According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath(CVE-2026-43112)

    lib/crypto: chacha: Zeroize permuted_state before it leaves scope(CVE-2026-43336)

    MIPS: Work around LLVM bug when gp is used as global register variable(CVE-2026-46250)

    bridge: br_nd_send: validate ND option lengths(CVE-2026-31752)

    iommu/vt-d: Clear Present bit before tearing down PASID entry(CVE-2026-45894)

    xfs: remove xfs_attr_leaf_hasname(CVE-2026-43153)

    smb: client: reject userspace cifs.spnego descriptions(CVE-2026-46243)

    usb: ulpi: fix double free in ulpi_register_interface() error path(CVE-2026-31759)

    crypto: ccp: Don't attempt to copy PDH cert to userspace if PSP command failed(CVE-2026-31698)

    RDMA/hns: Fix WQ_MEM_RECLAIM warning(CVE-2026-46265)

    KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1(CVE-2026-46076)

    netfilter: nfnetlink_queue: do shared-unconfirmed check before segmentation(CVE-2026-45859)

    RDMA/umem: Fix double dma_buf_unpin in failure path(CVE-2026-43128)

    mm/page_alloc: change all pageblocks migrate type on coalescing(CVE-2025-71134)

    slip: reject VJ receive packets on instances with no rstate array(CVE-2026-45842)

    net/tcp-md5: Fix MAC comparison to be constant-time(CVE-2026-43383)

    scsi: smartpqi: Fix memory leak in pqi_report_phys_luns()(CVE-2026-45872)

    netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table()(CVE-2026-43450)

    tracepoint: balance regfunc() on func_add() failure in tracepoint_add_func()(CVE-2026-46196)

    tpm: tpm_i2c_infineon: Fix locality leak on get_burstcount() failure(CVE-2026-45941)

    zram: do not forget to endio for partial discard requests(CVE-2026-46089)

    KVM: SVM: Inject #UD for INVLPGA if EFER.SVME=0(CVE-2026-46082)

    vsock: fix buffer size clamping order(CVE-2026-46234)

    ipv4: icmp: validate reply type before using icmp_pointers(CVE-2026-46037)

    powerpc/smp: Add check for kcalloc() failure in parse_thread_groups()(CVE-2026-43148)

    ipmi: Check event message buffer response for bad data(CVE-2026-46128)

    netfilter: arp_tables: fix IEEE1394 ARP payload parsing(CVE-2026-45844)

    ext4: move ext4_percpu_param_init() before ext4_mb_init()(CVE-2026-43288)

    usb: typec: ucsi: validate connector number in ucsi_notify_common()(CVE-2026-31729)

    dm: remove fake timeout to avoid leak request(CVE-2026-43314)

    nvmet: avoid recursive nvmet-wq flush in nvmet_ctrl_free(CVE-2026-46304)

    xfrm: Wait for RCU readers during policy netns exit(CVE-2026-43091)

    netfilter: nf_conntrack_h323: fix OOB read in decode_choice()(CVE-2026-43233)

    scsi: core: Fix refcount leak for tagset_refcnt(CVE-2026-23296)

    md/raid10: fix deadlock with check operation and nowait requests(CVE-2026-46050)

    netfilter: nf_conncount: increase the connection clean up limit to 64(CVE-2026-45860)

    crypto: ccp: Don't attempt to copy ID to userspace if PSP command failed(CVE-2026-31697)

    net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ(CVE-2026-43465)

    fanotify: fix false positive on permission events(CVE-2026-46150)

    ipv6: icmp: clear skb2-cb[] in ip6_err_gen_icmpv6_unreach()(CVE-2026-43038)

    APEI/GHES: ensure that won't go past CPER allocated record(CVE-2026-43277)

    openvswitch: cap upcall PID array size and pre-size vport replies(CVE-2026-45840)

    AppArmor: Allow apparmor to handle unaligned dfa tables(CVE-2026-46254)

    tun: free page on short-frame rejection in tun_xdp_one()(CVE-2026-46321)

    smb: client: validate dacloffset before building DACL pointers(CVE-2026-46195)

    bpf: sockmap: Fix use-after-free of sk-sk_socket in sk_psock_verdict_data_ready().(CVE-2026-43016)

    net: af_key: zero aligned sockaddr tail in PF_KEY exports(CVE-2026-43088)

    iommu/amd: move wait_on_sem() out of spinlock(CVE-2026-43253)

    fs/buffer: add alert in try_to_free_buffers() for folios without buffers(CVE-2025-71295)

    ext4: don't zero the entire extent if EXT4_EXT_DATA_PARTIAL_VALID1(CVE-2026-45858)

    fat: avoid parent link count underflow in rmdir(CVE-2026-45915)

    mtd: spi-nor: debugfs: fix out-of-bounds read in spi_nor_params_show()(CVE-2026-46190)

    tcp: call sk_data_ready() after listener migration(CVE-2026-46015)

    sched/rt: Skip currently executing CPU in rto_next_cpu()(CVE-2026-45919)

    xfrm6: fix uninitialized saddr in xfrm6_get_saddr()(CVE-2026-43139)

    rtmutex: Use waiter::task instead of current in remove_waiter()(CVE-2026-43499)

    bpf: Fix bpf_xdp_store_bytes proto for read-only arg(CVE-2026-45886)

    ext4: don't set EXT4_GET_BLOCKS_CONVERT when splitting before submitting I/O(CVE-2026-45985)

    netfilter: xt_tcpmss: check remaining length before reading optlen(CVE-2026-43190)

    crypto: pcrypt - Fix handling of MAY_BACKLOG requests(CVE-2026-43493)

    ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data()(CVE-2026-43186)

    media: saa7164: add ioremap return checks and cleanups(CVE-2026-46235)

    l2tp: Drop large packets with UDP encap(CVE-2026-43080)

    md/raid5: validate payload size before accessing journal metadata(CVE-2026-46070)

    smb: client: fix in-place encryption corruption in SMB2_write()(CVE-2026-43362)

    drm/display/dp_mst: Add protection against 0 vcpi(CVE-2025-71305)

    x86-64: rename misleadingly named '__copy_user_nocache()' function(CVE-2026-43073)

    serial: 8250: Fix TX deadlock when using DMA(CVE-2026-43061)

    md raid: fix hang when stopping arrays with metadata through dm-raid(CVE-2026-43309)

    iommu/vt-d: Clear Present bit before tearing down context entry(CVE-2026-45944)

    netfilter: nft_ct: drop pending enqueued packets on removal(CVE-2026-43060)

    xfrm: always flush state and policy upon NETDEV_UNREGISTER event(CVE-2026-43167)

    KVM: nSVM: Triple fault if restore host CR3 fails on nested #VMEXIT(CVE-2026-46032)

    nfsd: never defer requests during idmap lookup(CVE-2026-45983)

    exit: prevent preemption of oopsing TASK_DEAD task(CVE-2026-46173)

    md/raid10: fix divide-by-zero in setup_geo() with zero far_copies(CVE-2026-46161)

    APEI/GHES: ARM processor Error: don't go past allocated memory(CVE-2026-43201)

    netfilter: nf_conntrack_helper: pass helper to expect cleanup(CVE-2026-43027)

    net: consume xmit errors of GSO frames(CVE-2026-43194)

    net/mlx5: lag: Check for LAG device before creating debugfs(CVE-2026-43013)

    net: sched: cls_api: fix tc_chain_fill_node to initialize tcm_info to zero to prevent an info-     leak(CVE-2026-43035)

    ipmi: Add limits to event and receive message requests(CVE-2026-46177)

    nouveau/dpcd: return EBUSY for aux xfer if the device is asleep(CVE-2026-43381)

    perf: sched: Fix perf crash with new is_user_task() helper(CVE-2026-23159)

    netfilter: x_tables: guard option walkers against 1-byte tail reads(CVE-2026-43452)

    mmc: core: Avoid bitfield RMW for claim/retune flags(CVE-2026-43484)

    unshare: fix unshare_fs() handling(CVE-2026-43472)

    net: strparser: fix skb_head leak in strp_abort_strp()(CVE-2026-46102)

    vsock/virtio: fix accept queue count leak on transport mismatch(CVE-2026-46214)

    scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show()(CVE-2026-46149)

    scsi: sd: fix missing put_disk() when device_add(disk_dev) fails(CVE-2026-45997)

    crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption(CVE-2026-43033)

    smb: client: require a full NFS mode SID before reading mode bits(CVE-2026-43350)

    xfrm_user: fix info leak in build_mapping()(CVE-2026-43089)

    ext4: drop extent cache when splitting extent fails(CVE-2026-45899)

    net/mlx5: Fix deadlock between devlink lock and esw-wq(CVE-2026-43468)

    smb: client: validate the whole DACL before rewriting it in cifsacl(CVE-2026-31709)

    ip6_tunnel: clear skb2-cb[] in ip4ip6_err()(CVE-2026-43037)

    net: correctly handle tunneled traffic on IPV6_CSUM GSO fallback(CVE-2026-43057)

    ipv6: ioam: fix potential NULL dereferences in __ioam6_fill_trace_data()(CVE-2026-43101)

    netfilter: ctnetlink: ignore explicit helper on new expectations(CVE-2026-43025)

    net: Drop the lock in skb_may_tx_timestamp()(CVE-2026-43216)

    dm mirror: fix integer overflow in create_dirty_log()(CVE-2026-46023)

    usb: image: mdc800: kill download URB on timeout(CVE-2026-43425)

    netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path(CVE-2026-43451)

    usb: class: cdc-wdm: fix reordering issue in read code path(CVE-2026-43427)

    net/packet: fix TOCTOU race on mmap'd vnet_hdr in tpacket_snd()(CVE-2026-31700)

    smb/client: fix out-of-bounds read in symlink_data()(CVE-2026-46185)

    xsk: validate MTU against usable frame size on bind(CVE-2026-43092)

    fuse: reject oversized dirents in page cache(CVE-2026-31694)

    net: ioam6: fix OOB and missing lock(CVE-2026-43083)

    usb: usbtmc: Flush anchored URBs in usbtmc_release(CVE-2026-31758)

    usb: usblp: fix uninitialized heap leak via LPGETSTATUS ioctl(CVE-2026-46167)

    ext4: fix iloc.bh leak in ext4_fc_replay_inode() error paths(CVE-2026-43066)

    ipv6: prevent possible UaF in addrconf_permanent_addr()(CVE-2026-43339)

    net: hns3: fix double free issue for tx spare buffer(CVE-2026-45891)

    8021q: delete cleared egress QoS mappings(CVE-2026-46153)

    cpufreq: governor: fix double free in cpufreq_dbs_governor_init() error path(CVE-2026-43328)

    apparmor: fix NULL sock in aa_sock_file_perm(CVE-2026-45848)

    net: rtnetlink: zero ifla_vf_broadcast to avoid stack infoleak in rtnl_fill_vfinfo(CVE-2026-46132)

    usb: usblp: fix heap leak in IEEE 1284 device ID via short response(CVE-2026-46151)

    xfs: delete attr leaf freemap entries when empty(CVE-2026-43187)

    PCI: Fix pci_slot_trylock() error handling(CVE-2026-43211)

    pstore/ram: fix buffer overflow in persistent_ram_save_old()(CVE-2026-46253)

    ima: verify the previous kernel's IMA buffer lies in addressable RAM(CVE-2026-43129)

    net: bridge: use a stable FDB dst snapshot in RCU readers(CVE-2026-46086)

    iommu/vt-d: Flush cache for PASID table before using it(CVE-2026-45862)

    KVM: nSVM: Remove a user-triggerable WARN on nested_svm_load_cr3() succeeding(CVE-2026-43315)

    xfrm: ah: account for ESN high bits in async callbacks(CVE-2026-46193)

    ext4: don't cache extent during splitting extent(CVE-2026-45912)

    io_uring/kbuf: check if target buffer list is still legacy on recycle(CVE-2026-43366)

    ipvs: fix NULL deref in ip_vs_add_service error path(CVE-2026-43086)

    md/raid5: fix soft lockup in retry_aligned_read()(CVE-2026-46051)

    ipmi:si: Return state to normal if message allocation fails(CVE-2026-46108)

    isofs: validate Rock Ridge CE continuation extent against volume size(CVE-2026-46303)

    crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl(CVE-2026-43078)

    xfrm: account XFRMA_IF_ID in aevent size calculation(CVE-2026-43107)

    ext4: fix memory leak in ext4_ext_shift_extents()(CVE-2026-45948)

    xsk: tighten UMEM headroom validation to account for tailroom and min frame(CVE-2026-43093)

    drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs()(CVE-2026-46209)

    eventfs: Hold eventfs_mutex and SRCU when remount walks events(CVE-2026-46106)

    udf: fix partition descriptor append bookkeeping(CVE-2026-45991)

    md/bitmap: fix GPF in write_page caused by resize race(CVE-2026-43163)

    xfs: fix freemap adjustments when adding xattrs to leaf blocks(CVE-2026-43158)

    procfs: fix missing RCU protection when reading real_parent in do_task_stat()(CVE-2026-46259)

    KVM: SVM: Add missing save/restore handling of LBR MSRs(CVE-2026-46014)

    apparmor: fix invalid deref of rawdata when export_binary is unset(CVE-2026-45965)

    KVM: nSVM: Always use NextRIP as vmcb02's NextRIP after first L2 VMRUN(CVE-2026-46059)

    media: pvrusb2: fix URB leak in pvr2_send_request_ex(CVE-2026-43223)

    xprtrdma: Decrement re_receiving on the early exit paths(CVE-2026-43469)

    tcp: fix potential race in tcp_v6_syn_recv_sock()(CVE-2026-43198)

    x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache(CVE-2026-46174)

    netfilter: x_tables: ensure names are nul-terminated(CVE-2026-43028)

    dlm: validate length in dlm_search_rsb_tree(CVE-2026-43125)

    ipvs: do not keep dest_dst if dev is going down(CVE-2026-45917)

    ipv4: icmp: fix null-ptr-deref in icmp_build_probe()(CVE-2026-43099)

    eventpoll: fix ep_remove struct eventpoll / struct file UAF(CVE-2026-46242)

    RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event()(CVE-2026-46181)

    drm/nouveau: fix u32 overflow in pushbuf reloc bounds check(CVE-2026-46006)

    ata: libata-scsi: avoid Non-NCQ command starvation(CVE-2026-45855)

    net: bonding: Fix nd_tbl NULL dereference when IPv6 is disabled(CVE-2026-43441)

    drm/amd/display: Fix dc_link NULL handling in HPD init(CVE-2026-46245)

    fbcon: Avoid OOB font access if console rotation fails(CVE-2026-46191)

    net: remove WARN_ON_ONCE when accessing forward path array(CVE-2026-45847)

    xfrm: fix ip_rt_bug race in icmp_route_lookup reverse path(CVE-2026-45905)

    xfs: fix a resource leak in xfs_alloc_buftarg()(CVE-2026-46005)

    net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery(CVE-2026-43466)

    HID: logitech-hidpp: Check maxfield in hidpp_get_report_length()(CVE-2026-43136)

    mm/page_alloc: clear page-private in free_pages_prepare()(CVE-2026-43303)

    crypto: authencesn - reject short ahash digests during instance creation(CVE-2026-46033)

    eventpoll: defer struct eventpoll free to RCU grace period(CVE-2026-43074)

    cpuidle: Skip governor when only one idle state is available(CVE-2026-45968)

    netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop()(CVE-2026-43453)

    crypto: algif_aead - Fix minimum RX size check for decryption(CVE-2026-43077)

    cgroup: fix race between task migration and iteration(CVE-2026-43439)

    thermal: core: Fix thermal zone governor cleanup issues(CVE-2026-46021)

    scsi: storvsc: Fix scheduling while atomic on PREEMPT_RT(CVE-2026-43475)

    quota: fix livelock between quotactl and freeze_super(CVE-2026-45895)

    net/ipv6: ioam6: prevent schema length wraparound in trace fill(CVE-2026-43341)

    KVM: nSVM: Sync interrupt shadow to cached vmcb12 after VMRUN of L2(CVE-2026-45987)

    dm-thin: fix metadata refcount underflow(CVE-2026-46107)

    flow_dissector: do not dissect PPPoE PFC frames(CVE-2026-46306)

    RDMA/hns: Fix unlocked call to hns_roce_qp_remove()(CVE-2026-46112)

    netfilter: ctnetlink: ensure safe access to master conntrack(CVE-2026-43116)

    ext4: fix e4b bitmap inconsistency reports(CVE-2026-45942)

    smb: client: use kzalloc to zero-initialize security descriptor buffer(CVE-2026-46139)

    EFI/CPER: don't go past the ARM processor CPER record buffer(CVE-2026-43266)

    nvmet-tcp: fix race between ICReq handling and queue teardown(CVE-2026-46135)

    netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry(CVE-2026-43114)

    (CVE-2026-46320)

    ext4: fix missing brelse() in ext4_xattr_inode_dec_ref_all()(CVE-2026-46046)

    SUNRPC: fix gss_auth kref leak in gss_alloc_msg error path(CVE-2026-45964)

    ipv6: xfrm6: release dst on error in xfrm6_rcv_encap()(CVE-2026-46172)

    dm: fix a buffer overflow in ioctl processing(CVE-2026-46294)

    ext4: drop extent cache after doing PARTIAL_VALID1 zeroout(CVE-2026-45892)

    SUNRPC: auth_gss: fix memory leaks in XDR decoding error paths(CVE-2026-45870)

    sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL(CVE-2026-46227)

    x86/kexec: add a sanity check on previous kernel's ima kexec buffer(CVE-2026-43240)

    Revert 'PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV'(CVE-2026-43147)

    netfilter: nft_set_rbtree: check for partial overlaps in anonymous sets(CVE-2026-45873)

    xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete(CVE-2026-46116)

    spi: fix resource leaks on device setup failure(CVE-2026-46083)

    mailbox: Prevent out-of-bounds access in fw_mbox_index_xlate()(CVE-2026-43281)

    fbdev: defio: Disconnect deferred I/O from the lifetime of struct fb_info(CVE-2026-46065)

    inotify: fix watch count leak when fsnotify_add_inode_mark_locked() fails(CVE-2026-46040)

    smb/client: fix out-of-bounds read in smb2_compound_op()(CVE-2026-46155)

    vxlan: validate ND option lengths in vxlan_na_create(CVE-2026-31738)

    drm: Account property blob allocations to memcg(CVE-2026-43287)

    crypto: algif_aead - snapshot IV for async AEAD requests(CVE-2026-46028)

    netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator(CVE-2026-43085)

    netfilter: nf_tables: reject immediate NF_QUEUE verdict(CVE-2026-43024)

    scsi: csiostor: Fix dereference of null pointer rn(CVE-2026-45857)

    bonding: alb: fix UAF in rlb_arp_recv during bond up/down(CVE-2026-45970)

    usb: xhci: Fix memory leak in xhci_disable_slot()(CVE-2026-43432)

    bpf: Fix tcx/netkit detach permissions when prog fd isn't given(CVE-2026-45932)

    netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO(CVE-2026-45841)

    ext4: fix dirtyclusters double decrement on fs shutdown(CVE-2026-45920)

    slip: bound decode() reads against the compressed packet length(CVE-2026-45843)

    net: use skb_header_pointer() for TCPv4 GSO frag_off check(CVE-2026-43036)

    net: bridge: mcast: always update mdb_n_entries for vlan contexts(CVE-2026-45913)

    net: ipv6: ndisc: fix ndisc_ra_useropt to initialize nduseropt_padX fields to zero to prevent an info-     leak(CVE-2026-43040)

    bpf: reject negative CO-RE accessor indices in bpf_core_parse_spec()(CVE-2026-45839)

    iommu/vt-d: Flush dev-IOTLB only when PCIe device is accessible in scalable mode(CVE-2026-43130)

    PCI/P2PDMA: Release per-CPU pgmap ref when vm_insert_page() fails(CVE-2026-45880)

    bpf: fix end-of-list detection in cgroup_storage_get_next_key()(CVE-2026-45838)

    ipvs: skip ipv6 extension headers for csum checks(CVE-2026-45850)

    netfilter: reject zero shift in nft_bitwise(CVE-2026-46101)

    RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send(CVE-2026-45856)

    sched/fair: Fix zero_vruntime tracking fix(CVE-2026-43323)

    crypto: ccp: Don't attempt to copy CSR to userspace if PSP command failed(CVE-2026-31699)

    netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent(CVE-2026-43026)

    net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ(CVE-2026-43464)

    isofs: validate block number from NFS file handle in isofs_export_iget(CVE-2026-46124)

    ipmi:ssif: Clean up kthread on errors(CVE-2026-46044)

    erofs: fix unsigned underflow in z_erofs_lz4_handle_overlap()(CVE-2026-45999)

    ipv6: rpl: reserve mac_len headroom when recompressed SRH grows(CVE-2026-43501)

    erofs: fix inline data read failure for ztailpacking pclusters(CVE-2026-45943)

    erofs: fix the out-of-bounds nameoff handling for trailing dirents(CVE-2026-46078)

Tenable has extracted the preceding description block directly from the EulerOS kernel security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 24.04 LTS / Pro Realtime 24.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-8669-1 advisory.

    Several security issues were discovered in the Linux kernel. An attacker could possibly use these to     compromise the system. This update corrects flaws in the following subsystems:

    - Foo-over-UDP (FOU);

    - ARM64 architecture;

    - x86 architecture;

    - Block layer subsystem;

    - Drivers core;

    - Null block device driver;

    - Bluetooth drivers;

    - Counter interface drivers;

    - DMA engine subsystem;

    - DPLL subsystem;

    - GPIO subsystem;

    - GPU drivers;

    - I2C subsystem;

    - IIO ADC drivers;

    - IIO subsystem;

    - InfiniBand drivers;

    - On-Chip Interconnect management framework;

    - IOMMU subsystem;

    - IRQ chip drivers;

    - Modular ISDN driver;

    - LED subsystem;

    - Multiple devices driver;

    - Media drivers;

    - UACCE accelerator framework;

    - MMC subsystem;

    - Ethernet bonding driver;

    - Network drivers;

    - Mellanox network drivers;

    - Texas Instruments network drivers;

    - NVME drivers;

    - Device tree and open firmware driver;

    - PHY drivers;

    - x86 platform drivers;

    - i.MX PM domains;

    - SCSI subsystem;

    - SLIMbus drivers;

    - SPI subsystem;

    - TTY drivers;

    - USB Host Controller drivers;

    - W1 Dallas's 1-wire bus driver;

    - Xen hypervisor drivers;

    - BTRFS file system;

    - EFI Variable file system;

    - File systems infrastructure;

    - Ext4 file system;

    - FUSE (File system in Userspace);

    - Network file systems library;

    - Network file system (NFS) client;

    - Network file system (NFS) server daemon;

    - SMB network file system;

    - Memory Management;

    - Memory management;

    - Scheduler infrastructure;

    - Tracing infrastructure;

    - IPv4 networking;

    - Netfilter;

    - NFC subsystem;

    - Network traffic control;

    - TCP network protocol;

    - io_uring subsystem;

    - Perf events;

    - Locking primitives;

    - Hibernation control;

    - Timer subsystem;

    - BPF subsystem;

    - Floating proportions library;

    - Bluetooth subsystem;

    - CAN network layer;

    - Ceph Core library;

    - Networking core;

    - IPv6 networking;

    - L2TP protocol;

    - MAC80211 subsystem;

    - Multipath TCP;

    - NET/ROM layer;

    - RxRPC session sockets;

    - SCTP protocol;

    - SMC sockets;

    - VMware vSockets driver;

    - Wireless networking;

    - ALSA AC97 driver;

    - Creative Sound Blaster X-Fi driver;

    - Texas InstrumentS Audio (ASoC/HDA) drivers;

    - USB sound devices; (CVE-2025-71158, CVE-2025-71160, CVE-2025-71161, CVE-2025-71162, CVE-2025-71163,     CVE-2025-71180, CVE-2025-71182, CVE-2025-71183, CVE-2025-71184, CVE-2025-71185, CVE-2025-71186,     CVE-2025-71187, CVE-2025-71188, CVE-2025-71189, CVE-2025-71190, CVE-2025-71191, CVE-2025-71192,     CVE-2025-71193, CVE-2025-71194, CVE-2025-71195, CVE-2025-71196, CVE-2025-71197, CVE-2025-71198,     CVE-2025-71199, CVE-2025-71200, CVE-2025-71201, CVE-2026-22976, CVE-2026-22977, CVE-2026-22978,     CVE-2026-22979, CVE-2026-22980, CVE-2026-22981, CVE-2026-22982, CVE-2026-22985, CVE-2026-22986,     CVE-2026-22987, CVE-2026-22989, CVE-2026-22990, CVE-2026-22991, CVE-2026-22992, CVE-2026-22993,     CVE-2026-22994, CVE-2026-22996, CVE-2026-22997, CVE-2026-22998, CVE-2026-22999, CVE-2026-23000,     CVE-2026-23001, CVE-2026-23002, CVE-2026-23003, CVE-2026-23004, CVE-2026-23005, CVE-2026-23006,     CVE-2026-23007, CVE-2026-23008, CVE-2026-23009, CVE-2026-23010, CVE-2026-23011, CVE-2026-23012,     CVE-2026-23013, CVE-2026-23014, CVE-2026-23015, CVE-2026-23017, CVE-2026-23018, CVE-2026-23019,     CVE-2026-23020, CVE-2026-23021, CVE-2026-23022, CVE-2026-23023, CVE-2026-23024, CVE-2026-23025,     CVE-2026-23026, CVE-2026-23030, CVE-2026-23031, CVE-2026-23032, CVE-2026-23033, CVE-2026-23034,     CVE-2026-23035, CVE-2026-23036, CVE-2026-23037, CVE-2026-23038, CVE-2026-23042, CVE-2026-23044,     CVE-2026-23045, CVE-2026-23046, CVE-2026-23047, CVE-2026-23049, CVE-2026-23050, CVE-2026-23051,     CVE-2026-23052, CVE-2026-23053, CVE-2026-23054, CVE-2026-23055, CVE-2026-23056, CVE-2026-23057,     CVE-2026-23058, CVE-2026-23059, CVE-2026-23061, CVE-2026-23062, CVE-2026-23063, CVE-2026-23064,     CVE-2026-23065, CVE-2026-23066, CVE-2026-23067, CVE-2026-23068, CVE-2026-23069, CVE-2026-23070,     CVE-2026-23071, CVE-2026-23072, CVE-2026-23073, CVE-2026-23075, CVE-2026-23076, CVE-2026-23077,     CVE-2026-23078, CVE-2026-23079, CVE-2026-23080, CVE-2026-23081, CVE-2026-23083, CVE-2026-23084,     CVE-2026-23085, CVE-2026-23086, CVE-2026-23087, CVE-2026-23088, CVE-2026-23089, CVE-2026-23090,     CVE-2026-23092, CVE-2026-23093, CVE-2026-23094, CVE-2026-23095, CVE-2026-23096, CVE-2026-23097,     CVE-2026-23098, CVE-2026-23099, CVE-2026-23100, CVE-2026-23101, CVE-2026-23102, CVE-2026-23103,     CVE-2026-23104, CVE-2026-23105, CVE-2026-23106, CVE-2026-23107, CVE-2026-23108, CVE-2026-23109,     CVE-2026-23110, CVE-2026-23113, CVE-2026-23114, CVE-2026-23115, CVE-2026-23116, CVE-2026-23118,     CVE-2026-23119, CVE-2026-23120, CVE-2026-23121, CVE-2026-23122, CVE-2026-23123, CVE-2026-23124,     CVE-2026-23125, CVE-2026-23126, CVE-2026-23128, CVE-2026-23129, CVE-2026-23130, CVE-2026-23131,     CVE-2026-23133, CVE-2026-23135, CVE-2026-23136, CVE-2026-23137, CVE-2026-23138, CVE-2026-23139,     CVE-2026-23140, CVE-2026-23141, CVE-2026-23142, CVE-2026-23143, CVE-2026-23144, CVE-2026-23145,     CVE-2026-23146, CVE-2026-23147, CVE-2026-23148, CVE-2026-23150, CVE-2026-23151, CVE-2026-23152,     CVE-2026-23154, CVE-2026-23156, CVE-2026-23157, CVE-2026-23158, CVE-2026-23159, CVE-2026-23160,     CVE-2026-23161, CVE-2026-23162, CVE-2026-23163, CVE-2026-23164, CVE-2026-23165, CVE-2026-23166,     CVE-2026-23167, CVE-2026-23168, CVE-2026-23169, CVE-2026-23170, CVE-2026-23171, CVE-2026-23172,     CVE-2026-23173, CVE-2026-23212, CVE-2026-31405, CVE-2026-31414, CVE-2026-31444, CVE-2026-31501,     CVE-2026-31589, CVE-2026-31633, CVE-2026-31636, CVE-2026-31705, CVE-2026-43198, CVE-2026-43379,     CVE-2026-43465, CVE-2026-43499, CVE-2026-46113, CVE-2026-46137, CVE-2026-46242, CVE-2026-46290,     CVE-2026-46317, CVE-2026-46331, CVE-2026-52924, CVE-2026-52989, CVE-2026-53086, CVE-2026-53131,     CVE-2026-53176, CVE-2026-53212, CVE-2026-53225, CVE-2026-53228, CVE-2026-53277, CVE-2026-53359)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 10 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-50160 advisory.

    - mm/hugetlb: fix hugetlb_pmd_shared() (David Hildenbrand) [Orabug: 38931087] {CVE-2026-23100}
    - platform/x86: classmate-laptop: Add missing NULL pointer checks (Rafael J. Wysocki) [Orabug: 39044501]     {CVE-2026-23237}
    - scsi: qla2xxx: Fix bsg_done() causing double free (Anil Gurumurthy) [Orabug: 39044457] {CVE-2025-71238}
    - wifi: rtl8xxxu: fix slab-out-of-bounds in rtl8xxxu_sta_add (Ali Tariq) [Orabug: 38997990]     {CVE-2025-71234}
    - xfs: fix UAF in xchk_btree_check_block_owner (Darrick J. Wong) [Orabug: 38998028] {CVE-2026-23223}
    - scsi: qla2xxx: Free sp in error path to fix system crash (Anil Gurumurthy) [Orabug: 38997979]     {CVE-2025-71232}
    - scsi: qla2xxx: Delay module unload while fabric scan in progress (Anil Gurumurthy) [Orabug: 38997992]     {CVE-2025-71235}
    - scsi: qla2xxx: Validate sp before freeing associated memory (Anil Gurumurthy) [Orabug: 38997998]     {CVE-2025-71236}
    - wifi: rtw88: Fix alignment fault in rtw_core_enable_beacon() (Bitterblue Smith) [Orabug: 38997972]     {CVE-2025-71229}
    - crypto: virtio - Add spinlock protection with virtqueue notification (Bibo Mao) [Orabug: 38998052]     {CVE-2026-23229}
    - crypto: iaa - Fix out-of-bounds index in find_empty_iaa_compression_mode (Thorsten Blum) [Orabug:
    38997976] {CVE-2025-71231}
    - smb: client: split cached_fid bitfields to avoid shared-byte RMW races (Henrique Carvalho) [Orabug:
    38998059] {CVE-2026-23230}
    - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Breno Leitao) [Orabug: 38970593]     {CVE-2026-23202}
    - ASoC: amd: fix memory leak in acp3x pdm dma ops (Chris Bainbridge) [Orabug: 38970441] {CVE-2026-23190}
    - ipv6: Fix ECMP sibling count mismatch when clearing RTF_ADDRCONF (Shigeru Yoshida) [Orabug: 38970598]     {CVE-2026-23200}
    - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (Andrew Fasano) [Orabug:
    38970170] {CVE-2026-23111}
    - net: usb: r8152: fix resume reset deadlock (Sergey Senozhatsky) [Orabug: 38970438] {CVE-2026-23188}
    - macvlan: fix error recovery in macvlan_common_newlink() (Eric Dumazet) [Orabug: 38970508]     {CVE-2026-23209}
    - net/sched: cls_u32: use skb_header_pointer_careful() (Eric Dumazet) [Orabug: 38970487] {CVE-2026-23204}
    - smb/client: fix memory leak in smb2_open_file() (Chenxiaosong) [Orabug: 38970578] {CVE-2026-23205}
    - btrfs: reject new transactions if the fs is fully read-only (Qu Wenruo) [Orabug: 38985156]     {CVE-2026-23214}
    - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (Maurizio Lombardi) [Orabug:
    38985169] {CVE-2026-23216}
    - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (Maurizio Lombardi) [Orabug:
    38970453] {CVE-2026-23193}
    - nvmet-tcp: fixup hang in nvmet_tcp_listen_data_ready() (Hannes Reinecke) [Orabug: 38970416]     {CVE-2026-23179}
    - drm/amd/pm: Disable MMIO access during SMU Mode 1 reset (Perry Yuan) [Orabug: 38985149] {CVE-2026-23213}
    - HID: i2c-hid: fix potential buffer overflow in i2c_hid_get_report() (Kwok Kin Ming) [Orabug: 38970413]     {CVE-2026-23178}
    - md: suspend array while updating raid_disks via sysfs (Danny Shih) [Orabug: 38985108] {CVE-2025-71225}
    - wifi: wlcore: ensure skb headroom before skb_push (Peter Astrand) [Orabug: 38970152] {CVE-2025-71222}
    - wifi: mac80211: ocb: skip rx_no_sta when interface is not joined (Moon Hee Lee) [Orabug: 38970163]     {CVE-2025-71224}
    - procfs: avoid fetching build ID while holding VMA lock (Andrii Nakryiko) [Orabug: 38970476]     {CVE-2026-23199}
    - mm, shmem: prevent infinite loop on truncate race (Kairui Song) [Orabug: 38970409] {CVE-2026-23177}
    - ceph: fix oops due to invalid pointer for kfree() in parse_longname() (Daniel Vogelbacher) [Orabug:
    38970590] {CVE-2026-23201}
    - ceph: fix NULL pointer dereference in ceph_mds_auth_match() (Viacheslav Dubeyko) [Orabug: 38970595]     {CVE-2026-23189}
    - mm/slab: Add alloc_tagging_slab_free_hook for memcg_alloc_abort_single (Hao Ge) [Orabug: 38985192]     {CVE-2026-23219}
    - ALSA: aloop: Fix racy access at PCM trigger (Takashi Iwai) [Orabug: 38970445] {CVE-2026-23191}
    - x86/vmware: Fix hypercall clobbers (Josh Poimboeuf) [Orabug: 38985163] {CVE-2026-23215}
    - nvmet-tcp: add bounds checks in nvmet_tcp_build_pdu_iovec (Yunje Shin) [Orabug: 38970176]     {CVE-2026-23112}
    - perf: sched: Fix perf crash with new is_user_task() helper (Steven Rostedt) [Orabug: 38970581]     {CVE-2026-23159}
    - wifi: ath11k: add srng->lock for ath11k_hal_srng_* in monitor mode (Kang Yang) [Orabug: 37844126]     {CVE-2024-58096}
    - drm/amdgpu: fix NULL pointer dereference in amdgpu_gmc_filter_faults_remove (Jon Doron) [Orabug:
    38970348] {CVE-2026-23163}
    - net: fix segmentation of forwarding fraglist GRO (Jibin Zhang) [Orabug: 38970318] {CVE-2026-23154}
    - mm/shmem, swap: fix race of truncate and swap entry split (Kairui Song) [Orabug: 38970345]     {CVE-2026-23161}
    - flex_proportions: make fprop_new_period() hardirq safe (Jan Kara) [Orabug: 38970373] {CVE-2026-23168}
    - nvmet: fix race in nvmet_bio_done() leading to NULL pointer dereference (Ming Lei) [Orabug: 38970608]     {CVE-2026-23148}
    - efivarfs: fix error propagation in efivar_entry_get() (Kohei Enju) [Orabug: 38970325] {CVE-2026-23156}
    - net/mlx5e: TC, delete flows only for existing peers (Mark Bloch) [Orabug: 38970397] {CVE-2026-23173}
    - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Aaron Ma) [Orabug: 38970364]     {CVE-2026-23166}
    - rocker: fix memory leak in rocker_world_port_post_fini() (Kery Qi) [Orabug: 38970351] {CVE-2026-23164}
    - bonding: annotate data-races around slave->last_rx (Eric Dumazet) [Orabug: 38985142] {CVE-2026-23212}
    - Bluetooth: MGMT: Fix memory leak in set_ssp_complete (Jianpeng Chang) [Orabug: 38970587]     {CVE-2026-23151}
    - Bluetooth: hci_uart: fix null-ptr-deref in hci_uart_write_work (Jia-Hong Su) [Orabug: 38970604]     {CVE-2026-23146}
    - wifi: ath11k: fix RCU stall while reaping monitor destination ring (P Praneesh) [Orabug: 37844129]     {CVE-2024-58097}
    - btrfs: fix racy bitfield write in btrfs_clear_space_info_full() (Boris Burkov) [Orabug: 38798802]     {CVE-2025-68358}
    - sched_ext: Fix possible deadlock in the deferred_irq_workfn() (Zqiang) [Orabug: 38792605]     {CVE-2025-68333}
    - exfat: fix refcount leak in exfat_find (Shuhao Fu) [Orabug: 38798780] {CVE-2025-68351}
    - bpf: Do not let BPF test infra emit invalid GSO types to stack (Daniel Borkmann) [Orabug: 38798881]     {CVE-2025-68725}
    - migrate: correct lock ordering for hugetlb file folios (Matthew Wilcox) [Orabug: 38931066]     {CVE-2026-23097}
    - can: usb_8dev: usb_8dev_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde) [Orabug: 38931120]     {CVE-2026-23108}
    - can: kvaser_usb: kvaser_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde) [Orabug:
    38930881] {CVE-2026-23061}
    - can: ems_usb: ems_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde) [Orabug: 38930859]     {CVE-2026-23058}
    - irqchip/gic-v3-its: Avoid truncating memory addresses (Arnd Bergmann) [Orabug: 38931001]     {CVE-2026-23085}
    - intel_th: fix device leak on output open() (Johan Hovold) [Orabug: 38931040] {CVE-2026-23091}
    - tracing: Fix crash on synthetic stacktrace field usage (Steven Rostedt) [Orabug: 38931024]     {CVE-2026-23088}
    - arm64: Set __nocfi on swsusp_arch_resume() (Zhaoyang Huang) [Orabug: 38970241] {CVE-2026-23128}
    - arm64/fpsimd: signal: Allocate SSVE storage when restoring ZA (Mark Rutland) [Orabug: 38931118]     {CVE-2026-23107}
    - wifi: rsi: Fix memory corruption due to not set vif driver data size (Marek Vasut) [Orabug: 38930939]     {CVE-2026-23073}
    - wifi: ath10k: fix dma_free_coherent() pointer (Thomas Fourier) [Orabug: 38970253] {CVE-2026-23133}
    - ALSA: usb-audio: Fix use-after-free in snd_usb_mixer_free() (Berk Cem Goksel) [Orabug: 38931029]     {CVE-2026-23089}
    - ALSA: scarlett2: Fix buffer overflow in config retrieval (Samasth Norway Ananda) [Orabug: 38930973]     {CVE-2026-23078}
    - ALSA: ctxfi: Fix potential OOB access in audio mixer handling (Takashi Iwai) [Orabug: 38930966]     {CVE-2026-23076}
    - leds: led-class: Only Add LED to leds_list when it is fully ready (Hans de Goede) [Orabug: 38931091]     {CVE-2026-23101}
    - dpll: Prevent duplicate registrations (Ivan Vecera) [Orabug: 38970244] {CVE-2026-23129}
    - vsock/virtio: cap TX credit to local buffer size (Melbin K Mathew) [Orabug: 38931008] {CVE-2026-23086}
    - vsock/virtio: fix potential underflow in virtio_transport_get_credit() (Melbin K Mathew) [Orabug:
    38930919] {CVE-2026-23069}
    - bonding: provide a net pointer to __skb_flow_dissect() (Eric Dumazet) [Orabug: 38970199]     {CVE-2026-23119}
    - be2net: Fix NULL pointer dereference in be_cmd_get_mac_from_list (Andrey Vatoropin) [Orabug: 38930992]     {CVE-2026-23084}
    - ipv6: annotate data-race in ndisc_router_discovery() (Eric Dumazet) [Orabug: 38970222] {CVE-2026-23124}
    - netdevsim: fix a race issue related to the operation on bpf_bound_progs list (Yun Lu) [Orabug: 38970233]     {CVE-2026-23126}
    - scsi: qla2xxx: Sanitize payload size to prevent member overflow (Jiasheng Jiang) [Orabug: 38930867]     {CVE-2026-23059}
    - scsi: core: Wake up the error handler when final completions race against each other (David Jeffery)     [Orabug: 38931132] {CVE-2026-23110}
    - regmap: Fix race condition in hwspinlock irqsave routine (Cheng-Yu Lee) [Orabug: 38930930]     {CVE-2026-23071}
    - interconnect: debugfs: initialize src_node and dst_node to empty strings (Georgi Djakov) [Orabug:
    38970218] {CVE-2026-23123}
    - io_uring/io-wq: check IO_WQ_BIT_EXIT inside work run loop (Jens Axboe) [Orabug: 38970181]     {CVE-2026-23113}
    - platform/x86: hp-bioscfg: Fix kernel panic in GET_INSTANCE_ID macro (Mario Limonciello) [Orabug:
    38930890] {CVE-2026-23062}
    - platform/x86: hp-bioscfg: Fix kobject warnings for empty attribute names (Mario Limonciello) [Orabug:
    38970247] {CVE-2026-23131}
    - scsi: xen: scsiback: Fix potential memory leak in scsiback_remove() (Abdun Nihaal) [Orabug: 38931014]     {CVE-2026-23087}
    - w1: therm: Fix off-by-one buffer overflow in alarms_store (Thorsten Blum) [Orabug: 38930796]     {CVE-2025-71197}
    - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec (Taeyang Lee) [Orabug:
    38930874] {CVE-2026-23060}
    - net/sched: qfq: Use cl_is_active to determine whether class is active in qfq_rm_from_ag (Jamal Hadi     Salim) [Orabug: 38931110] {CVE-2026-23105}
    - net/sched: Enforce that teql can only be used as root qdisc (Jamal Hadi Salim) [Orabug: 38930948]     {CVE-2026-23074}
    - ipvlan: Make the addrs_lock be per port (Dmitry Skorodumov) [Orabug: 38931102] {CVE-2026-23103}
    - l2tp: avoid one data-race in l2tp_tunnel_del_work() (Eric Dumazet) [Orabug: 38970202] {CVE-2026-23120}
    - gue: Fix skb memleak with inner IP protocol 0. (Kuniyuki Iwashima) [Orabug: 38931057] {CVE-2026-23095}
    - sctp: move SCTP_CMD_ASSOC_SHKEY right after SCTP_CMD_PEER_INIT (Xin Long) [Orabug: 38970225]     {CVE-2026-23125}
    - can: gs_usb: gs_usb_receive_bulk_callback(): unanchor URL on usb_submit_urb() error (Marc Kleine-Budde)     [Orabug: 38931184] {CVE-2026-23082}
    - l2tp: Fix memleak in l2tp_udp_encap_recv(). (Kuniyuki Iwashima) [Orabug: 38930935] {CVE-2026-23072}
    - bonding: limit BOND_MODE_8023AD to Ethernet devices (Eric Dumazet) [Orabug: 38931079] {CVE-2026-23099}
    - vsock/virtio: Coalesce only linear skb (Michal Luczaj) [Orabug: 38930857] {CVE-2026-23057}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
346773	EulerOS 2.0 SP15 : kernel (EulerOS-SA-2026-3807)	Nessus	Huawei Local Security Checks	9/17/2026	9/18/2026	high
340678	Ubuntu 24.04 LTS / Pro Realtime 24.04 LTS : Linux kernel (NVIDIA) vulnerabilities (USN-8669-1)	Nessus	Ubuntu Local Security Checks	8/26/2026	9/23/2026	high
377235	EulerOS Virtualization 2.15.0 : kernel (EulerOS-SA-2026-4820)	Nessus	Huawei Local Security Checks	11/7/2026	11/9/2026	high
303468	Oracle Linux 10 / 9 : Unbreakable Enterprise kernel (ELSA-2026-50160)	Nessus	Oracle Linux Local Security Checks	3/24/2026	3/24/2026	critical

Detections

Analytics

Plugins Search

high

high

high

critical