The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:0317-1 advisory.

    The SUSE Linux Enterprise 15 SP5 kernel was updated to fix various security issues

    The following security issues were fixed:

    - CVE-2022-50630: mm: hugetlb: fix UAF in hugetlb_handle_userfault (bsc#1254785).
    - CVE-2022-50700: wifi: ath10k: Delay the unmapping of the buffer (bsc#1255576).
    - CVE-2023-53254: cacheinfo: Fix shared_cpu_map to handle shared caches at different levels (bsc#1249871).
    - CVE-2023-53781: smc: Fix use-after-free in tcp_write_timer_handler() (bsc#1254751).
    - CVE-2024-56590: Bluetooth: hci_core: Fix not checking skb length on hci_acldata_packet (bsc#1235038).
    - CVE-2025-39977: futex: Prevent use-after-free during requeue-PI (bsc#1252046).
    - CVE-2025-40019: crypto: essiv - Check ssize for decryption and in-place encryption (bsc#1252678).
    - CVE-2025-40139: smc: Use __sk_dst_get() and dst_dev_rcu() in in smc_clc_prfx_set() (bsc#1253409).
    - CVE-2025-40215: kABI: xfrm: delete x->tunnel as we delete x (bsc#1254959).
    - CVE-2025-40220: fuse: fix livelock in synchronous file put from fuseblk workers (bsc#1254520).
    - CVE-2025-40233: ocfs2: clear extent cache after moving/defragmenting extents (bsc#1254813).
    - CVE-2025-40258: mptcp: fix race condition in mptcp_schedule_work() (bsc#1254843).
    - CVE-2025-40277: drm/vmwgfx: Validate command header size against (bsc#1254894).
    - CVE-2025-40280: tipc: Fix use-after-free in tipc_mon_reinit_self() (bsc#1254847).
    - CVE-2025-40331: sctp: Prevent TOCTOU out-of-bounds write (bsc#1254615).
    - CVE-2025-68732: gpu: host1x: Fix race in syncpt alloc/free (bsc#1255688).

    The following non security issues were fixed:

    - ACPI/IORT: Fix memory leak in iort_rmr_alloc_sids() (git-fixes).
    - ACPI: PRM: Remove unnecessary strict handler address checks (git-fixes).
    - ACPI: property: Do not pass NULL handles to acpi_attach_data() (git-fixes).
    - ACPI: property: Fix buffer properties extraction for subnodes (git-fixes).
    - KVM: SVM: Fix TSC_AUX virtualization setup (git-fixes).
    - RDMA/cm: Rate limit destroy CM ID timeout error message (git-fixes).
    - RDMA/counter: Check CAP_NET_RAW check in user namespace for RDMA counters (git-fixes).
    - RDMA/hns: Fix the modification of max_send_sge (git-fixes).
    - RDMA/mlx5: Check CAP_NET_RAW in user namespace for anchor create (git-fixes).
    - RDMA/mlx5: Check CAP_NET_RAW in user namespace for devx create (git-fixes).
    - RDMA/mlx5: Check CAP_NET_RAW in user namespace for flow create (git-fixes).
    - RDMA/mlx5: Fix compilation warning when USER_ACCESS isn't set (git-fixes).
    - RDMA/nldev: Check CAP_NET_RAW in user namespace for QP modify (git-fixes).
    - RDMA/uverbs: Add empty rdma_uattrs_has_raw_cap() declaration (git-fixes).
    - RDMA/uverbs: Check CAP_NET_RAW in user namespace for QP create (git-fixes).
    - RDMA/uverbs: Check CAP_NET_RAW in user namespace for RAW QP create (git-fixes).
    - RDMA/uverbs: Check CAP_NET_RAW in user namespace for flow create (git-fixes).
    - arch/idle: Change arch_cpu_idle() behavior: always exit with IRQs disabled (git-fixes).
    - cpuidle/poll: Ensure IRQs stay disabled after cpuidle_state::enter() calls (git-fixes).
    - cpuidle: Move IRQ state validation (git-fixes).
    - cpuidle: haltpoll: Do not enable interrupts when entering idle (git-fixes).
    - dm: free table mempools if not used in __bind (git-fixes).
    - padata: Honor the caller's alignment in case of chunk_size 0 (bsc#1237563).
    - platform/x86/intel-uncore-freq: Fail module load when plat_info is NULL (git-fixes).
    - x86/bugs: Fix RSB clearing in indirect_branch_prediction_barrier() (git-fixes).
    - x86/bugs: Use SBPB in write_ibpb() if applicable (git-fixes).
    - x86/paravirt: Move halt paravirt calls under CONFIG_PARAVIRT (git-fixes).
    - x86/tdx: Drop flags from __tdx_hypercall() (git-fixes).
    - x86/tdx: Dynamically disable SEPT violations from causing #VEs (git-fixes).
    - x86/tdx: Emit warning if IRQs are enabled during HLT #VE handling (git-fixes).
    - x86/tdx: Extend TDX_MODULE_CALL to support more TDCALL/SEAMCALL leafs (git-fixes).
    - x86/tdx: Fix __noreturn build warning around __tdx_hypercall_failed() (git-fixes).
    - x86/tdx: Fix arch_safe_halt() execution for TDX VMs (git-fixes).
    - x86/tdx: Introduce wrappers to read and write TD metadata (git-fixes).
    - x86/tdx: Make TDX_HYPERCALL asm similar to TDX_MODULE_CALL (git-fixes).
    - x86/tdx: Make macros of TDCALLs consistent with the spec (git-fixes).
    - x86/tdx: Pass TDCALL/SEAMCALL input/output registers via a structure (git-fixes).
    - x86/tdx: Reimplement __tdx_hypercall() using TDX_MODULE_CALL asm (git-fixes).
    - x86/tdx: Remove 'struct tdx_hypercall_args' (git-fixes).
    - x86/tdx: Remove TDX_HCALL_ISSUE_STI (git-fixes).
    - x86/tdx: Rename __tdx_module_call() to __tdcall() (git-fixes).
    - x86/tdx: Rename tdx_parse_tdinfo() to tdx_setup() (git-fixes).
    - x86/tdx: Retry partially-completed page conversion hypercalls (git-fixes).
    - x86/tdx: Skip saving output regs when SEAMCALL fails with VMFailInvalid (git-fixes).
    - x86/tdx: Zero out the missing RSI in TDX_HYPERCALL macro (git-fixes).
    - x86/virt/tdx: Make TDX_MODULE_CALL handle SEAMCALL #UD and #GP (git-fixes).
    - x86/virt/tdx: Wire up basic SEAMCALL functions (git-fixes).
    - xfs: fix sparse inode limits on runt AG (bsc#1254392).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1777616064 advisory.

  - In the Linux kernel, the following vulnerability has been resolved: tracing: Fix potential double free in     create_var_ref() In create_var_ref(), init_var_ref() is called to initialize the fields of variable     ref_field, which is allocated in the previous function call to create_hist_field(). Function     init_var_ref() allocates the corresponding fields such as ref_field->system, but frees these fields when     the function encounters an error. The caller later calls destroy_hist_field() to conduct error handling,     which frees the fields and the variable itself. This results in double free of the fields which are     already freed in the previous function. Fix this by storing NULL to the corresponding fields when they are     freed in init_var_ref(). (CVE-2022-49410)

  - In the Linux kernel, the following vulnerability has been resolved: net: mdio: fix undefined behavior in     bit shift for __mdiobus_register Shifting signed 32-bit value by 31 bits is undefined, so changing     significant bit to unsigned. The UBSAN warning calltrace like below: UBSAN: shift-out-of-bounds in     drivers/net/phy/mdio_bus.c:586:27 left shift of 1 by 31 places cannot be represented in type 'int' Call     Trace: <TASK> dump_stack_lvl+0x7d/0xa5 dump_stack+0x15/0x1b ubsan_epilogue+0xe/0x4e
    __ubsan_handle_shift_out_of_bounds+0x1e7/0x20c __mdiobus_register+0x49d/0x4e0     fixed_mdio_bus_init+0xd8/0x12d do_one_initcall+0x76/0x430 kernel_init_freeable+0x3b3/0x422     kernel_init+0x24/0x1e0 ret_from_fork+0x1f/0x30 </TASK> (CVE-2022-49907)

  - In the Linux kernel, the following vulnerability has been resolved: vt: Clear selection before changing     the font When changing the console font with ioctl(KDFONTOP) the new font size can be bigger than the     previous font. A previous selection may thus now be outside of the new screen size and thus trigger out-     of-bounds accesses to graphics memory if the selection is removed in vc_do_resize(). Prevent such out-of-     memory accesses by dropping the selection before the various con_font_set() console handlers are called.
    (CVE-2022-49948)

  - In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mvm: fix double free on     tx path. We see kernel crashes and lockups and KASAN errors related to ax210 firmware crashes. One of the     KASAN dumps pointed at the tx path, and it appears there is indeed a way to double-free an skb. If     iwl_mvm_tx_skb_sta returns non-zero, then the 'skb' sent into the method will be freed. But, in case where     we build TSO skb buffer, the skb may also be freed in error case. So, return 0 in that particular error     case and do cleanup manually. BUG: KASAN: use-after-free in __list_del_entry_valid+0x12/0x90 iwlwifi     0000:06:00.0: 0x00000000 | tsf hi Read of size 8 at addr ffff88813cfa4ba0 by task btserver/9650 CPU: 4     PID: 9650 Comm: btserver Tainted: G W 5.19.8+ #5 iwlwifi 0000:06:00.0: 0x00000000 | time gp1 Hardware     name: Default string Default string/SKYBAY, BIOS 5.12 02/19/2019 Call Trace: <TASK>     dump_stack_lvl+0x55/0x6d print_report.cold.12+0xf2/0x684 iwlwifi 0000:06:00.0: 0x1D0915A8 | time gp2 ?
    __list_del_entry_valid+0x12/0x90 kasan_report+0x8b/0x180 iwlwifi 0000:06:00.0: 0x00000001 | uCode revision     type ? __list_del_entry_valid+0x12/0x90 __list_del_entry_valid+0x12/0x90 iwlwifi 0000:06:00.0: 0x00000048     | uCode version major tcp_update_skb_after_send+0x5d/0x170 __tcp_transmit_skb+0xb61/0x15c0 iwlwifi     0000:06:00.0: 0xDAA05125 | uCode version minor ? __tcp_select_window+0x490/0x490 iwlwifi 0000:06:00.0:
    0x00000420 | hw version ? trace_kmalloc_node+0x29/0xd0 ? __kmalloc_node_track_caller+0x12a/0x260 ?     memset+0x1f/0x40 ? __build_skb_around+0x125/0x150 ? __alloc_skb+0x1d4/0x220 ?     skb_zerocopy_clone+0x55/0x230 iwlwifi 0000:06:00.0: 0x00489002 | board version ? kmalloc_reserve+0x80/0x80     ? rcu_read_lock_bh_held+0x60/0xb0 tcp_write_xmit+0x3f1/0x24d0 iwlwifi 0000:06:00.0: 0x034E001C | hcmd ?
    __check_object_size+0x180/0x350 iwlwifi 0000:06:00.0: 0x24020000 | isr0 tcp_sendmsg_locked+0x8a9/0x1520     iwlwifi 0000:06:00.0: 0x01400000 | isr1 ? tcp_sendpage+0x50/0x50 iwlwifi 0000:06:00.0: 0x48F0000A | isr2 ?     lock_release+0xb9/0x400 ? tcp_sendmsg+0x14/0x40 iwlwifi 0000:06:00.0: 0x00C3080C | isr3 ?     lock_downgrade+0x390/0x390 ? do_raw_spin_lock+0x114/0x1d0 iwlwifi 0000:06:00.0: 0x00200000 | isr4 ?     rwlock_bug.part.2+0x50/0x50 iwlwifi 0000:06:00.0: 0x034A001C | last cmd Id ? rwlock_bug.part.2+0x50/0x50 ?     lockdep_hardirqs_on_prepare+0xe/0x200 iwlwifi 0000:06:00.0: 0x0000C2F0 | wait_event ?
    __local_bh_enable_ip+0x87/0xe0 ? inet_send_prepare+0x220/0x220 iwlwifi 0000:06:00.0: 0x000000C4 |     l2p_control tcp_sendmsg+0x22/0x40 sock_sendmsg+0x5f/0x70 iwlwifi 0000:06:00.0: 0x00010034 | l2p_duration
    __sys_sendto+0x19d/0x250 iwlwifi 0000:06:00.0: 0x00000007 | l2p_mhvalid ? __ia32_sys_getpeername+0x40/0x40     iwlwifi 0000:06:00.0: 0x00000000 | l2p_addr_match ? rcu_read_lock_held_common+0x12/0x50 ?     rcu_read_lock_sched_held+0x5a/0xd0 ? rcu_read_lock_bh_held+0xb0/0xb0 ? rcu_read_lock_sched_held+0x5a/0xd0     ? rcu_read_lock_sched_held+0x5a/0xd0 ? lock_release+0xb9/0x400 ? lock_downgrade+0x390/0x390 ?     ktime_get+0x64/0x130 ? ktime_get+0x8d/0x130 ? rcu_read_lock_held_common+0x12/0x50 ?     rcu_read_lock_sched_held+0x5a/0xd0 ? rcu_read_lock_held_common+0x12/0x50 ?     rcu_read_lock_sched_held+0x5a/0xd0 ? rcu_read_lock_bh_held+0xb0/0xb0 ? rcu_read_lock_bh_held+0xb0/0xb0
    __x64_sys_sendto+0x6f/0x80 do_syscall_64+0x34/0xb0 entry_SYSCALL_64_after_hwframe+0x46/0xb0 RIP:
    0033:0x7f1d126e4531 Code: 00 00 00 00 0f 1f 44 00 00 f3 0f 1e fa 48 8d 05 35 80 0c 00 41 89 ca 8b 00 85 c0     75 1c 45 31 c9 45 31 c0 b8 2c 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 67 c3 66 0f 1f 44 00 00 55 48 83 ec 20     48 89 RSP: 002b:00007ffe21a679d8 EFLAGS: 00000246 ORIG_RAX: 000000000000002c RAX: ffffffffffffffda RBX:
    000000000000ffdc RCX: 00007f1d126e4531 RDX: 0000000000010000 RSI: 000000000374acf0 RDI: 0000000000000014     RBP: 00007ffe21a67ac0 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11:
    0000000000000246 R ---truncated--- (CVE-2022-50248)

  - In the Linux kernel, the following vulnerability has been resolved: mmc: rtsx_usb_sdmmc: fix return value     check of mmc_add_host() mmc_add_host() may return error, if we ignore its return value, the memory that     allocated in mmc_alloc_host() will be leaked and it will lead a kernel crash because of deleting not added     device in the remove path. So fix this by checking the return value and calling mmc_free_host() in the     error path, besides, led_classdev_unregister() and pm_runtime_disable() also need be called.
    (CVE-2022-50347)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-2026_70403 advisory.

    * kernel: crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CVE-2025-39964)

    * kernel: Linux kernel Bluetooth: Denial of Service via race condition in hidp_session_thread     (CVE-2023-54120)

    * kernel: Bluetooth: L2CAP: Fix potential user-after-free (CVE-2023-54214)

    * kernel: Bluetooth: btusb: revert use of devm_kzalloc in btusb (CVE-2025-71082)

    * kernel: Bluetooth: SMP: force responder MITM requirements before building the pairing response     (CVE-2026-43334)

    * kernel: iommu/vt-d: Clear Present bit before tearing down PASID entry (CVE-2026-45894)

    * kernel: RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (CVE-2026-46043)

    * kernel: RDMA/rxe: Reject unknown opcodes before ICRC processing (CVE-2026-46133)

    * kernel: Bluetooth: serialize accept_q access (CVE-2026-52918)

    * kernel: dm cache policy smq: fix missing locks in invalidating cache blocks (CVE-2026-53062)

    * kernel: iommu/amd: Fix clone_alias() to use the original device's devid (CVE-2026-53053)

    * kernel: Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CVE-2026-53256)

    * kernel: Bluetooth: RFCOMM: validate skb length in MCC handlers (CVE-2026-53254)

    * kernel: keys: Pin request_key_auth payload in instantiate paths (CVE-2026-63823)

    * kernel: Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CVE-2026-63975)

    * kernel: Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CVE-2026-63947)

    * kernel: nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CVE-2026-64534)

    * kernel: RDMA/rxe: Fix a use-after-free problem in rxe_mmap (CVE-2026-64582)

    * kernel: net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CVE-2026-68293)

    * kernel: Linux kernel Bluetooth RFCOMM: Denial of Service via use-after-free in set_termios     (CVE-2026-68188)

    Bug Fix(es) and Enhancement(s):

    * Intel IOMMU: possible circular locking dependency (JIRA:Rocky Linux-243217)

    * xfs: repeated xfs_trans_cancel called from xfs_iomap_write_direct (JIRA:Rocky Linux-251578)

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-70402 advisory.

    - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237293] {CVE-2026-68121}
    - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263345] {CVE-2026-89480}
    - nvme: rename and document nvme_end_request (CKI Backport Bot) [RHEL-263345] {CVE-2026-89480}
    - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255839] {CVE-2026-80714}
    - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231233] {CVE-2026-52912}
    - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221269]     {CVE-2026-31566}
    - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264385] {CVE-2026-81000}
    - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264314] {CVE-2026-80844}
    - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262571]     {CVE-2026-89846}
    - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243620]     {CVE-2026-72261}
    - mac802154: llsec: add skb_cow_data() before in-place crypto (Abhishek Rawal) [RHEL-231030]     {CVE-2026-63831}
    - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234282]     {CVE-2026-64564}
    - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222381] {CVE-2026-43370}
    - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264205]     {CVE-2025-39964}
    - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264205]     {CVE-2025-39964}
    - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot)     [RHEL-260522] {CVE-2026-64534}
    - nvmet-tcp: pass iov_len instead of sg->length to bvec_set_page() (Chris Leech) [RHEL-260522]     {CVE-2026-64534}
    - nvmet-tcp: remove nvmet_tcp_finish_cmd (CKI Backport Bot) [RHEL-260522] {CVE-2026-64534}
    - nvmet-tcp: fix NULL pointer dereference during release (Chris Leech) [RHEL-260522] {CVE-2026-64534}
    - nvmet-tcp: don't map pages which can't come from HIGHMEM (CKI Backport Bot) [RHEL-260522]     {CVE-2026-64534}
    - keys: Pin request_key_auth payload in instantiate paths (Bruno Meneguele) [RHEL-225491] {CVE-2026-63823}
    - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228475]     {CVE-2026-45894}
    - iommu/amd: Fix clone_alias() to use the original device's devid (Eder Zulian) [RHEL-227450]     {CVE-2026-53053}
    - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237326] {CVE-2026-68188}
    - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236787]     {CVE-2026-68293}
    - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233821] {CVE-2026-64582}
    - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226871] {CVE-2026-46133}
    - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228181]     {CVE-2026-46043}
    - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231810]     {CVE-2026-53062}
    - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231810]     {CVE-2026-53062}
    - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231060]     {CVE-2026-63947}
    - Bluetooth: L2CAP: Fix potential user-after-free (CKI Backport Bot) [RHEL-229428] {CVE-2023-54214}
    - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228747]     {CVE-2026-63975}
    - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport     Bot) [RHEL-227528] {CVE-2026-43334}
    - Bluetooth: Fix race condition in hidp_session_thread (CKI Backport Bot) [RHEL-227382] {CVE-2023-54120}
    - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225633] {CVE-2026-53254}
    - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225571]     {CVE-2026-53256}
    - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225535] {CVE-2026-52918}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:0316-1 advisory.

    The SUSE Linux Enterprise 12 SP5 kernel was updated to fix various security issues

    The following security issues were fixed:

    - CVE-2022-49604,CVE-2025-40074: ip: Fix data-races around sysctl_ip_fwd_use_pmtu (bsc#1238414     bsc#1252794).
    - CVE-2022-50527: drm/amdgpu: Fix size validation for non-exclusive domains (v4) (bsc#1251738).
    - CVE-2022-50625: serial: amba-pl011: avoid SBSA UART accessing DMACR register (bsc#1254559).
    - CVE-2022-50630: mm: hugetlb: fix UAF in hugetlb_handle_userfault (bsc#1254785).
    - CVE-2022-50656: nfc: pn533: Clear nfc_target before being used (bsc#1254745).
    - CVE-2022-50678: wifi: brcmfmac: fix invalid address access when enabling SCAN log level (bsc#1254902).
    - CVE-2022-50700: wifi: ath10k: Delay the unmapping of the buffer (bsc#1255576).
    - CVE-2023-53454: HID: multitouch: Correct devm device reference for hidinput input_dev name     (bsc#1250759).
    - CVE-2023-53718: ring-buffer: Do not swap cpu_buffer during resize process (bsc#1252564).
    - CVE-2023-53748: media: mediatek: vcodec: Fix potential array out-of-bounds in decoder queue_setup     (bsc#1254907).
    - CVE-2023-53765: dm cache: free background tracker's queued work in btracker_destroy (bsc#1254912).
    - CVE-2023-53781: smc: Fix use-after-free in tcp_write_timer_handler() (bsc#1254751).
    - CVE-2023-53788: ALSA: hda/ca0132: fixup buffer overrun at tuning_ctl_set() (bsc#1254917).
    - CVE-2023-53819: amdgpu: validate offset_in_bo of drm_amdgpu_gem_va (bsc#1254712).
    - CVE-2023-53850: iavf: use internal state to free traffic IRQs (bsc#1254677).
    - CVE-2023-54120: Bluetooth: Fix race condition in hidp_session_thread (bsc#1256133).
    - CVE-2023-54214: Bluetooth: L2CAP: Fix potential user-after-free (bsc#1255954).
    - CVE-2023-54236: net/net_failover: fix txq exceeding warning (bsc#1255922).
    - CVE-2023-54286: wifi: iwlwifi: dvm: Fix memcpy: detected field-spanning write backtrace (bsc#1255803).
    - CVE-2023-54300: wifi: ath9k: avoid referencing uninit memory in ath9k_wmi_ctrl_rx (bsc#1255790).
    - CVE-2025-38085: mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race (bsc#1245431 bsc#1245499).
    - CVE-2025-38336: ata: pata_via: Force PIO for ATAPI devices on VT6415/VT6330 (bsc#1246370).
    - CVE-2025-38728: smb3: fix for slab out of bounds on mount to ksmbd (bsc#1249256).
    - CVE-2025-40006: mm/hugetlb: fix folio is still mapped when deleted (bsc#1252342).
    - CVE-2025-40035: Input: uinput - zero-initialize uinput_ff_upload_compat to avoid info leak     (bsc#1252866).
    - CVE-2025-40053: net: dlink: handle copy_thresh allocation failure (bsc#1252808).
    - CVE-2025-40064: smc: Fix use-after-free in __pnet_find_base_ndev() (bsc#1252845).
    - CVE-2025-40075: tcp_metrics: use dst_dev_net_rcu() (bsc#1252795).
    - CVE-2025-40081: perf: arm_spe: Prevent overflow in PERF_IDX2OFF() (bsc#1252776).
    - CVE-2025-40110: drm/vmwgfx: Fix a null-ptr access in the cursor snooper (bsc#1253275).
    - CVE-2025-40123: bpf: Enforce expected_attach_type for tailcall compatibility (bsc#1253365).
    - CVE-2025-40135: ipv6: use RCU in ip6_xmit() (bsc#1253342).
    - CVE-2025-40139: smc: Use __sk_dst_get() and dst_dev_rcu() in in smc_clc_prfx_set() (bsc#1253409).
    - CVE-2025-40149: tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock() (bsc#1253355).
    - CVE-2025-40153: mm: hugetlb: avoid soft lockup when mprotect to large memory area (bsc#1253408).
    - CVE-2025-40158: ipv6: use RCU in ip6_output() (bsc#1253402).
    - CVE-2025-40160: xen/events: Cleanup find_virq() return codes (bsc#1253400).
    - CVE-2025-40164: usbnet: Fix using smp_processor_id() in preemptible code warnings (bsc#1253407).
    - CVE-2025-40167: ext4: detect invalid INLINE_DATA + EXTENTS flag combination (bsc#1253458).
    - CVE-2025-40168: smc: Use __sk_dst_get() and dst_dev_rcu() in smc_clc_prfx_match() (bsc#1253427).
    - CVE-2025-40170: net: use dst_dev_rcu() in sk_setup_caps() (bsc#1253413).
    - CVE-2025-40178: pid: Add a judgment for ns null in pid_nr_ns (bsc#1253463).
    - CVE-2025-40198: ext4: avoid potential buffer over-read in parse_apply_sb_mount_options() (bsc#1253453).
    - CVE-2025-40200: Squashfs: reject negative file sizes in squashfs_read_inode() (bsc#1253448).
    - CVE-2025-40215: kABI: xfrm: delete x->tunnel as we delete x (bsc#1254959).
    - CVE-2025-40219: PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV (bsc#1254518).
    - CVE-2025-40233: ocfs2: clear extent cache after moving/defragmenting extents (bsc#1254813).
    - CVE-2025-40240: sctp: avoid NULL dereference when chunk data buffer is missing (bsc#1254869).
    - CVE-2025-40244: hfsplus: fix KMSAN uninit-value issue in __hfsplus_ext_cache_extent() (bsc#1255033).
    - CVE-2025-40248: vsock: Ignore signal/timeout on connect() if already established (bsc#1254864).
    - CVE-2025-40252: net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end()     (bsc#1254849).
    - CVE-2025-40269: ALSA: usb-audio: Fix potential overflow of PCM transfer buffer (bsc#1255035).
    - CVE-2025-40275: ALSA: usb-audio: Fix NULL pointer dereference in snd_usb_mixer_controls_badd     (bsc#1254829).
    - CVE-2025-40278: net: sched: act_ife: initialize struct tc_ife to fix KMSAN kernel-infoleak     (bsc#1254825).
    - CVE-2025-40279: net: sched: act_connmark: initialize struct tc_ife to fix kernel leak (bsc#1254846).
    - CVE-2025-40283: Bluetooth: btusb: reorder cleanup in btusb_disconnect to avoid UAF (bsc#1254858).
    - CVE-2025-40304: fbdev: Add bounds checking in bit_putcs to fix vmalloc-out-of-bounds (bsc#1255034).
    - CVE-2025-40308: Bluetooth: bcsp: receive data only if registered (bsc#1255064).
    - CVE-2025-40321: wifi: brcmfmac: fix crash while sending Action Frames in standalone AP Mode     (bsc#1254795).
    - CVE-2025-40322: fbdev: bitblit: bound-check glyph index in bit_putcs* (bsc#1255092).
    - CVE-2025-40331: sctp: Prevent TOCTOU out-of-bounds write (bsc#1254615).
    - CVE-2025-40337: net: stmmac: Correctly handle Rx checksum offload errors (bsc#1255081).
    - CVE-2025-40349: hfs: validate record offset in hfsplus_bmap_alloc (bsc#1255280).
    - CVE-2025-40351: hfsplus: fix KMSAN uninit-value issue in hfsplus_delete_cat() (bsc#1255281).
    - CVE-2025-68206: netfilter: nft_ct: add seqadj extension for natted connections (bsc#1255142).
    - CVE-2025-68340: team: Move team device type change at the end of team_port_add (bsc#1255507).

    The following non security issues were fixed:

    - HID: multitouch: Add NULL check in mt_input_configured (bsc#1250759).
    - Squashfs: add additional inode sanity checking (bsc#1253448).
    - drm/amdgpu: Fix potential NULL dereference (bsc#1251238).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Bluetooth: Fix race condition in hidp_session_thread There is a potential race condition in     hidp_session_thread that may lead to use-after-free. For instance, the timer is active while     hidp_del_timer is called in hidp_session_thread(). After hidp_session_put, then 'session' will be freed,     causing kernel panic when hidp_idle_timeout is running. The solution is to use del_timer_sync instead of     del_timer. Here is the call trace: ? hidp_session_probe+0x780/0x780 call_timer_fn+0x2d/0x1e0
    __run_timers.part.0+0x569/0x940 hidp_session_probe+0x780/0x780 call_timer_fn+0x1e0/0x1e0     ktime_get+0x5c/0xf0 lapic_next_deadline+0x2c/0x40 clockevents_program_event+0x205/0x320     run_timer_softirq+0xa9/0x1b0 __do_softirq+0x1b9/0x641 __irq_exit_rcu+0xdc/0x190 irq_exit_rcu+0xe/0x20     sysvec_apic_timer_interrupt+0xa1/0xc0 (CVE-2023-54120)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:70402 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CVE-2025-39964)

    * kernel: Linux kernel Bluetooth: Denial of Service via race condition in hidp_session_thread     (CVE-2023-54120)

    * kernel: Bluetooth: L2CAP: Fix potential user-after-free (CVE-2023-54214)

    * kernel: Bluetooth: btusb: revert use of devm_kzalloc in btusb (CVE-2025-71082)

    * kernel: Bluetooth: SMP: force responder MITM requirements before building the pairing response     (CVE-2026-43334)

    * kernel: iommu/vt-d: Clear Present bit before tearing down PASID entry (CVE-2026-45894)

    * kernel: RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (CVE-2026-46043)

    * kernel: RDMA/rxe: Reject unknown opcodes before ICRC processing (CVE-2026-46133)

    * kernel: Bluetooth: serialize accept_q access (CVE-2026-52918)

    * kernel: dm cache policy smq: fix missing locks in invalidating cache blocks (CVE-2026-53062)

    * kernel: iommu/amd: Fix clone_alias() to use the original device's devid (CVE-2026-53053)

    * kernel: Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CVE-2026-53256)

    * kernel: Bluetooth: RFCOMM: validate skb length in MCC handlers (CVE-2026-53254)

    * kernel: keys: Pin request_key_auth payload in instantiate paths (CVE-2026-63823)

    * kernel: Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CVE-2026-63975)

    * kernel: Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CVE-2026-63947)

    * kernel: nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CVE-2026-64534)

    * kernel: RDMA/rxe: Fix a use-after-free problem in rxe_mmap (CVE-2026-64582)

    * kernel: net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CVE-2026-68293)

    * kernel: Linux kernel Bluetooth RFCOMM: Denial of Service via use-after-free in set_termios     (CVE-2026-68188)

    Bug Fix(es) and Enhancement(s):

    * Intel IOMMU: possible circular locking dependency (JIRA:RHEL-243217)

    * xfs: repeated xfs_trans_cancel called from xfs_iomap_write_direct (JIRA:RHEL-251578)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:70402 advisory.

    * kernel: crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CVE-2025-39964)

    * kernel: Linux kernel Bluetooth: Denial of Service via race condition in hidp_session_thread     (CVE-2023-54120)

    * kernel: Bluetooth: L2CAP: Fix potential user-after-free (CVE-2023-54214)

    * kernel: Bluetooth: btusb: revert use of devm_kzalloc in btusb (CVE-2025-71082)

    * kernel: Bluetooth: SMP: force responder MITM requirements before building the pairing response     (CVE-2026-43334)

    * kernel: iommu/vt-d: Clear Present bit before tearing down PASID entry (CVE-2026-45894)

    * kernel: RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (CVE-2026-46043)

    * kernel: RDMA/rxe: Reject unknown opcodes before ICRC processing (CVE-2026-46133)

    * kernel: Bluetooth: serialize accept_q access (CVE-2026-52918)

    * kernel: dm cache policy smq: fix missing locks in invalidating cache blocks (CVE-2026-53062)

    * kernel: iommu/amd: Fix clone_alias() to use the original device's devid (CVE-2026-53053)

    * kernel: Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CVE-2026-53256)

    * kernel: Bluetooth: RFCOMM: validate skb length in MCC handlers (CVE-2026-53254)

    * kernel: keys: Pin request_key_auth payload in instantiate paths (CVE-2026-63823)

    * kernel: Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CVE-2026-63975)

    * kernel: Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CVE-2026-63947)

    * kernel: nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CVE-2026-64534)

    * kernel: RDMA/rxe: Fix a use-after-free problem in rxe_mmap (CVE-2026-64582)

    * kernel: net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CVE-2026-68293)

    * kernel: Linux kernel Bluetooth RFCOMM: Denial of Service via use-after-free in set_termios     (CVE-2026-68188)

    Bug Fix(es) and Enhancement(s):

    * Intel IOMMU: possible circular locking dependency (JIRA:Rocky Linux-243217)

    * xfs: repeated xfs_trans_cancel called from xfs_iomap_write_direct (JIRA:Rocky Linux-251578)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
297191	SUSE SLES15 : Security update for the Linux Kernel (SUSE-SU-2026:0317-1)	Nessus	SuSE Local Security Checks	1/30/2026	9/29/2026	high
353159	AlmaLinux 9.2 [TuxCare] Security Update: bpftool / kernel / kernel-64k / kernel-64k-core / kernel-64k-debug / etc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1777616064)	Nessus	Alma Linux Local Security Checks	9/30/2026	10/20/2026	high
355284	Rocky Linux 8 [CIQ] Security Update: kernel-rt / kernel-rt-core / kernel-rt-debug / kernel-rt-debug-core / etc Multiple Vulnerabilities (crlsa-2026_70403)	Nessus	Rocky Linux Local Security Checks	10/1/2026	10/1/2026	high
362987	Oracle Linux 8 : kernel (ELSA-2026-70402)	Nessus	Oracle Linux Local Security Checks	10/5/2026	10/5/2026	high
297090	SUSE SLES12: cluster-md-kmp-default / dlm-kmp-default / gfs2-kmp-default / etc (SUSE-SU-2026:0316-1)	Nessus	SuSE Local Security Checks	1/29/2026	6/26/2026	high
319448	EulerOS Virtualization 2.13.1 : kernel (EulerOS-SA-2026-2132)	Nessus	Huawei Local Security Checks	6/6/2026	6/6/2026	high
301628	EulerOS 2.0 SP13 : kernel (EulerOS-SA-2026-1280)	Nessus	Huawei Local Security Checks	3/10/2026	3/10/2026	high
279789	Linux Distros Unpatched Vulnerability : CVE-2023-54120	Nessus	Misc.	12/24/2025	11/5/2026	high
349148	RHEL 8 : kernel (RHSA-2026:70402)	Nessus	Red Hat Local Security Checks	9/23/2026	9/23/2026	high
349672	RockyLinux 8 : kernel (RLSA-2026:70402)	Nessus	Rocky Linux Local Security Checks	9/24/2026	9/24/2026	high

Detections

Analytics

Plugins Search

high

high

high

high

high

high

high

high

high

high