The CentOS Linux 8.5 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS8.5:CLSA-2026:1792750763 advisory.

  - In the Linux kernel, the following vulnerability has been resolved: netfilter: ipset: fix race between     dump and ip_set_list resize The release path of ip_set_dump_do() and ip_set_dump_done() read     inst->ip_set_list via ip_set_ref_netlink(), a plain rcu_dereference_raw() of the array pointer. These run     from netlink_recvmsg() without the nfnl mutex and without an RCU read-side critical section. A concurrent     ip_set_create() can grow the array: it publishes the new array, calls synchronize_net() and then kvfree()s     the old one. Since the dump paths read the array outside any RCU reader, synchronize_net() does not wait     for them and the old array can be freed while they still index into it, causing a use-after-free. The     dumped set itself stays pinned via set->ref_netlink, so only the array load needs protecting. Take     rcu_read_lock() around it, matching ip_set_get_byname() and __ip_set_put_byindex(). BUG: KASAN: slab-use-     after-free in ip_set_dump_do (net/netfilter/ipset/ip_set_core.c:1697) Read of size 8 at addr     ffff88800b5c4018 by task exploit/150 Call Trace: ... kasan_report (mm/kasan/report.c:595) ip_set_dump_do     (net/netfilter/ipset/ip_set_core.c:1697) netlink_dump (net/netlink/af_netlink.c:2325) netlink_recvmsg     (net/netlink/af_netlink.c:1976) sock_recvmsg (net/socket.c:1159) __sys_recvfrom (net/socket.c:2315) ...
    Oops: general protection fault, probably for non-canonical address ... KASAN NOPTI KASAN: maybe wild-     memory-access in range [0x02d6...d0-0x02d6...d7] RIP: 0010:ip_set_dump_do     (net/netfilter/ipset/ip_set_core.c:1698) Kernel panic - not syncing: Fatal exception (CVE-2026-64189)

  - In the Linux kernel, the following vulnerability has been resolved: dm log: fix out-of-bounds write due to     region_count overflow The local variable region_count in create_log_context() is declared as unsigned int     (32-bit), but dm_sector_div_up() returns sector_t (64-bit). When a device-mapper target has a sufficiently     large ti->len with a small region_size, the division result can exceed UINT_MAX. The truncated value is     then used to calculate bitset_size, causing clean_bits, sync_bits, and recovering_bits to be allocated far     smaller than needed for the actual number of regions. Subsequent log operations (log_set_bit,     log_clear_bit, log_test_bit) use region indices derived from the full untruncated region space, causing     out-of-bounds writes to kernel heap memory allocated by vmalloc. This can be reproduced by creating a     mirror target whose region_count overflows 32 bits: dmsetup create bigzero --table '0 8589934594 zero'     dmsetup create mymirror --table '0 8589934594 mirror \ core 2 2 nosync 2 /dev/mapper/bigzero 0 \     /dev/mapper/bigzero 0' The status output confirms the truncation (sync_count=1 instead of 4294967297,     because 0x100000001 was truncated to 1): $ dmsetup status mymirror 0 8589934594 mirror 2 254:1 254:1     1/4294967297 ... This leads to a kernel crash in core_in_sync: BUG: scheduling while atomic: (udev-     worker)/9150/0x00000000 RIP: 0010:core_in_sync+0x14/0x30 [dm_log] CR2: 0000000000000008 Fixing recursive     fault but reboot is needed! Fix by widening the local region_count to sector_t and adding an explicit     overflow check before the value is assigned to lc->region_count. (CVE-2026-53059)

  - In the Linux kernel, the following vulnerability has been resolved: ipv6: fix fib6 walker UAF on seq stop     ipv6_route_iter_active() treats a walker in FWS_U at the table root as already unlinked. fib6_del_route()     can move a still-linked walker into that same state when the current leaf is the last route at the root,     so ipv6_route_native_seq_stop() skips fib6_walker_unlink(). The seq private object can then be freed while     it remains on net->ipv6.fib6_walkers. A later route deletion walks the dangling list and uses the freed     walker. Use the list head as membership state and reinitialize it when unlinking. Keep the existing     w->node check so a never-started iterator with a zeroed private object is not treated as linked. The same     stop helper is used by /proc/net/ipv6_route and by the BPF ipv6_route iterator. The BPF show path only     widens the race. (CVE-2026-97940)

  - In the Linux kernel, the following vulnerability has been resolved: net: bridge: stop fast-leave after     deleting a port group br_multicast_leave_group() iterates mp->ports with pp = &p->next in its fast-leave     path. After br_multicast_del_pg() removes p, continuing the loop advances pp through the deleted entry. If     multicast-to-unicast was enabled, the bridge can hold multiple port groups for the same port and group     with different source MAC addresses. Once multicast-to-unicast is disabled, br_port_group_equal() matches     those entries by port only. A fast leave can then delete one entry and continue from its stale next     pointer, leaving mp->ports pointing at a deleted port group. Fast leave only needs to remove one matching     port group. Break after br_multicast_del_pg() so the loop stops before dereferencing the removed entry.
    (CVE-2026-74480)

  - In the Linux kernel, the following vulnerability has been resolved: dmaengine: Fix possible use after free     In dma_release_channel(), check chan->device->privatecnt after call dma_chan_put(). However,     dma_chan_put() call dma_device_put() which could release the last reference of the device if the DMA     provider is already gone and hence free it. Fixes it by moving dma_chan_put() after the check.
    (CVE-2026-72476)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

CentOS Linux 8.5 [TuxCare] Security Update: bpftool / kernel / kernel-core / kernel-cross-headers / etc Multiple Vulnerabilities (CENTOS8.5:CLSA-2026:1792750763)

high Nessus Plugin ID 371224

Version 1.3

Version 1.2

Version 1.1

Version 1.3 Nov 12, 2026, 8:34 PM CVE (set "CVE" coverage to "CVE-2021-47616,CVE-2022-50697,CVE-2023-52935,CVE-2024-53174,CVE-2026-43503,CVE-2026-45856,CVE-2026-46033,CVE-2026-46043,CVE-2026-46056,CVE-2026-46120,CVE-2026-46133,CVE-2026-46149,CVE-2026-46189,CVE-2026-46331,CVE-2026-52920,CVE-2026-52956,CVE-2026-52957,CVE-2026-53004,CVE-2026-53006,CVE-2026-53009,CVE-2026-53016,CVE-2026-53059,CVE-2026-53071,CVE-2026-53072,CVE-2026-53075,CVE-2026-53129,CVE-2026-53149,CVE-2026-53195,CVE-2026-53223,CVE-2026-53228,CVE-2026-53268,CVE-2026-53270,CVE-2026-53275,CVE-2026-63794,CVE-2026-63922,CVE-2026-64002,CVE-2026-64009,CVE-2026-64018,CVE-2026-64034,CVE-2026-64047,CVE-2026-64189,CVE-2026-64276,CVE-2026-64380,CVE-2026-64471,CVE-2026-64483,CVE-2026-72157,CVE-2026-72383,CVE-2026-72476,CVE-2026-74255,CVE-2026-74282,CVE-2026-74408,CVE-2026-74444,CVE-2026-74480,CVE-2026-74498,CVE-2026-74540,CVE-2026-74581,CVE-2026-80681,CVE-2026-80714,CVE-2026-89537,CVE-2026-89542,CVE-2026-89548,CVE-2026-89550,CVE-2026-89553,CVE-2026-89575,CVE-2026-89656,CVE-2026-89699,CVE-2026-89729,CVE-2026-89778,CVE-2026-89823,CVE-2026-89856,CVE-2026-89893,CVE-2026-89932,CVE-2026-90033,CVE-2026-90329,CVE-2026-93104,CVE-2026-93175,CVE-2026-93817,CVE-2026-97408,CVE-2026-97427,CVE-2026-97448,CVE-2026-97539,CVE-2026-97612,CVE-2026-97940,CVE-2026-97949,CVE-2026-98017,CVE-2026-98096,CVE-2026-98130,CVE-2026-98217,CVE-2026-98222,CVE-2026-98343,CVE-2026-98364,CVE-2026-99284") Exploit attributes ("Exploit framework core" changed from "True" to none. "Exploit framework metasploit" changed from "True" to none) Plugin metadata Plugin Feed: 202611122034
Version 1.2 Oct 26, 2026, 8:43 AM Exploit attributes ("Exploit framework core" set to "True") Exploit attributes ("Exploit framework metasploit" set to "True") Plugin Feed: 202610260843
Version 1.1 Oct 23, 2026, 5:56 PM New Plugin Feed: 202610231756