CentOS Linux 8.4 [TuxCare] Security Update: bpftool / kernel / kernel-core / kernel-cross-headers / etc Multiple Vulnerabilities (CENTOS8.4:CLSA-2026:1792749577)

high Nessus Plugin ID 371225

Language:

Synopsis

The CentOS Linux host is missing one or more security updates.

Description

The CentOS Linux 8.4 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS8.4:CLSA-2026:1792749577 advisory.

- In the Linux kernel, the following vulnerability has been resolved: ALSA: mtpav: shut down output timer before card teardown snd_mtpav_output_timer() rearms chip->timer while holding chip->spinlock and accesses the card-private mtpav state. snd_mtpav_free() currently takes the same lock and calls timer_delete() when the timer is active. This only removes a pending timer; it does not wait for a callback that is already running and does not prevent the callback from rearming the timer. A callback running on another CPU can therefore continue after snd_mtpav_free() releases the lock and access the card-private state while the card is being torn down. It can also rearm the timer after timer_delete() has returned. Call timer_shutdown_sync() without holding chip->spinlock. This waits for any running callback to finish and prevents further rearming before the card-private mtpav state is released. (CVE-2026-90116)

- In the Linux kernel, the following vulnerability has been resolved: tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() Sashiko found that iptunnel_pmtud_build_icmp() and iptunnel_pmtud_build_icmpv6() were caching ip_hdr() and ipv6_hdr() before an skb_cow() call which can reallocate skb->head. Fix this possible UAF by initializing the local variables after the skb_cow() call.
Remove skb_reset_network_header() calls which were not needed. (CVE-2026-63994)

- In the Linux kernel, the following vulnerability has been resolved: ipv6: fix fib6 walker UAF on seq stop ipv6_route_iter_active() treats a walker in FWS_U at the table root as already unlinked. fib6_del_route() can move a still-linked walker into that same state when the current leaf is the last route at the root, so ipv6_route_native_seq_stop() skips fib6_walker_unlink(). The seq private object can then be freed while it remains on net->ipv6.fib6_walkers. A later route deletion walks the dangling list and uses the freed walker. Use the list head as membership state and reinitialize it when unlinking. Keep the existing w->node check so a never-started iterator with a zeroed private object is not treated as linked. The same stop helper is used by /proc/net/ipv6_route and by the BPF ipv6_route iterator. The BPF show path only widens the race. (CVE-2026-97940)

- In the Linux kernel, the following vulnerability has been resolved: net: bridge: stop fast-leave after deleting a port group br_multicast_leave_group() iterates mp->ports with pp = &p->next in its fast-leave path. After br_multicast_del_pg() removes p, continuing the loop advances pp through the deleted entry. If multicast-to-unicast was enabled, the bridge can hold multiple port groups for the same port and group with different source MAC addresses. Once multicast-to-unicast is disabled, br_port_group_equal() matches those entries by port only. A fast leave can then delete one entry and continue from its stale next pointer, leaving mp->ports pointing at a deleted port group. Fast leave only needs to remove one matching port group. Break after br_multicast_del_pg() so the loop stops before dereferencing the removed entry.
(CVE-2026-74480)

- In the Linux kernel, the following vulnerability has been resolved: dmaengine: Fix possible use after free In dma_release_channel(), check chan->device->privatecnt after call dma_chan_put(). However, dma_chan_put() call dma_device_put() which could release the last reference of the device if the DMA provider is already gone and hence free it. Fixes it by moving dma_chan_put() after the check.
(CVE-2026-72476)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected packages based on the guidance in TuxCare advisory CENTOS8.4:CLSA-2026:1792749577.

Plugin Details

Severity: High

ID: 371225

File Name: tuxcare_centos_8.4_CLSA-2026-1792749577.nasl

Version: 1.3

Type: Local

Agent: unix

Family: CentOS Local Security Checks

Published: 10/23/2026

Updated: 11/12/2026

Supported Sensors: Nessus Agent, Continuous Assessment, Tenable Cloud Security, Tenable Self-Hosted Container Security, Nessus

Risk Information

VPR

Risk Factor: Critical

Score: 9.2

Percentile: 99.77

Vendor

Vendor Severity: Critical

CVSS v2

Risk Factor: Medium

Base Score: 6.8

Temporal Score: 5.6

Vector: CVSS2#AV:L/AC:L/Au:S/C:C/I:C/A:C

CVSS Score Source: CVE-2026-64362

CVSS v3

Risk Factor: High

Base Score: 7.8

Temporal Score: 7.2

Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:F/RL:O/RC:C

Vulnerability Information

Required KB Items: Host/local_checks_enabled, Host/CentOS/release, Host/CentOS/rpm-list, Host/OS/extended-third-party

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 10/23/2026

Vulnerability Publication Date: 9/7/2023

Reference Information

CVE: CVE-2023-53794, CVE-2026-43503, CVE-2026-45856, CVE-2026-46033, CVE-2026-46043, CVE-2026-46056, CVE-2026-46069, CVE-2026-46149, CVE-2026-46181, CVE-2026-46189, CVE-2026-46331, CVE-2026-52920, CVE-2026-52956, CVE-2026-52957, CVE-2026-53004, CVE-2026-53006, CVE-2026-53009, CVE-2026-53016, CVE-2026-53053, CVE-2026-53072, CVE-2026-53075, CVE-2026-53078, CVE-2026-53129, CVE-2026-53149, CVE-2026-53195, CVE-2026-53228, CVE-2026-53239, CVE-2026-53268, CVE-2026-53392, CVE-2026-63800, CVE-2026-63962, CVE-2026-63994, CVE-2026-64002, CVE-2026-64276, CVE-2026-64362, CVE-2026-64471, CVE-2026-64483, CVE-2026-72157, CVE-2026-72383, CVE-2026-72413, CVE-2026-72476, CVE-2026-74282, CVE-2026-74283, CVE-2026-74359, CVE-2026-74408, CVE-2026-74444, CVE-2026-74469, CVE-2026-74480, CVE-2026-74498, CVE-2026-74505, CVE-2026-74540, CVE-2026-74550, CVE-2026-74581, CVE-2026-80622, CVE-2026-80681, CVE-2026-80714, CVE-2026-89448, CVE-2026-89481, CVE-2026-89548, CVE-2026-89553, CVE-2026-89559, CVE-2026-89575, CVE-2026-89637, CVE-2026-89699, CVE-2026-89892, CVE-2026-89893, CVE-2026-89932, CVE-2026-89965, CVE-2026-89972, CVE-2026-90011, CVE-2026-90033, CVE-2026-90057, CVE-2026-90116, CVE-2026-90329, CVE-2026-93104, CVE-2026-93117, CVE-2026-93163, CVE-2026-93175, CVE-2026-93817, CVE-2026-93826, CVE-2026-97408, CVE-2026-97448, CVE-2026-97509, CVE-2026-97531, CVE-2026-97539, CVE-2026-97564, CVE-2026-97940, CVE-2026-97949, CVE-2026-98077, CVE-2026-98096, CVE-2026-98130, CVE-2026-98196, CVE-2026-98217, CVE-2026-98222, CVE-2026-98320, CVE-2026-98342, CVE-2026-98343, CVE-2026-99284

CLSA: 2026:1792749577

Detections

Analytics