The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1786352940 advisory.

  - In the Linux kernel, the following vulnerability has been resolved: serial: imx: fix tx statemachine     deadlock When using the serial port as RS485 port, the tx statemachine is used to control the RTS pin to     drive the RS485 transceiver TX_EN pin. When the TTY port is closed in the middle of a transmission (for     instance during userland application crash), imx_uart_shutdown disables the interface and disables the     Transmission Complete interrupt. afer that, imx_uart_stop_tx bails on an incomplete transmission, to be     retriggered by the TC interrupt. This interrupt is disabled and therefore the tx statemachine never     transitions out of SEND. The statemachine is in deadlock now, and the TX_EN remains low, making the     interface useless. imx_uart_stop_tx now checks for incomplete transmission AND whether TC interrupts are     enabled before bailing to be retriggered. This makes sure the state machine handling is reached, and is     properly set to WAIT_AFTER_SEND. (CVE-2023-52456)

  - In the Linux kernel, the following vulnerability has been resolved: ubi: Fix use-after-free when volume     resizing failed There is an use-after-free problem reported by KASAN:
    ================================================================== BUG: KASAN: use-after-free in     ubi_eba_copy_table+0x11f/0x1c0 [ubi] Read of size 8 at addr ffff888101eec008 by task ubirsvol/4735 CPU: 2     PID: 4735 Comm: ubirsvol Not tainted 6.1.0-rc1-00003-g84fa3304a7fc-dirty #14 Hardware name: QEMU Standard     PC (i440FX + PIIX, 1996), BIOS 1.14.0-1.fc33 04/01/2014 Call Trace: <TASK> dump_stack_lvl+0x34/0x44     print_report+0x171/0x472 kasan_report+0xad/0x130 ubi_eba_copy_table+0x11f/0x1c0 [ubi]     ubi_resize_volume+0x4f9/0xbc0 [ubi] ubi_cdev_ioctl+0x701/0x1850 [ubi] __x64_sys_ioctl+0x11d/0x170     do_syscall_64+0x35/0x80 entry_SYSCALL_64_after_hwframe+0x46/0xb0 </TASK> When ubi_change_vtbl_record()     returns an error in ubi_resize_volume(), new_eba_tbl will be freed on error handing path, but it is     holded by vol->eba_tbl in ubi_eba_replace_table(). It means that the liftcycle of vol->eba_tbl and     vol are different, so when resizing volume in next time, it causing an use-after-free fault. Fix it by     not freeing new_eba_tbl after it replaced in ubi_eba_replace_table(), while will be freed in next volume     resizing. (CVE-2023-53800)

  - In the Linux kernel, the following vulnerability has been resolved: kdb: Fix buffer overflow during tab-     complete Currently, when the user attempts symbol completion with the Tab key, kdb will use strncpy() to     insert the completed symbol into the command buffer. Unfortunately it passes the size of the source buffer     rather than the destination to strncpy() with predictably horrible results. Most obviously if the command     buffer is already full but cp, the cursor position, is in the middle of the buffer, then we will write     past the end of the supplied buffer. Fix this by replacing the dubious strncpy() calls with     memmove()/memcpy() calls plus explicit boundary checks to make sure we have enough space before we start     moving characters around. (CVE-2024-39480)

  - In the Linux kernel, the following vulnerability has been resolved: Fix userfaultfd_api to return EINVAL     as expected Currently if we request a feature that is not set in the Kernel config we fail silently and     return all the available features. However, the man page indicates we should return an EINVAL. We need to     fix this issue since we can end up with a Kernel warning should a program request the feature     UFFD_FEATURE_WP_UNPOPULATED on a kernel with the config not set with this feature. [ 200.812896] WARNING:
    CPU: 91 PID: 13634 at mm/memory.c:1660 zap_pte_range+0x43d/0x660 [ 200.820738] Modules linked in: [     200.869387] CPU: 91 PID: 13634 Comm: userfaultfd Kdump: loaded Not tainted 6.9.0-rc5+ #8 [ 200.877477]     Hardware name: Dell Inc. PowerEdge R6525/0N7YGH, BIOS 2.7.3 03/30/2022 [ 200.885052] RIP:
    0010:zap_pte_range+0x43d/0x660 (CVE-2024-41027)

  - In the Linux kernel, the following vulnerability has been resolved: mlxsw: core_linecards: Fix double     memory deallocation in case of invalid INI file In case of invalid INI file mlxsw_linecard_types_init()     deallocates memory but doesn't reset pointer to NULL and returns 0. In case of any error occurred after     mlxsw_linecard_types_init() call, mlxsw_linecards_init() calls mlxsw_linecard_types_fini() which performs     memory deallocation again. Add pointer reset to NULL. Found by Linux Verification Center     (linuxtesting.org) with SVACE. (CVE-2024-42138)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 22.04 LTS / 24.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-8497-1 advisory.

    It was discovered that the Linux kernel did not properly handle shared page fragments during socket buffer     operations, collectively known as Dirty Frag. A logic flaw existed in the XFRM ESP-in-TCP subsystem and in     the RxRPC networking subsystem when processing paged fragments. A local attacker could use this to     escalate privileges, or possibly escape a container. (CVE-2026-43284, CVE-2026-43500, CVE-2026-45998,     CVE-2026-46000)

    It was discovered that a logic flaw existed in the XFRM ESP-in-TCP subsystem in the Linux kernel when     handling socket buffer fragments. This flaw is known as Fragnesia. A local attacker could use this to     escalate privileges, or possibly escape a container. (CVE-2026-43503, CVE-2026-46300)

    Qualys discovered that a race condition existed in the ptrace subsystem of the Linux kernel when     privileged processes are exiting. An unprivileged local attacker could use this issue to expose sensitive     information. (CVE-2026-46333)

    Tristan Madani discovered that Ubuntu Linux kernel 6.8, 6.17 and 7.0 contain a memory leak when handling     AppArmor notifications. A local attacker could use this to cause resource exhaustion. (CVE-2026-47326)

    Tristan Madani discovered that Ubuntu Linux kernel 6.8, 6.17 and 7.0 contain a NULL pointer dereference     when handling AppArmor notifications. A local attacker could use this to cause a kernel oops.
    (CVE-2026-47327)

    Tristan Madani discovered that Ubuntu Linux kernel 6.8, 6.17 and 7.0 contained an invalid free when     handling AppArmor notifications. A local attacker could use this to corrupt kernel memory.
    (CVE-2026-47328)

    Tristan Madani discovered that Ubuntu Linux kernel 6.8, 6.17 and 7.0 contained insufficient validation of     AppArmor notification responses. A local attacker could use this to allow crafted responses to be     processed. (CVE-2026-47329)

    Tristan Madani discovered that Ubuntu Linux kernel 6.8, 6.17 and 7.0 used an uninitialized variable when     handling AppArmor notifications. A local attacker could use this to cause incorrect caching of data.
    (CVE-2026-47330)

    Tristan Madani discovered that Ubuntu Linux kernel 6.8 contained a use- after-free (UAF) bug. A local     attacker could use this to cause memory corruption and, theoretically, arbitrary code execution.
    (CVE-2026-47331)

    Tristan Madani discovered that Ubuntu Linux kernel 6.8, 6.17 and 7.0 contained an out-of-bounds (OOB) read     when handling AppArmor notifications. A local attacker could use this to cause information disclosure of     kernel memory. (CVE-2026-47332)

    Tristan Madani discovered that Ubuntu Linux kernel 6.8, 6.17 and 7.0 contained a out-of-bounds (OOB) read     when handling AppArmor notifications. A local attacker could use this to cause kernel memory corruption     and, theoretically, influence processing of AppArmor policies. (CVE-2026-47333)

    Tristan Madani discovered that Ubuntu Linux kernel 6.8, 6.17 and 7.0 contained incorrect holding of locks     when handling AppArmor notifications. A local attacker could use this to cause a kernel panic or deadlock.
    (CVE-2026-47334)

    Tristan Madani discovered that Ubuntu Linux kernel 6.8 contained a NULL pointer dereference when handling     AppArmor notifications. A local attacker could use this to cause a kernel panic. (CVE-2026-47335)

    Tristan Madani discovered that Ubuntu Linux kernel 6.8 used an uninitialized variable when handling     AppArmor AF_INET/AF_INET6 socket mediation. A local attacker could use this to influence processing of     fine- grained network socket mediation. (CVE-2026-47336)

    Tristan Madani and Trevor Lawrence have each independently discovered that Ubuntu Linux kernel 6.8, 6.17     and 7.0 contained a NULL pointer dereference when handling AppArmor network socket mediation. A local     attacker could use this to cause a kernel oops. (CVE-2026-47337)

    Several security issues were discovered in the Linux kernel. An attacker could possibly use these to     compromise the system. This update corrects flaws in the following subsystems:

    - ARM64 architecture;

    - MIPS architecture;

    - PowerPC architecture;

    - x86 architecture;

    - Block layer subsystem;

    - Cryptographic API;

    - ACPI drivers;

    - ATM drivers;

    - RNBD block device driver;

    - Ublk userspace block driver;

    - Bus devices;

    - Character device driver;

    - TPM device driver;

    - Clock framework and drivers;

    - Clocksource drivers;

    - CPU idle management framework;

    - Hardware crypto device drivers;

    - DMA engine subsystem;

    - EFI core;

    - GPIO subsystem;

    - GPU drivers;

    - HID subsystem;

    - Hardware monitoring drivers;

    - IIO subsystem;

    - InfiniBand drivers;

    - IOMMU subsystem;

    - Multiple devices driver;

    - Media drivers;

    - Multifunction device drivers;

    - Broadcom VK accelerator driver;

    - MOST (Media Oriented Systems Transport) drivers;

    - MTD block device drivers;

    - Ethernet bonding driver;

    - Network drivers;

    - Mellanox network drivers;

    - STMicroelectronics network drivers;

    - NTB driver;

    - NVME drivers;

    - PCI subsystem;

    - Performance monitor drivers;

    - Pin controllers subsystem;

    - x86 platform drivers;

    - Power supply drivers;

    - RapidIO drivers;

    - RAS (Reliability, Availability, Serviceability) subsystem;

    - Remote Processor subsystem;

    - RPMSG subsystem;

    - S/390 drivers;

    - SCSI subsystem;

    - MediaTek SoC drivers;

    - Texas Instruments SoC drivers;

    - SPI subsystem;

    - Greybus lights staging drivers;

    - Realtek RTL8723BS SDIO drivers;

    - UFS subsystem;

    - ChipIdea USB driver;

    - DesignWare USB3 driver;

    - USB over IP driver;

    - vDPA drivers;

    - Virtio Host (VHOST) subsystem;

    - Framebuffer layer;

    - BTRFS file system;

    - File systems infrastructure;

    - Ceph distributed file system;

    - Ext4 file system;

    - F2FS file system;

    - FAT file system;

    - GFS2 file system;

    - HFS+ file system;

    - JFS file system;

    - Network file system (NFS) server daemon;

    - NILFS2 file system;

    - NTFS3 file system;

    - OCFS2 file system;

    - Proc file system;

    - Pstore file system;

    - Diskquota system;

    - SMB network file system;

    - XFS file system;

    - Audit subsystem;

    - Memory Management;

    - IPv6 networking;

    - Netfilter;

    - Tracing infrastructure;

    - Kernel kexec() syscall;

    - RCU subsystem;

    - Scheduler infrastructure;

    - Scatterlist API;

    - 9P file system network protocol;

    - Asynchronous Transfer Mode (ATM) subsystem;

    - B.A.T.M.A.N. meshing protocol;

    - Bluetooth subsystem;

    - Ethernet bridge;

    - Ceph Core library;

    - Networking core;

    - IPv4 networking;

    - KCM (Kernel Connection Multiplexor) sockets driver;

    - Multipath TCP;

    - NFC subsystem;

    - RDS protocol;

    - RxRPC session sockets;

    - Network traffic control;

    - SMC sockets;

    - Sun RPC protocol;

    - X.25 network layer;

    - XFRM subsystem;

    - AppArmor security module;

    - Simplified Mandatory Access Control Kernel framework;

    - SOF drivers;

    - USB sound devices; (CVE-2025-40005, CVE-2025-71229, CVE-2025-71231, CVE-2025-71232, CVE-2025-71233,     CVE-2025-71235, CVE-2025-71236, CVE-2025-71237, CVE-2025-71238, CVE-2025-71239, CVE-2025-71265,     CVE-2025-71266, CVE-2025-71267, CVE-2025-71272, CVE-2025-71273, CVE-2025-71274, CVE-2025-71286,     CVE-2025-71291, CVE-2025-71292, CVE-2025-71294, CVE-2025-71295, CVE-2025-71297, CVE-2025-71304,     CVE-2025-71305, CVE-2026-23100, CVE-2026-23169, CVE-2026-23220, CVE-2026-23221, CVE-2026-23222,     CVE-2026-23228, CVE-2026-23229, CVE-2026-23230, CVE-2026-23233, CVE-2026-23234, CVE-2026-23235,     CVE-2026-23236, CVE-2026-23237, CVE-2026-23238, CVE-2026-23241, CVE-2026-23242, CVE-2026-23243,     CVE-2026-23249, CVE-2026-23266, CVE-2026-23267, CVE-2026-23272, CVE-2026-23278, CVE-2026-23392,     CVE-2026-23428, CVE-2026-23450, CVE-2026-23455, CVE-2026-31402, CVE-2026-31411, CVE-2026-31418,     CVE-2026-31436, CVE-2026-31448, CVE-2026-31478, CVE-2026-31607, CVE-2026-31637, CVE-2026-31649,     CVE-2026-31657, CVE-2026-31659, CVE-2026-31668, CVE-2026-31669, CVE-2026-31676, CVE-2026-31682,     CVE-2026-31685, CVE-2026-31687, CVE-2026-31693, CVE-2026-43011, CVE-2026-43037, CVE-2026-43038,     CVE-2026-43071, CVE-2026-43114, CVE-2026-43117, CVE-2026-43123, CVE-2026-43124, CVE-2026-43128,     CVE-2026-43130, CVE-2026-43132, CVE-2026-43133, CVE-2026-43134, CVE-2026-43135, CVE-2026-43136,     CVE-2026-43137, CVE-2026-43139, CVE-2026-43140, CVE-2026-43141, CVE-2026-43143, CVE-2026-43145,     CVE-2026-43147, CVE-2026-43148, CVE-2026-43149, CVE-2026-43150, CVE-2026-43152, CVE-2026-43153,     CVE-2026-43156, CVE-2026-43157, CVE-2026-43158, CVE-2026-43159, CVE-2026-43163, CVE-2026-43167,     CVE-2026-43168, CVE-2026-43169, CVE-2026-43170, CVE-2026-43171, CVE-2026-43173, CVE-2026-43175,     CVE-2026-43180, CVE-2026-43182, CVE-2026-43183, CVE-2026-43184, CVE-2026-43186, CVE-2026-43187,     CVE-2026-43189, CVE-2026-43190, CVE-2026-43194, CVE-2026-43196, CVE-2026-43199, CVE-2026-43200,     CVE-2026-43201, CVE-2026-43202, CVE-2026-43203, CVE-2026-43205, CVE-2026-43206, CVE-2026-43207,     CVE-2026-43209, CVE-2026-43211, CVE-2026-43212, CVE-2026-43214, CVE-2026-43215, CVE-2026-43218,     CVE-2026-43221, CVE-2026-43222, CVE-2026-43223, CVE-2026-43225, CVE-2026-43226, CVE-2026-43227,     CVE-2026-43230, CVE-2026-43231, CVE-2026-43232, CVE-2026-43233, CVE-2026-43236, CVE-2026-43238,     CVE-2026-43239, CVE-2026-43241, CVE-2026-43242, CVE-2026-43244, CVE-2026-43246, CVE-2026-43248,     CVE-2026-43249, CVE-2026-43250, CVE-2026-43251, CVE-2026-43253, CVE-2026-43255, CVE-2026-43256,     CVE-2026-43257, CVE-2026-43258, CVE-2026-43261, CVE-2026-43262, CVE-2026-43264, CVE-2026-43266,     CVE-2026-43268, CVE-2026-43269, CVE-2026-43270, CVE-2026-43271, CVE-2026-43273, CVE-2026-43275,     CVE-2026-43277, CVE-2026-43278, CVE-2026-43279, CVE-2026-43283, CVE-2026-43287, CVE-2026-43288,     CVE-2026-43289, CVE-2026-43291, CVE-2026-43295, CVE-2026-43296, CVE-2026-43297, CVE-2026-43300,     CVE-2026-43302, CVE-2026-43304, CVE-2026-43312, CVE-2026-43313, CVE-2026-43314, CVE-2026-43315,     CVE-2026-43316, CVE-2026-43317, CVE-2026-43318, CVE-2026-43319, CVE-2026-43320, CVE-2026-43341,     CVE-2026-43378, CVE-2026-43383, CVE-2026-43384, CVE-2026-43406, CVE-2026-43407, CVE-2026-43414,     CVE-2026-43493, CVE-2026-43494, CVE-2026-43501, CVE-2026-45847, CVE-2026-45848, CVE-2026-45849,     CVE-2026-45851, CVE-2026-45852, CVE-2026-45856, CVE-2026-45857, CVE-2026-45859, CVE-2026-45860,     CVE-2026-45861, CVE-2026-45862, CVE-2026-45864, CVE-2026-45865, CVE-2026-45866, CVE-2026-45867,     CVE-2026-45868, CVE-2026-45869, CVE-2026-45870, CVE-2026-45871, CVE-2026-45872, CVE-2026-45873,     CVE-2026-45875, CVE-2026-45877, CVE-2026-45878, CVE-2026-45879, CVE-2026-45880, CVE-2026-45881,     CVE-2026-45882, CVE-2026-45883, CVE-2026-45884, CVE-2026-45885, CVE-2026-45886, CVE-2026-45890,     CVE-2026-45891, CVE-2026-45893, CVE-2026-45895, CVE-2026-45902, CVE-2026-45904, CVE-2026-45905,     CVE-2026-45910, CVE-2026-45912, CVE-2026-45913, CVE-2026-45914, CVE-2026-45915, CVE-2026-45916,     CVE-2026-45917, CVE-2026-45919, CVE-2026-45921, CVE-2026-45923, CVE-2026-45928, CVE-2026-45935,     CVE-2026-45936, CVE-2026-45938, CVE-2026-45941, CVE-2026-45946, CVE-2026-45947, CVE-2026-45948,     CVE-2026-45954, CVE-2026-45957, CVE-2026-45960, CVE-2026-45962, CVE-2026-45964, CVE-2026-45965,     CVE-2026-45968, CVE-2026-45969, CVE-2026-45970, CVE-2026-45972, CVE-2026-45973, CVE-2026-45974,     CVE-2026-45976, CVE-2026-45978, CVE-2026-45981, CVE-2026-45982, CVE-2026-45983, CVE-2026-45984,     CVE-2026-45988, CVE-2026-46043, CVE-2026-46115, CVE-2026-46119, CVE-2026-46135, CVE-2026-46185,     CVE-2026-46195, CVE-2026-46243, CVE-2026-46244, CVE-2026-46246, CVE-2026-46247, CVE-2026-46249,     CVE-2026-46250, CVE-2026-46251, CVE-2026-46253, CVE-2026-46254, CVE-2026-46255, CVE-2026-46259,     CVE-2026-46260, CVE-2026-46261, CVE-2026-46265, CVE-2026-46266, CVE-2026-46267, CVE-2026-46270,     CVE-2026-46289, CVE-2026-46323, CVE-2026-46328)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1514 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    btrfs: fix reservation leak in some error paths when inserting inline extent (CVE-2025-71268)

    In the Linux kernel, the following vulnerability has been resolved:

    btrfs: do not free data reservation in fallback from inline due to -ENOSPC (CVE-2025-71269)

    In the Linux kernel, the following vulnerability has been resolved:

    smack: /smack/doi: accept previously used values (CVE-2025-71304)

    In the Linux kernel, the following vulnerability has been resolved:

    fs/ntfs3: Initialize new folios before use (CVE-2025-71311)

    In the Linux kernel, the following vulnerability has been resolved:

    RDMA/umad: Reject negative data_len in ib_umad_write (CVE-2026-23243)

    In the Linux kernel, the following vulnerability has been resolved:

    net: gro: fix outer network offset (CVE-2026-23254)

    In the Linux kernel, the following vulnerability has been resolved:

    net: add proper RCU protection to /proc/net/ptype (CVE-2026-23255)

    In the Linux kernel, the following vulnerability has been resolved:

    io_uring/rw: free potentially allocated iovec on cache put failure (CVE-2026-23259)

    In the Linux kernel, the following vulnerability has been resolved:

    regmap: maple: free entry on mas_store_gfp() failure (CVE-2026-23260)

    In the Linux kernel, the following vulnerability has been resolved:

    io_uring/zcrx: fix page array leak (CVE-2026-23263)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: nft_set_rbtree: validate open interval overlap (CVE-2026-23333)

    In the Linux kernel, the following vulnerability has been resolved:

    tracing/dma: Cap dma_map_sg tracepoint arrays to prevent buffer overflow (CVE-2026-23390)

    In the Linux kernel, the following vulnerability has been resolved:

    smb: client: make use of smbdirect_socket.recv_io.credits.available (CVE-2026-31535)

    In the Linux kernel, the following vulnerability has been resolved:

    smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (CVE-2026-31539)

    In the Linux kernel, the following vulnerability has been resolved:

    driver core: enforce device_lock for driver_match_device() (CVE-2026-31688)

    In the Linux kernel, the following vulnerability has been resolved:

    ACPI: processor: Update cpuidle driver check in __acpi_processor_start() (CVE-2026-43122)

    In the Linux kernel, the following vulnerability has been resolved:

    cpufreq: intel_pstate: Fix NULL pointer dereference in update_cpu_qos_request() (CVE-2026-43401)

    In the Linux kernel, the following vulnerability has been resolved:

    net: remove WARN_ON_ONCE when accessing forward path array (CVE-2026-45847)

    In the Linux kernel, the following vulnerability has been resolved:

    efi: Fix reservation of unaccepted memory table (CVE-2026-45851)

    In the Linux kernel, the following vulnerability has been resolved:

    ata: libata-scsi: avoid Non-NCQ command starvation (CVE-2026-45855)

    In the Linux kernel, the following vulnerability has been resolved:

    RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CVE-2026-45856)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: don't zero the entire extent if EXT4_EXT_DATA_PARTIAL_VALID1 (CVE-2026-45858)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: nfnetlink_queue: do shared-unconfirmed check before segmentation (CVE-2026-45859)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: nf_conncount: increase the connection clean up limit to 64 (CVE-2026-45860)

    In the Linux kernel, the following vulnerability has been resolved:

    iommu/vt-d: Flush cache for PASID table before using it (CVE-2026-45862)

    In the Linux kernel, the following vulnerability has been resolved:

    fs/ntfs3: prevent infinite loops caused by the next valid being the same (CVE-2026-45864)

    In the Linux kernel, the following vulnerability has been resolved:

    SUNRPC: auth_gss: fix memory leaks in XDR decoding error paths (CVE-2026-45870)

    In the Linux kernel, the following vulnerability has been resolved:

    scsi: smartpqi: Fix memory leak in pqi_report_phys_luns() (CVE-2026-45872)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: nft_set_rbtree: check for partial overlaps in anonymous sets (CVE-2026-45873)

    In the Linux kernel, the following vulnerability has been resolved:

    arm64/gcs: Fix error handling in arch_set_shadow_stack_status() (CVE-2026-45876)

    In the Linux kernel, the following vulnerability has been resolved:

    PCI/P2PDMA: Release per-CPU pgmap ref when vm_insert_page() fails (CVE-2026-45880)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf: Fix bpf_xdp_store_bytes proto for read-only arg (CVE-2026-45886)

    In the Linux kernel, the following vulnerability has been resolved:

    af_unix: Fix memleak of newsk in unix_stream_connect(). (CVE-2026-45887)

    In the Linux kernel, the following vulnerability has been resolved:

    md/raid1: fix memory leak in raid1_run() (CVE-2026-45888)

    In the Linux kernel, the following vulnerability has been resolved:

    mptcp: do not account for OoO in mptcp_rcvbuf_grow() (CVE-2026-45889)

    In the Linux kernel, the following vulnerability has been resolved:

    xen-netback: reject zero-queue configuration from guest (CVE-2026-45890)

    In the Linux kernel, the following vulnerability has been resolved:

    iommu/vt-d: Clear Present bit before tearing down PASID entry (CVE-2026-45894)

    In the Linux kernel, the following vulnerability has been resolved:

    quota: fix livelock between quotactl and freeze_super (CVE-2026-45895)

    In the Linux kernel, the following vulnerability has been resolved:

    RDMA/iwcm: Fix workqueue list corruption by removing work_list (CVE-2026-45898)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: drop extent cache when splitting extent fails (CVE-2026-45899)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf: Fix memory access flags in helper prototypes (CVE-2026-45903)

    In the Linux kernel, the following vulnerability has been resolved:

    xfrm: fix ip_rt_bug race in icmp_route_lookup reverse path (CVE-2026-45905)

    In the Linux kernel, the following vulnerability has been resolved:

    net/mlx5e: Fix deadlocks between devlink and netdev instance locks (CVE-2026-45907)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: don't cache extent during splitting extent (CVE-2026-45912)

    In the Linux kernel, the following vulnerability has been resolved:

    net: bridge: mcast: always update mdb_n_entries for vlan contexts (CVE-2026-45913)

    In the Linux kernel, the following vulnerability has been resolved:

    fat: avoid parent link count underflow in rmdir (CVE-2026-45915)

    In the Linux kernel, the following vulnerability has been resolved:

    ipvs: do not keep dest_dst if dev is going down (CVE-2026-45917)

    In the Linux kernel, the following vulnerability has been resolved:

    ovpn: tcp - don't deref NULL sk_socket member after tcp_close() (CVE-2026-45918)

    In the Linux kernel, the following vulnerability has been resolved:

    sched/rt: Skip currently executing CPU in rto_next_cpu() (CVE-2026-45919)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: fix dirtyclusters double decrement on fs shutdown (CVE-2026-45920)

    In the Linux kernel, the following vulnerability has been resolved:

    RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (CVE-2026-45922)

    In the Linux kernel, the following vulnerability has been resolved:

    thermal/of: Fix reference leak in thermal_of_cm_lookup() (CVE-2026-45925)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf: Require frozen map for calculating map hash (CVE-2026-45927)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf: Fix tcx/netkit detach permissions when prog fd isn't given (CVE-2026-45932)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf: Preserve id of register in sync_linked_regs() (CVE-2026-45933)

    In the Linux kernel, the following vulnerability has been resolved:

    btrfs: fix EEXIST abort due to non-consecutive gaps in chunk allocation (CVE-2026-45934)

    In the Linux kernel, the following vulnerability has been resolved:

    fs/ntfs3: Fix slab-out-of-bounds read in DeleteIndexEntryRoot (CVE-2026-45935)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: fix e4b bitmap inconsistency reports (CVE-2026-45942)

    In the Linux kernel, the following vulnerability has been resolved:

    erofs: fix inline data read failure for ztailpacking pclusters (CVE-2026-45943)

    In the Linux kernel, the following vulnerability has been resolved:

    iommu/vt-d: Clear Present bit before tearing down context entry (CVE-2026-45944)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: fix memory leak in ext4_ext_shift_extents() (CVE-2026-45948)

    In the Linux kernel, the following vulnerability has been resolved:

    hwrng: core - use RCU and work_struct to fix race condition (CVE-2026-45949)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf: Fix a potential use-after-free of BTF object (CVE-2026-45951)

    In the Linux kernel, the following vulnerability has been resolved:

    md/raid5: fix IO hang with degraded array with llbitmap (CVE-2026-45953)

    In the Linux kernel, the following vulnerability has been resolved:

    md/md-llbitmap: fix percpu_ref not resurrected on suspend timeout (CVE-2026-45955)

    In the Linux kernel, the following vulnerability has been resolved:

    rcu: Fix rcu_read_unlock() deadloop due to softirq (CVE-2026-45957)

    In the Linux kernel, the following vulnerability has been resolved:

    SUNRPC: fix gss_auth kref leak in gss_alloc_msg error path (CVE-2026-45964)

    In the Linux kernel, the following vulnerability has been resolved:

    cpuidle: Skip governor when only one idle state is available (CVE-2026-45968)

    In the Linux kernel, the following vulnerability has been resolved:

    bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CVE-2026-45970)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf: Limit bpf program signature size (CVE-2026-45971)

    In the Linux kernel, the following vulnerability has been resolved:

    RDMA/mlx5: Fix UMR hang in LAG error state unload (CVE-2026-45973)

    In the Linux kernel, the following vulnerability has been resolved:

    btrfs: fix invalid leaf access in btrfs_quota_enable() if ref key not found (CVE-2026-45974)

    In the Linux kernel, the following vulnerability has been resolved:

    ACPICA: Fix NULL pointer dereference in acpi_ev_address_space_dispatch() (CVE-2026-45982)

    In the Linux kernel, the following vulnerability has been resolved:

    nfsd: never defer requests during idmap lookup (CVE-2026-45983)

    In the Linux kernel, the following vulnerability has been resolved:

    btrfs: fix block_group_tree dirty_list corruption (CVE-2026-46251)

    In the Linux kernel, the following vulnerability has been resolved:

    pstore/ram: fix buffer overflow in persistent_ram_save_old() (CVE-2026-46253)

    In the Linux kernel, the following vulnerability has been resolved:

    NFS/localio: prevent direct reclaim recursion into NFS via nfs_writepages (CVE-2026-46256)

    In the Linux kernel, the following vulnerability has been resolved:

    procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CVE-2026-46259)

    In the Linux kernel, the following vulnerability has been resolved:

    inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (CVE-2026-46266)

    In the Linux kernel, the following vulnerability has been resolved:

    dm: fix unlocked test for dm_suspended_md (CVE-2026-46327)

    In the Linux kernel, the following vulnerability has been resolved:

    apparmor: fix rlimit for posix cpu timers (CVE-2026-46328)

    In the Linux kernel, the following vulnerability has been resolved:

    erofs: handle end of filesystem properly for file-backed mounts (CVE-2026-46329)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 22.04 LTS / 24.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-8492-1 advisory.

    Several security issues were discovered in the Linux kernel. An attacker could possibly use these to     compromise the system. This update corrects flaws in the following subsystems:

    - ARM64 architecture;

    - MIPS architecture;

    - PowerPC architecture;

    - x86 architecture;

    - Block layer subsystem;

    - Cryptographic API;

    - ACPI drivers;

    - ATM drivers;

    - RNBD block device driver;

    - Ublk userspace block driver;

    - Bus devices;

    - Character device driver;

    - TPM device driver;

    - Clock framework and drivers;

    - Clocksource drivers;

    - CPU idle management framework;

    - Hardware crypto device drivers;

    - DMA engine subsystem;

    - EFI core;

    - GPIO subsystem;

    - GPU drivers;

    - HID subsystem;

    - Hardware monitoring drivers;

    - IIO subsystem;

    - InfiniBand drivers;

    - IOMMU subsystem;

    - Multiple devices driver;

    - Media drivers;

    - Multifunction device drivers;

    - Broadcom VK accelerator driver;

    - MOST (Media Oriented Systems Transport) drivers;

    - MTD block device drivers;

    - Ethernet bonding driver;

    - Network drivers;

    - Mellanox network drivers;

    - STMicroelectronics network drivers;

    - NTB driver;

    - NVME drivers;

    - PCI subsystem;

    - Performance monitor drivers;

    - Pin controllers subsystem;

    - x86 platform drivers;

    - Power supply drivers;

    - RapidIO drivers;

    - RAS (Reliability, Availability, Serviceability) subsystem;

    - Remote Processor subsystem;

    - RPMSG subsystem;

    - S/390 drivers;

    - SCSI subsystem;

    - MediaTek SoC drivers;

    - Texas Instruments SoC drivers;

    - SPI subsystem;

    - Greybus lights staging drivers;

    - Realtek RTL8723BS SDIO drivers;

    - UFS subsystem;

    - ChipIdea USB driver;

    - DesignWare USB3 driver;

    - USB over IP driver;

    - vDPA drivers;

    - Virtio Host (VHOST) subsystem;

    - Framebuffer layer;

    - BTRFS file system;

    - File systems infrastructure;

    - Ceph distributed file system;

    - Ext4 file system;

    - F2FS file system;

    - FAT file system;

    - GFS2 file system;

    - HFS+ file system;

    - JFS file system;

    - Network file system (NFS) server daemon;

    - NILFS2 file system;

    - NTFS3 file system;

    - OCFS2 file system;

    - Proc file system;

    - Pstore file system;

    - Diskquota system;

    - SMB network file system;

    - XFS file system;

    - Audit subsystem;

    - Memory Management;

    - IPv6 networking;

    - Netfilter;

    - Tracing infrastructure;

    - Kernel kexec() syscall;

    - RCU subsystem;

    - Scheduler infrastructure;

    - Scatterlist API;

    - 9P file system network protocol;

    - Asynchronous Transfer Mode (ATM) subsystem;

    - B.A.T.M.A.N. meshing protocol;

    - Bluetooth subsystem;

    - Ethernet bridge;

    - Ceph Core library;

    - Networking core;

    - IPv4 networking;

    - KCM (Kernel Connection Multiplexor) sockets driver;

    - Multipath TCP;

    - NFC subsystem;

    - RDS protocol;

    - RxRPC session sockets;

    - Network traffic control;

    - SMC sockets;

    - Sun RPC protocol;

    - X.25 network layer;

    - XFRM subsystem;

    - AppArmor security module;

    - Simplified Mandatory Access Control Kernel framework;

    - SOF drivers;

    - USB sound devices; (CVE-2025-40005, CVE-2025-71229, CVE-2025-71231, CVE-2025-71232, CVE-2025-71233,     CVE-2025-71235, CVE-2025-71236, CVE-2025-71237, CVE-2025-71238, CVE-2025-71239, CVE-2025-71265,     CVE-2025-71266, CVE-2025-71267, CVE-2025-71272, CVE-2025-71273, CVE-2025-71274, CVE-2025-71286,     CVE-2025-71291, CVE-2025-71292, CVE-2025-71294, CVE-2025-71295, CVE-2025-71297, CVE-2025-71304,     CVE-2025-71305, CVE-2026-23100, CVE-2026-23169, CVE-2026-23220, CVE-2026-23221, CVE-2026-23222,     CVE-2026-23228, CVE-2026-23229, CVE-2026-23230, CVE-2026-23233, CVE-2026-23234, CVE-2026-23235,     CVE-2026-23236, CVE-2026-23237, CVE-2026-23238, CVE-2026-23241, CVE-2026-23242, CVE-2026-23243,     CVE-2026-23249, CVE-2026-23266, CVE-2026-23267, CVE-2026-23272, CVE-2026-23278, CVE-2026-23392,     CVE-2026-23428, CVE-2026-23450, CVE-2026-23455, CVE-2026-31402, CVE-2026-31411, CVE-2026-31418,     CVE-2026-31436, CVE-2026-31448, CVE-2026-31478, CVE-2026-31607, CVE-2026-31637, CVE-2026-31649,     CVE-2026-31657, CVE-2026-31659, CVE-2026-31668, CVE-2026-31669, CVE-2026-31682, CVE-2026-31685,     CVE-2026-31687, CVE-2026-31693, CVE-2026-43011, CVE-2026-43037, CVE-2026-43038, CVE-2026-43071,     CVE-2026-43114, CVE-2026-43117, CVE-2026-43123, CVE-2026-43124, CVE-2026-43128, CVE-2026-43130,     CVE-2026-43132, CVE-2026-43133, CVE-2026-43134, CVE-2026-43135, CVE-2026-43136, CVE-2026-43137,     CVE-2026-43139, CVE-2026-43140, CVE-2026-43141, CVE-2026-43143, CVE-2026-43145, CVE-2026-43147,     CVE-2026-43148, CVE-2026-43149, CVE-2026-43150, CVE-2026-43152, CVE-2026-43153, CVE-2026-43156,     CVE-2026-43157, CVE-2026-43158, CVE-2026-43159, CVE-2026-43163, CVE-2026-43167, CVE-2026-43168,     CVE-2026-43169, CVE-2026-43170, CVE-2026-43171, CVE-2026-43173, CVE-2026-43175, CVE-2026-43180,     CVE-2026-43182, CVE-2026-43183, CVE-2026-43184, CVE-2026-43186, CVE-2026-43187, CVE-2026-43189,     CVE-2026-43190, CVE-2026-43194, CVE-2026-43196, CVE-2026-43199, CVE-2026-43200, CVE-2026-43201,     CVE-2026-43202, CVE-2026-43203, CVE-2026-43205, CVE-2026-43206, CVE-2026-43207, CVE-2026-43209,     CVE-2026-43211, CVE-2026-43212, CVE-2026-43214, CVE-2026-43215, CVE-2026-43218, CVE-2026-43221,     CVE-2026-43222, CVE-2026-43223, CVE-2026-43225, CVE-2026-43226, CVE-2026-43227, CVE-2026-43230,     CVE-2026-43231, CVE-2026-43232, CVE-2026-43233, CVE-2026-43236, CVE-2026-43238, CVE-2026-43239,     CVE-2026-43241, CVE-2026-43242, CVE-2026-43244, CVE-2026-43246, CVE-2026-43248, CVE-2026-43249,     CVE-2026-43250, CVE-2026-43251, CVE-2026-43253, CVE-2026-43255, CVE-2026-43256, CVE-2026-43257,     CVE-2026-43258, CVE-2026-43261, CVE-2026-43262, CVE-2026-43264, CVE-2026-43266, CVE-2026-43268,     CVE-2026-43269, CVE-2026-43270, CVE-2026-43271, CVE-2026-43273, CVE-2026-43275, CVE-2026-43277,     CVE-2026-43278, CVE-2026-43279, CVE-2026-43283, CVE-2026-43287, CVE-2026-43288, CVE-2026-43289,     CVE-2026-43291, CVE-2026-43295, CVE-2026-43296, CVE-2026-43297, CVE-2026-43300, CVE-2026-43302,     CVE-2026-43304, CVE-2026-43312, CVE-2026-43313, CVE-2026-43314, CVE-2026-43315, CVE-2026-43316,     CVE-2026-43317, CVE-2026-43318, CVE-2026-43319, CVE-2026-43320, CVE-2026-43341, CVE-2026-43378,     CVE-2026-43383, CVE-2026-43384, CVE-2026-43406, CVE-2026-43407, CVE-2026-43414, CVE-2026-43493,     CVE-2026-43501, CVE-2026-45847, CVE-2026-45848, CVE-2026-45849, CVE-2026-45851, CVE-2026-45852,     CVE-2026-45856, CVE-2026-45857, CVE-2026-45859, CVE-2026-45860, CVE-2026-45861, CVE-2026-45862,     CVE-2026-45864, CVE-2026-45865, CVE-2026-45866, CVE-2026-45867, CVE-2026-45868, CVE-2026-45869,     CVE-2026-45870, CVE-2026-45871, CVE-2026-45872, CVE-2026-45873, CVE-2026-45875, CVE-2026-45877,     CVE-2026-45878, CVE-2026-45879, CVE-2026-45880, CVE-2026-45881, CVE-2026-45882, CVE-2026-45883,     CVE-2026-45884, CVE-2026-45885, CVE-2026-45886, CVE-2026-45890, CVE-2026-45891, CVE-2026-45893,     CVE-2026-45895, CVE-2026-45902, CVE-2026-45904, CVE-2026-45905, CVE-2026-45910, CVE-2026-45912,     CVE-2026-45913, CVE-2026-45914, CVE-2026-45915, CVE-2026-45916, CVE-2026-45917, CVE-2026-45919,     CVE-2026-45921, CVE-2026-45923, CVE-2026-45928, CVE-2026-45935, CVE-2026-45936, CVE-2026-45938,     CVE-2026-45941, CVE-2026-45946, CVE-2026-45947, CVE-2026-45948, CVE-2026-45954, CVE-2026-45957,     CVE-2026-45960, CVE-2026-45962, CVE-2026-45964, CVE-2026-45965, CVE-2026-45968, CVE-2026-45969,     CVE-2026-45970, CVE-2026-45972, CVE-2026-45973, CVE-2026-45974, CVE-2026-45976, CVE-2026-45978,     CVE-2026-45981, CVE-2026-45982, CVE-2026-45983, CVE-2026-45984, CVE-2026-45988, CVE-2026-46043,     CVE-2026-46115, CVE-2026-46119, CVE-2026-46135, CVE-2026-46185, CVE-2026-46195, CVE-2026-46243,     CVE-2026-46244, CVE-2026-46246, CVE-2026-46247, CVE-2026-46249, CVE-2026-46250, CVE-2026-46251,     CVE-2026-46253, CVE-2026-46254, CVE-2026-46255, CVE-2026-46259, CVE-2026-46260, CVE-2026-46261,     CVE-2026-46265, CVE-2026-46266, CVE-2026-46267, CVE-2026-46270, CVE-2026-46289, CVE-2026-46328)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 10 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-50372 advisory.

    - net/sched: fix pedit partial COW leading to page cache corruption (Rajat Gupta)   {CVE-2026-46331}
    - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Christian Brauner)  [Orabug: 39668743]     {CVE-2026-46242}
    - net: skbuff: fix missing zerocopy reference in pskb_carve helpers (Minh Nguyen)  [Orabug: 39656679]     {CVE-2026-52943}
    - arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Rutland)  [Orabug: 39548792]     {CVE-2025-10263}
    - openvswitch: vport: fix self-deadlock on release of tunnel ports (Ilya Maximets) {CVE-2026-46165}
    - iommu/amd: serialize sequence allocation under concurrent TLB invalidations (Ankit Soni)     {CVE-2026-43220}
    - usb: ulpi: fix memory leak on ulpi_register() error paths (Felix Gu) {CVE-2026-46109}
    - smb: client: reject userspace cifs.spnego descriptions (Asim Viladi Oglu Manizada)  [Orabug: 39463671]     {CVE-2026-46243}
    - net: skbuff: propagate shared-frag marker through frag-transfer helpers (Hyunwoo Kim) [Orabug:
    39368826,39441323] {CVE-2026-43503,CVE-2026-46300}
    - net: skbuff: preserve shared-frag marker during coalescing (William Bowling) [Orabug: 39368826]     {CVE-2026-46300}
    - netfilter: reject zero shift in nft_bitwise (Kai Ma) [Orabug: 39452464] {CVE-2026-46101}
    - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Andrea Mayer) [Orabug: 39452457]     {CVE-2026-46099}
    - ALSA: caiaq: fix usb_dev refcount leak on probe failure (Deepanshu Kartikey) [Orabug: 39452739]     {CVE-2026-46048}
    - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Greg Kroah-Hartman) [Orabug: 39426003]     {CVE-2026-43501}
    - ALSA: caiaq: Fix potentially leftover ep1_in_urb at error path (Takashi Iwai) [Orabug: 39452746]     {CVE-2026-45992}
    - net: bonding: fix use-after-free in bond_xmit_broadcast() (Xiang Mei) [Orabug: 39205989]     {CVE-2026-31419}
    - crypto: authencesn - reject short ahash digests during instance creation (Yucheng Lu) [Orabug: 39452231]     {CVE-2026-46033}
    - spi: fix resource leaks on device setup failure (Johan Hovold) [Orabug: 39452400] {CVE-2026-46083}
    - net: qrtr: ns: Limit the total number of nodes (Manivannan Sadhasivam) [Orabug: 39452123]     {CVE-2026-46003}
    - net: bridge: use a stable FDB dst snapshot in RCU readers (Zhengchuan Liang) [Orabug: 39452411]     {CVE-2026-46086}
    - net: qrtr: ns: Limit the maximum number of lookups (Manivannan Sadhasivam) [Orabug: 39452207]     {CVE-2026-46026}
    - net: qrtr: ns: Limit the maximum server registration per node (Manivannan Sadhasivam) [Orabug: 39410851]     {CVE-2026-43491}
    - RDMA/mana_ib: Disable RX steering on RSS QP destroy (Long Li) [Orabug: 39452406] {CVE-2026-46084}
    - media: rc: igorplugusb: heed coherency rules (Oliver Neukum) [Orabug: 39452432] {CVE-2026-46091}
    - wifi: mwifiex: fix use-after-free in mwifiex_adapter_cleanup() (Daniel Hodges) [Orabug: 39452343]     {CVE-2026-46069}
    - thermal: core: Fix thermal zone governor cleanup issues (Rafael J. Wysocki) [Orabug: 39452186]     {CVE-2026-46021}
    - smb: client: validate the whole DACL before rewriting it in cifsacl (Michael Bommarito) [Orabug:
    39300611] {CVE-2026-31709}
    - scsi: sd: fix missing put_disk() when device_add(&disk_dev) fails (Yang Xiuwei) [Orabug: 39452100]     {CVE-2026-45997}
    - rtmutex: Use waiter::task instead of current in remove_waiter() (Keenan Dong) [Orabug: 39425998]     {CVE-2026-43499}
    - ceph: only d_add() negative dentries when they are unhashed (Max Kellermann) [Orabug: 39452291]     {CVE-2026-46052}
    - dm mirror: fix integer overflow in create_dirty_log() (Junrui Luo) [Orabug: 39452196] {CVE-2026-46023}
    - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (Shuvam Pandey) [Orabug: 39452304]     {CVE-2026-46056}
    - tcp: call sk_data_ready() after listener migration (Zhenzhong Wu) [Orabug: 39452159] {CVE-2026-46015}
    - inotify: fix watch count leak when fsnotify_add_inode_mark_locked() fails (Chia-Ming Chang) [Orabug:
    39452250] {CVE-2026-46040}
    - md/raid5: validate payload size before accessing journal metadata (Junrui Luo) [Orabug: 39452349]     {CVE-2026-46070}
    - md/raid5: fix soft lockup in retry_aligned_read() (Chia-Ming Chang) [Orabug: 39452287] {CVE-2026-46051}
    - ext4: fix missing brelse() in ext4_xattr_inode_dec_ref_all() (Sohei Koyama) [Orabug: 39452269]     {CVE-2026-46046}
    - ext4: fix bounds check in check_xattrs() to prevent out-of-bounds access (Deepanshu Kartikey) [Orabug:
    39452442] {CVE-2026-46094}
    - io_uring/poll: fix multishot recv missing EOF on wakeup race (Jens Axboe) {CVE-2026-23473}
    - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Kevin Cheng) [Orabug: 39452372]     {CVE-2026-46076}
    - KVM: SVM: Inject #UD for INVLPGA if EFER.SVME=0 (Kevin Cheng) [Orabug: 39452394] {CVE-2026-46082}
    - KVM: nSVM: Sync interrupt shadow to cached vmcb12 after VMRUN of L2 (Yosry Ahmed) [Orabug: 39452061]     {CVE-2026-45987}
    - xfs: fix a resource leak in xfs_alloc_buftarg() (Haoxiang Li) [Orabug: 39452131] {CVE-2026-46005}
    - libceph: Prevent potential null-ptr-deref in ceph_handle_auth_reply() (Raphael Zimmer) [Orabug:
    39452201] {CVE-2026-46024}
    - ipv4: icmp: validate reply type before using icmp_pointers (Ruide Cao) [Orabug: 39452243]     {CVE-2026-46037}
    - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Hkbinbin) [Orabug: 39452259]     {CVE-2026-46043}
    - net: qrtr: ns: Free the node during ctrl_cmd_bye() (Manivannan Sadhasivam) [Orabug: 39452246]     {CVE-2026-46038}
    - rxrpc: Fix rxkad crypto unalignment handling (David Howells) [Orabug: 39452728] {CVE-2026-46085}
    - ALSA: caiaq: Handle probe errors properly (Takashi Iwai) [Orabug: 39452126] {CVE-2026-46004}
    - rbd: fix null-ptr-deref when device_add_disk() fails (Dawei Feng) [Orabug: 39452385] {CVE-2026-46079}
    - md/raid10: fix deadlock with check operation and nowait requests (Josh Hunt) [Orabug: 39452284]     {CVE-2026-46050}
    - jbd2: fix deadlock in jbd2_journal_cancel_revoke() (Zhang Yi) [Orabug: 39452318] {CVE-2026-46061}
    - erofs: fix the out-of-bounds nameoff handling for trailing dirents (Gao Xiang) [Orabug: 39452380]     {CVE-2026-46078}
    - ALSA: ctxfi: Add fallback to default RSR for S/PDIF (Harin Lee) [Orabug: 39452280] {CVE-2026-46049}
    - ext2: reject inodes with zero i_nlink and valid mode in ext2_iget() (Vasiliy Kovalev) [Orabug: 39452119]     {CVE-2026-46002}
    - net: qrtr: ns: Fix use-after-free in driver remove() (Manivannan Sadhasivam) [Orabug: 39452274]     {CVE-2026-46047}
    - net: strparser: fix skb_head leak in strp_abort_strp() (Luxiao Xu) [Orabug: 39452468] {CVE-2026-46102}
    - ALSA: control: Validate buf_len before strnlen() in snd_ctl_elem_init_enum_names() (Ziqing Chen)     [Orabug: 39452416] {CVE-2026-46088}
    - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Herbert Xu) [Orabug: 39410863] {CVE-2026-43493}
    - wifi: rtw88: check for PCI upstream bridge existence (Fedor Pchelkin) [Orabug: 39452437]     {CVE-2026-46092}
    - zram: do not forget to endio for partial discard requests (Sergey Senozhatsky) [Orabug: 39452420]     {CVE-2026-46089}
    - ocfs2: split transactions in dio completion to avoid credit exhaustion (Heming Zhao) [Orabug: 39452388]     {CVE-2026-46080}
    - drm/amdgpu: Limit BO list entry count to prevent resource exhaustion (Jesse Zhang) [Orabug: 39167551]     {CVE-2026-23468}
    - padata: Fix pd UAF once and for all (Herbert Xu) [Orabug: 38335055] {CVE-2025-38584}
    - drm/nouveau: fix u32 overflow in pushbuf reloc bounds check (Greg Kroah-Hartman) [Orabug: 39452133]     {CVE-2026-46006}
    - ALSA: usb-audio: stop parsing UAC2 rates at MAX_NR_RATES (Cassio Gabriel) [Orabug: 39452170]     {CVE-2026-46018}
    - Buffer overflow in drivers/xen/sys-hypervisor.c (Juergen Gross) [Orabug: 39305898] {CVE-2026-31786}
    - xen/privcmd: fix double free via VMA splitting (Juergen Gross) [Orabug: 39305908] {CVE-2026-31787}
    - rxrpc: Fix missing validation of ticket length in non-XDR key preparsing (Anderson Nascimento) [Orabug:
    39300563] {CVE-2026-31696}
    - crypto: ccp: Don't attempt to copy ID to userspace if PSP command failed (Sean Christopherson)     {CVE-2026-31697}
    - crypto: ccp: Don't attempt to copy PDH cert to userspace if PSP command failed (Sean Christopherson)     {CVE-2026-31698}
    - crypto: ccp: Don't attempt to copy CSR to userspace if PSP command failed (Sean Christopherson)     {CVE-2026-31699}
    - net/packet: fix TOCTOU race on mmap'd vnet_hdr in tpacket_snd() (Bingquan Chen) {CVE-2026-31700}
    - ALSA: caiaq: take a reference on the USB device in create_card() (Berk Cem Goksel) [Orabug: 39300586]     {CVE-2026-31701}
    - smb: client: fix OOB read in smb2_ioctl_query_info QUERY_INFO path (Michael Bommarito) [Orabug:
    39300607] {CVE-2026-31708}
    - smb: client: require a full NFS mode SID before reading mode bits (Michael Bommarito) [Orabug: 39343707]     {CVE-2026-43350}
    - fuse: reject oversized dirents in page cache (Samuel Page) [Orabug: 39300556] {CVE-2026-31694}
    - mm/pagewalk: fix race between concurrent split and refault (Max Boone) [Orabug: 39250782]     {CVE-2026-31456}
    - wifi: mac80211: always free skb on ieee80211_tx_prepare_skb() failure (Felix Fietkau) [Orabug: 39167472]     {CVE-2026-23444}
    - mm/userfaultfd: fix hugetlb fault mutex hash calculation (Jianhui Zhou) [Orabug: 39273453]     {CVE-2026-31575}
    - ipv6: add NULL checks for idev in SRv6 paths (Heminhong) [Orabug: 39167467] {CVE-2026-23442}
    - ocfs2: fix out-of-bounds write in ocfs2_write_end_inline (Joseph Qi) [Orabug: 39331090] {CVE-2026-43075}
    - ocfs2: validate inline data i_size during inode read (Deepanshu Kartikey) [Orabug: 39331097]     {CVE-2026-43076}
    - media: as102: fix to not free memory after the device is registered in as102_usb_probe() (Jeongjun Park)     [Orabug: 39273467] {CVE-2026-31578}
    - bcache: fix cached_dev.sb_bio use-after-free and crash (Mingzhe Zou) [Orabug: 39273481] {CVE-2026-31580}
    - ALSA: 6fire: fix use-after-free on disconnect (Berk Cem Goksel) [Orabug: 39273486] {CVE-2026-31581}
    - media: em28xx: fix use-after-free in em28xx_v4l2_open() (Abhishek Kumar) [Orabug: 39273493]     {CVE-2026-31583}
    - mm: blk-cgroup: fix use-after-free in cgwb_release_workfn() (Breno Leitao) [Orabug: 39273507]     {CVE-2026-31586}
    - KVM: x86: Use scratch field in MMIO fragment to hold small write values (Sean Christopherson) [Orabug:
    39273521] {CVE-2026-31588}
    - x86-64: rename misleadingly named '__copy_user_nocache()' function (Linus Torvalds) [Orabug: 39323162]     {CVE-2026-43073}
    - kernel: be more careful about dup_mmap() failures and uprobe registering (Liam R. Howlett)     {CVE-2025-21709}
    - gpiolib: fix race condition for gdev->srcu (Pawel Narewski) [Orabug: 38887677] {CVE-2026-22986}
    - KVM: SEV: Drop WARN on large size for KVM_MEMORY_ENCRYPT_REG_REGION (Sean Christopherson) [Orabug:
    39273529] {CVE-2026-31590}
    - KVM: SEV: Reject attempts to sync VMSA of an already-launched/encrypted vCPU (Sean Christopherson)     [Orabug: 39273553] {CVE-2026-31593}
    - ocfs2: handle invalid dinode in ocfs2_group_extend (Zhengyuan Huang) [Orabug: 39273569] {CVE-2026-31596}
    - ocfs2: fix use-after-free in ocfs2_fault() when VM_FAULT_RETRY (Tejas Bharambe) [Orabug: 39273578]     {CVE-2026-31597}
    - ocfs2: fix possible deadlock between unlink and dio_end_io_write (Joseph Qi) [Orabug: 39273586]     {CVE-2026-31598}
    - dcache: Limit the minimal number of bucket to two (Zhihao Cheng) [Orabug: 39323133] {CVE-2026-43071}
    - ALSA: ctxfi: Limit PTP to a single page (Harin Lee) [Orabug: 39273608] {CVE-2026-31602}
    - wifi: rtw88: fix device leak on probe failure (Johan Hovold) [Orabug: 39273620] {CVE-2026-31604}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
360569	Rocky Linux 9.6 [TuxCare] Security Update: kernel / kernel-64k / kernel-64k-core / kernel-64k-debug / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1786352940)	Nessus	Rocky Linux Local Security Checks	10/1/2026	10/28/2026	high
325012	Ubuntu 22.04 LTS / 24.04 LTS : Linux kernel (Low Latency) vulnerabilities (USN-8497-1)	Nessus	Ubuntu Local Security Checks	7/3/2026	10/29/2026	high
377332	EulerOS Virtualization 2.15.1 : kernel (EulerOS-SA-2026-4761)	Nessus	Huawei Local Security Checks	11/7/2026	11/9/2026	high
304298	Amazon Linux 2023 : bpftool6.18, kernel6.18, kernel6.18-devel (ALAS2023-2026-1514)	Nessus	Amazon Linux Local Security Checks	3/30/2026	6/17/2026	high
305231	Amazon Linux 2023 : bpftool6.12, kernel6.12, kernel6.12-devel (ALAS2023-2026-1543)	Nessus	Amazon Linux Local Security Checks	4/7/2026	6/17/2026	high
325011	Ubuntu 22.04 LTS / 24.04 LTS : Linux kernel vulnerabilities (USN-8492-1)	Nessus	Ubuntu Local Security Checks	7/3/2026	7/30/2026	high
377235	EulerOS Virtualization 2.15.0 : kernel (EulerOS-SA-2026-4820)	Nessus	Huawei Local Security Checks	11/7/2026	11/9/2026	high
325292	Oracle Linux 10 / 9 : Unbreakable Enterprise kernel (ELSA-2026-50372)	Nessus	Oracle Linux Local Security Checks	7/6/2026	10/29/2026	high

Detections

Analytics

Plugins Search

high

high

high

high

high

high

high

high