The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:27354 advisory.

    * kernel: Linux kernel: Use-after-free in bonding driver leads to denial of service (CVE-2026-31419)

    * kernel: drm/amd/display: Do not skip unrelated mode changes in DSC validation (CVE-2026-31488)

    * kernel: net: mana: fix use-after-free in add_adev() error path (CVE-2026-43056)

    * kernel: ALSA: usb-audio: Add sanity check for OOB writes at silencing (CVE-2026-43279)

    * kernel: net/sched: act_pedit: extend the writable skb range per key (CVE-2026-46331)

    * kernel: ALSA: aloop: Fix peer runtime UAF during format-change stop (CVE-2026-46090)

    * kernel: RDMA/mana: Validate rx_hash_key_len (CVE-2026-46145)

    * kernel: nvmet-tcp: fix race between ICReq handling and queue teardown (CVE-2026-46135)

    Bug Fix(es) and Enhancement(s):

    * Rocky Linux8 RT kernel panic in replenish_dl_entity() caused by stale DEADLINE PI state during rt_mutex     de-boosting (JIRA:Rocky Linux-178520)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:27789 advisory.

    * kernel: can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CVE-2026-31474)
      * kernel: mptcp: fix slab-use-after-free in __inet_lookup_established (CVE-2026-31669)
      * kernel: xen/privcmd: fix double free via VMA splitting (CVE-2026-31787)
      * kernel: Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CVE-2026-31772)
      * kernel: bnxt_en: Fix RSS context delete logic (CVE-2026-43260)
      * kernel: ALSA: usb-audio: Add sanity check for OOB writes at silencing (CVE-2026-43279)
      * kernel: scsi: qla2xxx: Completely fix fcport double free (CVE-2026-43414)
      * kernel: net/sched: act_pedit: extend the writable skb range per key (CVE-2026-46331)
      * kernel: gfs2: Fix use-after-free in iomap inline data write path (CVE-2026-45984)
      * kernel: Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CVE-2026-46056)
      * kernel: wifi: mac80211: drop stray 'static' from fast-RX rx_result (CVE-2026-46152)
      * kernel: RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CVE-2026-46117)
      * kernel: RDMA/mana: Validate rx_hash_key_len (CVE-2026-46145)
      * kernel: wifi: mac80211: remove station if connection prep fails (CVE-2026-46125)
      * kernel: exit: prevent preemption of oopsing TASK_DEAD task (CVE-2026-46173)
      * kernel: wifi: mac80211: use safe list iteration in radar detect work (CVE-2026-46166)
      * kernel: nvmet-tcp: fix race between ICReq handling and queue teardown (CVE-2026-46135)


    Bug Fix(es) and Enhancement(s):

      * AlmaLinux9.4 - s390/ap: Expose ap_bindings_complete_count counter via sysfs [almalinux-9.8.z]     (JIRA:AlmaLinux-166048)
      * [AlmaLinux 9.8] Hung tasks during both suspend and hibernate operations on systems with Intel E810     NICs [almalinux-9.8.z] (JIRA:AlmaLinux-175699)
      * DPLL: Add support for pin operational state [almalinux-9.8.z] (JIRA:AlmaLinux-175820)
      * DPLL: Add support for fractional frequency offset between pin and device [almalinux-9.8.z]     (JIRA:AlmaLinux-175823)
      * ibmveth Adapter Freeze with Small MSS [almalinux-9.8.z] (JIRA:AlmaLinux-178308)
      * AlmaLinux9.4 - s390/mm: Add missing secure storage access fixups [almalinux-9.8.z]     (JIRA:AlmaLinux-183317)
      * rbd: eliminate a race in lock_dwork draining on unmap [almalinux-9.8.z] (JIRA:AlmaLinux-183130)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:27789 advisory.

    * kernel: can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CVE-2026-31474)

    * kernel: mptcp: fix slab-use-after-free in __inet_lookup_established (CVE-2026-31669)

    * kernel: xen/privcmd: fix double free via VMA splitting (CVE-2026-31787)

    * kernel: Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CVE-2026-31772)

    * kernel: bnxt_en: Fix RSS context delete logic (CVE-2026-43260)

    * kernel: ALSA: usb-audio: Add sanity check for OOB writes at silencing (CVE-2026-43279)

    * kernel: scsi: qla2xxx: Completely fix fcport double free (CVE-2026-43414)

    * kernel: net/sched: act_pedit: extend the writable skb range per key (CVE-2026-46331)

    * kernel: gfs2: Fix use-after-free in iomap inline data write path (CVE-2026-45984)

    * kernel: Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CVE-2026-46056)

    * kernel: wifi: mac80211: drop stray 'static' from fast-RX rx_result (CVE-2026-46152)

    * kernel: RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CVE-2026-46117)

    * kernel: RDMA/mana: Validate rx_hash_key_len (CVE-2026-46145)

    * kernel: wifi: mac80211: remove station if connection prep fails (CVE-2026-46125)

    * kernel: exit: prevent preemption of oopsing TASK_DEAD task (CVE-2026-46173)

    * kernel: wifi: mac80211: use safe list iteration in radar detect work (CVE-2026-46166)

    * kernel: nvmet-tcp: fix race between ICReq handling and queue teardown (CVE-2026-46135)

    Bug Fix(es) and Enhancement(s):

    * Rocky Linux9.4 - s390/ap: Expose ap_bindings_complete_count counter via sysfs [rhel-9.8.z] (JIRA:Rocky     Linux-166048)

    * [Rocky Linux 9.8] Hung tasks during both suspend and hibernate operations on systems with Intel E810     NICs [rhel-9.8.z] (JIRA:Rocky Linux-175699)

    * DPLL: Add support for pin operational state [rhel-9.8.z] (JIRA:Rocky Linux-175820)

    * DPLL: Add support for fractional frequency offset between pin and device [rhel-9.8.z] (JIRA:Rocky     Linux-175823)

    * ibmveth Adapter Freeze with Small MSS [rhel-9.8.z] (JIRA:Rocky Linux-178308)

    * Rocky Linux9.4 - s390/mm: Add missing secure storage access fixups [rhel-9.8.z] (JIRA:Rocky     Linux-183317)

    * rbd: eliminate a race in lock_dwork draining on unmap [rhel-9.8.z] (JIRA:Rocky Linux-183130)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-27789 advisory.

    - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392]     {CVE-2026-46331}
    - scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414}
    - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102]     {CVE-2026-46135}
    - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158]     {CVE-2026-46117}
    - exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173}
    - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941]     {CVE-2026-43279}
    - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984}
    - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984}
    - bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260}
    - wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121]     {CVE-2026-46125}
    - RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145}
    - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057]     {CVE-2026-46152}
    - wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025]     {CVE-2026-46166}
    - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359]     {CVE-2026-46056}
    - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506]     {CVE-2026-31669}
    - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525]     {CVE-2026-31474}
    - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot)     [RHEL-172858] {CVE-2026-31772}
    - xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787}
    - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037}
    - net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539]     {CVE-2026-31508}
    - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181}
    - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408]     {CVE-2026-43501}
    - RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852}
    - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843]     {CVE-2026-43116}
    - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993]     {CVE-2026-43125}
    - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125}
    - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581}
    - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056}
    - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot)     [RHEL-165564] {CVE-2026-23216}
    - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068]     {CVE-2026-31419}
    - smb: client: reject userspace cifs.spnego descriptions (Paulo Alcantara) [RHEL-178944] {CVE-2026-46243}
    - Buffer overflow in drivers/xen/sys-hypervisor.c (Vitaly Kuznetsov) [RHEL-172510] {CVE-2026-31786}
    - smb: client: fix OOB reads parsing symlink error response (CKI Backport Bot) [RHEL-171471]     {CVE-2026-31613}
    - netfilter: xt_tcpmss: check remaining length before reading optlen (CKI Backport Bot) [RHEL-174216]     {CVE-2026-43190}
    - wifi: brcmfmac: validate bsscfg indices in IF events (CKI Backport Bot) [RHEL-173848] {CVE-2026-43110}
    - Bluetooth: SCO: fix race conditions in sco_sock_connect() (CKI Backport Bot) [RHEL-172599]     {CVE-2026-43023}
    - Bluetooth: MGMT: validate LTK enc_size on load (CKI Backport Bot) [RHEL-172572] {CVE-2026-43020}
    - proc: fix type confusion in pde_set_flags() (Abhi Das) [RHEL-163343] {CVE-2025-38653}
    - proc: fix missing pde_set_flags() for net proc files (Abhi Das) [RHEL-163343] {CVE-2025-38653}
    - proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (CKI Backport Bot)     [RHEL-163343] {CVE-2025-38653}
    - mm/page_alloc: clear page->private in free_pages_prepare() (Rafael Aquini) [RHEL-174750]     {CVE-2026-43303}
    - smb: client: validate the whole DACL before rewriting it in cifsacl (Paulo Alcantara) [RHEL-172821]     {CVE-2026-31709}
    - Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (David Marlin)     [RHEL-165063] {CVE-2026-31408}
    - xfs: fix freemap adjustments when adding xattrs to leaf blocks (CKI Backport Bot) [RHEL-174058]     {CVE-2026-43158}
    - xfs: delete attr leaf freemap entries when empty (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158}
    - HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CKI Backport Bot) [RHEL-172740]     {CVE-2026-43051}
    - netfilter: nf_conntrack_helper: pass helper to expect cleanup (CKI Backport Bot) [RHEL-172620]     {CVE-2026-43027}
    - netfilter: ip6t_eui64: reject invalid MAC header for all packets (CKI Backport Bot) [RHEL-171155]     {CVE-2026-31685}
    - net: sched: act_csum: validate nested VLAN headers (CKI Backport Bot) [RHEL-171138] {CVE-2026-31684}
    - nbd: defer config unlock in nbd_genl_connect (Jeff Moyer) [RHEL-166950] {CVE-2025-68366}
    - x86/mm: flush IOMMU before freeing kernel page table pages (Jerry Snitselaar) [RHEL-167100]     {CVE-2025-71089}
    - iommu/sva: add kernel page table IOTLB flush notification (Jerry Snitselaar) [RHEL-167100]     {CVE-2025-71089}
    - netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CKI Backport Bot) [RHEL-166987]     {CVE-2026-23455}
    - crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot)     [RHEL-166927] {CVE-2025-68724}
    - ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (Bruno Meneguele) [RHEL-169734]     {CVE-2025-68183}
    - netfilter: nf_tables: release flowtable after rcu grace period on error (CKI Backport Bot) [RHEL-160461]     {CVE-2026-23392}
    - net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176064]     {CVE-2026-46300}
    - net: move skb_gro_receive_list from udp to core (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300}
    - net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176064]     {CVE-2026-46300}
    - ptrace: slightly saner 'get_dumpable()' logic (Ricardo Robaina) [RHEL-176454] {CVE-2026-46333}
    - md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174091] {CVE-2026-43163}
    - RDMA/umem: Fix double dma_buf_unpin in failure path (CKI Backport Bot) [RHEL-174020] {CVE-2026-43128}
    - usbip: validate number_of_packets in usbip_pack_ret_submit() (CKI Backport Bot) [RHEL-171430]     {CVE-2026-31607}
    - can: raw: fix ro->uniq use-after-free in raw_rcv() (CKI Backport Bot) [RHEL-170759] {CVE-2026-31532}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:2914-1 advisory.

    The SUSE Linux Enterprise 12 SP5 kernel was updated to fix various security issues

    The following security issues were fixed:

    - CVE-2023-53995: net: ipv4: fix one memleak in __inet_del_ifa() (bsc#1255616).
    - CVE-2026-23255: net: add proper RCU protection to /proc/net/ptype (bsc#1259891).
    - CVE-2026-23451: bonding: prevent potential infinite loop in bond_header_parse() (bsc#1261604).
    - CVE-2026-31462: drm/amdgpu: prevent immediate PASID reuse case (bsc#1262655).
    - CVE-2026-31499: Bluetooth: L2CAP: Fix deadlock in l2cap_conn_del() (bsc#1262674).
    - CVE-2026-31502: team: fix header_ops type confusion with non-Ethernet ports (bsc#1263072).
    - CVE-2026-31592: KVM: SEV: Protect *all* of sev_mem_enc_register_region() with kvm->lock (bsc#1263123).
    - CVE-2026-31670: net: rfkill: prevent unlimited numbers of rfkill events from being created     (bsc#1263573).
    - CVE-2026-31677: crypto: af_alg - limit RX SG extraction by receive buffer budget (bsc#1263560).
    - CVE-2026-31680: net: ipv6: flowlabel: defer exclusive option free until RCU teardown (bsc#1263563).
    - CVE-2026-31773: Bluetooth: SMP: derive legacy responder STK authentication from MITM state     (bsc#1264039).
    - CVE-2026-31781: drm/ioc32: stop speculation on the drm_compat_ioctl path (bsc#1264033).
    - CVE-2026-43035: net: sched: cls_api: fix tc_chain_fill_node to initialize tcm_info to zero to prevent an     info-leak       (bsc#1263996).
    - CVE-2026-43036: net: use skb_header_pointer() for TCPv4 GSO frag_off check (bsc#1263993).
    - CVE-2026-43043: crypto: af-alg - fix NULL pointer dereference in scatterwalk (bsc#1264088).
    - CVE-2026-43047: HID: multitouch: Check to ensure report responses match the request (bsc#1264073).
    - CVE-2026-43051: HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (bsc#1264065).
    - CVE-2026-43080: l2tp: Drop large packets with UDP encap (bsc#1264236).
    - CVE-2026-43089: xfrm_user: fix info leak in build_mapping() (bsc#1264261).
    - CVE-2026-43093: xsk: tighten UMEM headroom validation to account for tailroom and min frame     (bsc#1264254).
    - CVE-2026-43112: fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (bsc#1264437).
    - CVE-2026-43117: btrfs: tracepoints: get correct superblock from dentry in event btrfs_sync_file()     (bsc#1264414).
    - CVE-2026-43139: xfrm6: fix uninitialized saddr in xfrm6_get_saddr() (bsc#1264294).
    - CVE-2026-43233: netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (bsc#1264337).
    - CVE-2026-43279: ALSA: usb-audio: Add sanity check for OOB writes at silencing (bsc#1264618).
    - CVE-2026-43336: lib/crypto: chacha: Zeroize permuted_state before it leaves scope (bsc#1265113).
    - CVE-2026-43456: bonding: fix type confusion in bond_setup_by_slave() (bsc#1264734).
    - CVE-2026-43472: unshare: fix unshare_fs() handling (bsc#1264748).
    - CVE-2026-43492: lib/crypto: mpi: Fix integer underflow in mpi_read_raw_from_sgl() (bsc#1265629).
    - CVE-2026-45840: openvswitch: cap upcall PID array size and pre-size vport replies (bsc#1266397).
    - CVE-2026-45912: ext4: don't cache extent during splitting extent (bsc#1266899).
    - CVE-2026-45948: ext4: fix memory leak in ext4_ext_shift_extents() (bsc#1266929).
    - CVE-2026-45960: hfsplus: return error when node already exists in hfs_bnode_create (bsc#1266971).
    - CVE-2026-46028: crypto: algif_aead - snapshot IV for async AEAD requests (bsc#1267430).
    - CVE-2026-46065: fbdev: defio: Disconnect deferred I/O from the lifetime of struct (bsc#1267458).
    - CVE-2026-46069: wifi: mwifiex: fix use-after-free in mwifiex_adapter_cleanup() (bsc#1267437).
    - CVE-2026-46082: KVM: SVM: Inject #UD for INVLPGA if EFER.SVME=0 (bsc#1267473).
    - CVE-2026-46124: isofs: validate block number from NFS file handle in isofs_export_iget (bsc#1266847).
    - CVE-2026-46133: RDMA/rxe: Reject unknown opcodes before ICRC processing (bsc#1266928).
    - CVE-2026-46253: pstore/ram: fix buffer overflow in persistent_ram_save_old() (bsc#1267635).
    - CVE-2026-46254: AppArmor: Allow apparmor to handle unaligned dfa tables (bsc#1267637).
    - CVE-2026-46266: inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (bsc#1267684).
    - CVE-2026-46275: Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (bsc#1267968).
    - CVE-2026-46299: hfsplus: fix held lock freed on hfsplus_fill_super() (bsc#1267920).
    - CVE-2026-46320: tap: free page on error paths in tap_get_user_xdp() (bsc#1267993).
    - CVE-2026-46328: apparmor: fix rlimit for posix cpu timers (bsc#1268037).
    - CVE-2026-46331: net/sched: fix pedit partial COW leading to page cache (bsc#1265421).
    - CVE-2026-52918: Bluetooth: serialize accept_q access (bsc#1269100).
    - CVE-2026-52923: ipc: limit next_id allocation to the valid ID range (bsc#1269033).
    - CVE-2026-52954: libceph: handle rbtree insertion error in decode_choose_args() (bsc#1269137).
    - CVE-2026-52955: libceph: Fix potential out-of-bounds access in crush_decode() (bsc#1269159).
    - CVE-2026-52957: libceph: Fix potential null-ptr-deref in decode_choose_args() (bsc#1269103).
    - CVE-2026-52962: ceph: fix a buffer leak in __ceph_setxattr() (bsc#1269135).
    - CVE-2026-52972: crypto: af_alg - Cap AEAD AD length to 0x80000000 (bsc#1269195).
    - CVE-2026-53040: ocfs2: validate bg_bits during freefrag scan (bsc#1269397).
    - CVE-2026-53041: ocfs2: fix listxattr handling when the buffer is full (bsc#1269398).
    - CVE-2026-53075: ppp: require CAP_NET_ADMIN in target netns for unattached ioctls (bsc#1269690).
    - CVE-2026-53148: thunderbolt: Clamp XDomain response data copy to allocation size (bsc#1269786).
    - CVE-2026-53150: thunderbolt: Reject zero-length property entries in validator (bsc#1269386).
    - CVE-2026-53194: USB: serial: kl5kusb105: fix bulk-out buffer overflow (bsc#1269904).
    - CVE-2026-53253: Bluetooth: bnep: fix incorrect length parsing in bnep_rx_frame() extension handling     (bsc#1269574).
    - CVE-2026-53287: audit: fix incorrect inheritable capability in CAPSET records (bsc#1269506).
    - CVE-2026-53359: KVM: x86: Fix shadow paging use-after-free due to unexpected role (bsc#1270059).

    The following non security issues were fixed:

    - btrfs: tracepoints: fix sleep while in atomic context in btrfs_sync_file() (git-fixes).
    - libceph: add non-asserting rbtree insertion helper (bsc#1269137).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1783362244 advisory.

  - In the Linux kernel, the following vulnerability has been resolved: extcon: Modify extcon device to be     created after driver data is set Currently, someone can invoke the sysfs such as state_show()     intermittently before dev_set_drvdata() is done. And it can be a cause of kernel Oops because of edev is     Null at that time. So modified the driver registration to after setting drviver data. - Oops's backtrace.
    Backtrace: [<c067865c>] (state_show) from [<c05222e8>] (dev_attr_show) [<c05222c0>] (dev_attr_show) from     [<c02c66e0>] (sysfs_kf_seq_show) [<c02c6648>] (sysfs_kf_seq_show) from [<c02c496c>] (kernfs_seq_show)     [<c02c4938>] (kernfs_seq_show) from [<c025e2a0>] (seq_read) [<c025e11c>] (seq_read) from [<c02c50a0>]     (kernfs_fop_read) [<c02c5064>] (kernfs_fop_read) from [<c0231cac>] (__vfs_read) [<c0231c5c>] (__vfs_read)     from [<c0231ee0>] (vfs_read) [<c0231e34>] (vfs_read) from [<c0232464>] (ksys_read) [<c02323f0>]     (ksys_read) from [<c02324fc>] (sys_read) [<c02324e4>] (sys_read) from [<c00091d0>] (__sys_trace_return)     (CVE-2022-49308)

  - In the Linux kernel, the following vulnerability has been resolved: tick/nohz: unexport __init-annotated     tick_nohz_full_setup() EXPORT_SYMBOL and __init is a bad combination because the .init.text section is     freed up after the initialization. Hence, modules cannot use symbols annotated __init. The access to a     freed symbol may end up with kernel panic. modpost used to detect it, but it had been broken for a decade.
    Commit 28438794aba4 (modpost: fix section mismatch check for exported init/exit sections) fixed it so     modpost started to warn it again, then this showed up: MODPOST vmlinux.symvers WARNING: modpost:
    vmlinux.o(___ksymtab_gpl+tick_nohz_full_setup+0x0): Section mismatch in reference from the variable
    __ksymtab_tick_nohz_full_setup to the function .init.text:tick_nohz_full_setup() The symbol     tick_nohz_full_setup is exported and annotated __init Fix this by removing the __init annotation of     tick_nohz_full_setup or drop the export. Drop the export because tick_nohz_full_setup() is only called     from the built-in code in kernel/sched/isolation.c. (CVE-2022-49675)

  - In the Linux kernel, the following vulnerability has been resolved: ata: libata-core: fix NULL pointer     deref in ata_host_alloc_pinfo() In an unlikely (and probably wrong?) case that the 'ppi' parameter of     ata_host_alloc_pinfo() points to an array starting with a NULL pointer, there's going to be a kernel oops     as the 'pi' local variable won't get reassigned from the initial value of NULL. Initialize 'pi' instead to     '&ata_dummy_port_info' to fix the possible kernel oops for good... Found by Linux Verification Center     (linuxtesting.org) with the SVACE static analysis tool. (CVE-2022-49731)

  - In the Linux kernel, the following vulnerability has been resolved: bridge: switchdev: Fix memory leaks     when changing VLAN protocol The bridge driver can offload VLANs to the underlying hardware either via     switchdev or the 8021q driver. When the former is used, the VLAN is marked in the bridge driver with the     'BR_VLFLAG_ADDED_BY_SWITCHDEV' private flag. To avoid the memory leaks mentioned in the cited commit, the     bridge driver will try to delete a VLAN via the 8021q driver if the VLAN is not marked with the previously     mentioned flag. When the VLAN protocol of the bridge changes, switchdev drivers are notified via the     'SWITCHDEV_ATTR_ID_BRIDGE_VLAN_PROTOCOL' attribute, but the 8021q driver is also called to add the     existing VLANs with the new protocol and delete them with the old protocol. In case the VLANs were     offloaded via switchdev, the above behavior is both redundant and buggy. Redundant because the VLANs are     already programmed in hardware and drivers that support VLAN protocol change (currently only mlx5) change     the protocol upon the switchdev attribute notification. Buggy because the 8021q driver is called despite     these VLANs being marked with 'BR_VLFLAG_ADDED_BY_SWITCHDEV'. This leads to memory leaks [1] when the     VLANs are deleted. Fix by not calling the 8021q driver for VLANs that were already programmed via     switchdev. [1] unreferenced object 0xffff8881f6771200 (size 256): comm ip, pid 446855, jiffies     4298238841 (age 55.240s) hex dump (first 32 bytes): 00 00 7f 0e 83 88 ff ff 00 00 00 00 00 00 00 00     ................ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace:
    [<00000000012819ac>] vlan_vid_add+0x437/0x750 [<00000000f2281fad>] __br_vlan_set_proto+0x289/0x920     [<000000000632b56f>] br_changelink+0x3d6/0x13f0 [<0000000089d25f04>] __rtnl_newlink+0x8ae/0x14c0     [<00000000f6276baf>] rtnl_newlink+0x5f/0x90 [<00000000746dc902>] rtnetlink_rcv_msg+0x336/0xa00     [<000000001c2241c0>] netlink_rcv_skb+0x11d/0x340 [<0000000010588814>] netlink_unicast+0x438/0x710     [<00000000e1a4cd5c>] netlink_sendmsg+0x788/0xc40 [<00000000e8992d4e>] sock_sendmsg+0xb0/0xe0     [<00000000621b8f91>] ____sys_sendmsg+0x4ff/0x6d0 [<000000000ea26996>] ___sys_sendmsg+0x12e/0x1b0     [<00000000684f7e25>] __sys_sendmsg+0xab/0x130 [<000000004538b104>] do_syscall_64+0x3d/0x90     [<0000000091ed9678>] entry_SYSCALL_64_after_hwframe+0x46/0xb0 (CVE-2022-49812)

  - In the Linux kernel, the following vulnerability has been resolved: capabilities: fix potential memleak on     error path from vfs_getxattr_alloc() In cap_inode_getsecurity(), we will use vfs_getxattr_alloc() to     complete the memory allocation of tmpbuf, if we have completed the memory allocation of tmpbuf, but failed     to call handler->get(...), there will be a memleak in below logic: |-- ret =     (int)vfs_getxattr_alloc(mnt_userns, ...) | /* ^^^ alloc for tmpbuf */ |-- value = krealloc(*xattr_value,     error + 1, flags) | /* ^^^ alloc memory */ |-- error = handler->get(handler, ...) | /* error! */ |--
    *xattr_value = value | /* xattr_value is &tmpbuf (memory leak!) */ So we will try to free(tmpbuf) after     vfs_getxattr_alloc() fails to fix it. [PM: subject line and backtrace tweaks] (CVE-2022-49890)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
321892	RockyLinux 8 : kernel-rt (RLSA-2026:27354)	Nessus	Rocky Linux Local Security Checks	6/22/2026	9/28/2026	critical
322284	AlmaLinux 9 : kernel (ALSA-2026:27789)	Nessus	Alma Linux Local Security Checks	6/24/2026	9/28/2026	high
322776	RockyLinux 9 : kernel (RLSA-2026:27789)	Nessus	Rocky Linux Local Security Checks	6/25/2026	9/25/2026	high
323118	Oracle Linux 9 : kernel (ELSA-2026-27789)	Nessus	Oracle Linux Local Security Checks	6/26/2026	9/25/2026	high
326705	SUSE SLES12: cluster-md-kmp-default / dlm-kmp-default / gfs2-kmp-default / etc (SUSE-SU-2026:2914-1)	Nessus	SuSE Local Security Checks	7/14/2026	7/15/2026	high
360687	AlmaLinux 9.2 [TuxCare] Security Update: bpftool / kernel / kernel-abi-stablelists / kernel-core / etc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1783362244)	Nessus	Alma Linux Local Security Checks	10/1/2026	10/1/2026	high

Detections

Analytics

Plugins Search

critical

high

high

high

high

high