Detections
Analytics

CentOS Linux 6 [TuxCare] Security Update: kernel / kernel-abi-whitelists / kernel-debug / kernel-debug-devel / etc Multiple Vulnerabilities (CENTOS6:CLSA-2026:1791949745)

high Nessus Plugin ID 367921

Synopsis

The CentOS Linux host is missing one or more security updates.

Description

The CentOS Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS6:CLSA-2026:1791949745 advisory.

 - In the Linux kernel, the following vulnerability has been resolved: HID: core: zero-initialize the report buffer Since the report buffer is used by all kinds of drivers in various ways, let's zero-initialize it during allocation to make sure that it can't be ever used to leak kernel memory via specially-crafted report. (CVE-2024-50302)

 - In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Fix potential out-of- bound accesses for Extigy and Mbox devices A bogus device can provide a bNumConfigurations value that exceeds the initial value used in usb_get_configuration for allocating dev->config. This can lead to out- of-bounds accesses later, e.g. in usb_destroy_configuration. (CVE-2024-53197)

 - In the Linux kernel, the following vulnerability has been resolved: smb: client: reject userspace cifs.spnego descriptions cifs.spnego key descriptions contain authority-bearing fields such as pid, uid, creduid, and upcall_target that cifs.upcall treats as kernel-originating inputs. However, userspace can also create keys of this type through request_key(2) or add_key(2), allowing those fields to be supplied without CIFS origin. Only accept cifs.spnego descriptions while CIFS is using its private spnego_cred to request the key. (CVE-2026-46243)

 - In the Linux kernel, the following vulnerability has been resolved: Bluetooth: serialize accept_q access bt_sock_poll() walks the accept queue without synchronization, while child teardown can unlink the same socket and drop its last reference. The unsynchronized accept queue walk has existed since the initial Bluetooth import. Protect accept_q with a dedicated lock for queue updates and polling. Also rework bt_accept_dequeue() to take temporary child references under the queue lock before dropping it and locking the child socket. (CVE-2026-52918)

 - In the Linux kernel, the following vulnerability has been resolved: netfilter: bridge: make ebt_snat ARP rewrite writable The ebtables SNAT target keeps the Ethernet source address rewrite behind skb_ensure_writable(skb, 0). This is intentional: at the bridge ebtables hooks the Ethernet header is addressed through skb_mac_header()/eth_hdr(), while skb->data points at the Ethernet payload. Asking skb_ensure_writable() for ETH_HLEN bytes would check the payload, not the Ethernet header, and would reintroduce the small packet regression fixed by commit 63137bc5882a. However, the optional ARP sender hardware address rewrite is different. It writes through skb_store_bits() at an offset relative to skb->data: skb_store_bits(skb, sizeof(struct arphdr), info->mac, ETH_ALEN) skb_header_pointer() only safely reads the ARP header; it does not make the later sender hardware address range writable. If that range is still held in a nonlinear skb fragment backed by a splice-imported file page, skb_store_bits() maps the frag page and copies the new MAC address directly into it. Ensure the ARP SHA range is writable before reading the ARP header and before calling skb_store_bits(). (CVE-2026-53266)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected packages based on the guidance in TuxCare advisory CENTOS6:CLSA-2026:1791949745.

See Also

https://cve.tuxcare.com/els/releases/CLSA-2026:1791949745

http://www.nessus.org/u?6fed9383

Plugin Details

Severity: High

ID: 367921

File Name: tuxcare_centos_6_CLSA-2026-1791949745.nasl

Version: 1.1

Type: Local

Agent: unix

Published: 10/20/2026

Updated: 10/20/2026

Supported Sensors: Nessus Agent, Continuous Assessment, Tenable Cloud Security, Tenable Self-Hosted Container Security, Nessus

Risk Information

VPR

Risk Factor: Critical

Score: 9.3

Percentile: 99.82

Vendor

Vendor Severity: Critical

CVSS v2

Risk Factor: Medium

Base Score: 6.8

Temporal Score: 5.9

Vector: CVSS2#AV:L/AC:L/Au:S/C:C/I:C/A:C

CVSS Score Source: CVE-2026-64340

CVSS v3

Risk Factor: High

Base Score: 7.8

Temporal Score: 7.5

Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:H/RL:O/RC:C

Vulnerability Information

Required KB Items: Host/local_checks_enabled, Host/CentOS/release, Host/CentOS/rpm-list, Host/OS/extended-third-party

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 10/14/2026

Vulnerability Publication Date: 4/9/2024

CISA Known Exploited Vulnerability Due Dates: 3/25/2025, 4/30/2025, 9/21/2026

Reference Information

CVE: CVE-2024-50302, CVE-2024-53197, CVE-2026-46243, CVE-2026-52918, CVE-2026-53266, CVE-2026-63826, CVE-2026-63922, CVE-2026-63983, CVE-2026-64322, CVE-2026-64340, CVE-2026-64422, CVE-2026-64471, CVE-2026-68093, CVE-2026-68202, CVE-2026-68320, CVE-2026-68365, CVE-2026-72070, CVE-2026-72322, CVE-2026-72389, CVE-2026-72398, CVE-2026-72413, CVE-2026-74287, CVE-2026-74359, CVE-2026-74387, CVE-2026-74388, CVE-2026-74556, CVE-2026-74588, CVE-2026-74630, CVE-2026-74641, CVE-2026-74689, CVE-2026-80536, CVE-2026-80590, CVE-2026-80622, CVE-2026-80829, CVE-2026-81001, CVE-2026-89478, CVE-2026-89549, CVE-2026-89550, CVE-2026-89575, CVE-2026-89607, CVE-2026-89633, CVE-2026-89671, CVE-2026-89699, CVE-2026-89893, CVE-2026-90033, CVE-2026-90057, CVE-2026-90116, CVE-2026-90203, CVE-2026-90383, CVE-2026-90421, CVE-2026-93803, CVE-2026-97408, CVE-2026-97445, CVE-2026-97455, CVE-2026-97536, CVE-2026-97539, CVE-2026-97540, CVE-2026-97931, CVE-2026-97938, CVE-2026-97949, CVE-2026-98077, CVE-2026-98193, CVE-2026-98194, CVE-2026-98266, CVE-2026-98276, CVE-2026-98348, CVE-2026-98349, CVE-2026-98364, CVE-2026-98375

CLSA: 2026:1791949745