Rocky Linux 9 [CIQ] Security Update: kernel / kernel-64k / kernel-64k-core / kernel-64k-debug / etc Multiple Vulnerabilities (crlsa-2026_99135)

medium Nessus Plugin ID 381022

Synopsis

The Rocky Linux host is missing one or more security updates.

Description

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-2026_99135 advisory.

* kernel: USB: serial: io_ti: fix heap overflow in get_manuf_info() (CVE-2026-53196)

* kernel: net/iucv: fix use-after-free of a severed iucv_path (CVE-2026-68140)

* kernel: sctp: avoid auth_enable sysctl UAF during netns teardown (CVE-2026-68162)

* kernel: s390/zcrypt: Validate length for CCA AES cipher key requests (CVE-2026-68452)

* kernel: s390/zcrypt: Validate length for CCA ECC private key requests (CVE-2026-68451)

* kernel: sunrpc: pin svc_xprt across the asynchronous TLS handshake callback (CVE-2026-72222)

* kernel: sunrpc: wait for in-flight TLS handshake callback when cancel loses race (CVE-2026-72221)

* kernel: nvmet-tcp: check return value of nvmet_tcp_set_queue_sock (CVE-2026-74385)

* kernel: sctp: keep chunk->transport in step with the list it is queued on (CVE-2026-74588)

* kernel: sctp: clear new_transport when removing a peer (CVE-2026-74586)

* kernel: sctp: validate cookie AUTH state before use (CVE-2026-74752)

* kernel: mptcp: options: reset DSS fields in case of unexpected size (CVE-2026-80586)

* kernel: s390/vfio_ccw: Cancel existing workqueues (CVE-2026-80553)

* kernel: powerpc/pseries: papr-phy-attest - validate cmd.length, plug mem leak (CVE-2026-80571)

* kernel: s390/qeth: validate user buffer length in SNMP and ARP query ioctls (CVE-2026-80584)

* kernel: ipv6: fix use-after-free in ip6_finish_output2() (CVE-2026-80792)

* kernel: net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (CVE-2026-80981)

* kernel: smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (CVE-2026-89633)

* kernel: sctp: stop processing a packet once its association is deleted (CVE-2026-89479)

* kernel: s390/vfio-ap: Fix missing lock required to access list of ap_matrix_mdev objects (CVE-2026-89956)

* kernel: ALSA: seq: midi: Serialize input teardown with event_input (CVE-2026-90207)

* kernel: ALSA: pcm: Serialize PCM mmap with buffer reallocation to fix page UAF (CVE-2026-98116)

* kernel: smb: client: validate absolute native symlink targets before NT fixups (CVE-2026-98318)

* kernel: ipv4: validate checksum_start before completing checksum (CVE-2026-99999)

* kernel: net/sched: act_ct: fix helper UAF due to extensions realloc (CVE-2026-98442)

* kernel: ALSA: ua101: reject mismatched capture/playback packet sizes (CVE-2026-98741)

* kernel: net/smc: protect clcsock lifetime in smc_getname (CVE-2026-99032)

* kernel: kernel: Denial of Service via unvalidated task in iSCSI management responses (CVE-2026-99152)

* kernel: kernel: Denial of service via unvalidated task tag in iSCSI Reject PDU (CVE-2026-99153)

Bug Fix(es) and Enhancement(s):

* [Rocky Linux9.9z] watchdog: System panics during reboot when pretimeout is disabled (0) (JIRA:Rocky Linux-255218)

* RT scheduler livelock: migrate-disabled task at pushable-list head causes repeated RT push/stopper retries, starving a critical RT task (remaining issue after CVE-2026-45919 fix in 94894c9c477e) [rhel-9.9.z] (JIRA:Rocky Linux-256280)

* MADVISE i/o size in Rocky Linux 9 additionally limited by read_ahead_kb - Was addressed in Rocky Linux8 via Rocky Linux-22476 [rhel-9.9.z] (JIRA:Rocky Linux-259532)

* try_charge_memcg() refactor in kernel 5.14.0-687.36.1 causes premature memcg OOM with GiB of clean page cache present [rhel-9.9.z] (JIRA:Rocky Linux-269061)

* Rocky Linux9.4 - kernel: CPU hotplug unsupported by CPUMF [rhel-9.9.z] (JIRA:Rocky Linux-270893)

* Accel-DSA: dmaengine: idxd: kernel oops on unbind [rhel-9.9.z] (JIRA:Rocky Linux-274411)

* af_unix: Fix peek then tail dereference UAF in unix_stream_data_wait() [rhel-9.9] (JIRA:Rocky Linux-275410)

* Kernel panic after stopping retis capture [rhel-9.9.z] (JIRA:Rocky Linux-275457)

* Hard lockup experienced with repro from Rocky Linux-282072 [rhel-9.9.z] (JIRA:Rocky Linux-290031)

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected packages based on the guidance in CIQ advisory crlsa-2026_99135.

Plugin Details

Severity: Medium

ID: 381022

File Name: ciq_rocky_linux_9_crlsa-2026_99135.nasl

Version: 1.1

Type: Local

Family: Rocky Linux Local Security Checks

Published: 11/14/2026

Updated: 11/14/2026

Supported Sensors: Continuous Assessment, Nessus Agent, Nessus

Risk Information

VPR

Risk Factor: High

Score: 8

Percentile: 99.69

Vendor

Vendor Severity: Unknown

CVSS v2

Risk Factor: High

Base Score: 7.2

Temporal Score: 5.6

Vector: CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C

CVSS Score Source: CVE-2026-53196

CVSS v3

Risk Factor: Medium

Base Score: 6.8

Temporal Score: 6.1

Vector: CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

Vulnerability Information

Required KB Items: Host/OS/extended-third-party, Host/local_checks_enabled, Host/RockyLinux/release, Host/RockyLinux/rpm-list, Host/cpu

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 11/13/2026

Vulnerability Publication Date: 4/29/2025

Reference Information

CVE: CVE-2026-53196, CVE-2026-68140, CVE-2026-68162, CVE-2026-68451, CVE-2026-68452, CVE-2026-72221, CVE-2026-72222, CVE-2026-74385, CVE-2026-74586, CVE-2026-74588, CVE-2026-74752, CVE-2026-80553, CVE-2026-80571, CVE-2026-80584, CVE-2026-80586, CVE-2026-80792, CVE-2026-80981, CVE-2026-89479, CVE-2026-89633, CVE-2026-89956, CVE-2026-90207, CVE-2026-98116, CVE-2026-98318, CVE-2026-98442, CVE-2026-98741, CVE-2026-99032, CVE-2026-99152, CVE-2026-99153, CVE-2026-99999

Detections

Analytics