The CentOS Linux 8.4 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS8.4:CLSA-2026:1792749577 advisory.

  - In the Linux kernel, the following vulnerability has been resolved: ALSA: mtpav: shut down output timer     before card teardown snd_mtpav_output_timer() rearms chip->timer while holding chip->spinlock and accesses     the card-private mtpav state. snd_mtpav_free() currently takes the same lock and calls timer_delete() when     the timer is active. This only removes a pending timer; it does not wait for a callback that is already     running and does not prevent the callback from rearming the timer. A callback running on another CPU can     therefore continue after snd_mtpav_free() releases the lock and access the card-private state while the     card is being torn down. It can also rearm the timer after timer_delete() has returned. Call     timer_shutdown_sync() without holding chip->spinlock. This waits for any running callback to finish and     prevents further rearming before the card-private mtpav state is released. (CVE-2026-90116)

  - In the Linux kernel, the following vulnerability has been resolved: tunnels: load network headers after     skb_cow() in iptunnel_pmtud_build_icmp[v6]() Sashiko found that iptunnel_pmtud_build_icmp() and     iptunnel_pmtud_build_icmpv6() were caching ip_hdr() and ipv6_hdr() before an skb_cow() call which can     reallocate skb->head. Fix this possible UAF by initializing the local variables after the skb_cow() call.
    Remove skb_reset_network_header() calls which were not needed. (CVE-2026-63994)

  - In the Linux kernel, the following vulnerability has been resolved: ipv6: fix fib6 walker UAF on seq stop     ipv6_route_iter_active() treats a walker in FWS_U at the table root as already unlinked. fib6_del_route()     can move a still-linked walker into that same state when the current leaf is the last route at the root,     so ipv6_route_native_seq_stop() skips fib6_walker_unlink(). The seq private object can then be freed while     it remains on net->ipv6.fib6_walkers. A later route deletion walks the dangling list and uses the freed     walker. Use the list head as membership state and reinitialize it when unlinking. Keep the existing     w->node check so a never-started iterator with a zeroed private object is not treated as linked. The same     stop helper is used by /proc/net/ipv6_route and by the BPF ipv6_route iterator. The BPF show path only     widens the race. (CVE-2026-97940)

  - In the Linux kernel, the following vulnerability has been resolved: net: bridge: stop fast-leave after     deleting a port group br_multicast_leave_group() iterates mp->ports with pp = &p->next in its fast-leave     path. After br_multicast_del_pg() removes p, continuing the loop advances pp through the deleted entry. If     multicast-to-unicast was enabled, the bridge can hold multiple port groups for the same port and group     with different source MAC addresses. Once multicast-to-unicast is disabled, br_port_group_equal() matches     those entries by port only. A fast leave can then delete one entry and continue from its stale next     pointer, leaving mp->ports pointing at a deleted port group. Fast leave only needs to remove one matching     port group. Break after br_multicast_del_pg() so the loop stops before dereferencing the removed entry.
    (CVE-2026-74480)

  - In the Linux kernel, the following vulnerability has been resolved: dmaengine: Fix possible use after free     In dma_release_channel(), check chan->device->privatecnt after call dma_chan_put(). However,     dma_chan_put() call dma_device_put() which could release the last reference of the device if the DMA     provider is already gone and hence free it. Fixes it by moving dma_chan_put() after the check.
    (CVE-2026-72476)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

CentOS Linux 8.4 [TuxCare] Security Update: bpftool / kernel / kernel-core / kernel-cross-headers / etc Multiple Vulnerabilities (CENTOS8.4:CLSA-2026:1792749577)

high Nessus Plugin ID 371225

Version 1.2