Detections
Analytics

AlmaLinux 9.2 [TuxCare] Security Update: bpftool / kernel / kernel-64k / kernel-64k-core / kernel-64k-debug / etc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1793786843)

high Nessus Plugin ID 376201

Synopsis

The AlmaLinux host is missing one or more security updates.

Description

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1793786843 advisory.

 - In the Linux kernel, the following vulnerability has been resolved: soc: qcom: qmi_encdec: Restrict string length in decode The QMI TLV value for strings in a lot of qmi element info structures account for null terminated strings with MAX_LEN + 1. If a string is actually MAX_LEN + 1 length, this will cause an out of bounds access when the NULL character is appended in decoding. (CVE-2023-53729)

 - In the Linux kernel, the following vulnerability has been resolved: rv: Use strings in da monitors tracepoints Using DA monitors tracepoints with KASAN enabled triggers the following warning: BUG: KASAN:
 global-out-of-bounds in do_trace_event_raw_event_event_da_monitor+0xd6/0x1a0 Read of size 32 at addr ffffffffaada8980 by task ... Call Trace: <TASK> [...] do_trace_event_raw_event_event_da_monitor+0xd6/0x1a0 ? __pfx_do_trace_event_raw_event_event_da_monitor+0x10/0x10 ? trace_event_sncid+0x83/0x200 trace_event_sncid+0x163/0x200 [...] The buggy address belongs to the variable: automaton_snep+0x4e0/0x5e0 This is caused by the tracepoints reading 32 bytes __array instead of __string from the automata definition. Such strings are literals and reading 32 bytes ends up in out of bound memory accesses (e.g.
 the next automaton's data in this case). The error is harmless as, while printing the string, we stop at the null terminator, but it should still be fixed. Use the __string facilities while defining the tracepoints to avoid reading out of bound memory. (CVE-2025-38636)

 - In the Linux kernel, the following vulnerability has been resolved: perf: arm_spe: Prevent overflow in PERF_IDX2OFF() Cast nr_pages to unsigned long to avoid overflow when handling large AUX buffer sizes (>= 2 GiB). (CVE-2025-40081)

 - In the Linux kernel, the following vulnerability has been resolved: arch_topology: Fix incorrect error check in topology_parse_cpu_capacity() Fix incorrect use of PTR_ERR_OR_ZERO() in topology_parse_cpu_capacity() which causes the code to proceed with NULL clock pointers. The current logic uses !PTR_ERR_OR_ZERO(cpu_clk) which evaluates to true for both valid pointers and NULL, leading to potential NULL pointer dereference in clk_get_rate(). Per include/linux/err.h documentation, PTR_ERR_OR_ZERO(ptr) returns: The error code within @ptr if it is an error pointer; 0 otherwise. This means PTR_ERR_OR_ZERO() returns 0 for both valid pointers AND NULL pointers. Therefore !PTR_ERR_OR_ZERO(cpu_clk) evaluates to true (proceed) when cpu_clk is either valid or NULL, causing clk_get_rate(NULL) to be called when of_clk_get() returns NULL. Replace with !IS_ERR_OR_NULL(cpu_clk) which only proceeds for valid pointers, preventing potential NULL pointer dereference in clk_get_rate().
 (CVE-2025-40346)

 - In the Linux kernel, the following vulnerability has been resolved: platform/x86/amd/pmc: Add support for Van Gogh SoC The ROG Xbox Ally (non-X) SoC features a similar architecture to the Steam Deck. While the Steam Deck supports S3 (s2idle causes a crash), this support was dropped by the Xbox Ally which only S0ix suspend. Since the handler is missing here, this causes the device to not suspend and the AMD GPU driver to crash while trying to resume afterwards due to a power hang. (CVE-2025-68334)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected packages based on the guidance in TuxCare advisory ALMALINUX9.2:CLSA-2026:1793786843.

See Also

https://cve.tuxcare.com/els/releases/CLSA-2026:1793786843

http://www.nessus.org/u?dd55c3f4

Plugin Details

Severity: High

ID: 376201

File Name: tuxcare_alma_linux_9.2_CLSA-2026-1793786843.nasl

Version: 1.1

Type: Local

Published: 11/5/2026

Updated: 11/5/2026

Supported Sensors: Nessus Agent, Continuous Assessment, Nessus

Risk Information

VPR

Risk Factor: High

Score: 7.7

Percentile: 98.94

Vendor

Vendor Severity: Critical

CVSS v2

Risk Factor: Low

Base Score: 2.1

Temporal Score: 1.6

Vector: CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:N

CVSS Score Source: CVE-2022-26966

CVSS v3

Risk Factor: High

Base Score: 7.1

Temporal Score: 6.2

Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

CVSS Score Source: CVE-2025-38636

Vulnerability Information

Required KB Items: Host/local_checks_enabled, Host/cpu, Host/AlmaLinux/release, Host/AlmaLinux/rpm-list, Host/OS/extended-third-party

Exploit Ease: No known exploits are available

Patch Publication Date: 11/4/2026

Vulnerability Publication Date: 7/21/2021

Reference Information

CVE: CVE-2022-26966, CVE-2022-49118, CVE-2023-53729, CVE-2023-54007, CVE-2023-54116, CVE-2024-46777, CVE-2024-47707, CVE-2025-38636, CVE-2025-40056, CVE-2025-40081, CVE-2025-40102, CVE-2025-40206, CVE-2025-40257, CVE-2025-40273, CVE-2025-40297, CVE-2025-40338, CVE-2025-40346, CVE-2025-40359, CVE-2025-68171, CVE-2025-68334, CVE-2025-68345, CVE-2025-68758, CVE-2025-68770, CVE-2025-68783, CVE-2026-100070, CVE-2026-23178, CVE-2026-31674, CVE-2026-31779, CVE-2026-43018, CVE-2026-43139, CVE-2026-45846, CVE-2026-45917, CVE-2026-46149, CVE-2026-46168, CVE-2026-46292, CVE-2026-52925, CVE-2026-52982, CVE-2026-53208, CVE-2026-53258, CVE-2026-53403, CVE-2026-63803, CVE-2026-63822, CVE-2026-63826, CVE-2026-63890, CVE-2026-63913, CVE-2026-63920, CVE-2026-63925, CVE-2026-63940, CVE-2026-63942, CVE-2026-63947, CVE-2026-63974, CVE-2026-63985, CVE-2026-63990, CVE-2026-64006, CVE-2026-64125, CVE-2026-64126, CVE-2026-64133, CVE-2026-64144, CVE-2026-64155, CVE-2026-64178, CVE-2026-64222, CVE-2026-64316, CVE-2026-64487, CVE-2026-64538, CVE-2026-64540, CVE-2026-64547, CVE-2026-64554, CVE-2026-64580, CVE-2026-68197, CVE-2026-68247, CVE-2026-68293, CVE-2026-68299, CVE-2026-68309, CVE-2026-68325, CVE-2026-68326, CVE-2026-68328, CVE-2026-68403, CVE-2026-68405, CVE-2026-68476, CVE-2026-68479, CVE-2026-72005, CVE-2026-72019, CVE-2026-72020, CVE-2026-72051, CVE-2026-72052, CVE-2026-72061, CVE-2026-72088, CVE-2026-72099, CVE-2026-72106, CVE-2026-72107, CVE-2026-72108, CVE-2026-72250, CVE-2026-72251, CVE-2026-72256, CVE-2026-72297, CVE-2026-72301, CVE-2026-72307, CVE-2026-72312, CVE-2026-72316, CVE-2026-72341, CVE-2026-72342, CVE-2026-72343, CVE-2026-72347, CVE-2026-72348, CVE-2026-72392, CVE-2026-72420, CVE-2026-72435, CVE-2026-72436, CVE-2026-72439, CVE-2026-72502, CVE-2026-74271, CVE-2026-74291, CVE-2026-74295, CVE-2026-74300, CVE-2026-74317, CVE-2026-74330, CVE-2026-74376, CVE-2026-74379, CVE-2026-74398, CVE-2026-74407, CVE-2026-74410, CVE-2026-74424, CVE-2026-74427, CVE-2026-74455, CVE-2026-74456, CVE-2026-74457, CVE-2026-74458, CVE-2026-74460, CVE-2026-74473, CVE-2026-74474, CVE-2026-74475, CVE-2026-74476, CVE-2026-74488, CVE-2026-74507, CVE-2026-74508, CVE-2026-74512, CVE-2026-74516, CVE-2026-74519, CVE-2026-74523, CVE-2026-74537, CVE-2026-74564, CVE-2026-74598, CVE-2026-74612, CVE-2026-74615, CVE-2026-74623, CVE-2026-74668, CVE-2026-74684, CVE-2026-74691, CVE-2026-74695, CVE-2026-80572, CVE-2026-80579, CVE-2026-80603, CVE-2026-80634, CVE-2026-80637, CVE-2026-80653, CVE-2026-80659, CVE-2026-80664, CVE-2026-80714, CVE-2026-80715, CVE-2026-80785, CVE-2026-80884, CVE-2026-80944, CVE-2026-80947, CVE-2026-80963, CVE-2026-80964, CVE-2026-80967, CVE-2026-80969, CVE-2026-80972, CVE-2026-80973, CVE-2026-81005, CVE-2026-81007, CVE-2026-89441, CVE-2026-89444, CVE-2026-89484, CVE-2026-89511, CVE-2026-89515, CVE-2026-89531, CVE-2026-89554, CVE-2026-89557, CVE-2026-89561, CVE-2026-89569, CVE-2026-89573, CVE-2026-89582, CVE-2026-89662, CVE-2026-89665, CVE-2026-89666, CVE-2026-89672, CVE-2026-89693, CVE-2026-89696, CVE-2026-89697, CVE-2026-89702, CVE-2026-89704, CVE-2026-89707, CVE-2026-89783, CVE-2026-89843, CVE-2026-89845, CVE-2026-89848, CVE-2026-89850, CVE-2026-89855, CVE-2026-89858, CVE-2026-89864, CVE-2026-89865, CVE-2026-89897, CVE-2026-89970, CVE-2026-89975, CVE-2026-89997, CVE-2026-90002, CVE-2026-90056, CVE-2026-90088, CVE-2026-90097, CVE-2026-90104, CVE-2026-90128, CVE-2026-90141, CVE-2026-90148, CVE-2026-90196, CVE-2026-90198, CVE-2026-90202, CVE-2026-90284, CVE-2026-90285, CVE-2026-90345, CVE-2026-90385, CVE-2026-90388, CVE-2026-90407, CVE-2026-92496, CVE-2026-92524, CVE-2026-93062, CVE-2026-93149, CVE-2026-93213, CVE-2026-93271, CVE-2026-93281, CVE-2026-93781, CVE-2026-93783, CVE-2026-93788, CVE-2026-93789, CVE-2026-93792, CVE-2026-93793, CVE-2026-93796, CVE-2026-93797, CVE-2026-93799, CVE-2026-93804, CVE-2026-97441, CVE-2026-97442, CVE-2026-97516, CVE-2026-97523, CVE-2026-97532, CVE-2026-97537, CVE-2026-97572, CVE-2026-97573, CVE-2026-97613, CVE-2026-97930, CVE-2026-97977, CVE-2026-97978, CVE-2026-97987, CVE-2026-97992, CVE-2026-97997, CVE-2026-97998, CVE-2026-98003, CVE-2026-98014, CVE-2026-98023, CVE-2026-98076, CVE-2026-98078, CVE-2026-98099, CVE-2026-98102, CVE-2026-98128, CVE-2026-98129, CVE-2026-98148, CVE-2026-98157, CVE-2026-98158, CVE-2026-98159, CVE-2026-98186, CVE-2026-98201, CVE-2026-98202, CVE-2026-98204, CVE-2026-98205, CVE-2026-98213, CVE-2026-98246, CVE-2026-98247, CVE-2026-98252, CVE-2026-98262, CVE-2026-98273, CVE-2026-98287, CVE-2026-98297, CVE-2026-98301, CVE-2026-98314, CVE-2026-98321, CVE-2026-98322, CVE-2026-98333, CVE-2026-98334, CVE-2026-98338, CVE-2026-98339, CVE-2026-98345, CVE-2026-98347, CVE-2026-98379, CVE-2026-98381, CVE-2026-98398, CVE-2026-98404, CVE-2026-98417, CVE-2026-98419, CVE-2026-98427, CVE-2026-98428, CVE-2026-98429, CVE-2026-98442, CVE-2026-98451, CVE-2026-98454, CVE-2026-98457, CVE-2026-98460, CVE-2026-98484, CVE-2026-98485, CVE-2026-98488, CVE-2026-98489, CVE-2026-98490, CVE-2026-98491, CVE-2026-98494, CVE-2026-98531, CVE-2026-98532, CVE-2026-98547, CVE-2026-98549, CVE-2026-98554, CVE-2026-98568, CVE-2026-98594, CVE-2026-98598, CVE-2026-98612, CVE-2026-98624, CVE-2026-98626, CVE-2026-98631, CVE-2026-98636, CVE-2026-98694, CVE-2026-98698, CVE-2026-98704, CVE-2026-98706, CVE-2026-98707, CVE-2026-98709, CVE-2026-98732, CVE-2026-98738, CVE-2026-98741, CVE-2026-98742, CVE-2026-98750, CVE-2026-98775, CVE-2026-98792, CVE-2026-98794, CVE-2026-98810, CVE-2026-98819, CVE-2026-98827, CVE-2026-98829, CVE-2026-98836, CVE-2026-98850, CVE-2026-98851, CVE-2026-98853, CVE-2026-98857, CVE-2026-98881, CVE-2026-98887, CVE-2026-98891, CVE-2026-98892, CVE-2026-98893, CVE-2026-98899, CVE-2026-98902, CVE-2026-98947, CVE-2026-98967, CVE-2026-99008, CVE-2026-99010, CVE-2026-99015, CVE-2026-99019, CVE-2026-99025, CVE-2026-99026, CVE-2026-99027, CVE-2026-99031, CVE-2026-99036, CVE-2026-99037, CVE-2026-99041, CVE-2026-99053, CVE-2026-99057, CVE-2026-99061, CVE-2026-99072, CVE-2026-99081, CVE-2026-99109, CVE-2026-99110, CVE-2026-99112, CVE-2026-99117, CVE-2026-99121, CVE-2026-99128, CVE-2026-99138, CVE-2026-99139, CVE-2026-99152, CVE-2026-99153, CVE-2026-99154, CVE-2026-99156, CVE-2026-99165, CVE-2026-99167, CVE-2026-99175, CVE-2026-99176, CVE-2026-99178, CVE-2026-99179, CVE-2026-99181, CVE-2026-99192, CVE-2026-99206, CVE-2026-99216

CLSA: 2026:1793786843