Detections
Analytics

AlmaLinux 9.2 [TuxCare] Security Update: bpftool / kernel / kernel-64k / kernel-64k-core / kernel-64k-debug / etc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1794643812)

high Nessus Plugin ID 381298

Synopsis

The AlmaLinux host is missing one or more security updates.

Description

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1794643812 advisory.

 - In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: add HE 6 GHz capability in the scan elems len The HE 6 GHz Band Capability element is in the probe request for every band if 6 GHz is supported, so add the size to scan_ies_len. Otherwise, building probe request elements can fail, triggering the WARN_ON in __ieee80211_start_scan(). (CVE-2026-98328)

 - In the Linux kernel, the following vulnerability has been resolved: bpf: Fix issue in verifying allow_ptr_leaks After we converted the capabilities of our networking-bpf program from cap_sys_admin to cap_net_admin+cap_bpf, our networking-bpf program failed to start. Because it failed the bpf verifier, and the error log is R3 pointer comparison prohibited. A simple reproducer as follows, SEC(cls-ingress) int ingress(struct __sk_buff *skb) { struct iphdr *iph = (void *)(long)skb->data + sizeof(struct ethhdr);
 if ((long)(iph + 1) > (long)skb->data_end) return TC_ACT_STOLEN; return TC_ACT_OK; } Per discussion with Yonghong and Alexei [1], comparison of two packet pointers is not a pointer leak. This patch fixes it. Our local kernel is 6.1.y and we expect this fix to be backported to 6.1.y, so stable is CCed. [1].
 https://lore.kernel.org/bpf/CAADnVQ+Nmspr7Si+pxWn8zkE7hX-7s93ugwC+94aXSy4uQ9vBg@mail.gmail.com/ (CVE-2023-54181)

 - In the Linux kernel, the following vulnerability has been resolved: driver core: Avoid warning when removing a device while its supplier is unbinding During driver removal, the following warning can appear:
 WARNING: CPU: 1 PID: 139 at drivers/base/core.c:1497 __device_links_no_driver+0xcc/0xfc ... Call trace:
 __device_links_no_driver+0xcc/0xfc (P) device_links_driver_cleanup+0xa8/0xf0 device_release_driver_internal+0x208/0x23c device_links_unbind_consumers+0xe0/0x108 device_release_driver_internal+0xec/0x23c device_links_unbind_consumers+0xe0/0x108 device_release_driver_internal+0xec/0x23c device_links_unbind_consumers+0xe0/0x108 device_release_driver_internal+0xec/0x23c driver_detach+0xa0/0x12c bus_remove_driver+0x6c/0xbc driver_unregister+0x30/0x60 pci_unregister_driver+0x20/0x9c lan966x_pci_driver_exit+0x18/0xa90 [lan966x_pci] This warning is triggered when a consumer is removed because the links status of its supplier is not DL_DEV_DRIVER_BOUND and the link flag DL_FLAG_SYNC_STATE_ONLY is not set. The topology in terms of consumers/suppliers used was the following (consumer ---> supplier): i2c -----------> OIC ----> PCI device | ^ | | +---> pinctrl ---+ When the PCI device is removed, the OIC (interrupt controller) has to be removed. In order to remove the OIC, pinctrl and i2c need to be removed and to remove pinctrl, i2c need to be removed. The removal order is: 1) i2c 2) pinctrl 3) OIC 4) PCI device In details, the removal sequence is the following (with 0000:01:00.0 the PCI device): driver_detach: call device_release_driver_internal(0000:01:00.0)... device_links_busy(0000:01:00.0): links->status = DL_DEV_UNBINDING device_links_unbind_consumers(0000:01:00.0): 0000:01:00.0--oic link->status = DL_STATE_SUPPLIER_UNBIND call device_release_driver_internal(oic)... device_links_busy(oic): links->status = DL_DEV_UNBINDING device_links_unbind_consumers(oic): oic--pinctrl link->status = DL_STATE_SUPPLIER_UNBIND call device_release_driver_internal(pinctrl)... device_links_busy(pinctrl):
 links->status = DL_DEV_UNBINDING device_links_unbind_consumers(pinctrl): pinctrl--i2c link->status = DL_STATE_SUPPLIER_UNBIND call device_release_driver_internal(i2c)... device_links_busy(i2c): links->status = DL_DEV_UNBINDING __device_links_no_driver(i2c)... pinctrl--i2c link->status is DL_STATE_SUPPLIER_UNBIND oic--i2c link->status is DL_STATE_ACTIVE oic--i2c link->supplier->links.status is DL_DEV_UNBINDING The warning is triggered by the i2c removal because the OIC (supplier) links status is not DL_DEV_DRIVER_BOUND. Its links status is indeed set to DL_DEV_UNBINDING. It is perfectly legit to have the links status set to DL_DEV_UNBINDING in that case. Indeed we had started to unbind the OIC which triggered the consumer unbinding and didn't finish yet when the i2c is unbound. Avoid the warning when the supplier links status is set to DL_DEV_UNBINDING and thus support this removal sequence without any warnings.
 (CVE-2026-97479)

 - In the Linux kernel, the following vulnerability has been resolved: usb: typec: ucsi: displayport: Fix OOB altmode array index The UCSI displayport driver indexes the connector's port altmode array with the GET_CURRENT_CAM response after checking it is not 0xff. The port altmode array is UCSI_MAX_ALTMODES elements long. If the PPM returns an invalid GET_CURRENT_CAM response above UCSI_MAX_ALTMODES and not equal to 0xff, the kernel may crash with an array index OOB error. Update the UCSI displayport driver to verify the current cam is less than UCSI_MAX_ALTMODES before accessing the port altmode array.
 (CVE-2026-90025)

 - In the Linux kernel, the following vulnerability has been resolved: NFSv4.1: fix layout segment leak on the pnfs_layout_process() forget path When the server returns a new layout stateid while a valid one is still held, pnfs_layout_process() calls pnfs_mark_matching_lsegs_return() on the on-stack free_me list and jumps to out_forget. Segments whose reference count drops to zero are unlinked from lo->plh_segs and moved to free_me by mark_lseg_invalid(); for an idle cached segment the layout header holds the only reference, so this happens on the first decrement. out_forget never drains free_me -- only the success path calls pnfs_free_lseg_list(). Commit 814b84971388 (pNFS/NFSv4: Fix a layout segment leak in pnfs_layout_process()) added the drain; commit 08bd8dbe8882 (pNFS/NFSv4: Try to return invalid layout in pnfs_layout_process()) removed it while switching the destination to lo->plh_return_segs, which is drained elsewhere. Commit fb700ef02676 (NFSv4.1: Simplify layout return in pnfs_layout_process()) switched the destination back to free_me without restoring the drain. Restore the pnfs_free_lseg_list() call. (CVE-2026-89710)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected packages based on the guidance in TuxCare advisory ALMALINUX9.2:CLSA-2026:1794643812.

See Also

https://cve.tuxcare.com/els/releases/CLSA-2026:1794643812

http://www.nessus.org/u?4af5309b

Plugin Details

Severity: High

ID: 381298

File Name: tuxcare_alma_linux_9.2_CLSA-2026-1794643812.nasl

Version: 1.1

Type: Local

Published: 11/14/2026

Updated: 11/14/2026

Supported Sensors: Continuous Assessment, Nessus Agent, Nessus

Risk Information

VPR

Risk Factor: High

Score: 7.9

Percentile: 99.34

Vendor

Vendor Severity: Important

CVSS v2

Risk Factor: Medium

Base Score: 6.8

Temporal Score: 5.3

Vector: CVSS2#AV:L/AC:L/Au:S/C:C/I:C/A:C

CVSS Score Source: CVE-2026-46004

CVSS v3

Risk Factor: High

Base Score: 7.8

Temporal Score: 7

Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

Vulnerability Information

Required KB Items: Host/OS/extended-third-party, Host/local_checks_enabled, Host/AlmaLinux/release, Host/AlmaLinux/rpm-list, Host/cpu

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 11/14/2026

Vulnerability Publication Date: 7/21/2021

Reference Information

CVE: CVE-2022-50697, CVE-2023-53048, CVE-2023-53069, CVE-2023-53082, CVE-2023-53115, CVE-2023-53127, CVE-2023-53128, CVE-2023-53142, CVE-2023-53703, CVE-2023-53723, CVE-2023-53754, CVE-2023-53799, CVE-2023-53800, CVE-2023-53826, CVE-2023-53831, CVE-2023-53850, CVE-2023-53994, CVE-2023-54056, CVE-2023-54107, CVE-2023-54128, CVE-2023-54181, CVE-2023-54236, CVE-2024-14040, CVE-2024-26759, CVE-2024-27010, CVE-2024-27019, CVE-2024-36889, CVE-2024-40931, CVE-2024-41012, CVE-2024-50135, CVE-2024-56531, CVE-2024-57857, CVE-2025-21707, CVE-2025-37875, CVE-2025-38399, CVE-2025-38509, CVE-2025-38692, CVE-2025-39970, CVE-2025-40038, CVE-2025-40051, CVE-2025-40242, CVE-2025-40307, CVE-2025-68219, CVE-2025-68822, CVE-2026-23050, CVE-2026-31662, CVE-2026-31701, CVE-2026-31771, CVE-2026-43013, CVE-2026-43016, CVE-2026-43157, CVE-2026-43238, CVE-2026-45894, CVE-2026-46004, CVE-2026-46026, CVE-2026-46054, CVE-2026-52991, CVE-2026-53001, CVE-2026-53062, CVE-2026-53071, CVE-2026-53151, CVE-2026-53265, CVE-2026-63809, CVE-2026-63867, CVE-2026-63897, CVE-2026-63904, CVE-2026-63917, CVE-2026-63921, CVE-2026-63961, CVE-2026-63976, CVE-2026-64128, CVE-2026-64458, CVE-2026-64508, CVE-2026-64510, CVE-2026-64511, CVE-2026-64527, CVE-2026-64543, CVE-2026-64549, CVE-2026-64553, CVE-2026-68090, CVE-2026-68118, CVE-2026-68180, CVE-2026-68192, CVE-2026-68216, CVE-2026-68217, CVE-2026-68238, CVE-2026-68244, CVE-2026-68278, CVE-2026-68304, CVE-2026-68386, CVE-2026-68396, CVE-2026-68406, CVE-2026-68469, CVE-2026-68477, CVE-2026-72004, CVE-2026-72021, CVE-2026-72023, CVE-2026-72039, CVE-2026-72055, CVE-2026-72056, CVE-2026-72065, CVE-2026-72067, CVE-2026-72087, CVE-2026-72096, CVE-2026-72114, CVE-2026-72122, CVE-2026-72144, CVE-2026-72177, CVE-2026-72219, CVE-2026-72223, CVE-2026-72224, CVE-2026-72240, CVE-2026-72247, CVE-2026-72253, CVE-2026-72319, CVE-2026-72320, CVE-2026-72326, CVE-2026-72334, CVE-2026-72339, CVE-2026-72349, CVE-2026-72379, CVE-2026-72416, CVE-2026-72421, CVE-2026-72428, CVE-2026-72441, CVE-2026-72447, CVE-2026-72466, CVE-2026-72473, CVE-2026-72487, CVE-2026-72488, CVE-2026-74261, CVE-2026-74265, CVE-2026-74279, CVE-2026-74334, CVE-2026-74339, CVE-2026-74346, CVE-2026-74395, CVE-2026-74405, CVE-2026-74406, CVE-2026-74487, CVE-2026-74492, CVE-2026-74495, CVE-2026-74509, CVE-2026-74527, CVE-2026-74533, CVE-2026-74557, CVE-2026-74577, CVE-2026-74579, CVE-2026-74624, CVE-2026-74626, CVE-2026-74632, CVE-2026-74676, CVE-2026-74683, CVE-2026-74696, CVE-2026-80539, CVE-2026-80586, CVE-2026-80692, CVE-2026-80707, CVE-2026-80733, CVE-2026-80744, CVE-2026-80755, CVE-2026-80756, CVE-2026-80757, CVE-2026-80767, CVE-2026-80781, CVE-2026-80792, CVE-2026-80793, CVE-2026-80805, CVE-2026-80829, CVE-2026-80837, CVE-2026-80875, CVE-2026-80880, CVE-2026-80887, CVE-2026-80905, CVE-2026-80913, CVE-2026-80941, CVE-2026-80948, CVE-2026-80949, CVE-2026-80987, CVE-2026-80989, CVE-2026-80996, CVE-2026-89476, CVE-2026-89539, CVE-2026-89565, CVE-2026-89574, CVE-2026-89576, CVE-2026-89586, CVE-2026-89626, CVE-2026-89638, CVE-2026-89676, CVE-2026-89684, CVE-2026-89686, CVE-2026-89710, CVE-2026-89713, CVE-2026-89740, CVE-2026-89816, CVE-2026-89852, CVE-2026-89861, CVE-2026-89944, CVE-2026-89982, CVE-2026-89987, CVE-2026-90025, CVE-2026-90036, CVE-2026-90049, CVE-2026-90054, CVE-2026-90061, CVE-2026-90062, CVE-2026-90072, CVE-2026-90076, CVE-2026-90084, CVE-2026-90099, CVE-2026-90102, CVE-2026-90106, CVE-2026-90109, CVE-2026-90114, CVE-2026-90126, CVE-2026-90138, CVE-2026-90150, CVE-2026-90160, CVE-2026-90190, CVE-2026-90194, CVE-2026-90206, CVE-2026-90207, CVE-2026-90216, CVE-2026-90234, CVE-2026-90247, CVE-2026-90248, CVE-2026-90256, CVE-2026-90283, CVE-2026-90307, CVE-2026-90311, CVE-2026-90318, CVE-2026-90343, CVE-2026-90360, CVE-2026-90361, CVE-2026-90398, CVE-2026-90415, CVE-2026-90434, CVE-2026-92494, CVE-2026-92504, CVE-2026-93102, CVE-2026-93103, CVE-2026-93140, CVE-2026-93161, CVE-2026-93206, CVE-2026-93221, CVE-2026-93226, CVE-2026-93231, CVE-2026-93287, CVE-2026-93790, CVE-2026-93794, CVE-2026-97455, CVE-2026-97472, CVE-2026-97477, CVE-2026-97479, CVE-2026-97494, CVE-2026-97500, CVE-2026-97510, CVE-2026-97524, CVE-2026-97529, CVE-2026-97530, CVE-2026-97558, CVE-2026-97559, CVE-2026-97562, CVE-2026-97566, CVE-2026-97567, CVE-2026-97899, CVE-2026-97929, CVE-2026-98006, CVE-2026-98012, CVE-2026-98021, CVE-2026-98022, CVE-2026-98074, CVE-2026-98101, CVE-2026-98111, CVE-2026-98172, CVE-2026-98208, CVE-2026-98233, CVE-2026-98241, CVE-2026-98288, CVE-2026-98290, CVE-2026-98304, CVE-2026-98308, CVE-2026-98319, CVE-2026-98325, CVE-2026-98328, CVE-2026-98329, CVE-2026-98330, CVE-2026-98331, CVE-2026-98337, CVE-2026-98340, CVE-2026-98362, CVE-2026-98393, CVE-2026-98422, CVE-2026-98423, CVE-2026-98425, CVE-2026-98430, CVE-2026-98441, CVE-2026-98453, CVE-2026-98456, CVE-2026-98461, CVE-2026-98495, CVE-2026-98509, CVE-2026-98550, CVE-2026-98556, CVE-2026-98597, CVE-2026-98606, CVE-2026-98681, CVE-2026-98734, CVE-2026-98735, CVE-2026-98752, CVE-2026-98798, CVE-2026-98800, CVE-2026-98824, CVE-2026-98889, CVE-2026-98903, CVE-2026-98904, CVE-2026-98936, CVE-2026-98981, CVE-2026-98990, CVE-2026-98992, CVE-2026-99052, CVE-2026-99054, CVE-2026-99056, CVE-2026-99122, CVE-2026-99123, CVE-2026-99131, CVE-2026-99132, CVE-2026-99136, CVE-2026-99146, CVE-2026-99150, CVE-2026-99203, CVE-2026-99218, CVE-2026-99219, CVE-2026-99220, CVE-2026-99222, CVE-2026-99224, CVE-2026-99225, CVE-2026-99226, CVE-2026-99233, CVE-2026-99235, CVE-2026-99236, CVE-2026-99246, CVE-2026-99256, CVE-2026-99272, CVE-2026-99281, CVE-2026-99283

CLSA: 2026:1794643812