Detections
Analytics

CentOS Linux 8 [TuxCare] Security Update: bpftool / kernel / kernel-core / kernel-cross-headers / etc Multiple Vulnerabilities (CENTOS-STREAM8:CLSA-2026:1792759740)

high Nessus Plugin ID 371420

Language:

Synopsis

The CentOS Linux host is missing one or more security updates.

Description

The CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS-STREAM8:CLSA-2026:1792759740 advisory.

 - In the Linux kernel, the following vulnerability has been resolved: netfilter: ipset: fix race between dump and ip_set_list resize The release path of ip_set_dump_do() and ip_set_dump_done() read inst->ip_set_list via ip_set_ref_netlink(), a plain rcu_dereference_raw() of the array pointer. These run from netlink_recvmsg() without the nfnl mutex and without an RCU read-side critical section. A concurrent ip_set_create() can grow the array: it publishes the new array, calls synchronize_net() and then kvfree()s the old one. Since the dump paths read the array outside any RCU reader, synchronize_net() does not wait for them and the old array can be freed while they still index into it, causing a use-after-free. The dumped set itself stays pinned via set->ref_netlink, so only the array load needs protecting. Take rcu_read_lock() around it, matching ip_set_get_byname() and __ip_set_put_byindex(). BUG: KASAN: slab-use- after-free in ip_set_dump_do (net/netfilter/ipset/ip_set_core.c:1697) Read of size 8 at addr ffff88800b5c4018 by task exploit/150 Call Trace: ... kasan_report (mm/kasan/report.c:595) ip_set_dump_do (net/netfilter/ipset/ip_set_core.c:1697) netlink_dump (net/netlink/af_netlink.c:2325) netlink_recvmsg (net/netlink/af_netlink.c:1976) sock_recvmsg (net/socket.c:1159) __sys_recvfrom (net/socket.c:2315) ...
 Oops: general protection fault, probably for non-canonical address ... KASAN NOPTI KASAN: maybe wild- memory-access in range [0x02d6...d0-0x02d6...d7] RIP: 0010:ip_set_dump_do (net/netfilter/ipset/ip_set_core.c:1698) Kernel panic - not syncing: Fatal exception (CVE-2026-64189)

 - In the Linux kernel, the following vulnerability has been resolved: tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() Sashiko found that iptunnel_pmtud_build_icmp() and iptunnel_pmtud_build_icmpv6() were caching ip_hdr() and ipv6_hdr() before an skb_cow() call which can reallocate skb->head. Fix this possible UAF by initializing the local variables after the skb_cow() call.
 Remove skb_reset_network_header() calls which were not needed. (CVE-2026-63994)

 - In the Linux kernel, the following vulnerability has been resolved: dm log: fix out-of-bounds write due to region_count overflow The local variable region_count in create_log_context() is declared as unsigned int (32-bit), but dm_sector_div_up() returns sector_t (64-bit). When a device-mapper target has a sufficiently large ti->len with a small region_size, the division result can exceed UINT_MAX. The truncated value is then used to calculate bitset_size, causing clean_bits, sync_bits, and recovering_bits to be allocated far smaller than needed for the actual number of regions. Subsequent log operations (log_set_bit, log_clear_bit, log_test_bit) use region indices derived from the full untruncated region space, causing out-of-bounds writes to kernel heap memory allocated by vmalloc. This can be reproduced by creating a mirror target whose region_count overflows 32 bits: dmsetup create bigzero --table '0 8589934594 zero' dmsetup create mymirror --table '0 8589934594 mirror \ core 2 2 nosync 2 /dev/mapper/bigzero 0 \ /dev/mapper/bigzero 0' The status output confirms the truncation (sync_count=1 instead of 4294967297, because 0x100000001 was truncated to 1): $ dmsetup status mymirror 0 8589934594 mirror 2 254:1 254:1 1/4294967297 ... This leads to a kernel crash in core_in_sync: BUG: scheduling while atomic: (udev- worker)/9150/0x00000000 RIP: 0010:core_in_sync+0x14/0x30 [dm_log] CR2: 0000000000000008 Fixing recursive fault but reboot is needed! Fix by widening the local region_count to sector_t and adding an explicit overflow check before the value is assigned to lc->region_count. (CVE-2026-53059)

 - In the Linux kernel, the following vulnerability has been resolved: netfilter: require Ethernet MAC header before using eth_hdr() `ip6t_eui64`, `xt_mac`, the `bitmap:ip,mac`, `hash:ip,mac`, and `hash:mac` ipset types, and `nf_log_syslog` access `eth_hdr(skb)` after either assuming that the skb is associated with an Ethernet device or checking only that the `ETH_HLEN` bytes at `skb_mac_header(skb)` lie between `skb->head` and `skb->data`. Make these paths first verify that the skb is associated with an Ethernet device, that the MAC header was set, and that it spans at least a full Ethernet header before accessing `eth_hdr(skb)`. (CVE-2026-53131)

 - In the Linux kernel, the following vulnerability has been resolved: RDMA/mlx5: Fix integer overflow of user QP buffer size set_user_buf_size() computes the QP buffer size by left-shifting the user-supplied rq.wqe_cnt and rq.wqe_shift values as signed integers. A sufficiently large rq.wqe_cnt causes signed integer overflow, which is undefined behavior, and yields a small or negative buf_size, causing ib_umem_get() to map a buffer smaller than the hardware will actually write into. Replace the shifts and addition with check_shl_overflow() and check_add_overflow(), rejecting invalid user inputs. Moreover, guard the identical shift computing qp->sq.offset in _create_user_qp() before set_user_buf_size() is reached. (CVE-2026-90435)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected packages based on the guidance in TuxCare advisory CENTOS-STREAM8:CLSA-2026:1792759740.

See Also

https://cve.tuxcare.com/els/releases/CLSA-2026:1792759740

http://www.nessus.org/u?53453c9a

Plugin Details

Severity: High

ID: 371420

File Name: tuxcare_centos_8_CLSA-2026-1792759740.nasl

Version: 1.3

Type: Local

Agent: unix

Published: 10/23/2026

Updated: 11/12/2026

Supported Sensors: Nessus Agent, Continuous Assessment, Tenable Cloud Security, Tenable Self-Hosted Container Security, Nessus

Risk Information

VPR

Risk Factor: Critical

Score: 9.2

Percentile: 99.77

Vendor

Vendor Severity: Critical

CVSS v2

Risk Factor: Medium

Base Score: 6.8

Temporal Score: 5.6

Vector: CVSS2#AV:L/AC:L/Au:S/C:C/I:C/A:C

CVSS Score Source: CVE-2026-64362

CVSS v3

Risk Factor: High

Base Score: 7.8

Temporal Score: 7.2

Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:F/RL:O/RC:C

Vulnerability Information

Required KB Items: Host/local_checks_enabled, Host/CentOS/release, Host/CentOS/rpm-list, Host/OS/extended-third-party

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 10/23/2026

Vulnerability Publication Date: 7/21/2021

Reference Information

CVE: CVE-2022-50697, CVE-2023-53800, CVE-2026-43503, CVE-2026-45856, CVE-2026-45861, CVE-2026-45970, CVE-2026-45984, CVE-2026-46043, CVE-2026-46047, CVE-2026-46056, CVE-2026-46119, CVE-2026-46120, CVE-2026-46133, CVE-2026-46149, CVE-2026-46180, CVE-2026-46181, CVE-2026-46189, CVE-2026-46209, CVE-2026-46227, CVE-2026-46259, CVE-2026-46294, CVE-2026-52912, CVE-2026-52920, CVE-2026-52923, CVE-2026-52924, CVE-2026-52935, CVE-2026-52942, CVE-2026-52947, CVE-2026-52957, CVE-2026-52986, CVE-2026-52993, CVE-2026-53002, CVE-2026-53004, CVE-2026-53006, CVE-2026-53016, CVE-2026-53059, CVE-2026-53062, CVE-2026-53071, CVE-2026-53075, CVE-2026-53078, CVE-2026-53089, CVE-2026-53131, CVE-2026-53136, CVE-2026-53148, CVE-2026-53149, CVE-2026-53182, CVE-2026-53195, CVE-2026-53223, CVE-2026-53228, CVE-2026-53239, CVE-2026-53254, CVE-2026-53255, CVE-2026-53256, CVE-2026-53264, CVE-2026-53265, CVE-2026-53268, CVE-2026-53270, CVE-2026-53374, CVE-2026-53391, CVE-2026-53397, CVE-2026-63794, CVE-2026-63800, CVE-2026-63801, CVE-2026-63886, CVE-2026-63887, CVE-2026-63892, CVE-2026-63922, CVE-2026-63975, CVE-2026-63992, CVE-2026-63994, CVE-2026-64002, CVE-2026-64007, CVE-2026-64009, CVE-2026-64015, CVE-2026-64018, CVE-2026-64047, CVE-2026-64102, CVE-2026-64113, CVE-2026-64114, CVE-2026-64115, CVE-2026-64189, CVE-2026-64191, CVE-2026-64276, CVE-2026-64277, CVE-2026-64320, CVE-2026-64351, CVE-2026-64362, CVE-2026-64546, CVE-2026-64548, CVE-2026-72157, CVE-2026-72262, CVE-2026-74287, CVE-2026-74377, CVE-2026-74480, CVE-2026-74581, CVE-2026-80714, CVE-2026-89537, CVE-2026-89569, CVE-2026-89575, CVE-2026-89655, CVE-2026-89656, CVE-2026-89699, CVE-2026-89729, CVE-2026-89786, CVE-2026-89823, CVE-2026-89854, CVE-2026-89856, CVE-2026-89861, CVE-2026-89893, CVE-2026-89932, CVE-2026-89965, CVE-2026-90000, CVE-2026-90011, CVE-2026-90033, CVE-2026-90103, CVE-2026-90203, CVE-2026-90334, CVE-2026-90335, CVE-2026-90382, CVE-2026-90413, CVE-2026-90414, CVE-2026-90435, CVE-2026-93054, CVE-2026-93262, CVE-2026-93791, CVE-2026-98025, CVE-2026-98116, CVE-2026-98130, CVE-2026-98185, CVE-2026-98222, CVE-2026-98323, CVE-2026-98343, CVE-2026-98360, CVE-2026-98375, CVE-2026-99284

CLSA: 2026:1792759740