Detections
Analytics

CentOS Linux 7 [TuxCare] Security Update: bpftool / kernel / kernel-debug / kernel-debug-devel / kernel-devel / etc Multiple Vulnerabilities (CENTOS7:CLSA-2026:1792751247)

medium Nessus Plugin ID 372116

Synopsis

The CentOS Linux host is missing one or more security updates.

Description

The CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS7:CLSA-2026:1792751247 advisory.

 - In the Linux kernel, the following vulnerability has been resolved: mmmremap.c: avoid pointless invalidate_range_start/end on mremap(old_size=0) If an mremap() syscall with old_size=0 ends up in move_page_tables(), it will call invalidate_range_start()/invalidate_range_end() unnecessarily, i.e. with an empty range. This causes a WARN in KVM's mmu_notifier. In the past, empty ranges have been diagnosed to be off-by-one bugs, hence the WARNing. Given the low (so far) number of unique reports, the benefits of detecting more buggy callers seem to outweigh the cost of having to fix cases such as this one, where userspace is doing something silly. In this particular case, an early return from move_page_tables() is enough to fix the issue. (CVE-2022-49077)

 - In the Linux kernel, the following vulnerability has been resolved: virtio_console: eliminate anonymous module_init & module_exit Eliminate anonymous module_init() and module_exit(), which can lead to confusion or ambiguity when reading System.map, crashes/oops/bugs, or an initcall_debug log. Give each of these init and exit functions unique driver-specific names to eliminate the anonymous names. Example 1: (System.map) ffffffff832fc78c t init ffffffff832fc79e t init ffffffff832fc8f8 t init Example 2: (initcall_debug log) calling init+0x0/0x12 @ 1 initcall init+0x0/0x12 returned 0 after 15 usecs calling init+0x0/0x60 @ 1 initcall init+0x0/0x60 returned 0 after 2 usecs calling init+0x0/0x9a @ 1 initcall init+0x0/0x9a returned 0 after 74 usecs (CVE-2022-49100)

 - In the Linux kernel, the following vulnerability has been resolved: mtd: Fix device name leak when register device failed in add_mtd_device() There is a kmemleak when register device failed: unreferenced object 0xffff888101aab550 (size 8): comm insmod, pid 3922, jiffies 4295277753 (age 925.408s) hex dump (first 8 bytes): 6d 74 64 30 00 88 ff ff mtd0.... backtrace: [<00000000bde26724>]
 __kmalloc_node_track_caller+0x4e/0x150 [<000000003c32b416>] kvasprintf+0xb0/0x130 [<000000001f7a8f15>] kobject_set_name_vargs+0x2f/0xb0 [<000000006e781163>] dev_set_name+0xab/0xe0 [<00000000e30d0c78>] add_mtd_device+0x4bb/0x700 [<00000000f3d34de7>] mtd_device_parse_register+0x2ac/0x3f0 [<00000000c0d88488>] 0xffffffffa0238457 [<00000000b40d0922>] 0xffffffffa02a008f [<0000000023d17b9d>] do_one_initcall+0x87/0x2a0 [<00000000770f6ca6>] do_init_module+0xdf/0x320 [<000000007b6768fe>] load_module+0x2f98/0x3330 [<00000000346bed5a>] __do_sys_finit_module+0x113/0x1b0 [<00000000674c2290>] do_syscall_64+0x35/0x80 [<000000004c6a8d97>] entry_SYSCALL_64_after_hwframe+0x46/0xb0 If register device failed, should call put_device() to give up the reference. (CVE-2022-50566)

 - In the Linux kernel, the following vulnerability has been resolved: media: dvb-frontends: fix leak of memory fw (CVE-2022-50664)

 - In the Linux kernel, the following vulnerability has been resolved: acct: fix potential integer overflow in encode_comp_t() The integer overflow is descripted with following codes: > 317 static comp_t encode_comp_t(u64 value) > 318 { > 319 int exp, rnd; ...... > 341 exp <<= MANTSIZE; > 342 exp += value; > 343 return exp; > 344 } Currently comp_t is defined as type of '__u16', but the variable 'exp' is type of 'int', so overflow would happen when variable 'exp' in line 343 is greater than 65535. (CVE-2022-50749)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected packages based on the guidance in TuxCare advisory CENTOS7:CLSA-2026:1792751247.

See Also

https://cve.tuxcare.com/els/releases/CLSA-2026:1792751247

http://www.nessus.org/u?30666fc8

Plugin Details

Severity: Medium

ID: 372116

File Name: tuxcare_centos_7_CLSA-2026-1792751247.nasl

Version: 1.1

Type: Local

Agent: unix

Published: 10/26/2026

Updated: 10/26/2026

Supported Sensors: Nessus Agent, Continuous Assessment, Nessus

Risk Information

VPR

Risk Factor: High

Score: 7.9

Percentile: 99.35

Vendor

Vendor Severity: Important

CVSS v2

Risk Factor: Medium

Base Score: 4.6

Temporal Score: 3.8

Vector: CVSS2#AV:L/AC:L/Au:S/C:N/I:N/A:C

CVSS Score Source: CVE-2022-49100

CVSS v3

Risk Factor: Medium

Base Score: 5.5

Temporal Score: 5.1

Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Temporal Vector: CVSS:3.0/E:F/RL:O/RC:C

Vulnerability Information

Required KB Items: Host/local_checks_enabled, Host/CentOS/release, Host/CentOS/rpm-list, Host/OS/extended-third-party

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 10/23/2026

Vulnerability Publication Date: 7/21/2021

Reference Information

CVE: CVE-2022-49077, CVE-2022-49100, CVE-2022-50566, CVE-2022-50664, CVE-2022-50749, CVE-2022-50764, CVE-2022-50821, CVE-2026-46331, CVE-2026-63890, CVE-2026-63922, CVE-2026-63957, CVE-2026-64487, CVE-2026-64580, CVE-2026-64585, CVE-2026-68338, CVE-2026-68432, CVE-2026-72096, CVE-2026-72144, CVE-2026-72240, CVE-2026-72256, CVE-2026-72297, CVE-2026-72348, CVE-2026-74290, CVE-2026-74308, CVE-2026-74339, CVE-2026-74416, CVE-2026-74424, CVE-2026-74443, CVE-2026-74457, CVE-2026-74458, CVE-2026-74471, CVE-2026-74473, CVE-2026-74474, CVE-2026-74475, CVE-2026-74495, CVE-2026-74497, CVE-2026-74507, CVE-2026-74547, CVE-2026-74557, CVE-2026-80579, CVE-2026-80580, CVE-2026-80593, CVE-2026-80603, CVE-2026-80714, CVE-2026-80717, CVE-2026-80755, CVE-2026-80757, CVE-2026-80781, CVE-2026-80782, CVE-2026-80793, CVE-2026-80812, CVE-2026-80814, CVE-2026-80830, CVE-2026-80843, CVE-2026-80890, CVE-2026-80948, CVE-2026-80949, CVE-2026-80964, CVE-2026-80969, CVE-2026-80972, CVE-2026-80974, CVE-2026-80987, CVE-2026-89478, CVE-2026-89479, CVE-2026-89484, CVE-2026-89525, CVE-2026-89531, CVE-2026-89551, CVE-2026-89569, CVE-2026-89573, CVE-2026-89582, CVE-2026-89627, CVE-2026-89642, CVE-2026-89649, CVE-2026-89707, CVE-2026-89726, CVE-2026-90318, CVE-2026-90336, CVE-2026-90403, CVE-2026-90415, CVE-2026-90434, CVE-2026-92521, CVE-2026-93055, CVE-2026-93108, CVE-2026-93188, CVE-2026-93261, CVE-2026-93804, CVE-2026-97540, CVE-2026-97565, CVE-2026-98364

CLSA: 2026:1792751247