The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-2295:121 advisory.

    * kernel: tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock() (CVE-2025-40149)
      * kernel: ipv6: add NULL checks for idev in SRv6 paths (CVE-2026-23442)
      * kernel: thermal: core: Fix thermal zone device registration error path (CVE-2026-43332)
      * kernel: KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (CVE-2026-46076)
      * kernel: gfs2: Fix slab-use-after-free in qd_put (CVE-2026-45861)
      * kernel: Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CVE-2026-46275)
      * kernel: KVM: arm64: Reassign nested_mmus array behind mmu_lock (CVE-2026-46317)
      * kernel: netfilter: nf_log: validate MAC header was set before dumping it (CVE-2026-52942)
      * kernel: gfs2: add some missing log locking (CVE-2026-53049)
      * kernel: netfilter: nf_conntrack_sip: don't use simple_strtoul (CVE-2026-52986)
      * kernel: Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CVE-2026-53357)
      * kernel: net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (CVE-2026-63829)
      * kernel: ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (CVE-2026-63924)
      * kernel: ipv6: exthdrs: refresh nh after handling HAO option (CVE-2026-63922)
      * kernel: ipv6: validate extension header length before copying to cmsg (CVE-2026-63920)
      * kernel: vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (CVE-2026-63993)
      * kernel: ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (CVE-2026-63984)
      * kernel: tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (CVE-2026-63992)
      * kernel: tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]()     (CVE-2026-63994)
      * kernel: Kernel SMB client: Double-free vulnerability allows remote denial of service or privilege     escalation (CVE-2026-64385)
      * kernel: Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CVE-2026-64557)
      * kernel: vxlan: require CAP_NET_ADMIN in the device netns for changelink (CVE-2026-68432)
      * kernel: net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (CVE-2026-72052)
      * kernel: dm-integrity: don't increment hash_offset twice (CVE-2026-72099)
      * kernel: KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CVE-2026-72289)
      * kernel: netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CVE-2026-72255)
      * kernel: KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active     (CVE-2026-74516)
      * kernel: netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CVE-2026-74569)
      * kernel: ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CVE-2026-74669)
      * kernel: netfilter: flowtable: publish GC-visible tuple last (CVE-2026-74746)
      * kernel: ipv6: fix use-after-free in ip6_finish_output2() (CVE-2026-80792)
      * kernel: KVM: s390: vsie: zero stale crypto bits (CVE-2026-80921)
      * kernel: nvme-tcp: reject a read that transferred too few bytes (CVE-2026-89480)
      * kernel: nvme-tcp: fix host memory disclosure on R2T for a read command (CVE-2026-89481)
      * kernel: nvme: add missing SRCU grace period in error path (CVE-2026-89972)
      * kernel: nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CVE-2026-90227)
      * kernel: netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CVE-2026-97417)
      * kernel: netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state     (CVE-2026-93288)
      * kernel: ipvlan: Make the addrs_lock be per port (CVE-2026-23103)
      * kernel: KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (CVE-2026-53360)
      * kernel: vsock/virtio: fix zerocopy completion for multi-skb sends (CVE-2026-53365)
      * kernel: NFSD: Fix SECINFO_NO_NAME decode error cleanup (CVE-2026-53398)
      * kernel: vsock/virtio: bind uarg before filling zerocopy skb (CVE-2026-63970)
      * kernel: igc: set tx buffer type for SMD frames (CVE-2026-64035)
      * kernel: idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (CVE-2026-64162)
      * kernel: vsock/vmci: fix UAF when peer resets connection during handshake (CVE-2026-64115)
      * kernel: SUNRPC: pin upper rpc_clnt across the TLS connect_worker (CVE-2026-72317)
      * kernel: ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (CVE-2026-74744)
      * kernel: nfsd: defer vfree of compound ops to fix rpc_status UAF (CVE-2026-89690)
      * kernel: nfsd: initialize copy-notify stateid before publishing it (CVE-2026-89669)
      * kernel: svcrdma: Reject inline replies that overflow the pull-up buffer (CVE-2026-89530)
      * kernel: nfsd: revoke copy-notify stateids before dropping their reference (CVE-2026-89663)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

MiracleLinux 9 : kernel-5.14.0-687.56.1.el9_8 (AXSA:2026-2295:121)

high Nessus Plugin ID 378094

Version 1.1