Rocky Linux 9.6 [TuxCare] Security Update: kernel / kernel-64k / kernel-64k-core / kernel-64k-debug / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1792445930)

high Nessus Plugin ID 369491

Synopsis

The Rocky Linux host is missing one or more security updates.

Description

The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1792445930 advisory.

- In the Linux kernel, the following vulnerability has been resolved: virt: tdx-guest: Just leak decrypted memory on unrecoverable errors In CoCo VMs it is possible for the untrusted host to cause set_memory_decrypted() to fail such that an error is returned and the resulting memory is shared. Callers need to take care to handle these errors to avoid returning decrypted (shared) memory to the page allocator, which could lead to functional or security issues. Leak the decrypted memory when set_memory_decrypted() fails, and don't need to print an error since set_memory_decrypted() will call WARN_ONCE(). (CVE-2024-57793)

- In the Linux kernel, the following vulnerability has been resolved: crypto: af_alg - zero initialize memory allocated via sock_kmalloc Several crypto user API contexts and requests allocated with sock_kmalloc() were left uninitialized, relying on callers to set fields explicitly. This resulted in the use of uninitialized data in certain error paths or when new fields are added in the future. The ACVP patches also contain two user-space interface files: algif_kpp.c and algif_akcipher.c. These too rely on proper initialization of their context structures. A particular issue has been observed with the newly added 'inflight' variable introduced in af_alg_ctx by commit: 67b164a871af (crypto: af_alg - Disallow multiple in-flight AIO requests) Because the context is not memset to zero after allocation, the inflight variable has contained garbage values. As a result, af_alg_alloc_areq() has incorrectly returned -EBUSY randomly when the garbage value was interpreted as true:
https://github.com/gregkh/linux/blame/master/crypto/af_alg.c#L1209 The check directly tests ctx->inflight without explicitly comparing against true/false. Since inflight is only ever set to true or false later, an uninitialized value has triggered -EBUSY failures. Zero-initializing memory allocated with sock_kmalloc() ensures inflight and other fields start in a known state, removing random issues caused by uninitialized data. (CVE-2025-71113)

- In the Linux kernel, the following vulnerability has been resolved: rxrpc: proc: size address buffers for %pISpc output The AF_RXRPC procfs helpers format local and remote socket addresses into fixed 50-byte stack buffers with %pISpc. That is too small for the longest current-tree IPv6-with-port form the formatter can produce. In lib/vsprintf.c, the compressed IPv6 path uses a dotted-quad tail not only for v4mapped addresses, but also for ISATAP addresses via ipv6_addr_is_isatap(). As a result, a case such as [ffff:ffff:ffff:ffff:0:5efe:255.255.255.255]:65535 is possible with the current formatter. That is 50 visible characters, so 51 bytes including the trailing NUL, which does not fit in the existing char[50] buffers used by net/rxrpc/proc.c. Size the buffers from the formatter's maximum textual form and switch the call sites to scnprintf(). Changes since v1: - correct the changelog to cite the actual maximum current-tree case explicitly - frame the proof around the ISATAP formatting path instead of the earlier mapped-v4 example (CVE-2026-31630)

- In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_set_rbtree: check for partial overlaps in anonymous sets Userspace provides an optimized representation in case intervals are adjacent, where the end element is omitted. The existing partial overlap detection logic skips anonymous set checks on start elements for this reason. However, it is possible to add intervals that overlap to this anonymous where two start elements with the same, eg. A-B, A-C where C < B. start end A B start end A C Restore the check on overlapping start elements to report an overlap. (CVE-2026-45873)

- In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Bound VBIOS record- chain walk loops [Why & How] All record-chain walk loops in bios_parser.c and bios_parser2.c use for(;;) and only terminate on a 0xFF record_type sentinel or zero record_size. A malformed VBIOS image missing the terminator record causes unbounded iteration at probe time, potentially hundreds of thousands of iterations with record_size=1. In the final iterations near the BIOS image boundary, struct casts beyond the 2-byte header validated by GET_IMAGE can also read out of bounds. Cap all 14 record-chain walk loops to BIOS_MAX_NUM_RECORD (256) iterations. The atombios.h defines up to 22 distinct record types and atomfirmware.h has 13. Assuming an average of less than 10 records per type (which is reasonable since most are connector- based) 256 is a generous upper bound. (cherry picked from commit 95700a3d660287ed657d6892f7be9ffc0e294a93) (CVE-2026-53138)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected packages based on the guidance in TuxCare advisory ALMALINUX9.6:CLSA-2026:1792445930.

Plugin Details

Severity: High

ID: 369491

File Name: tuxcare_rocky_linux_9.6_CLSA-2026-1792445930.nasl

Version: 1.1

Type: Local

Family: Rocky Linux Local Security Checks

Published: 10/21/2026

Updated: 10/21/2026

Supported Sensors: Nessus Agent, Continuous Assessment, Nessus

Risk Information

VPR

Risk Factor: High

Score: 8

Percentile: 99.7

Vendor

Vendor Severity: Important

CVSS v2

Risk Factor: Medium

Base Score: 6.8

Temporal Score: 5.3

Vector: CVSS2#AV:L/AC:L/Au:S/C:C/I:C/A:C

CVSS Score Source: CVE-2026-64424

CVSS v3

Risk Factor: High

Base Score: 7.8

Temporal Score: 7

Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

Vulnerability Information

Required KB Items: Host/local_checks_enabled, Host/cpu, Host/RockyLinux/release, Host/RockyLinux/rpm-list, Host/OS/extended-third-party

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 10/19/2026

Vulnerability Publication Date: 1/11/2025

Reference Information

CVE: CVE-2024-57793, CVE-2025-71113, CVE-2026-31630, CVE-2026-45873, CVE-2026-53138, CVE-2026-53224, CVE-2026-53246, CVE-2026-53268, CVE-2026-53294, CVE-2026-53374, CVE-2026-53388, CVE-2026-53399, CVE-2026-63808, CVE-2026-63823, CVE-2026-63888, CVE-2026-63922, CVE-2026-63945, CVE-2026-63970, CVE-2026-63992, CVE-2026-63993, CVE-2026-63994, CVE-2026-63996, CVE-2026-64009, CVE-2026-64017, CVE-2026-64029, CVE-2026-64098, CVE-2026-64109, CVE-2026-64113, CVE-2026-64114, CVE-2026-64342, CVE-2026-64354, CVE-2026-64362, CVE-2026-64424, CVE-2026-64470, CVE-2026-64471, CVE-2026-64546, CVE-2026-64548, CVE-2026-64555, CVE-2026-64560, CVE-2026-68266, CVE-2026-68411, CVE-2026-72299, CVE-2026-72383, CVE-2026-72398, CVE-2026-72404, CVE-2026-74268, CVE-2026-74345, CVE-2026-74359, CVE-2026-74450, CVE-2026-74479, CVE-2026-74550, CVE-2026-74575, CVE-2026-74637, CVE-2026-74714, CVE-2026-80725, CVE-2026-80840, CVE-2026-80841, CVE-2026-80951, CVE-2026-80976, CVE-2026-89476, CVE-2026-89488, CVE-2026-89520, CVE-2026-89545, CVE-2026-89564, CVE-2026-89625, CVE-2026-89633, CVE-2026-89637, CVE-2026-89659, CVE-2026-89685, CVE-2026-89763, CVE-2026-89778, CVE-2026-89972, CVE-2026-90041, CVE-2026-90111, CVE-2026-90116, CVE-2026-90292, CVE-2026-92508, CVE-2026-93117, CVE-2026-97531, CVE-2026-97541, CVE-2026-97555, CVE-2026-97918, CVE-2026-97931, CVE-2026-97935, CVE-2026-97938, CVE-2026-97949, CVE-2026-98248, CVE-2026-98260, CVE-2026-98312, CVE-2026-98354, CVE-2026-98365, CVE-2026-99999

CLSA: 2026:1792445930

Detections

Analytics