An update of the linux package has been released.

The remote CentOS Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the kernel-5.14.0-719.el9 build changelog.

  - In the Linux kernel, the following vulnerability has been resolved: cxl/port: Fix use after free of     parent_port in cxl_detach_ep() cxl_detach_ep() is called during bottom-up removal when all CXL memory     devices beneath a switch port have been removed. For each port in the hierarchy it locks both the port and     its parent, removes the endpoint, and if the port is now empty, marks it dead and unregisters the port by     calling delete_switch_port(). There are two places during this work where the parent_port may be used     after freeing: First, a concurrent detach may have already processed a port by the time a second worker     finds it via bus_find_device(). Without pinning parent_port, it may already be freed when we discover     port->dead and attempt to unlock the parent_port. In a production kernel that's a silent memory     corruption, with lock debug, it looks like this: []DEBUG_LOCKS_WARN_ON(__owner_task(owner) !=     get_current()) []WARNING: kernel/locking/mutex.c:949 at __mutex_unlock_slowpath+0x1ee/0x310 []Call Trace:
    []mutex_unlock+0xd/0x20 []cxl_detach_ep+0x180/0x400 [cxl_core] []devm_action_release+0x10/0x20     []devres_release_all+0xa8/0xe0 []device_unbind_cleanup+0xd/0xa0 []really_probe+0x1a6/0x3e0 Second,     delete_switch_port() releases three devm actions registered against parent_port. The last of those is     unregister_port() and it calls device_unregister() on the child port, which can cascade. If parent_port is     now also empty the device core may unregister and free it too. So by the time delete_switch_port()     returns, parent_port may be free, and the subsequent device_unlock(&parent_port->dev) operates on freed     memory. The kernel log looks same as above, with a different offset in cxl_detach_ep(). Both of these     issues stem from the absence of a lifetime guarantee between a child port and its parent port. Establish a     lifetime rule for ports: child ports hold a reference to their parent device until release. Take the     reference when the port is allocated and drop it when released. This ensures the parent is valid for the     full lifetime of the child and eliminates the use after free window in cxl_detach_ep(). This is easily     reproduced with a reload of cxl_acpi in QEMU with CXL devices present. (CVE-2026-31530)

  - In the Linux kernel, the following vulnerability has been resolved: crypto: tegra - Add missing     CRYPTO_ALG_ASYNC The tegra crypto driver failed to set the CRYPTO_ALG_ASYNC on its asynchronous     algorithms, causing the crypto API to select them for users that request only synchronous algorithms. This     causes crashes (at least). Fix this by adding the flag like what the other drivers do. Also remove the     unnecessary CRYPTO_ALG_TYPE_* flags, since those just get ignored and overridden by the registration     function anyway. (CVE-2026-31739)

  - In the Linux kernel, the following vulnerability has been resolved: ipv6: icmp: clear skb2->cb[] in     ip6_err_gen_icmpv6_unreach() Sashiko AI-review observed: In ip6_err_gen_icmpv6_unreach(), the skb is an     outer IPv4 ICMP error packet where its cb contains an IPv4 inet_skb_parm. When skb is cloned into skb2 and     passed to icmp6_send(), it uses IP6CB(skb2). IP6CB interprets the IPv4 inet_skb_parm as an inet6_skb_parm.
    The cipso offset in inet_skb_parm.opt directly overlaps with dsthao in inet6_skb_parm at offset 18. If an     attacker sends a forged ICMPv4 error with a CIPSO IP option, dsthao would be a non-zero offset. Inside     icmp6_send(), mip6_addr_swap() is called and uses ipv6_find_tlv(skb, opt->dsthao, IPV6_TLV_HAO). This     would scan the inner, attacker-controlled IPv6 packet starting at that offset, potentially returning a     fake TLV without checking if the remaining packet length can hold the full 18-byte struct     ipv6_destopt_hao. Could mip6_addr_swap() then perform a 16-byte swap that extends past the end of the     packet data into skb_shared_info? Should the cb array also be cleared in ip6_err_gen_icmpv6_unreach() and     ip6ip6_err() to prevent this? This patch implements the first suggestion. I am not sure if ip6ip6_err()     needs to be changed. A separate patch would be better anyway. (CVE-2026-43038)

  - In the Linux kernel, the following vulnerability has been resolved: procfs: fix missing RCU protection     when reading real_parent in do_task_stat() When reading /proc/[pid]/stat, do_task_stat() accesses     task->real_parent without proper RCU protection, which leads to: cpu 0 cpu 1 ----- ----- do_task_stat var     = task->real_parent release_task call_rcu(delayed_put_task_struct) task_tgid_nr_ns(var) rcu_read_lock <---     Too late to protect task->real_parent! task_pid_ptr <--- UAF! rcu_read_unlock This patch uses     task_ppid_nr_ns() instead of task_tgid_nr_ns() to add proper RCU protection for accessing     task->real_parent. (CVE-2026-46259)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - crypto: tegra - Add missing CRYPTO_ALG_ASYNC The tegra crypto driver failed to set the CRYPTO_ALG_ASYNC on     its asynchronous algorithms, causing the crypto API to select them for users that request only synchronous     algorithms. This causes crashes (at least). Fix this by adding the flag like what the other drivers do.
    Also remove the unnecessary CRYPTO_ALG_TYPE_* flags, since those just get ignored and overridden by the     registration function anyway. (CVE-2026-31739)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Published	Updated	Severity
318365	Photon OS 5.0: Linux PHSA-2026-5.0-0849	Nessus	PhotonOS Local Security Checks	6/3/2026	7/31/2026	high
324007	CentOS 9 : kernel-5.14.0-719.el9	Nessus	CentOS Local Security Checks	7/1/2026	7/1/2026	high
335080	openSUSE 16: cluster-md-kmp-64kb / cluster-md-kmp-azure / cluster-md-kmp-default / etc (openSUSE-SU-2026:21555-1)	Nessus	SuSE Local Security Checks	8/13/2026	9/19/2026	high
333798	Photon OS 5.0: Linux PHSA-2026-5.0-92-0849	Nessus	PhotonOS Local Security Checks	8/10/2026	8/22/2026	high
311718	Linux Distros Unpatched Vulnerability : CVE-2026-31739	Nessus	Misc.	5/2/2026	9/30/2026	high

Detections

Analytics

Plugins Search

high

high

high

high

high