read in ext4_read_inline_dir() (Xiang Mei) [Orabug: 40033084] {CVE-2026-89786}
 - ACPI: PCI: Clear driver_data on all paths that free the acpi_pci_root (Chen Pei) [Orabug: 40042714] {CVE-2026-92521}
 - ACPI: processor: validate MADT IOAPIC entry bounds (Pengpeng Hou) [Orabug: 40042719] {CVE-2026-92522}
 - irqchip/gic-v3-its: Prevent leak in its_vpe_irq_domain_alloc() (Kemeng Shi) [Orabug: 40042729] {CVE-2026-92524}
 - RDMA/srpt: Fix srpt_alloc_rw_ctxs() unwind counters (Zheng Tan) [Orabug: 40079981] {CVE-2026-100075}
 - RDMA/hfi1: Propagate sdma_txinit_ahg() errors (Danila Chernetsov) [Orabug: 40042739] {CVE-2026-93037}
 - ASoC: meson: Keep link pointers valid on realloc failure (Linmao Li) [Orabug: 40042746] {CVE-2026-93039}
 - software node: Fix software_node_get_reference_args() with index -1 (Alban Bedel) [Orabug: 40042772] {CVE-2026-93046}
 - mtd: part: reject MTDPART_OFS_RETAIN in mtd_add_partition() (Zhouminqiang) [Orabug: 40042782] {CVE-2026-93048}
 - mtd: mtdswap: Avoid freeing registered blktrans device twice (Ruoyu Wang) [Orabug: 40042803] {CVE-2026-93049}
 - vfio/pci: clear vdev->msi_perm after freeing it on init failure (Xiang Mei) [Orabug: 40033020] {CVE-2026-89777}
 - misc: ad525x_dpot: use driver core groups for sysfs files (Pengpeng Hou) [Orabug: 40042818] {CVE-2026-93051}
 - uio: Fix stale info pointer in failed registration path (Yuho Choi) [Orabug: 40042833] {CVE-2026-93054}
 - UDF symlink pathComponent header OOB read (David Lee) [Orabug: 40042841] {CVE-2026-93055}
 - usb: gadget: f_uac1_legacy: remove broken string configfs attributes (Xu Yang) [Orabug: 40042849] {CVE-2026-93056}
 - gpu: host1x: Avoid stack over-read in debug output helpers (Mikko Perttunen) [Orabug: 40042866] {CVE-2026-93061}
 - drm/bridge: tc358767: clamp the reported AUX read size to the request (Maoyi Xie) [Orabug: 40042884] {CVE-2026-93067}
 - wifi: ath11k: cap out-of-range rx MCS instead of leaving bogus rate (Baochen Qiang) [Orabug: 40072894] {CVE-2026-93271}
 - rpmsg: glink: fix deadlock in endpoint destroy during driver detach (Vishnu Santhosh) [Orabug: 40043409] {CVE-2026-93098}
 - isofs: fix out-of-bounds page array access on empty zisofs block (Xiang Mei) [Orabug: 40033029] {CVE-2026-89778}
 - RDMA/hfi1: Free RX data on late probe failure (Leon Romanovsky) [Orabug: 40042983] {CVE-2026-93102}
 - RDMA/hfi1: Preserve unit 0 on allocation failure (Leon Romanovsky) [Orabug: 40042988] {CVE-2026-93103}
 - xfrm6: fix out-of-bounds write in xfrm6_input_addr() when secpath is full (Xiang Mei) [Orabug: 40033063] {CVE-2026-89783}
 - RDMA/ipoib: Drain RCU callbacks during module teardown (Leon Romanovsky) [Orabug: 40043009] {CVE-2026-93108}
 - RDMA/mlx5: Drain RCU callbacks during module teardown (Leon Romanovsky) [Orabug: 40043015] {CVE-2026-93109}
 - RDMA/core: Wait for RCU callbacks before unloading ib_core (Leon Romanovsky) [Orabug: 40043022] {CVE-2026-93110}
 - usb: gadget: configfs: fix out-of-bounds read of qw_sign (Michael Bommarito) [Orabug: 40043062] {CVE-2026-93120}
 - platform/x86: dell-wmi-base: Fix resource leak on module load failure (Armin Wolf) [Orabug: 40043089] {CVE-2026-93130}
 - bpf: Fix vmlinux BTF prep race in bpf_get_btf_vmlinux (Daniel Borkmann) [Orabug: 40043115] {CVE-2026-93138}
 - udf: Mark LVID buffer as uptodate before marking it dirty (Aleksandr Nogikh) [Orabug: 40043122] {CVE-2026-93140}
 - clk: qcom: gdsc: tear down per-domain genpds in gdsc_unregister() (Herman van Hazendonk) [Orabug:
 40043147] {CVE-2026-93145}
 - staging: rtl8723bs: fix mismatched free of HalData in rtw_sdio_if1_init() (Dawei Feng) [Orabug:
 40079942] {CVE-2026-98160}
 - nvmet-rdma: fix response resource leak on queue teardown (Shin'Ichiro Kawasaki) [Orabug: 40043175] {CVE-2026-93151}
 - crypto: qat - clear AES key schedule from stack (Giovanni Cabiddu) [Orabug: 40043212] {CVE-2026-93161}
 - platform/chrome: sensorhub: Fix memory overread in ring handler (Tzung-Bi Shih) [Orabug: 40043224] {CVE-2026-93165}
 - drm/amdgpu/pm/powerplay: bounds-check voltage index in Vega10 lookup (Asad Kamal) [Orabug: 40043261] {CVE-2026-93177}
 - drm/amdgpu/pm/powerplay: bounds-check voltage index in SMU7 lookup (Asad Kamal) [Orabug: 40043267] {CVE-2026-93178}
 - pinctrl: bcm2835: Don't remove an unregistered GPIO chip (Daniel Mccarthy) [Orabug: 40072907] {CVE-2026-93274}
 - ASoC: rt700-sdw: always drain jack work on remove (Runyu Xiao) [Orabug: 40043295] {CVE-2026-93185}
 - HID: roccat: bound device-supplied profile index (Michael Bommarito) [Orabug: 40043302] {CVE-2026-93188}
 - HID: core: quiesce input in hid_hw_stop() to prevent use-after-free (Philipp Weber) [Orabug: 40043306] {CVE-2026-93189}
 - bpf: Enforce expected_attach_type for tailcall compatibility (Daniel Borkmann) [Orabug: 38649013] {CVE-2025-40123}
 - clk: meson: align gxbb_32k_clk_sel number of parents with actual count (Martin Blumenstingl) [Orabug:
 40033896] {CVE-2026-89947}
 - batman-adv: bla: avoid CRC corruption due to parallel claim add (Sven Eckelmann) [Orabug: 40043348] {CVE-2026-93203}
 - batman-adv: dat: atomically update mac addresses (Sven Eckelmann) [Orabug: 40043352] {CVE-2026-93204}
 - ksmbd: fix overflow in dacloffset bounds check (Norbert Szetei) [Orabug: 37844228] {CVE-2025-22039}
 - bpf: Fix same-register dst/src OOB read and pointer leak in sock_ops (Jiayuan Chen) [Orabug: 39622004] {CVE-2026-53078}
 - net: fix NULL pointer dereference in l3mdev_l3_rcv (Wang Liang) [Orabug: 37844463] {CVE-2025-22103}
 - bpf: Guard stack limits against 32bit overflow (Andrei Matei) [Orabug: 37283390] {CVE-2023-52676}
 - x86/mm/ident_map: Use gbpages only where full GB page should be mapped. (Steve Wahl) [Orabug: 37206382] {CVE-2024-50017}
 - xhci: fix lost bounce buffers on TDs spanning several ring segments (Arthur Gautier) [Orabug: 40034134] {CVE-2026-90015}
 - drm: Fix drm_crtc_commit leak if signaled when PAGE_FLIP_EVENT is used (Thadeu Lima de Souza Cascardo) [Orabug: 40033274] {CVE-2026-89816}
 - drm/gud: validate TV mode names before creating enum property (Tao Yu) [Orabug: 40072729] {CVE-2026-93234}
 - drm/gud: NUL-terminate TV mode names read from the device (Deepanshu Kartikey) [Orabug: 40033282] {CVE-2026-89817}
 - drm/amd/display: avoid divide-by-zero in __is_lut_linear() (Harry Wentland) [Orabug: 40033294] {CVE-2026-89821}
 - drm: fix race between partial drm_dev_register() failure and ioctl (Danilo Krummrich) [Orabug: 40033314] {CVE-2026-89823}
 - scsi: qla2xxx: Zero-init bsg stack buffers to avoid info leak (Nilesh Javali) [Orabug: 40033434] {CVE-2026-89843}
 - scsi: qla2xxx: Avoid req_q_map double-read in qla2x00_error_entry() (Nilesh Javali) [Orabug: 40033450] {CVE-2026-89845}
 - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (Nilesh Javali) [Orabug: 40033458] {CVE-2026-89846}
 - scsi: qla2xxx: Avoid double completion in async IOCB timeout (Nilesh Javali) [Orabug: 40033466] {CVE-2026-89847}
 - scsi: qla2xxx: Fix response queue over-consumption in __qla_consume_iocb() (Nilesh Javali) [Orabug:
 40072776] {CVE-2026-93242}
 - scsi: qla2xxx: Reject non-SCSI SRB on status IOCB fast path (Nilesh Javali) [Orabug: 40033478] {CVE-2026-89849}
 - scsi: qla2xxx: Don't query firmware state while chip is down (Nilesh Javali) [Orabug: 40033484] {CVE-2026-89850}
 - scsi: qla2xxx: Fix FCE trace enable parsing in debugfs (Nilesh Javali) [Orabug: 40033491] {CVE-2026-89851}
 - scsi: qla2xxx: Zero mailbox struct in qla2x00_get_firmware_state() (Nilesh Javali) [Orabug: 40033498] {CVE-2026-89852}
 - scsi: qla2xxx: Fix FCE trace use-after-free during firmware dump (Nilesh Javali) [Orabug: 40033505] {CVE-2026-89853}
 - scsi: qla2xxx: Fix cs84xx use-after-free on host teardown (Nilesh Javali) [Orabug: 40033511] {CVE-2026-89854}
 - scsi: qla2xxx: Serialize flash version read in reset handler (Nilesh Javali) [Orabug: 40033520] {CVE-2026-89855}
 - scsi: qla2xxx: Clamp MSI-X derived queue counts to avoid truncation (Nilesh Javali) [Orabug: 40033524] {CVE-2026-89856}
 - scsi: qla2xxx: Bound image count in qla2x00_update_fru_versions() (Nilesh Javali) [Orabug: 40033533] {CVE-2026-89858}
 - scsi: qla2xxx: Hold vport reference in qla24xx_report_id_acquisition() (Nilesh Javali) [Orabug:
 40033547] {CVE-2026-89861}
 - scsi: qla2xxx: edif: Fix NULL pointer deref in RX SA delete check (Nilesh Javali) [Orabug: 40033554] {CVE-2026-89863}
 - scsi: qla2xxx: Bound i2c->length in I2C bsg handlers (Nilesh Javali) [Orabug: 40033558] {CVE-2026-89864}
 - scsi: qla2xxx: Zero SFP DMA buffer in FRU/I2C bsg handlers (Nilesh Javali) [Orabug: 40033562] {CVE-2026-89865}
 - media: v4l2-fwnode: Fix fwnode leak in v4l2_fwnode_parse_link (Biren Pandya) [Orabug: 40033584] {CVE-2026-89872}
 - media: tda18250: fix possible integer overflow (Ilya Krutskih) [Orabug: 40033595] {CVE-2026-89876}
 - media: s2255: check firmware size before reading trailing marker (Huanglei) [Orabug: 40033610] {CVE-2026-89878}
 - media: s2255: bound JPEG frame size before copying into the buffer (Hyeongjun An) [Orabug: 40033615] {CVE-2026-89879}
 - media: rtl2832_sdr: release URBs and stream buffers on start_streaming() failure (Valery Borovsky) [Orabug: 40033620] {CVE-2026-89880}
 - media: rtl2832_sdr: use vb2_video_unregister_device() on remove to fix DMA leak (Valery Borovsky) [Orabug: 40033627] {CVE-2026-89881}
 - media: go7007: defer the ALSA v4l2 put until card release (Shuangpeng Bai) [Orabug: 40033656] {CVE-2026-89890}
 - media: em28xx: fix use-after-free of dev_next->devlist on disconnect (Jiangong Han) [Orabug: 40033663] {CVE-2026-89891}
 - media: em28xx: defer audio-only extension registration (Diego Fernando Mancera Gomez) [Orabug: 40033668] {CVE-2026-89892}
 - media: cx23885: cancel NetUP CI work before teardown (Fan Wu) [Orabug: 40033675] {CVE-2026-89893}
 - media: cx231xx: reject geometry changes while the VBI queue is busy (Bryam Vargas) [Orabug: 40033680] {CVE-2026-89894}
 - media: cec: Serialize exclusive follower delivery (Ruoyu Wang) [Orabug: 40033697] {CVE-2026-89897}
 - KVM: x86: hyper-v: Clamp stimer deadline to avoid livelock (Carlos Lopez) [Orabug: 40033805] {CVE-2026-89927}
 - KVM: nVMX: Service local TLB flushes on failed nested VM-Enter (Yosry Ahmed) [Orabug: 40033822] {CVE-2026-89930}
 - KVM: nVMX: Always flush vpid02 on first use (Yosry Ahmed) [Orabug: 40033830] {CVE-2026-89932}
 - ASoC: cs35l34: drain threaded IRQ before runtime suspend (Runyu Xiao) [Orabug: 40033886] {CVE-2026-89945}
 - batman-adv: bla: fix freeing of claims on meshif deletion (Sven Eckelmann) [Orabug: 40033901] {CVE-2026-89948}
 - batman-adv: fix stale receive device on merged fragments (Zhiling Zou) [Orabug: 40033914] {CVE-2026-89951}
 - mtd: rawnand: validate ONFI extended parameter page sections (Pengpeng Hou) [Orabug: 40033918] {CVE-2026-89952}
 - mtd: mtdoops: free page bitmap when the backing MTD is removed (Xu Rao) [Orabug: 40033922] {CVE-2026-89953}
 - nvdimm/btt: reject an arena whose nfree is below the lane count (Bryam Vargas) [Orabug: 40033967] {CVE-2026-89965}
 - nvmet-tcp: reject unsolicited H2CData PDUs (Shivam Kumar) [Orabug: 40033975] {CVE-2026-89968}
 - nvmet-tcp: fix out-of-bounds write when receiving an over-long PDU (Shivam Kumar) [Orabug: 40033979] {CVE-2026-89969}
 - nvme-tcp: check the data direction of a C2HData PDU (Yehyeong Lee) [Orabug: 40033995] {CVE-2026-89973}
 - ALSA: pcm: Fix race between non-atomic ops and trigger-start (Takashi Iwai) [Orabug: 40034012] {CVE-2026-89979}
 - i2c: mux: Fix channel node leak on adapter add failure (Ahmad Byagowi) [Orabug: 40034022] {CVE-2026-89982}
 - i2c: core: fix debugfs UAF on adapter removal (Vasileios Almpanis) [Orabug: 40034027] {CVE-2026-89983}
 - perf/x86/intel: Fix kernel address leakages in LBR stack (Dapeng Mi) [Orabug: 40034032] {CVE-2026-89984}
 - ima: Check for ERR_PTR from dentry_path() in validate_hash_algo() (Bradley Morgan) [Orabug: 40034048] {CVE-2026-89989}
 - dm: fix resume-vs-remove race (Mikulas Patocka) [Orabug: 40034074] {CVE-2026-89997}
 - HID: wacom: validate report length in wacom_intuos_pro2_bt_irq (Ibrahim Hashimov) [Orabug: 40034087] {CVE-2026-89999}
 - HID: rmi: fix OOB access with undersized RMI reports (Wei Jie Law) [Orabug: 40034091] {CVE-2026-90000}
 - scsi: pm8001: Use rollback index when freeing MSI-X vectors (Runyu Xiao) [Orabug: 40034112] {CVE-2026-90007}
 - scsi: target: iscsi: Reserve a terminator byte for the login payload (Sujal Tuladhar) [Orabug: 40034119] {CVE-2026-90011}
 - staging: rtl8723bs: fix OOB read in rtw_action_frame_parse() (Muhammad Bilal) [Orabug: 40034145] {CVE-2026-90017}
 - staging: rtl8723bs: fix OOB read / stack overflow in rtw_get_wps_attr() (Muhammad Bilal) [Orabug:
 40034152] {CVE-2026-90018}
 - usb: gadget: fix null pointer dereference in usb_put_function_instance() (Jeffin Philip) [Orabug:
 40034156] {CVE-2026-90019}
 - usb: typec: ucsi: displayport: Fix OOB altmode array index (Jameson Thies) [Orabug: 40034211] {CVE-2026-90025}
 - usb-storage: ene_ub6250: fix race between scan work and probe (Liu Qi) [Orabug: 40034249] {CVE-2026-90031}
 - media: usbtv: keep device alive while ALSA card exists (Shuangpeng Bai) [Orabug: 40034260] {CVE-2026-90032}
 - ALSA: usb-audio: fix OOB write in snd_usbmidi_us122l_output() (Hyeongjun An) [Orabug: 40034266] {CVE-2026-90033}
 - usb: image: mdc800: change kmalloc() to kzalloc() (Griffin Kroah-Hartman) [Orabug: 40034275] {CVE-2026-90034}
 - espintcp: remove encap socket caching to avoid reference leak (Sabrina Dubroca) [Orabug: 38152844] {CVE-2025-38097}
 - scsi: core: Fill in DMA padding bytes in scsi_alloc_sgtables() (Petr Vaganov) [Orabug: 40021009] {CVE-2026-89515}
 - drm/vmwgfx: drop dma_buf reference on foreign-fd prime import (Zack Rusin) [Orabug: 39982308] {CVE-2026-80888}
 - selinux: reject an unclaimed class value in security_get_classes() (Bryam Vargas) [Orabug: 39982374] {CVE-2026-80912}
 - fsnotify: Fix stale object mask after concurrent mark updates (Youngjae Kwon) [Orabug: 40021348] {CVE-2026-89595}
 - entry: Fix seccomp bypass after ptrace with TSYNC (Jinjie Ruan) [Orabug: 40021399] {CVE-2026-89603}
 - openvswitch: Fix CT limit teardown use-after-free (Yuqi Xu) [Orabug: 40020919] {CVE-2026-89488}
 - net: skbuff: don't skb_tx_error() the source skb in skb_zerocopy() (Norbert Szetei) [Orabug: 40034343] {CVE-2026-90049}
 - net: skbuff: don't touch shared zerocopy state in skb_tx_error() (Norbert Szetei) [Orabug: 40020575] {CVE-2026-80977}
 - signal: avoid shared siginfo namespace rewrites (Bradley Morgan) [Orabug: 40072687] {CVE-2026-93222}
 - tpm: tpm_i2c_nuvoton: disable IRQ on wait timeout (Myeonghun Pak) [Orabug: 40020406] {CVE-2026-80930}
 - vsock/virtio: flush works in dependency order (Chengfeng Ye) [Orabug: 40020418] {CVE-2026-80932}
 - wifi: rtw88: Fix potential memory leak in rtw_txq_push_skb() (Abdun Nihaal) [Orabug: 40020441] {CVE-2026-80941}
 - wifi: mwifiex: Detach sync cmd buffer on interrupted wait (Fabio Estevam) [Orabug: 40020450] {CVE-2026-80944}
 - wifi: brcmfmac: Fix memory leak in brcmf_sdio_read_control() (Abdun Nihaal) [Orabug: 40020473] {CVE-2026-80949}
 - dm-stats: fix a crash if allocation of per-cpu data fails (Mikulas Patocka) [Orabug: 40020503] {CVE-2026-80963}
 - ALSA: virmidi: Check card index validity at probe (Takashi Iwai) [Orabug: 40020510] {CVE-2026-80964}
 - ALSA: serial-u16550: Check card index validity at probe (Takashi Iwai) [Orabug: 40020518] {CVE-2026-80965}
 - ALSA: pcxhr: initialize mutexes before requesting threaded IRQ (Runyu Xiao) [Orabug: 40020528] {CVE-2026-80967}
 - ALSA: mpu401: Check card index validity at probe (Takashi Iwai) [Orabug: 40020541] {CVE-2026-80969}
 - ALSA: bcd2000: clear the URB pointers on disconnect (Baul Lee) [Orabug: 40020546] {CVE-2026-80971}
 - ALSA: aloop: Check card index validity at probe (Takashi Iwai) [Orabug: 40020553] {CVE-2026-80972}
 - ALSA: 6fire: bound the MIDI event length from the device (Baul Lee) [Orabug: 40020557] {CVE-2026-80973}
 - seg6: reset IP6CB after IPv6 decapsulation ...

 Please note that the description has been truncated due to length. Please refer to vendor advisory for the full description.

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected packages.

See Also

https://linux.oracle.com/errata/ELSA-2026-500398.html

Plugin Details

Severity: Critical

ID: 366663

File Name: oraclelinux_ELSA-2026-500398.nasl

Version: 1.1

Type: Local

Agent: unix

Published: 10/16/2026

Updated: 10/16/2026

Supported Sensors: Nessus Agent, Continuous Assessment, Nessus

Risk Information

VPR

Risk Factor: High

Score: 8

Percentile: 99.69

CVSS v2

Risk Factor: High

Base Score: 7.2

Temporal Score: 5.3

Vector: CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C

CVSS Score Source: CVE-2026-99999

CVSS v3

Risk Factor: Critical

Base Score: 9.3

Temporal Score: 8.1

Vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

CPE: cpe:/o:oracle:linux:8, cpe:/o:oracle:linux:9, cpe:/o:oracle:linux:9:8:baseos_patch, p-cpe:/a:oracle:linux:bpftool, p-cpe:/a:oracle:linux:kernel-uek-container-debug, p-cpe:/a:oracle:linux:kernel-uek-container, p-cpe:/a:oracle:linux:kernel-uek-core, p-cpe:/a:oracle:linux:kernel-uek-debug-core, p-cpe:/a:oracle:linux:kernel-uek-debug-devel, p-cpe:/a:oracle:linux:kernel-uek-debug-modules-extra, p-cpe:/a:oracle:linux:kernel-uek-debug-modules, p-cpe:/a:oracle:linux:kernel-uek-debug, p-cpe:/a:oracle:linux:kernel-uek-devel, p-cpe:/a:oracle:linux:kernel-uek-doc, p-cpe:/a:oracle:linux:kernel-uek-modules-extra, p-cpe:/a:oracle:linux:kernel-uek-modules, p-cpe:/a:oracle:linux:kernel-uek64k-core, p-cpe:/a:oracle:linux:kernel-uek64k-devel, p-cpe:/a:oracle:linux:kernel-uek64k-modules-extra, p-cpe:/a:oracle:linux:kernel-uek64k-modules, p-cpe:/a:oracle:linux:kernel-uek64k, p-cpe:/a:oracle:linux:kernel-uek

Required KB Items: Host/local_checks_enabled, Host/RedHat/release, Host/RedHat/rpm-list, Host/OracleLinux

Exploit Ease: No known exploits are available

Patch Publication Date: 10/16/2026

Vulnerability Publication Date: 10/15/2026

Reference Information

CVE: CVE-2026-98432, CVE-2026-99999