Detections
Analytics

EulerOS 2.0 SP12 : kernel (EulerOS-SA-2026-4488)

high Nessus Plugin ID 376715

Synopsis

The remote EulerOS host is missing multiple security updates.

Description

According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

 vt: stabilize tty reference in kbd_keycode with tty_port_tty_get(CVE-2026-74675)

 udp: fix potential use-after-free in tunnel segmentation(CVE-2026-74705)

 i2c: stub: Reject I2C block transfers with invalid length(CVE-2026-64191)

 USB: serial: mct_u232: fix memory corruption with small endpoint(CVE-2026-63898)

 apparmor: mediate the implicit connect of TCP fast open sendmsg(CVE-2026-63828)

 audit: fix potential use-after-free in audit_del_rule()(CVE-2026-74512)

 netfilter: ebt_nflog: pin the NFLOG backend(CVE-2026-74660)

 drm/vmwgfx: validate DRAW_PRIMITIVES header size before division(CVE-2026-74444)

 xfrm: fix sk_dst_cache double-free in xfrm_user_policy()(CVE-2026-64581)

 netfilter: synproxy: fix unaligned memory access in timestamp adjustment(CVE-2026-80637)

 macsec: don't read an unset MAC header in macsec_encrypt()(CVE-2026-72019)

 usb: usbtmc: check URB actual_length for interrupt-IN notifications(CVE-2026-63904)

 vhost: fix vhost_get_avail_idx for a non empty ring(CVE-2026-74356)

 net: ip6_vti: require CAP_NET_ADMIN in the device netns for changelink(CVE-2026-72055)

 vxlan: re-fetch eth header after route_shortcircuit()(CVE-2026-80681)

 netfilter: ebtables: zero chainstack array(CVE-2026-64413)

 ceph: avoid fs reclaim while using current-journal_info(CVE-2026-80528)

 net/sched: netem: fix queue limit check to include reordered packets(CVE-2026-52984)

 md/raid5: avoid R5_Overlap races while breaking stripe batches(CVE-2026-72420)

 tpm: tpm_tis_spi: Use wait_woken() in wait_for_tmp_stat()(CVE-2026-72152)

 fbdev: fix use-after-free in store_modes()(CVE-2026-63826)

 crypto: ecc - Fix carry overflow in vli multiplication(CVE-2026-64313)

 parport: Fix race between port and client registration(CVE-2026-63942)

 mm/hugetlb: fix hugetlb cgroup rsvd charge/uncharge mismatch(CVE-2026-72213)

 net: usb: kalmia: bound RX frame length in kalmia_rx_fixup()(CVE-2026-64351)

 netpoll: fix a use-after-free on shutdown path(CVE-2026-64424)

 sctp: fix addr_wq_timer race in sctp_free_addr_wq()(CVE-2026-72383)

 configfs_lookup(): don't leave -s_dentry dangling on failure(CVE-2026-74359)

 netfilter: ipset: fix order of kfree_rcu() and rcu_assign_pointer()(CVE-2026-72435)

 USB: serial: io_edgeport: cap received transmit credits(CVE-2026-68365)

 bpf: sockmap: fix tail fragment offset in bpf_msg_push_data(CVE-2026-63926)

 net: bonding: fix NULL pointer dereference in bond_do_ioctl()(CVE-2026-53337)

 ipv4: igmp: Fix potential UAF in igmp_gq_start_timer()(CVE-2026-72323)

 NFSv4/flexfiles: reject zero filehandle version count(CVE-2026-53392)

 mlxsw: fix refcount leak in mlxsw_sp_vrs_lpm_tree_replace()(CVE-2026-72307)

 tipc: serialize udp bearer replicast list updates(CVE-2026-68323)

 net/liquidio: drop cached VF pci_dev LUT(CVE-2026-72329)

 ipv6: addrconf: bail out of dad_failure when state is no longer POSTDAD(CVE-2026-74398)

 ipvs: do not propagate one-packet flag to synced conns(CVE-2026-80714)

 dm thin metadata: fix metadata snapshot consistency on commit failure(CVE-2026-72108)

 char: tlclk: fix use-after-free in tlclk_cleanup()(CVE-2026-80622)

 udf: validate VAT header length against the VAT inode size(CVE-2026-64323)

 thunderbolt: property: Cap recursion depth in __tb_property_parse_dir()(CVE-2026-63891)

 tracing: Fix use-after-free with same-name named triggers(CVE-2026-89746)

 netfilter: nft_ct: fix missing expect put in obj eval(CVE-2026-52970)

 tipc: reject inverted service ranges from peer bindings(CVE-2026-74281)

 libceph: remove debugfs files before client teardown(CVE-2026-68153)

 net: usb: ipheth: fix carrier_work UAF on disconnect(CVE-2026-74677)

 net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header(CVE-2026-80731)

 fuse: re-lock request before replacing page cache folio(CVE-2026-53388)

 smb: client: fix overflow in passthrough ioctl bounds check(CVE-2026-72310)

 xfrm6: clear dst.dev on error to avoid double netdev_put in xfrm6_fill_dst()(CVE-2026-64580)

 usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers(CVE-2026-63963)

 device property: fix infinite loop in fwnode_for_each_child_node()(CVE-2026-89744)

 netfilter: ipset: fix race between dump and ip_set_list resize(CVE-2026-64189)

 ipvs: clear IPv4 options after rebasing tunnel ICMP errors(CVE-2026-74669)

 usb: xhci: Fix sleep in atomic context in xhci_free_streams()(CVE-2026-64465)

 dm cache metadata: fix memory leak on metadata abort retry(CVE-2026-53060)

 apparmor: aa_label_alloc use aa_label_free on alloc failure(CVE-2026-72459)

 dm-integrity: don't increment hash_offset twice(CVE-2026-72099)

 MIPS: DEC: Prevent initial console buffer from landing in XKPHYS(CVE-2026-64252)

 USB: serial: digi_acceleport: fix broken rx after throttle(CVE-2026-64335)

 ACPI: CPPC: Suppress UBSAN warning caused by field misuse(CVE-2026-64512)

 nfsd: release layout stid on setlease failure(CVE-2026-53399)

 virtiofs: fix UAF on submount umount(CVE-2026-53381)

 crypto: qat - protect service table iterations with service_lock(CVE-2026-64305)

 netfilter: nf_tables: fix dst corruption in same register operation(CVE-2026-64006)

 net/sched: sch_multiq: Replace direct dequeue call with peek and qdisc_dequeue_peeked(CVE-2026-72036)

 netfilter: nf_conntrack_reasm: guard mac_header adjustment after IPv6 defrag(CVE-2026-72250)

 rhashtable: clear stale iter-p on table restart(CVE-2026-64563)

 net: ipv4: bound TCP reordering sysctl writes and MTU probe sizes(CVE-2026-64422)

 Input: elan_i2c - validate firmware size before use(CVE-2026-64237)

 openrisc: signal: do not restore privileged SR bits on sigreturn(CVE-2026-80560)

 usb: typec: tcpm: Validate SVID index in svdm_consume_modes()(CVE-2026-64330)

 KVM: x86/mmu: Fix use-after-free on vendor module reload(CVE-2026-68428)

 ipv6: prevent in6_dev_get() from resurrecting inet6_dev(CVE-2026-74630)

 netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check(CVE-2026-63913)

 fuse: re-lock request before returning from fuse_ref_folio()(CVE-2026-64266)

 cpu: hotplug: Preserve per instance callback errors(CVE-2026-72067)

 USB: serial: safe_serial: fix memory corruption with small endpoint(CVE-2026-63957)

 net: thunderbolt: Tear down DMA paths before stopping the rings(CVE-2026-74691)

 ceph: fix hanging __ceph_get_caps() with stale mds_wanted(CVE-2026-80527)

 vc_screen: fix null-ptr-deref in vcs_notifier() during concurrent vcs_write(CVE-2026-53385)

 net/packet: reset the MAC header on the packet-socket transmit path(CVE-2026-74667)

 KVM: arm64: vgic: Check the interrupt is still ours before migrating it(CVE-2026-72289)

 bpf: Mask pseudo pointer values in verifier logs(CVE-2026-72402)

 vhost/net: complete zerocopy ubufs only once(CVE-2026-74310)

 netfilter: nf_conntrack_sip: validate skb_dst() before accessing it(CVE-2026-72253)

 netfilter: ebtables: module names must be null-terminated(CVE-2026-64412)

 dm_early_create: fix freeing used table on dm_resume failure(CVE-2026-72102)

 tracing: Bound synthetic-field strings with seq_buf(CVE-2026-74391)

 tipc: fix out-of-bounds read in broadcast Gap ACK blocks(CVE-2026-64450)

 vsock/virtio: avoid refilling the RX queue after teardown(CVE-2026-74613)

 vhost: reset the vring metadata cache on vring reconfiguration(CVE-2026-74580)

 netfilter: nf_conntrack_irc: fix parse_dcc() off-by-one OOB read(CVE-2026-80603)

 sctp: validate Adaptation Indication parameter length(CVE-2026-80717)

 netfilter: nft_set_pipapo: don't leak bad clone into future transaction(CVE-2026-72252)

 sctp: avoid auth_enable sysctl UAF during netns teardown(CVE-2026-68162)

 iommu/amd: Wait for completion instead of returning early in iommu_completion_wait()(CVE-2026-68329)

 sctp: add INIT verification after cookie unpacking(CVE-2026-72398)

 xfs: bounds-check buffer log item's dirty bitmap(CVE-2026-80536)

 netfilter: ipset: fix refcount race between list:set GC and swap(CVE-2026-74748)

 drop_monitor: fix size calculations for 64-bit attributes(CVE-2026-68287)

 keys: Pin request_key_auth payload in instantiate paths(CVE-2026-63823)

 net: ip6_tunnel: require CAP_NET_ADMIN in the device netns for changelink(CVE-2026-72051)

 bpf: reject short IPv4/IPv6 inputs in bpf_prog_test_run_skb(CVE-2026-53074)

 usbnet: gl620a: fix out-of-bounds read in genelink_rx_fixup()(CVE-2026-64540)

 xfs: resample the data fork mapping after cycling ILOCK(CVE-2026-64600)

 userfaultfd: gate must_wait writability check on pte_present()(CVE-2026-64514)

 net/sched: serialize qdisc_rtab_list against concurrent get/put(CVE-2026-68138)

 configfs: fix lockless traversals of -s_children(CVE-2026-74330)

 Input: synaptics-rmi4 - fix F55 transmitter electrode count typo(CVE-2026-80754)

 KVM: x86: Unconditionally recompute CR8 intercept on PPR update(CVE-2026-64513)

 net: garp: fix unsigned integer underflow in garp_pdu_parse_attr(CVE-2026-63868)

 libceph: Avoid using invalid osd indices from primary_temp(CVE-2026-80558)

 tunnels: do not assume transport header in iptunnel_pmtud_check_icmp()(CVE-2026-63992)

 crypto: qat - fix VF2PF work teardown race in adf_disable_sriov()(CVE-2026-64438)

 bonding: refuse to enslave CAN devices(CVE-2026-63990)

 tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]()(CVE-2026-63994)

 net: thunderbolt: Fix frags[] overflow by bounding frame_count(CVE-2026-72157)

 entry: Fix seccomp bypass after ptrace with TSYNC(CVE-2026-89603)

 net: af_key: initialize alg_key_len for IPComp states(CVE-2026-64436)

 RDMA/rxe: Fix a use-after-free problem in rxe_mmap(CVE-2026-64582)

 ipv6: Fix null-ptr-deref in fib6_nh_mtu_change().(CVE-2026-64538)

 bpf, sockmap: fix integer overflow in bpf_msg_pop_data() bounds check(CVE-2026-74256)

 netfilter: nf_tables: make nft_object rhltable per table(CVE-2026-74565)

 net/mlx5e: Fix HV VHCA stats agent registration race(CVE-2026-72342)

 USB: serial: keyspan: fix missing indat transfer sanity check(CVE-2026-63900)

 sctp: fix use-after-free of cached ASCONF chunk(CVE-2026-74587)

 HID: lg-g15: cancel pending work on remove to fix a use-after-free(CVE-2026-64362)

 smb: client: mask server-provided mode to 07777 in modefromsid(CVE-2026-64379)

 libceph: fix two unsafe bare decodes in decode_lockers()(CVE-2026-68082)

 macvlan: inherit needed_headroom and needed_tailroom from lowerdev(CVE-2026-74743)

 bpf, sockmap: Fix cork use-after-free in tcp_bpf_sendmsg()(CVE-2026-68284)

 NFSv4: include MAY_WRITE in open permission mask for O_TRUNC(CVE-2026-64298)

 IB/mad: Drop unmatched RMPP responses before reassembly(CVE-2026-68425)

 USB: serial: digi_acceleport: fix hard lockup on disconnect(CVE-2026-64334)

 USB: ulpi: fix memory leak on registration failure(CVE-2026-64332)

 net/mlx5e: xsk: Fix unlocked writing to ICOSQ(CVE-2026-64210)

 smb/client: fix chown/chgrp with SMB3 POSIX Extensions(CVE-2026-64388)

 net/sched: act_tunnel_key: Defer dst_release to RCU callback(CVE-2026-68377)

 iio: event: Fix event FIFO reset race(CVE-2026-64496)

 RDMA/bnxt_re: zero shared page before exposing to userspace(CVE-2026-74584)

 ext4: validate donor file superblock early in EXT4_IOC_MOVE_EXT(CVE-2026-74307)

 libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE(CVE-2026-68159)

 xfrm: input: hold netns during deferred transport reinjection(CVE-2026-63919)

 KVM: nVMX: Hide shadow VMCS right after VMCLEAR(CVE-2026-64562)

 bpf: Fix RCU stall in bpf_fd_array_map_clear()(CVE-2026-53083)

 cifs: validate DFS referral string offsets(CVE-2026-72318)

 drm/vmwgfx: bound DMA command body size against suffix pointer(CVE-2026-74443)

 bpf: Fix UAF in sock clone early bailouts(CVE-2026-68399)

 spi: qup: fix error pointer deref after DMA setup failure(CVE-2026-64170)

 apparmor: fix use-after-free in rawdata dedup loop(CVE-2026-63827)

 openvswitch: vport: fix self-deadlock on release of tunnel ports(CVE-2026-46165)

 netfilter: xt_nat: reject unsupported target families(CVE-2026-80664)

 sctp: keep chunk-transport in step with the list it is queued on(CVE-2026-74588)

 netfilter: nf_nat: avoid invalid nat_net pointer use on failed nf_nat_init()(CVE-2026-72419)

 sctp: fix race between sctp_wait_for_connect and peeloff(CVE-2026-63971)

 netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst(CVE-2026-72255)

 tipc: fix UAF in tipc_l2_send_msg()(CVE-2026-74255)

 ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo()(CVE-2026-63924)

 tipc: require net admin for TIPCv2 netlink mutators(CVE-2026-74283)

 tcp: clear sock_ops cb flags before force-closing a child socket(CVE-2026-74268)

 tipc: fix use-after-free of the discoverer in tipc_disc_rcv()(CVE-2026-64543)

 net/sched: cls_fw: fix NULL dereference of 'old' filters before change()(CVE-2026-53080)

 netfilter: xt_u32: reject invalid shift counts(CVE-2026-72350)

 net/sched: cls_u32: skip hash tables in u32_bind_class()(CVE-2026-74739)

 sctp: validate STALE_COOKIE cause length before reading staleness(CVE-2026-64551)

 net: ipip: require CAP_NET_ADMIN in the device netns for changelink(CVE-2026-72053)

 scsi: target: Bound PR-OUT TransportID parsing to the received buffer(CVE-2026-72084)

 binfmt_misc: reject a flag character as the field delimiter(CVE-2026-74485)

 netfilter: synproxy: refresh tcphdr after skb_ensure_writable(CVE-2026-64007)

 packet: use consistent hard_header_len in TX_RING send path(CVE-2026-74668)

 block: Avoid mounting the bdev pseudo-filesystem in userspace(CVE-2026-63810)

 smb: client: validate DFS referral PathConsumed(CVE-2026-68343)

 Input: focaltech - fix array out-of-bounds in focaltech_process_rel_packet(CVE-2026-80574)

 USB: idmouse: fix use-after-free on disconnect race(CVE-2026-64344)

 fbdev: bitblit: bound-check glyph index in bit_cursor()(CVE-2026-74635)

 xfs: fail recovery on a committed log item with no regions(CVE-2026-64187)

 perf/core: Fix group leader use-after-free after sibling detach(CVE-2026-74637)

 tipc: read le-link under the node lock in tipc_node_link_down()(CVE-2026-74609)

 perf sched: Fix register_pid() overflow, strcpy, and BUG_ON(CVE-2026-80671)

 net: skmsg: preserve sg.copy across SG transforms(CVE-2026-63830)

 RDMA/mlx5: Release the HWprovided UAR index rather than the SW one(CVE-2026-74296)

 x86/bugs: Make Safe-RET robust against interrupt injection(CVE-2026-68480)

 ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress()(CVE-2026-63984)

 mm/hugetlb: fix list corruption in allocate_file_region_entries()(CVE-2026-74518)

 dmaengine: Fix possible use after free(CVE-2026-72476)

 pppoe: reload header pointer after dev_hard_header()(CVE-2026-68121)

 smb: client: restrict implied bcc[0] exemption to responses without data area(CVE-2026-64448)

 i2c: core: fix adapter registration race(CVE-2026-53400)

 netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp()(CVE-2026-74569)

 openvswitch: fix GSO userspace truncation underflow(CVE-2026-68123)

 cgroup/cpuset: rebind mm mempolicy to effective_mems, not mems_allowed(CVE-2026-72010)

 net/mlx5: fw_tracer, return NULL on create error(CVE-2026-74717)

 seg6: validate SRH length before reading fixed fields(CVE-2026-72400)

 platform/x86: dell-laptop: fix missing cleanups in init error path(CVE-2026-72144)

 ip6: vti: Use ip6_tnl.net in vti6_changelink().(CVE-2026-63917)

 net: gro: fix double aggregation of flush-marked skbs(CVE-2026-68136)

 inet: frags: strip GSO state from fragments before reassembly(CVE-2026-80590)

 ceph: fix pre-auth out-of-bounds read on snaptrace in ceph_handle_caps()(CVE-2026-68160)

 ixgbe: do not configure xps for XDP queues(CVE-2026-74317)

 sctp: fix auth_hmacs array size in struct sctp_cookie(CVE-2026-68376)

 xprtrdma: Repost Receive buffers for malformed replies(CVE-2026-72464)

 libceph: Fix multiplication overflow in decode_new_up_state_weight()(CVE-2026-68158)

 PCI: Check ROM header and data structure addr before accessing(CVE-2026-72487)

 ipvs: avoid out-of-bounds write in ip_vs_nat_icmp(CVE-2026-74724)

 af_unix: Fix UAF read of tail-len in unix_stream_data_wait()(CVE-2026-64109)

 ima: Instantiate file_truncate and path_truncate hooks(CVE-2026-74592)

 writeback: fix race between cgroup_writeback_umount() and inode_switch_wbs()(CVE-2026-64378)

 sched/rt: Have RT_PUSH_IPI be default off for non PREEMPT_RT(CVE-2026-64374)

 net: ena: clean up XDP TX queues when regular TX setup fails(CVE-2026-72056)

 scsi: lpfc: Fix memory leak in lpfc_sli4_driver_resource_setup()(CVE-2026-72087)

 libceph: refresh auth-authorizer_buf{,_len} after authorizer update(CVE-2026-68156)

 igbvf: Fix leak in TX DMA error cleanup(CVE-2026-74495)

 tipc: clear sock-sk on the failed-insert path in tipc_sk_create()(CVE-2026-68117)

 tracing: Do not call map-ops-elt_free() if elt_alloc() fails(CVE-2026-64173)

 media: rtl2832: fix use-after-free in rtl2832_remove()(CVE-2026-68214)

 vxlan: do not arm the ageing timer on a device that is down(CVE-2026-74615)

 libceph: bound get_version reply decode to front len(CVE-2026-68433)

 RDMA/rxe: Fix TOCTOU heap overflow in get_srq_wqe(CVE-2026-74378)

 pNFS: Fix use-after-free in pnfs_update_layout()(CVE-2026-63800)

 net: sit: require CAP_NET_ADMIN in the device netns for changelink(CVE-2026-72061)

 NFS: Pin the 'struct nfs_server' during a FREE_STATEID call(CVE-2026-74730)

 binfmt_misc: restore write access when removing an entry(CVE-2026-74487)

 pinctrl: devicetree: don't free uninitialized dev_name on error path(CVE-2026-74519)

 fsnotify: fix inode reference leak in fsnotify_recalc_mask()(CVE-2026-52990)

 netfilter: arp_tables: fix IEEE1394 ARP payload parsing(CVE-2026-45844)

 sctp: prevent peer transport count overflow(CVE-2026-74469)

 bpf, sockmap: Fix sk_redir use-after-free in send verdict(CVE-2026-74589)

 libceph: guard missing CRUSH type name lookup(CVE-2026-68157)

 l2tp: use refcount_inc_not_zero in l2tp_session_get_by_ifname(CVE-2026-63918)

 HID: core: Fix OOB read in hid_get_report for numbered reports(CVE-2026-80604) thunderbolt: Prevent XDomain delayed work use-after-free on disconnect (CVE-2026-74575)

 isofs: bound Rock Ridge symlink components to the SL record(CVE-2026-64317)

 fbdev: Fix fb_new_modelist to prevent null-ptr-deref in fb_videomode_to_var(CVE-2026-53403)

 cpu: hotplug: Bound hotplug states sysfs output(CVE-2026-72066)

 bpf: Reject BPF_MAP_TYPE_INODE_STORAGE creation if BPF LSM is uninitialized(CVE-2026-64192)

 mm/huge_memory: unlock i_mmap_rwsem before releasing after-split folios(CVE-2026-74482)

 ip6_tunnel: clear skb2-cb[] in ip6ip6_err()(CVE-2026-74597)

 ipvs: reset full ip_vs_seq structs in ip_vs_conn_new(CVE-2026-72020)

 RDMA/rxe: Copy WQE to local buffer in non-SRQ receive path(CVE-2026-74377)

 flow_dissector: check device type before reading ETH_ADDRS(CVE-2026-72444)

 tipc: restrict socket queue dumps in enqueue tracepoints(CVE-2026-72299)

 net: do not send ICMP/NDISC Redirects when peer allocation fails(CVE-2026-74550)

 tipc: fix u16 MTU truncation in media and bearer MTU validation(CVE-2026-68297)

 nfs: return EISDIR on nfs3_proc_create if d_alias is a dir(CVE-2026-43470)

 enic: fix tx_hang_reset use-after-free on device removal(CVE-2026-74725)

 vxlan: use pskb_network_may_pull() in route_shortcircuit()(CVE-2026-74473)

 dm: fix resume-vs-remove race(CVE-2026-89997)

 binfmt_misc: set have_execfd only once the interpreter is opened(CVE-2026-68186)

 proc: protect ptrace_may_access() with exec_update_lock (FD links)(CVE-2026-64375)

 USB: serial: digi_acceleport: fix memory corruption with small endpoints(CVE-2026-63901)

 vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets(CVE-2026-68299)

 xfrm: xfrm_interface: require CAP_NET_ADMIN in the device netns for changelink(CVE-2026-72136)

 bpf: Reset register bounds before narrowing retval range in check_mem_access()(CVE-2026-72111)

 nvdimm/btt: Free arena sub-allocations on discover_arenas() error path(CVE-2026-72223)

 netfilter: bridge: fix stale prevhdr pointer in br_ip6_fragment()(CVE-2026-64554)

 Input: elan_i2c - prevent division by zero and arithmetic underflow(CVE-2026-64275)

 netdevsim: zero initialize struct iphdr in dummy sk_buff(CVE-2026-52985)

 dm era: fix out-of-bounds memory access for non-zero start sector(CVE-2026-72107)

 ipv4: free net-ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table()(CVE-2026-64002)

 libceph: Reject monmaps advertising zero monitors(CVE-2026-68155)

 ipv6: validate extension header length before copying to cmsg(CVE-2026-63920)

 vxlan: require CAP_NET_ADMIN in the device netns for changelink(CVE-2026-68432)

 net/sched: cls_route: fix fastmap use-after-free on filter(CVE-2026-74583)

 bpf: Guard conntrack opts error writes(CVE-2026-72423)

 smb: client: harden POSIX SID length parsing(CVE-2026-64380)

 udf: validate free block extents against the partition length(CVE-2026-64324)

 media: pwc: Drain fill_buf on start_streaming() failure(CVE-2026-68217)

 crypto: qat - validate RSA CRT component lengths(CVE-2026-64304)

 sctp: validate stream count in sctp_process_strreset_inreq()(CVE-2026-68315)

 tracing: Avoid NULL return from hist_field_name() on truncation(CVE-2026-64028)

 net/sched: reject overly deep qdisc hierarchies(CVE-2026-74663)

 ipvs: revalidate ihl to prevent out-of-bounds access(CVE-2026-74747)

 scsi: target: core: Fix iSCSI ISID use-after-free in REGISTER AND MOVE(CVE-2026-72083)

 mm/huge_memory: fix huge_zero_pfn race(CVE-2026-74632)

 bpf, skmsg: fix verdict sk_data_ready racing with ktls rx(CVE-2026-64025)

 vxlan: use neigh_ha_snapshot() in route_shortcircuit()(CVE-2026-74475)

 netfilter: nf_nat_sip: reload possible stale data pointer(CVE-2026-72251)

 tcp: ipv6: clamp default adverting MSS to avoid GSO_BY_FRAGS (0xFFFF)(CVE-2026-72502)

 net: udp_tunnel: prevent double queueing in udp_tunnel_nic_device_sync(CVE-2026-72405)

 nfsd: reset write verifier on deferred writeback errors(CVE-2026-53393)

 tipc: fix UAF in cleanup_bearer() due to premature dst_cache_destroy()(CVE-2026-72404)

 xprtrdma: Decouple req recycling from RPC completion(CVE-2026-72473)

 i2c: core: fix adapter deregistration race(CVE-2026-64279)

 selinux: check connect-related permissions on TCP Fast Open(CVE-2026-72243)

 xfrm: fix stale skb-prev after async crypto steals a GSO segment(CVE-2026-68426)

 net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle(CVE-2026-64530)

 ipv4: restrict IPOPT_SSRR and IPOPT_LSRR options(CVE-2026-53249)

 geneve: require CAP_NET_ADMIN in the device netns for changelink(CVE-2026-68142)

 libceph: fix multiple unsafe decodes in decode_locker()(CVE-2026-80561)

 fbdev: bound mode sysfs output to the sysfs buffer(CVE-2026-80580)

 USB: serial: cypress_m8: validate interrupt packet headers(CVE-2026-63902)

 smb: client: fix UAF and buffer leak in cifs_check_trans2() for malformed secondary T2(CVE-2026-89637)

 media: pwc: Return queued buffers on start_streaming() failure(CVE-2026-68216)

 tracing: Check return value of __register_event() in trace_module_add_events()(CVE-2026-74471)

 apparmor: fix potential UAF in aa_replace_profiles(CVE-2026-80619)

 sched/psi: Shut down rtpoll_timer in psi_cgroup_free()(CVE-2026-74594)

 posix-cpu-timers: Prevent UAF caused by non-leader exec() race(CVE-2026-64560) net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink(CVE-2026-72052) tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done(CVE-2026-63801) net/sched: sch_codel: Do not call qdisc_tree_reduce_backlog during peek before restoring qlen(CVE-2026-74267) hwmon: (pmbus/core) honor vrm_version in pmbus_data2reg_vid()(CVE-2026-72397) USB: iowarrior: fix use-after-free on disconnect(CVE-2026-64342) vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu()(CVE-2026-63993) KVM: x86: Check for invalid/obsolete root *after* making MMU pages available(CVE-2026-64561) vxlan: use pskb_network_may_pull() for transmit path header pulls(CVE-2026-74474) KEYS: fix overflow in keyctl_pkey_params_get_2()(CVE-2026-63824) tpm: Make the TPM character devices non-seekable(CVE-2026-72135) net/sched: cls_api: Always acquire rtnl_lock when destroying locked classifiers(CVE-2026-74700) firewire: net: Fix fragmented datagram reassembly(CVE-2026-68354) xprtrdma: Fix bcall rep leak and unbounded peek(CVE-2026-72466) ftrace: Add global mutex to serialize trace_parser access(CVE-2026-68146) tcp: challenge ACK for non-exact RST in SYN-RECEIVED(CVE-2026-68118) USB: serial: mxuport: fix memory corruption with small endpoint(CVE-2026-63899) net: pktgen: fix proc entry use-after-free(CVE-2026-74479) net/sched: cls_u32: validate offshift to prevent shift-out-of-bounds(CVE-2026-74544) nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page(CVE-2026-64320) serial: 8250_mid: Fix NULL function pointer dereference on DNV/ICX-D/SNR platforms(CVE-2026-68434) sctp: clear control chunk transport if it is being removed(CVE-2026-74688) smb: client: reject a tree connect response whose byte count is too small(CVE-2026-89631) sctp: don't free the ASCONF's own transport in DEL-IP processing(CVE-2026-64564) ipv4: fib: free fib_alias with kfree_rcu() on insert error path(CVE-2026-64572) ipv4: fix use-after-free in fib_nhc_update_mtu()(CVE-2026-74656) ACPI: APEI: GHES: fix ARM section length accounting after header(CVE-2026-89588) net/openvswitch: check Ethernet header length in key_extract()(CVE-2026-74701) USB: serial: belkin_sa: validate interrupt status length(CVE-2026-63903) perf tools: Use perf_env__get_cpu_topology() in machine__resolve()(CVE-2026-80670) net/sched: act_pedit: fix TOCTOU heap OOB write in tc offload(CVE-2026-72338) bpf: Fix netns reference imbalance in conntrack kfuncs(CVE-2026-74715) USB: ldusb: fix use-after-free on disconnect race(CVE-2026-64343) minix: avoid overflow in bitmap block count calculation(CVE-2026-72369) KVM: Replace guest-triggerable BUG_ON() in ioeventfd datamatch with get_unaligned()(CVE-2026-63806) USB: serial: mct_u232: fix missing interrupt-in transfer sanity check(CVE-2026-63897) crypto: algif_skcipher - force synchronous processing on trees without ctx-state(CVE-2026-74578) fbdev: fbcon: fix out-of-bounds read in err_out of fbcon_do_set_font()(CVE-2026-53402) libceph: reject zero bucket types in crush_decode(CVE-2026-68154) usb: typec: tcpci_rt1711h: unregister TCPCI port with devres(CVE-2026-64463) mm/page_reporting: use system_freezable_wq to fix UAF during suspend(CVE-2026-74481) bonding: alb: re-check primary_is_promisc under RTNL in bond_alb_monitor(CVE-2026-74726) usb: typec: altmodes/displayport: validate count before reading Status Update VDO(CVE-2026-63961) netfilter: ipset: make sure gc is properly stopped(CVE-2026-72434) udf: validate sparing table length as an entry count, not a byte count(CVE-2026-64322) dm-log: fix a bitset_size overflow on 32bit machines( ...

 Please note that the description has been truncated due to length. Please refer to vendor advisory for the full description.

Tenable has extracted the preceding description block directly from the EulerOS kernel security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected kernel packages.

See Also

http://www.nessus.org/u?bb34b111

Plugin Details

Severity: High

ID: 376715

File Name: EulerOS_SA-2026-4488.nasl

Version: 1.1

Type: Local

Published: 11/6/2026

Updated: 11/6/2026

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: High

Score: 8

Percentile: 99.69

CVSS v2

Risk Factor: Medium

Base Score: 6.8

Temporal Score: 5.3

Vector: CVSS2#AV:L/AC:L/Au:S/C:C/I:C/A:C

CVSS Score Source: CVE-2026-64424

CVSS v3

Risk Factor: High

Base Score: 7.8

Temporal Score: 7

Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

Vulnerability Information

CPE: cpe:/o:huawei:euleros:2.0, p-cpe:/a:huawei:euleros:bpftool, p-cpe:/a:huawei:euleros:kernel-abi-stablelists, p-cpe:/a:huawei:euleros:kernel-tools-libs-devel, p-cpe:/a:huawei:euleros:kernel-tools-libs, p-cpe:/a:huawei:euleros:kernel-tools, p-cpe:/a:huawei:euleros:kernel, p-cpe:/a:huawei:euleros:perf-lite, p-cpe:/a:huawei:euleros:perf, p-cpe:/a:huawei:euleros:python3-perf

Required KB Items: Host/local_checks_enabled, Host/cpu, Host/EulerOS/release, Host/EulerOS/rpm-list, Host/EulerOS/sp

Excluded KB Items: Host/EulerOS/uvp_version

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 11/5/2026

Vulnerability Publication Date: 4/22/2026

Reference Information

CVE: CVE-2026-31466, CVE-2026-43470, CVE-2026-45844, CVE-2026-46165, CVE-2026-52970, CVE-2026-52984, CVE-2026-52985, CVE-2026-52990, CVE-2026-53012, CVE-2026-53060, CVE-2026-53074, CVE-2026-53080, CVE-2026-53083, CVE-2026-53091, CVE-2026-53249, CVE-2026-53337, CVE-2026-53381, CVE-2026-53385, CVE-2026-53388, CVE-2026-53392, CVE-2026-53393, CVE-2026-53398, CVE-2026-53399, CVE-2026-53400, CVE-2026-53402, CVE-2026-53403, CVE-2026-63794, CVE-2026-63800, CVE-2026-63801, CVE-2026-63806, CVE-2026-63809, CVE-2026-63810, CVE-2026-63823, CVE-2026-63824, CVE-2026-63826, CVE-2026-63827, CVE-2026-63828, CVE-2026-63829, CVE-2026-63830, CVE-2026-63868, CVE-2026-63890, CVE-2026-63891, CVE-2026-63897, CVE-2026-63898, CVE-2026-63899, CVE-2026-63900, CVE-2026-63901, CVE-2026-63902, CVE-2026-63903, CVE-2026-63904, CVE-2026-63913, CVE-2026-63914, CVE-2026-63917, CVE-2026-63918, CVE-2026-63919, CVE-2026-63920, CVE-2026-63921, CVE-2026-63922, CVE-2026-63924, CVE-2026-63925, CVE-2026-63926, CVE-2026-63942, CVE-2026-63957, CVE-2026-63961, CVE-2026-63963, CVE-2026-63971, CVE-2026-63984, CVE-2026-63990, CVE-2026-63992, CVE-2026-63993, CVE-2026-63994, CVE-2026-64002, CVE-2026-64006, CVE-2026-64007, CVE-2026-64009, CVE-2026-64012, CVE-2026-64015, CVE-2026-64025, CVE-2026-64028, CVE-2026-64046, CVE-2026-64047, CVE-2026-64098, CVE-2026-64109, CVE-2026-64112, CVE-2026-64114, CVE-2026-64170, CVE-2026-64173, CVE-2026-64185, CVE-2026-64187, CVE-2026-64189, CVE-2026-64191, CVE-2026-64192, CVE-2026-64210, CVE-2026-64237, CVE-2026-64252, CVE-2026-64266, CVE-2026-64275, CVE-2026-64279, CVE-2026-64298, CVE-2026-64299, CVE-2026-64304, CVE-2026-64305, CVE-2026-64306, CVE-2026-64312, CVE-2026-64313, CVE-2026-64317, CVE-2026-64320, CVE-2026-64322, CVE-2026-64323, CVE-2026-64324, CVE-2026-64330, CVE-2026-64332, CVE-2026-64333, CVE-2026-64334, CVE-2026-64335, CVE-2026-64340, CVE-2026-64341, CVE-2026-64342, CVE-2026-64343, CVE-2026-64344, CVE-2026-64351, CVE-2026-64362, CVE-2026-64371, CVE-2026-64374, CVE-2026-64375, CVE-2026-64378, CVE-2026-64379, CVE-2026-64380, CVE-2026-64381, CVE-2026-64388, CVE-2026-64412, CVE-2026-64413, CVE-2026-64422, CVE-2026-64423, CVE-2026-64424, CVE-2026-64435, CVE-2026-64436, CVE-2026-64438, CVE-2026-64448, CVE-2026-64450, CVE-2026-64456, CVE-2026-64463, CVE-2026-64465, CVE-2026-64475, CVE-2026-64496, CVE-2026-64510, CVE-2026-64512, CVE-2026-64513, CVE-2026-64514, CVE-2026-64529, CVE-2026-64530, CVE-2026-64534, CVE-2026-64538, CVE-2026-64540, CVE-2026-64543, CVE-2026-64544, CVE-2026-64546, CVE-2026-64547, CVE-2026-64548, CVE-2026-64551, CVE-2026-64553, CVE-2026-64554, CVE-2026-64560, CVE-2026-64561, CVE-2026-64562, CVE-2026-64563, CVE-2026-64564, CVE-2026-64569, CVE-2026-64572, CVE-2026-64580, CVE-2026-64581, CVE-2026-64582, CVE-2026-64600, CVE-2026-68082, CVE-2026-68096, CVE-2026-68117, CVE-2026-68118, CVE-2026-68121, CVE-2026-68123, CVE-2026-68131, CVE-2026-68136, CVE-2026-68138, CVE-2026-68142, CVE-2026-68146, CVE-2026-68153, CVE-2026-68154, CVE-2026-68155, CVE-2026-68156, CVE-2026-68157, CVE-2026-68158, CVE-2026-68159, CVE-2026-68160, CVE-2026-68162, CVE-2026-68186, CVE-2026-68212, CVE-2026-68214, CVE-2026-68216, CVE-2026-68217, CVE-2026-68255, CVE-2026-68284, CVE-2026-68287, CVE-2026-68297, CVE-2026-68299, CVE-2026-68300, CVE-2026-68315, CVE-2026-68320, CVE-2026-68323, CVE-2026-68329, CVE-2026-68338, CVE-2026-68343, CVE-2026-68354, CVE-2026-68365, CVE-2026-68376, CVE-2026-68377, CVE-2026-68388, CVE-2026-68398, CVE-2026-68399, CVE-2026-68425, CVE-2026-68426, CVE-2026-68428, CVE-2026-68432, CVE-2026-68433, CVE-2026-68434, CVE-2026-68446, CVE-2026-68476, CVE-2026-68477, CVE-2026-68480, CVE-2026-72010, CVE-2026-72019, CVE-2026-72020, CVE-2026-72021, CVE-2026-72036, CVE-2026-72051, CVE-2026-72052, CVE-2026-72053, CVE-2026-72054, CVE-2026-72055, CVE-2026-72056, CVE-2026-72061, CVE-2026-72066, CVE-2026-72067, CVE-2026-72083, CVE-2026-72084, CVE-2026-72087, CVE-2026-72098, CVE-2026-72099, CVE-2026-72102, CVE-2026-72105, CVE-2026-72107, CVE-2026-72108, CVE-2026-72111, CVE-2026-72129, CVE-2026-72135, CVE-2026-72136, CVE-2026-72144, CVE-2026-72152, CVE-2026-72157, CVE-2026-72213, CVE-2026-72223, CVE-2026-72224, CVE-2026-72225, CVE-2026-72240, CVE-2026-72242, CVE-2026-72243, CVE-2026-72247, CVE-2026-72250, CVE-2026-72251, CVE-2026-72252, CVE-2026-72253, CVE-2026-72255, CVE-2026-72284, CVE-2026-72288, CVE-2026-72289, CVE-2026-72299, CVE-2026-72307, CVE-2026-72310, CVE-2026-72316, CVE-2026-72318, CVE-2026-72319, CVE-2026-72322, CVE-2026-72323, CVE-2026-72329, CVE-2026-72338, CVE-2026-72339, CVE-2026-72342, CVE-2026-72348, CVE-2026-72350, CVE-2026-72369, CVE-2026-72383, CVE-2026-72389, CVE-2026-72390, CVE-2026-72397, CVE-2026-72398, CVE-2026-72400, CVE-2026-72402, CVE-2026-72404, CVE-2026-72405, CVE-2026-72416, CVE-2026-72419, CVE-2026-72420, CVE-2026-72421, CVE-2026-72423, CVE-2026-72434, CVE-2026-72435, CVE-2026-72436, CVE-2026-72444, CVE-2026-72459, CVE-2026-72464, CVE-2026-72466, CVE-2026-72473, CVE-2026-72476, CVE-2026-72487, CVE-2026-72502, CVE-2026-74255, CVE-2026-74256, CVE-2026-74267, CVE-2026-74268, CVE-2026-74271, CVE-2026-74279, CVE-2026-74281, CVE-2026-74283, CVE-2026-74287, CVE-2026-74288, CVE-2026-74289, CVE-2026-74296, CVE-2026-74297, CVE-2026-74305, CVE-2026-74307, CVE-2026-74310, CVE-2026-74317, CVE-2026-74330, CVE-2026-74331, CVE-2026-74347, CVE-2026-74356, CVE-2026-74359, CVE-2026-74365, CVE-2026-74377, CVE-2026-74378, CVE-2026-74384, CVE-2026-74389, CVE-2026-74391, CVE-2026-74394, CVE-2026-74397, CVE-2026-74398, CVE-2026-74406, CVE-2026-74443, CVE-2026-74444, CVE-2026-74445, CVE-2026-74465, CVE-2026-74469, CVE-2026-74470, CVE-2026-74471, CVE-2026-74473, CVE-2026-74474, CVE-2026-74475, CVE-2026-74479, CVE-2026-74480, CVE-2026-74481, CVE-2026-74482, CVE-2026-74485, CVE-2026-74487, CVE-2026-74492, CVE-2026-74495, CVE-2026-74512, CVE-2026-74518, CVE-2026-74519, CVE-2026-74544, CVE-2026-74550, CVE-2026-74565, CVE-2026-74567, CVE-2026-74569, CVE-2026-74575, CVE-2026-74578, CVE-2026-74579, CVE-2026-74580, CVE-2026-74581, CVE-2026-74582, CVE-2026-74583, CVE-2026-74584, CVE-2026-74586, CVE-2026-74587, CVE-2026-74588, CVE-2026-74589, CVE-2026-74592, CVE-2026-74594, CVE-2026-74597, CVE-2026-74598, CVE-2026-74601, CVE-2026-74609, CVE-2026-74613, CVE-2026-74615, CVE-2026-74630, CVE-2026-74632, CVE-2026-74635, CVE-2026-74637, CVE-2026-74656, CVE-2026-74660, CVE-2026-74662, CVE-2026-74663, CVE-2026-74666, CVE-2026-74667, CVE-2026-74668, CVE-2026-74669, CVE-2026-74675, CVE-2026-74677, CVE-2026-74684, CVE-2026-74688, CVE-2026-74691, CVE-2026-74697, CVE-2026-74700, CVE-2026-74701, CVE-2026-74705, CVE-2026-74715, CVE-2026-74717, CVE-2026-74720, CVE-2026-74724, CVE-2026-74725, CVE-2026-74726, CVE-2026-74730, CVE-2026-74739, CVE-2026-74743, CVE-2026-74744, CVE-2026-74747, CVE-2026-74748, CVE-2026-74752, CVE-2026-80527, CVE-2026-80528, CVE-2026-80536, CVE-2026-80557, CVE-2026-80558, CVE-2026-80560, CVE-2026-80561, CVE-2026-80572, CVE-2026-80574, CVE-2026-80580, CVE-2026-80590, CVE-2026-80603, CVE-2026-80604, CVE-2026-80609, CVE-2026-80619, CVE-2026-80622, CVE-2026-80630, CVE-2026-80637, CVE-2026-80646, CVE-2026-80664, CVE-2026-80670, CVE-2026-80671, CVE-2026-80677, CVE-2026-80681, CVE-2026-80714, CVE-2026-80717, CVE-2026-80731, CVE-2026-80737, CVE-2026-80754, CVE-2026-89588, CVE-2026-89631, CVE-2026-89637, CVE-2026-89744, CVE-2026-89746, CVE-2026-89997