Rocky Linux 9.6 [TuxCare] Security Update: kernel / kernel-64k / kernel-64k-core / kernel-64k-debug / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1792762308)

high Nessus Plugin ID 371428

Language:

Synopsis

The Rocky Linux host is missing one or more security updates.

Description

The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1792762308 advisory.

- In the Linux kernel, the following vulnerability has been resolved: netfilter: ipset: fix race between dump and ip_set_list resize The release path of ip_set_dump_do() and ip_set_dump_done() read inst->ip_set_list via ip_set_ref_netlink(), a plain rcu_dereference_raw() of the array pointer. These run from netlink_recvmsg() without the nfnl mutex and without an RCU read-side critical section. A concurrent ip_set_create() can grow the array: it publishes the new array, calls synchronize_net() and then kvfree()s the old one. Since the dump paths read the array outside any RCU reader, synchronize_net() does not wait for them and the old array can be freed while they still index into it, causing a use-after-free. The dumped set itself stays pinned via set->ref_netlink, so only the array load needs protecting. Take rcu_read_lock() around it, matching ip_set_get_byname() and __ip_set_put_byindex(). BUG: KASAN: slab-use- after-free in ip_set_dump_do (net/netfilter/ipset/ip_set_core.c:1697) Read of size 8 at addr ffff88800b5c4018 by task exploit/150 Call Trace: ... kasan_report (mm/kasan/report.c:595) ip_set_dump_do (net/netfilter/ipset/ip_set_core.c:1697) netlink_dump (net/netlink/af_netlink.c:2325) netlink_recvmsg (net/netlink/af_netlink.c:1976) sock_recvmsg (net/socket.c:1159) __sys_recvfrom (net/socket.c:2315) ...
Oops: general protection fault, probably for non-canonical address ... KASAN NOPTI KASAN: maybe wild- memory-access in range [0x02d6...d0-0x02d6...d7] RIP: 0010:ip_set_dump_do (net/netfilter/ipset/ip_set_core.c:1698) Kernel panic - not syncing: Fatal exception (CVE-2026-64189)

- In the Linux kernel, the following vulnerability has been resolved: dm log: fix out-of-bounds write due to region_count overflow The local variable region_count in create_log_context() is declared as unsigned int (32-bit), but dm_sector_div_up() returns sector_t (64-bit). When a device-mapper target has a sufficiently large ti->len with a small region_size, the division result can exceed UINT_MAX. The truncated value is then used to calculate bitset_size, causing clean_bits, sync_bits, and recovering_bits to be allocated far smaller than needed for the actual number of regions. Subsequent log operations (log_set_bit, log_clear_bit, log_test_bit) use region indices derived from the full untruncated region space, causing out-of-bounds writes to kernel heap memory allocated by vmalloc. This can be reproduced by creating a mirror target whose region_count overflows 32 bits: dmsetup create bigzero --table '0 8589934594 zero' dmsetup create mymirror --table '0 8589934594 mirror \ core 2 2 nosync 2 /dev/mapper/bigzero 0 \ /dev/mapper/bigzero 0' The status output confirms the truncation (sync_count=1 instead of 4294967297, because 0x100000001 was truncated to 1): $ dmsetup status mymirror 0 8589934594 mirror 2 254:1 254:1 1/4294967297 ... This leads to a kernel crash in core_in_sync: BUG: scheduling while atomic: (udev- worker)/9150/0x00000000 RIP: 0010:core_in_sync+0x14/0x30 [dm_log] CR2: 0000000000000008 Fixing recursive fault but reboot is needed! Fix by widening the local region_count to sector_t and adding an explicit overflow check before the value is assigned to lc->region_count. (CVE-2026-53059)

- In the Linux kernel, the following vulnerability has been resolved: ipv6: fix fib6 walker UAF on seq stop ipv6_route_iter_active() treats a walker in FWS_U at the table root as already unlinked. fib6_del_route() can move a still-linked walker into that same state when the current leaf is the last route at the root, so ipv6_route_native_seq_stop() skips fib6_walker_unlink(). The seq private object can then be freed while it remains on net->ipv6.fib6_walkers. A later route deletion walks the dangling list and uses the freed walker. Use the list head as membership state and reinitialize it when unlinking. Keep the existing w->node check so a never-started iterator with a zeroed private object is not treated as linked. The same stop helper is used by /proc/net/ipv6_route and by the BPF ipv6_route iterator. The BPF show path only widens the race. (CVE-2026-97940)

- In the Linux kernel, the following vulnerability has been resolved: fanotify: fix false positive on permission events fsnotify_get_mark_safe() may return false for a mark on an unrelated group, which results in bypassing the permission check. Fix by skipping over detached marks that are not in the current group. (CVE-2026-46150)

- In the Linux kernel, the following vulnerability has been resolved: nvmet: fix NULL pointer dereference in nvmet_execute_identify_ns_zns() When a host issues an Identify command with CNS 05h (I/O Command Set specific Identify Namespace) and CSI 02h (ZNS) targeting a file-backed namespace, nvmet_execute_identify_ns_zns() calls bdev_is_zoned() on req->ns->bdev. A file-backed namespace has no block device, so req->ns->bdev is NULL and bdev_is_zoned() dereferences it, oopsing. The I/O command set is selected by the host-supplied CSI field and the command is routed here whenever CONFIG_BLK_DEV_ZONED is enabled, independent of the namespace backing type, so any file-backed namespace is exposed. Reject the command with Invalid Field when the namespace is not backed by a block device. (CVE-2026-90228)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected packages based on the guidance in TuxCare advisory ALMALINUX9.6:CLSA-2026:1792762308.

Plugin Details

Severity: High

ID: 371428

File Name: tuxcare_rocky_linux_9.6_CLSA-2026-1792762308.nasl

Version: 1.2

Type: Local

Family: Rocky Linux Local Security Checks

Published: 10/23/2026

Updated: 11/12/2026

Supported Sensors: Nessus Agent, Continuous Assessment, Tenable Cloud Security, Tenable Self-Hosted Container Security, Nessus

Risk Information

VPR

Risk Factor: High

Score: 7.9

Percentile: 99.34

Vendor

Vendor Severity: Critical

CVSS v2

Risk Factor: Medium

Base Score: 6.8

Temporal Score: 5.3

Vector: CVSS2#AV:L/AC:L/Au:S/C:C/I:C/A:C

CVSS Score Source: CVE-2026-63794

CVSS v3

Risk Factor: High

Base Score: 7.8

Temporal Score: 7

Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

Vulnerability Information

Required KB Items: Host/local_checks_enabled, Host/cpu, Host/RockyLinux/release, Host/RockyLinux/rpm-list, Host/OS/extended-third-party

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 10/23/2026

Vulnerability Publication Date: 5/9/2025

Reference Information

CVE: CVE-2025-37861, CVE-2025-40284, CVE-2025-40344, CVE-2026-43038, CVE-2026-45852, CVE-2026-45857, CVE-2026-45861, CVE-2026-45898, CVE-2026-45957, CVE-2026-45984, CVE-2026-46120, CVE-2026-46150, CVE-2026-46155, CVE-2026-46209, CVE-2026-46227, CVE-2026-46266, CVE-2026-46323, CVE-2026-46324, CVE-2026-52951, CVE-2026-52956, CVE-2026-52998, CVE-2026-53004, CVE-2026-53006, CVE-2026-53059, CVE-2026-53078, CVE-2026-53089, CVE-2026-53129, CVE-2026-53185, CVE-2026-53203, CVE-2026-53228, CVE-2026-53230, CVE-2026-53242, CVE-2026-53275, CVE-2026-53398, CVE-2026-63794, CVE-2026-63887, CVE-2026-64002, CVE-2026-64007, CVE-2026-64015, CVE-2026-64121, CVE-2026-64189, CVE-2026-64378, CVE-2026-68176, CVE-2026-68201, CVE-2026-68236, CVE-2026-68405, CVE-2026-72029, CVE-2026-72157, CVE-2026-72261, CVE-2026-72402, CVE-2026-72413, CVE-2026-72469, CVE-2026-74287, CVE-2026-74289, CVE-2026-74387, CVE-2026-74390, CVE-2026-74394, CVE-2026-74408, CVE-2026-74444, CVE-2026-74469, CVE-2026-74470, CVE-2026-74480, CVE-2026-74498, CVE-2026-74518, CVE-2026-74569, CVE-2026-74581, CVE-2026-80613, CVE-2026-89448, CVE-2026-89478, CVE-2026-89508, CVE-2026-89533, CVE-2026-89542, CVE-2026-89550, CVE-2026-89553, CVE-2026-89559, CVE-2026-89575, CVE-2026-89671, CVE-2026-89690, CVE-2026-89699, CVE-2026-89712, CVE-2026-89729, CVE-2026-89786, CVE-2026-89847, CVE-2026-89932, CVE-2026-89965, CVE-2026-90000, CVE-2026-90033, CVE-2026-90067, CVE-2026-90103, CVE-2026-90203, CVE-2026-90228, CVE-2026-90334, CVE-2026-90335, CVE-2026-90382, CVE-2026-90383, CVE-2026-90393, CVE-2026-90413, CVE-2026-90414, CVE-2026-93054, CVE-2026-93262, CVE-2026-93791, CVE-2026-93822, CVE-2026-93826, CVE-2026-93830, CVE-2026-97427, CVE-2026-97448, CVE-2026-97509, CVE-2026-97539, CVE-2026-97564, CVE-2026-97596, CVE-2026-97612, CVE-2026-97940, CVE-2026-98015, CVE-2026-98025, CVE-2026-98041, CVE-2026-98066, CVE-2026-98077, CVE-2026-98130, CVE-2026-98175, CVE-2026-98185, CVE-2026-98196, CVE-2026-98217, CVE-2026-98264, CVE-2026-98276, CVE-2026-98374, CVE-2026-98375, CVE-2026-98383, CVE-2026-99284

CLSA: 2026:1792762308

Detections

Analytics