Linux/Unix 主機上安裝了一個或多個受到弱點影響的套件，且廠商未提供可用的修補程式。

  - eventfs：在 rcu 寬限期過後釋放 eventfs_inode tracefs_d_revalidate（） 讀取 dentry->d_fsdata 指向的 eventfs_inode 的 ->is_freed，並且在 rcu pathwalk 模式下呼叫 ->d_revalidate（），並且只保留 rcu_read_lock（） 。dentry 本身會為這樣的步行者保留，但當 dentry 被殺死時，tracefs_d_release（） 會刪除對 eventfs_inode 的引用，然後 release_ei（） 在 eventfs_srcu 的寬限期後釋放它。SRCU 寬限期不會等待 rcu_read_lock（） 區段，因此步行者可以讀取已經消失的eventfs_inode。在 tracefs_d_revalidate（） 中保留路徑行列，而 dentry 消失： 錯誤： KASAN：tracefs_d_revalidate+0x76/0x90 中的 slab-use-after-free 由 task walker/97 在 addr ff1100010152d8d0 讀取大小 1 調用追蹤：
    <TASK> tracefs_d_revalidate+0x76/0x90 lookup_fast+0x320/0x640 path_lookupat+0x160/0xb00 filename_lookup+0x1f1/0x5b0 vfs_statx+0xd7/0x3b0 vfs_fstatat+0x4d/0x90 __do_sys_newfstatat+0xa0/0x100 do_syscall_64+0x10e/0x5e0 entry_SYSCALL_64_after_hwframe+0x77/0x7f [...]依作業 1 分配：
    __kmalloc_cache_noprof+0x249/0x560 eventfs_create_dir+0x7a/0x590 event_create_dir+0x2fb/0xcf0 trace_add_event_call+0xbf/0x150 [...]由任務 11 釋放：kfree+0x1db/0x5b0 srcu_invoke_callbacks+0x3a3/0x620 process_one_work+0x937/0x1810 worker_thread+0x4f1/0xd60 在提交 8e556432477e 之前 （eventfs：使用 SRCU 釋放 eventfs_inodes） release_ei（） 使用了 call_rcu（），覆蓋了步行者，而 eventfs_iterate（） 需要 SRCU 寬限期。等待來自 SRCU 回呼的鏈結 call_rcu（）。（CVE-2026-99173）

請注意，Nessus 的判定取決於廠商所報告的套件是否存在。

Linux/Unix 主机中安装的一个或多个程序包受到一个漏洞影响，而供应商没有提供补丁程序。

  - eventfs：过了 rcu 宽限期后过度释放eventfs_inode tracefs_d_revalidate（） 读取 dentry->d_fsdata 指向的eventfs_inode的 ->is_freed，并且在 rcu pathwalk 模式下仅保留 rcu_read_lock（） 未保留任何内容，调用 ->d_revalidate）。对于此类遍历器，dentry 本身会存在，但是 tracefs_d_release（） 在终止 dentry 时放弃其对eventfs_inode的引用，然后在 release_ei eventfs_srcu 的宽限期后释放它。SRCU 宽限期不会等待 rcu_read_lock（） 部分，因此遍历器可以读取已消失的eventfs_inode。在 dentry 离开时，路径遍历在 tracefs_d_revalidate（） 中被搁置： 缺陷： KASAN：任务 walker/97 在地址 ff1100010152d8d0 中大小为 1 的 tracefs_d_revalidate+0x76/0x90 中的 slab-use-after-free 调用跟踪：
    <TASK> tracefs_d_revalidate+0x76/0x90 lookup_fast+0x320/0x640 path_lookupat+0x160/0xb00 filename_lookup+0x1f1/0x5b0 vfs_statx+0xd7/0x3b0 vfs_fstatat+0x4d/0x90 __do_sys_newfstatat+0xa0/0x100 do_syscall_64+0x10e/0x5e0 entry_SYSCALL_64_after_hwframe+0x77/0x7f [...]按任务 1 分配：
    __kmalloc_cache_noprof+0x249/0x560 eventfs_create_dir+0x7a/0x590 event_create_dir+0x2fb/0xcf0 trace_add_event_call+0xbf/0x150 [...]由任务 11 释放：kfree+0x1db/0x5b0 srcu_invoke_callbacks+0x3a3/0x620 process_one_work+0x937/0x1810 worker_thread+0x4f1/0xd60 提交前 8e556432477e （eventfs：使用 SRCU 释放 eventfs_inodes） release_ei（） 使用覆盖遍历器的 call_rcu（），而 eventfs_iterate（） 需要 SRCU 宽限期。等待来自 SRCU 回调的两者和链 call_rcu（）。（CVE-2026-99173）

请注意，Nessus 依赖供应商报告的程序包是否存在进行判断。

Linux/Unix ホストには、ベンダーが提供するパッチが利用できない脆弱性の影響を受ける複数のパッケージがインストールされています。

  - eventfs:rcu 猶予期間が過ぎると、eventfs_inode を解放します tracefs_d_revalidate() は dentry->d_fsdata が指すeventfs_inodeの ->is_freed を読み取り、->d_revalidate() は rcu_read_lock() だけを保持した状態で rcu pathwalk モードで呼び出されます。dentry 自体はそのようなウォーカーのために存在しますが、dentry が強制終了されると tracefs_d_release() は eventfs_inode への参照をドロップし、その後 release_ei() は eventfs_srcu の猶予期間の後にそれを解放します。SRCUの猶予期間はrcu_read_lock()セクションを待機しないため、ウォーカーはすでになくなったeventfs_inodeを読み取ることができます。dentry が消失する間に tracefs_d_revalidate() で pathwalk が保留された場合: バグ: KASAN:tracefs_d_revalidate+0x76/0x90 の slab-use-after-free タスク walker/97 による addr ff1100010152d8d0 でのサイズ 1 の読み取り コールトレース:
    <TASK> tracefs_d_revalidate+0x76/0x90 lookup_fast+0x320/0x640 path_lookupat+0x160/0xb00 filename_lookup+0x1f1/0x5b0 vfs_statx+0xd7/0x3b0 vfs_fstatat+0x4d/0x90 __do_sys_newfstatat+0xa0/0x100 do_syscall_64+0x10e/0x5e0 entry_SYSCALL_64_after_hwframe+0x77/0x7f [...]タスク 1 による割り当て:
    __kmalloc_cache_noprof+0x249/0x560 eventfs_create_dir+0x7a/0x590 event_create_dir+0x2fb/0xcf0 trace_add_event_call+0xbf/0x150 [...]タスク 11 により解放: kfree+0x1db/0x5b0 srcu_invoke_callbacks+0x3a3/0x620 process_one_work+0x937/0x1810 worker_thread+0x4f1/0xd60 8e556432477e をコミットする前に(eventfs: eventfs_inodes 解放に SRCU を使用 release_ei() はウォーカーを対象とする call_rcu() を使用しましたが、eventfs_iterate() には SRCU 猶予期間が必要です。SRCU コールバックからの call_rcu() の両方を待機します。(CVE-2026-99173)

Nessus は、ベンダーから報告されたパッケージの存在に依存していることに注意してください。

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - eventfs: Free the eventfs_inode after an rcu grace period too tracefs_d_revalidate() reads ->is_freed of     the eventfs_inode that dentry->d_fsdata points to, and ->d_revalidate() is called in rcu pathwalk mode     with nothing but rcu_read_lock() held. The dentry itself stays around for such a walker, but     tracefs_d_release() drops its reference to the eventfs_inode when the dentry is killed, and release_ei()     then frees it after a grace period of eventfs_srcu. An SRCU grace period doesn't wait for rcu_read_lock()     sections, so the walker can read an eventfs_inode that is already gone. With a pathwalk held up in     tracefs_d_revalidate() while the dentry goes away: BUG: KASAN: slab-use-after-free in     tracefs_d_revalidate+0x76/0x90 Read of size 1 at addr ff1100010152d8d0 by task walker/97 Call Trace:
    <TASK> tracefs_d_revalidate+0x76/0x90 lookup_fast+0x320/0x640 path_lookupat+0x160/0xb00     filename_lookup+0x1f1/0x5b0 vfs_statx+0xd7/0x3b0 vfs_fstatat+0x4d/0x90 __do_sys_newfstatat+0xa0/0x100     do_syscall_64+0x10e/0x5e0 entry_SYSCALL_64_after_hwframe+0x77/0x7f [...] Allocated by task 1:
    __kmalloc_cache_noprof+0x249/0x560 eventfs_create_dir+0x7a/0x590 event_create_dir+0x2fb/0xcf0     trace_add_event_call+0xbf/0x150 [...] Freed by task 11: kfree+0x1db/0x5b0     srcu_invoke_callbacks+0x3a3/0x620 process_one_work+0x937/0x1810 worker_thread+0x4f1/0xd60 Before commit     8e556432477e (eventfs: Use SRCU for freeing eventfs_inodes) release_ei() used call_rcu(), which covered     the walker, while eventfs_iterate() needs the SRCU grace period. Wait for both and chain call_rcu() from     the SRCU callback. (CVE-2026-99173)

Note that Nessus relies on the presence of the package as reported by the vendor.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3448 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    mm/pagewalk: fix stale walk->action escaping walk_pmd_range() (CVE-2026-89754)

    In the Linux kernel, the following vulnerability has been resolved:

    KVM: x86: Re-pend GET_NESTED_STATE_PAGES if getting said pages fails (CVE-2026-98863)

    In the Linux kernel, the following vulnerability has been resolved:

    ipv4: udp: Create exceptions before socket matching (CVE-2026-99077)

    In the Linux kernel, the following vulnerability has been resolved:

    workqueue: Fix unbound pool lifetime for pending pwqs (CVE-2026-99103)

    In the Linux kernel, the following vulnerability has been resolved:

    sched_ext: Fix stall when a task enqueued with SCX_ENQ_LAST lands back on its CPU's local DSQ     (CVE-2026-99105)

    In the Linux kernel, the following vulnerability has been resolved:

    smb: client: fix heap overflow in cifs_do_set_acl() (CVE-2026-99110)

    In the Linux kernel, the following vulnerability has been resolved:

    net/sched: cls_flower: validate mask pointer after nla_next() (CVE-2026-99112)

    In the Linux kernel, the following vulnerability has been resolved:

    net: bridge: mcast: don't truncate the port group walk on teardown (CVE-2026-99117)

    In the Linux kernel, the following vulnerability has been resolved:

    drm/i915/dmc: Harden DMC firmware payload parsing (CVE-2026-99118)

    In the Linux kernel, the following vulnerability has been resolved:

    ipv4: avoid divide by zero in fib_rebalance (CVE-2026-99121)

    In the Linux kernel, the following vulnerability has been resolved:

    vsock/virtio: validate packet source for connected sockets (CVE-2026-99123)

    In the Linux kernel, the following vulnerability has been resolved:

    page_pool: keep frag_offset aligned for odd-sized requests (CVE-2026-99127)

    In the Linux kernel, the following vulnerability has been resolved:

    sctp: validate chunk length in the inqueue parser (CVE-2026-99128)

    In the Linux kernel, the following vulnerability has been resolved:

    io_uring/cancel: don't spin on local work the task can't run (CVE-2026-99130)

    In the Linux kernel, the following vulnerability has been resolved:

    xfs: fix capability check in xfs (CVE-2026-99131)

    In the Linux kernel, the following vulnerability has been resolved:

    dm-integrity: fix infinite loop on discard with large tag size (CVE-2026-99135)

    In the Linux kernel, the following vulnerability has been resolved:

    dm-crypt: fix a tiny race condition in crypt_dec_pending (CVE-2026-99136)

    In the Linux kernel, the following vulnerability has been resolved:

    tcp: fix use-after-free in do_tcp_getsockopt(TCP_CC_INFO) (CVE-2026-99138)

    In the Linux kernel, the following vulnerability has been resolved:

    tcp: fix use-after-free in do_tcp_getsockopt(TCP_CONGESTION) (CVE-2026-99139)

    In the Linux kernel, the following vulnerability has been resolved:

    tracing: Check operator stack capacity before pushing (CVE-2026-99142)

    In the Linux kernel, the following vulnerability has been resolved:

    tracing: Keep the predicate limit separate from program capacity (CVE-2026-99143)

    In the Linux kernel, the following vulnerability has been resolved:

    drm/exec: don't immediately add prelocked obj to array of locked objs (CVE-2026-99147)

    In the Linux kernel, the following vulnerability has been resolved:

    scsi: libiscsi: Validate the ITT reflected in a Reject PDU (CVE-2026-99153)

    In the Linux kernel, the following vulnerability has been resolved:

    scsi: xen/scsifront: Check for a NULL shadow entry on a backend response (CVE-2026-99155)

    In the Linux kernel, the following vulnerability has been resolved:

    scsi: st: Fix use-after-free race between st_remove() and st_open() (CVE-2026-99156)

    In the Linux kernel, the following vulnerability has been resolved:

    ring-buffer: Fix false warning in ring_buffer_map_get_reader() (CVE-2026-99158)

    In the Linux kernel, the following vulnerability has been resolved:

    ring-buffer: Fix the sub-buffer array base in rb_meta_subbuf_idx() (CVE-2026-99159)

    In the Linux kernel, the following vulnerability has been resolved:

    ring-buffer: Do not show buffer_meta for CPUs without a buffer (CVE-2026-99160)

    In the Linux kernel, the following vulnerability has been resolved:

    sctp: revalidate output stream after association connect wait (CVE-2026-99165)

    In the Linux kernel, the following vulnerability has been resolved:

    net/sched: fix use-after-free in __tcf_action_put() (CVE-2026-99167)

    In the Linux kernel, the following vulnerability has been resolved:

    futex: Fix mm reuse handling for FUT_OFF_MMSHARED (CVE-2026-99169)

    In the Linux kernel, the following vulnerability has been resolved:

    ntfs3: free the sbi after a grace period (CVE-2026-99171)

    In the Linux kernel, the following vulnerability has been resolved:

    eventfs: Free the eventfs_inode after an rcu grace period too (CVE-2026-99173)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: free the sbi after a grace period (CVE-2026-99174)

    In the Linux kernel, the following vulnerability has been resolved:

    fsnotify: prevent mark additions during connector teardown (CVE-2026-99175)

    In the Linux kernel, the following vulnerability has been resolved:

    KVM: nVMX: Reset MMU back to the root MMU if loading L2 state fails for !VM-Entry (CVE-2026-99176)

    In the Linux kernel, the following vulnerability has been resolved:

    x86/kvm: Don't consume async #PF flags on a kernel #PF in NMI context (CVE-2026-99178)

    In the Linux kernel, the following vulnerability has been resolved:

    autofs: ignore notification errors from a replaced pipe (CVE-2026-99181)

    In the Linux kernel, the following vulnerability has been resolved:

    perf: Fix perf_pmu_migrate_context() leaving events behind (CVE-2026-99187)

    In the Linux kernel, the following vulnerability has been resolved:

    calipso: keep BIG TCP payload_len in calipso_skbuff_setattr() (CVE-2026-99191)

    In the Linux kernel, the following vulnerability has been resolved:

    netlink: avoid hashing the network namespace pointer (CVE-2026-99201)

    In the Linux kernel, the following vulnerability has been resolved:

    pipe: preserve existing fasync readers on writer setup failure (CVE-2026-99203)

    In the Linux kernel, the following vulnerability has been resolved:

    scsi: target: iscsi: Fix race in discovery auth updates (CVE-2026-99206)

    In the Linux kernel, the following vulnerability has been resolved:

    netlink: reset skb headers before unicast and multicast filtering (CVE-2026-99211)

    In the Linux kernel, the following vulnerability has been resolved:

    vsock: treat TCP_CLOSING as once-established (CVE-2026-99213)

    In the Linux kernel, the following vulnerability has been resolved:

    Drivers: hv: Don't reset VMBus connection state on error/exit paths (CVE-2026-99216)

    In the Linux kernel, the following vulnerability has been resolved:

    coredump: hold RCU while releasing parked threads (CVE-2026-99218)

    In the Linux kernel, the following vulnerability has been resolved:

    ftrace: Initialize modname and offset in print_rec() (CVE-2026-99219)

    In the Linux kernel, the following vulnerability has been resolved:

    asymmetric_keys: reject trust keys without IDs (CVE-2026-99220)

    In the Linux kernel, the following vulnerability has been resolved:

    keys/trusted_keys: return immediately after TPM unseal failure (CVE-2026-99221)

    In the Linux kernel, the following vulnerability has been resolved:

    keys: Protect the read method check against type removal (CVE-2026-99222)

    In the Linux kernel, the following vulnerability has been resolved:

    keys: make keyring indexes independent of kernel addresses (CVE-2026-99223)

    In the Linux kernel, the following vulnerability has been resolved:

    keys: Check the authorization payload in process keyring searches (CVE-2026-99225)

    In the Linux kernel, the following vulnerability has been resolved:

    keys: Avoid the owner account dereference in named keyring lookup (CVE-2026-99226)

    In the Linux kernel, the following vulnerability has been resolved:

    io_uring/waitid: prevent cancel reference wrap (CVE-2026-99227)

    In the Linux kernel, the following vulnerability has been resolved:

    io_uring/io-wq: don't lose the signal that ends work (CVE-2026-99228)

    In the Linux kernel, the following vulnerability has been resolved:

    io_uring/wait: don't spin on a stuck overflow list (CVE-2026-99229)

    In the Linux kernel, the following vulnerability has been resolved:

    io_uring/waitid: own the request before clearing ->head (CVE-2026-99231)

    In the Linux kernel, the following vulnerability has been resolved:

    tracing: Reject incomplete event filter expressions (CVE-2026-99236)

    In the Linux kernel, the following vulnerability has been resolved:

    pid_namespace: prevent TIF_NOTIFY_SIGNAL from interrupting the reaper (CVE-2026-99244)

    In the Linux kernel, the following vulnerability has been resolved:

    KEYS: Fix key_reject_and_link() race with keyring restriction (CVE-2026-99245)

    In the Linux kernel, the following vulnerability has been resolved:

    tipc: protect node reset trace dump with node lock (CVE-2026-99246)

    In the Linux kernel, the following vulnerability has been resolved:

    tracing: Do not initialize tracefs work if tracing is disabled (CVE-2026-99247)

    In the Linux kernel, the following vulnerability has been resolved:

    pid_namespace: make zap_pid_ns_processes() freezable (CVE-2026-99249)

    In the Linux kernel, the following vulnerability has been resolved:

    printk: Postpone kthread startup (CVE-2026-99250)

    In the Linux kernel, the following vulnerability has been resolved:

    Drivers: hv: Avoid infinite retry loop in init_vp_index() (CVE-2026-99251)

    In the Linux kernel, the following vulnerability has been resolved:

    io_uring: don't flood a cancelling task with task_work (CVE-2026-99254)

    In the Linux kernel, the following vulnerability has been resolved:

    io_uring/io-wq: don't hide a link from cancellations (CVE-2026-99255)

    In the Linux kernel, the following vulnerability has been resolved:

    dm cache: fix issue with background work locking (CVE-2026-99256)

    In the Linux kernel, the following vulnerability has been resolved:

    x86/hyperv: Avoid using per-cpu output page in hv_apicid_to_vp_index() (CVE-2026-99258)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
373347	Linux Distros 未修補弱點：CVE-2026-99173	Nessus	Misc.	10/28/2026	11/11/2026	high
373347	Linux Distros 未修补的漏洞：CVE-2026-99173	Nessus	Misc.	10/28/2026	11/11/2026	high
373347	Linux Distros のパッチ未適用の脆弱性: CVE-2026-99173	Nessus	Misc.	10/28/2026	11/11/2026	high
373347	Linux Distros Unpatched Vulnerability : CVE-2026-99173	Nessus	Misc.	10/28/2026	11/11/2026	high
379864	Amazon Linux 2023 : bpftool6.12, kernel6.12, kernel6.12-devel (ALAS2023-2026-3448)	Nessus	Amazon Linux Local Security Checks	11/12/2026	11/12/2026	critical

Detections

Analytics

Plugins Search

high

high

high

high

critical