The remote Oracle Linux 10 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-500399 advisory.

    - ipv4: free inet_opt and ireq_opt after an RCU grace period (Eric Dumazet)  [Orabug: 40167669]     {CVE-2026-98432}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - ipv4: free inet_opt and ireq_opt after an RCU grace period tcp_v4_syn_recv_sock() transfers ownership of     ireq->ireq_opt to the child socket (newinet->inet_opt) without copying it. Another cpu can concurrently     process a retransmitted SYN for the same request socket, and send a SYNACK from tcp_check_req().
    tcp_v4_send_synack() and inet_csk_route_req() read ireq->ireq_opt under rcu_read_lock() only, and     ip_build_and_send_pkt() and ip_options_build() then read opt->optlen twice. Note that the SYNACK timer     itself is not an issue: it holds a reference on its request socket, and inet_csk_reqsk_queue_drop() calls     timer_delete_sync() before the child can be freed. Since commit 079096f103fa (tcp/dccp: install syn_recv     requests into ehash table), request sockets are processed without holding the listener lock, so nothing     prevents the child socket from being freed while the SYNACK is still being built. TCP child sockets do not     have SOCK_RCU_FREE, and inet_sock_destruct() frees inet_opt with a plain kfree(), leading to a use-after-     free in ip_options_build(). A similar issue exists with request socket migration     (net.ipv4.tcp_migrate_req=1, or a BPF_SK_REUSEPORT_SELECT_OR_MIGRATE program). reqsk_timer_handler()     clones the request socket with inet_reqsk_clone(), so that the old request socket and its clone share the     same ireq_opt, then reqsk_migrate_reset() clears the pointer in the old one. Another cpu holding a     reference on the old request socket can still be using these options (sending a SYNACK, or creating a     child in tcp_v4_syn_recv_sock()) when the clone is freed, and tcp_v4_reqsk_destructor() also uses a plain     kfree(). Readers already use RCU, and other paths replacing inet_opt (do_ip_setsockopt(),     cipso_v4_sock_setattr()...) already use kfree_rcu(). Use kfree_rcu() in inet_sock_destruct() and     tcp_v4_reqsk_destructor() as well. IPv6 is not affected by the first issue, because tcp_v6_syn_recv_sock()     duplicates the options. tcp_v6_reqsk_destructor() has the same migration issue with ipv6_opt, which is     only set by CALIPSO. This will be addressed in a separate patch. (CVE-2026-98432)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote Oracle Linux 7 / 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-500397 advisory.

    - ipv4: free inet_opt and ireq_opt after an RCU grace period (Eric Dumazet)  [Orabug: 40167664]     {CVE-2026-98432}
    - ipv4: validate checksum_start before completing checksum (Michael S. Tsirkin)  [Orabug: 40167666]     {CVE-2026-99999}
    - vhost: reset the vring metadata cache on vring reconfiguration (Jun Yang)  [Orabug: 40166458]     {CVE-2026-74580}
    - net: tun: bound receive headroom (Asim Viladi Oglu Manizada)  [Orabug: 40020673]  {CVE-2026-81000}
    - xfrm: ah6: validate routing header segments_left (Asim Viladi Oglu Manizada)  [Orabug: 39982188]     {CVE-2026-80844}
    - inet: frags: strip GSO state from fragments before reassembly (Xinyang Ge)  [Orabug: 39972532]     {CVE-2026-80590}
    - sctp: prevent peer transport count overflow (Asim Viladi Oglu Manizada)  [Orabug: 39886843]     {CVE-2026-74469}
    - pppoe: reload header pointer after dev_hard_header() (Asim Viladi Oglu Manizada)  [Orabug: 39859408]     {CVE-2026-68121}
    - crypto: ecc - Fix carry overflow in vli multiplication (Anastasia Tishchenko) [Orabug: 39785911]     {CVE-2026-64313}
    - crypto: pcrypt - restore callback for non-parallel fallback (Ruijie Li) [Orabug: 39785907]     {CVE-2026-64312}
    - crypto: drbg - Fix returning success on failure in CTR_DRBG (Eric Biggers) [Orabug: 39785894]     {CVE-2026-64306}
    - KVM: x86: Use scratch field in MMIO fragment to hold small write values (Sean Christopherson) [Orabug:
    39273524] {CVE-2026-31588}
    - xfrm: clear trailing padding in build_polexpire() (Yasuaki Torimaru) [Orabug: 39262403] {CVE-2026-31664}
    - tipc: fix bc_ackers underflow on duplicate GRP_ACK_MSG (Oleh Konko) [Orabug: 39262395] {CVE-2026-31662}
    - netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (Lukas Johannes Moller)     [Orabug: 39167519] {CVE-2026-23457}
    - netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (Jenny Guanni Qu) [Orabug: 39167511]     {CVE-2026-23455}
    - x86/bugs: Make Safe-RET robust against interrupt injection (Borislav Petkov) [Orabug: 39784513,39853776]     {CVE-2026-68480}
    - x86/alternatives: Disable interrupts and sync when optimizing NOPs in place (Thomas Gleixner) [Orabug:
    39784513] {CVE-2026-68480}
    - x86/alternative: Support relocations in alternatives (Peter Zijlstra) [Orabug: 39784513]     {CVE-2026-68480}
    - x86/alternative: Make debug-alternative selective (Peter Zijlstra) [Orabug: 39784513] {CVE-2026-68480}
    - x86/alternatives: Add alt_instr.flags (Borislav Petkov) [Orabug: 39784513] {CVE-2026-68480}
    - x86/asm: Provide ALTERNATIVE_3 (Peter Zijlstra) [Orabug: 39784513] {CVE-2026-68480}
    - x86/alternative: Optimize single-byte NOPs at an arbitrary position (Borislav Petkov) [Orabug: 39784513]     {CVE-2026-68480}
    - x86/alternative: Align insn bytes vertically (Borislav Petkov) [Orabug: 39784513] {CVE-2026-68480}     (H Peter Anvin) [Orabug: 39784513] {CVE-2026-68480}
    - x86/alternatives: Optimize optimize_nops() (Peter Zijlstra) [Orabug: 39784513] {CVE-2026-68480}
    - x86: Add insn_decode_kernel() (Peter Zijlstra) [Orabug: 39784513] {CVE-2026-68480}
    - x86/insn: Add an insn_decode() API (Borislav Petkov) [Orabug: 39784513] {CVE-2026-68480}
    - x86/alternative: Use ALTERNATIVE_TERNARY() in _static_cpu_has() (Juergen Gross) [Orabug: 39784513]     {CVE-2026-68480}
    - x86/alternative: Support ALTERNATIVE_TERNARY (Juergen Gross) [Orabug: 39784513] {CVE-2026-68480}
    - x86/alternative: Merge include files (Juergen Gross) [Orabug: 39784513] {CVE-2026-68480}
    - x86/alternative: Drop unused feature parameter from ALTINSTR_REPLACEMENT() (Juergen Gross) [Orabug:
    39784513] {CVE-2026-68480}
    - x86/insn: Support big endian cross-compiles (Martin Schwidefsky) [Orabug: 39784513] {CVE-2026-68480}
    - x86/tools: Use tools headers for instruction decoder selftests (Vasily Gorbik) [Orabug: 39784513]     {CVE-2026-68480}
    - tools headers: Get tools's linux/compiler.h closer to the kernel's (Arnaldo Carvalho de Melo) [Orabug:
    39784513] {CVE-2026-68480}
    - perf build: Allow nested externs to enable BUILD_BUG() usage (Vasily Gorbik) [Orabug: 39784513]     {CVE-2026-68480}
    - objtool: Allow nested externs to enable BUILD_BUG() (Vasily Gorbik) [Orabug: 39784513] {CVE-2026-68480}
    - objtool: Make relocation in alternative handling arch dependent (Julien Thierry) [Orabug: 39784513]     {CVE-2026-68480}
    - x86/alternatives: Add pr_fmt() to debug macros (Borislav Petkov) [Orabug: 39784513] {CVE-2026-68480}
    - tools headers: Adopt verbatim copy of compiletime_assert() from kernel sources (Arnaldo Carvalho de     Melo) [Orabug: 39784513] {CVE-2026-68480}
    - x86/alternatives: Teach text_poke_bp() to emulate instructions (Peter Zijlstra) [Orabug: 39784513]     {CVE-2026-68480}
    - tools headers: Synchronize linux/bits.h with the kernel sources (Arnaldo Carvalho de Melo) [Orabug:
    39784513] {CVE-2026-68480}
    - net: tap: set skb->dev before parsing virtio net header in tap_get_user_xdp() (Dongli Zhang) [Orabug:
    39558751,39919265] {CVE-2026-74684}
    - ocfs2: fix possible deadlock between unlink and dio_end_io_write (Joseph Qi) [Orabug: 39273589]     {CVE-2026-31598}
    - fs/ocfs2: fix comments mentioning i_mutex (Hongnan Li) [Orabug: 39273589] {CVE-2026-31598}
    - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Michal Kosiorek) [Orabug: 39460235]     {CVE-2026-46116}
    - net/rds: zero per-item info buffer before handing it to visitors (Michael Bommarito) [Orabug:
    39621716,39638198] {CVE-2026-52995}
    - xfs: resample the data fork mapping after cycling ILOCK (Darrick Wong) [Orabug: 39776792]     {CVE-2026-64600}
    - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [Orabug:
    39673871,39686461] {CVE-2026-53359}
    - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (Sean Christopherson) [Orabug:
    39460223,39673871] {CVE-2026-46113}
    - net/sched: act_pedit: fix action bind logic (Pedro Tammela) [Orabug: 39567287] {CVE-2026-46331}
    - net/sched: act_pedit: free pedit keys on bail from offset check (Pedro Tammela) [Orabug: 39567287]     {CVE-2026-46331}
    - net/sched: fix pedit partial COW leading to page cache corruption (Rajat Gupta) [Orabug:
    39567287,39680880] {CVE-2026-46331}
    - net/sched: act_pedit: Parse L3 Header for L4 offset (Max Tottenham) [Orabug: 39567287] {CVE-2026-46331}
    - net/sched: act_pedit: rate limit datapath messages (Pedro Tammela) [Orabug: 39567287] {CVE-2026-46331}
    - net/sched: act_pedit: check static offsets a priori (Pedro Tammela) [Orabug: 39567287] {CVE-2026-46331}
    - net/sched: act_pedit: remove extra check for key type (Pedro Tammela) [Orabug: 39567287]     {CVE-2026-46331}
    - net/sched: simplify tcf_pedit_act (Pedro Tammela) [Orabug: 39567287] {CVE-2026-46331}
    - net/sched: transition act_pedit to rcu and percpu stats (Pedro Tammela) [Orabug: 39567287]     {CVE-2026-46331}
    - net/sched: act_pedit: use NLA_POLICY for parsing 'ex' keys (Pedro Tammela) [Orabug: 39567287]     {CVE-2026-46331}
    - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Hkbinbin) [Orabug: 39452261]     {CVE-2026-46043}
    - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Davidlohr Bueso) [Orabug:
    39426001,39751168] {CVE-2026-43499,CVE-2026-53163}
    - rtmutex: Use waiter::task instead of current in remove_waiter() (Keenan Dong) [Orabug:
    39426001,39706958] {CVE-2026-43499}
    - ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (Eric Dumazet) [Orabug: 39300930]     {CVE-2026-43038}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6568 advisory.

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-6568-1                   security@debian.org     https://www.debian.org/security/                     Salvatore Bonaccorso     October 16, 2026                      https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : linux     CVE ID         : CVE-2025-38204 CVE-2025-40158 CVE-2026-52988 CVE-2026-72315                      CVE-2026-72463 CVE-2026-74347 CVE-2026-80935 CVE-2026-80937                      CVE-2026-80939 CVE-2026-80980 CVE-2026-81016 CVE-2026-89437                      CVE-2026-89441 CVE-2026-89445 CVE-2026-89452 CVE-2026-89467                      CVE-2026-89500 CVE-2026-89503 CVE-2026-89520 CVE-2026-89527                      CVE-2026-89633 CVE-2026-89638 CVE-2026-89766 CVE-2026-89795                      CVE-2026-89797 CVE-2026-89806 CVE-2026-89827 CVE-2026-89832                      CVE-2026-89837 CVE-2026-89838 CVE-2026-89840 CVE-2026-89859                      CVE-2026-89868 CVE-2026-89912 CVE-2026-89921 CVE-2026-89956                      CVE-2026-89971 CVE-2026-89972 CVE-2026-89996 CVE-2026-90002                      CVE-2026-90013 CVE-2026-90016 CVE-2026-90023 CVE-2026-90029                      CVE-2026-90030 CVE-2026-90146 CVE-2026-93179 CVE-2026-93196                      CVE-2026-93199 CVE-2026-93200 CVE-2026-93231 CVE-2026-93243                      CVE-2026-93244 CVE-2026-93285 CVE-2026-97527 CVE-2026-97528                      CVE-2026-97529 CVE-2026-97530 CVE-2026-97531 CVE-2026-97532                      CVE-2026-97534 CVE-2026-97535 CVE-2026-97536 CVE-2026-97537                      CVE-2026-97549 CVE-2026-97558 CVE-2026-97559 CVE-2026-97566                      CVE-2026-97567 CVE-2026-97571 CVE-2026-97574 CVE-2026-97594                      CVE-2026-97597 CVE-2026-97603 CVE-2026-97609 CVE-2026-97615                      CVE-2026-97618 CVE-2026-97619 CVE-2026-97620 CVE-2026-97901                      CVE-2026-97906 CVE-2026-97918 CVE-2026-97919 CVE-2026-97933                      CVE-2026-97934 CVE-2026-97935 CVE-2026-97938 CVE-2026-97939                      CVE-2026-97949 CVE-2026-97950 CVE-2026-98101 CVE-2026-98161                      CVE-2026-98167 CVE-2026-98168 CVE-2026-98169 CVE-2026-98170                      CVE-2026-98171 CVE-2026-98172 CVE-2026-98173 CVE-2026-98174                      CVE-2026-98175 CVE-2026-98179 CVE-2026-98181 CVE-2026-98182                      CVE-2026-98184 CVE-2026-98185 CVE-2026-98186 CVE-2026-98187                      CVE-2026-98188 CVE-2026-98189 CVE-2026-98190 CVE-2026-98191                      CVE-2026-98192 CVE-2026-98193 CVE-2026-98194 CVE-2026-98195                      CVE-2026-98196 CVE-2026-98197 CVE-2026-98198 CVE-2026-98199                      CVE-2026-98200 CVE-2026-98201 CVE-2026-98202 CVE-2026-98203                      CVE-2026-98204 CVE-2026-98205 CVE-2026-98206 CVE-2026-98207                      CVE-2026-98208 CVE-2026-98209 CVE-2026-98210 CVE-2026-98211                      CVE-2026-98212 CVE-2026-98213 CVE-2026-98214 CVE-2026-98215                      CVE-2026-98216 CVE-2026-98217 CVE-2026-98218 CVE-2026-98221                      CVE-2026-98222 CVE-2026-98227 CVE-2026-98229 CVE-2026-98230                      CVE-2026-98231 CVE-2026-98232 CVE-2026-98233 CVE-2026-98234                      CVE-2026-98235 CVE-2026-98236 CVE-2026-98237 CVE-2026-98238                      CVE-2026-98239 CVE-2026-98241 CVE-2026-98245 CVE-2026-98246                      CVE-2026-98247 CVE-2026-98248 CVE-2026-98249 CVE-2026-98251                      CVE-2026-98252 CVE-2026-98253 CVE-2026-98254 CVE-2026-98255                      CVE-2026-98257 CVE-2026-98260 CVE-2026-98261 CVE-2026-98262                      CVE-2026-98263 CVE-2026-98264 CVE-2026-98265 CVE-2026-98266                      CVE-2026-98267 CVE-2026-98269 CVE-2026-98270 CVE-2026-98271                      CVE-2026-98272 CVE-2026-98275 CVE-2026-98276 CVE-2026-98282                      CVE-2026-98283 CVE-2026-98287 CVE-2026-98290 CVE-2026-98291                      CVE-2026-98293 CVE-2026-98295 CVE-2026-98297 CVE-2026-98298                      CVE-2026-98299 CVE-2026-98300 CVE-2026-98301 CVE-2026-98302                      CVE-2026-98303 CVE-2026-98306 CVE-2026-98307 CVE-2026-98308                      CVE-2026-98309 CVE-2026-98311 CVE-2026-98312 CVE-2026-98314                      CVE-2026-98316 CVE-2026-98319 CVE-2026-98320 CVE-2026-98322                      CVE-2026-98323 CVE-2026-98325 CVE-2026-98326 CVE-2026-98327                      CVE-2026-98328 CVE-2026-98329 CVE-2026-98331 CVE-2026-98334                      CVE-2026-98335 CVE-2026-98336 CVE-2026-98337 CVE-2026-98339                      CVE-2026-98340 CVE-2026-98342 CVE-2026-98343 CVE-2026-98344                      CVE-2026-98345 CVE-2026-98346 CVE-2026-98347 CVE-2026-98348                      CVE-2026-98349 CVE-2026-98351 CVE-2026-98352 CVE-2026-98354                      CVE-2026-98357 CVE-2026-98358 CVE-2026-98359 CVE-2026-98360                      CVE-2026-98362 CVE-2026-98363 CVE-2026-98365 CVE-2026-98366                      CVE-2026-98367 CVE-2026-98368 CVE-2026-98369 CVE-2026-98370                      CVE-2026-98373 CVE-2026-98374 CVE-2026-98375 CVE-2026-98377                      CVE-2026-98378 CVE-2026-98379 CVE-2026-98380 CVE-2026-98381                      CVE-2026-98382 CVE-2026-98383 CVE-2026-98384 CVE-2026-98386                      CVE-2026-98403 CVE-2026-98406 CVE-2026-98407 CVE-2026-98409                      CVE-2026-98410 CVE-2026-98411 CVE-2026-98412 CVE-2026-98413                      CVE-2026-98416 CVE-2026-98417 CVE-2026-98419 CVE-2026-98421                      CVE-2026-98422 CVE-2026-98423 CVE-2026-98425 CVE-2026-98426                      CVE-2026-98428 CVE-2026-98429 CVE-2026-98430 CVE-2026-98432                      CVE-2026-99999     Debian Bug     : 1149499 1149564 1150891

    Several vulnerabilities have been discovered in the Linux kernel that     may lead to a privilege escalation, denial of service or information     leaks.

    For the stable distribution (trixie), these problems have been fixed in     version 6.12.113-1.

    We recommend that you upgrade your linux packages.

    For the detailed security status of linux please refer to its security     tracker page at:
    https://security-tracker.debian.org/tracker/linux

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
366723	Oracle Linux 10 / 9 : Unbreakable Enterprise kernel (ELSA-2026-500399)	Nessus	Oracle Linux Local Security Checks	10/17/2026	10/17/2026	critical
366212	Linux Distros Unpatched Vulnerability : CVE-2026-98432	Nessus	Misc.	10/15/2026	10/17/2026	high
366662	Oracle Linux 7 / 8 : Unbreakable Enterprise kernel (ELSA-2026-500397)	Nessus	Oracle Linux Local Security Checks	10/16/2026	10/16/2026	critical
366663	Oracle Linux 8 / 9 : Unbreakable Enterprise kernel (ELSA-2026-500398)	Nessus	Oracle Linux Local Security Checks	10/16/2026	10/16/2026	critical
366507	Debian dsa-6568 : ata-modules-6.12.111+deb13-armmp-di - security update	Nessus	Debian Local Security Checks	10/16/2026	10/16/2026	medium

Detections

Analytics

Plugins Search

critical

high

critical

critical

medium