The remote SUSE Linux SLES16 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:22099-1 advisory.

    The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues

    The following security issues were fixed:

    - CVE-2026-23254: net: gro: fix outer network offset (bsc#1259884).
    - CVE-2026-23303: smb: client: Don't log plaintext credentials in cifs_set_cifscreds (bsc#1260502).
    - CVE-2026-23327: cxl/mbox: validate payload size before accessing       contents in cxl_payload_from_user_allowed() (bsc#1260548).
    - CVE-2026-23438: net: mvpp2: guard flow control update with global_tx_fc in buffer switching     (bsc#1261619).
    - CVE-2026-31396: net: macb: fix use-after-free access to PTP clock (bsc#1261791).
    - CVE-2026-31401: HID: bpf: prevent buffer overflow in hid_hw_request (bsc#1261603).
    - CVE-2026-31446: ext4: fix use-after-free in update_super_work when racing with umount (bsc#1262619).
    - CVE-2026-31448: ext4: avoid infinite loops caused by residual data (bsc#1262622).
    - CVE-2026-31454: xfs: save ailp before dropping the AIL lock in push callbacks (bsc#1262624).
    - CVE-2026-31455: xfs: stop reclaim before pushing AIL during unmount (bsc#1262615).
    - CVE-2026-31518: esp: fix skb leak with espintcp and async crypto (bsc#1262606).
    - CVE-2026-31546: net: bonding: fix NULL deref in bond_debug_rlb_hash_show (bsc#1263006).
    - CVE-2026-31556: xfs: scrub: unlock dquot before early return in quota scrub (bsc#1263062).
    - CVE-2026-31562: drm/mediatek: dsi: Store driver data before invoking mipi_dsi_host_register     (bsc#1263058).
    - CVE-2026-31584: media: mediatek: vcodec: fix use-after-free in encoder release path (bsc#1263180).
    - CVE-2026-31645: net: lan966x: fix page pool leak in error paths (bsc#1263794).
    - CVE-2026-31648: mm: filemap: fix nr_pages calculation overflow in filemap_map_pages() (bsc#1263579).
    - CVE-2026-31655: pmdomain: imx8mp-blk-ctrl: Keep the NOC_HDCP clock enabled (bsc#1263724).
    - CVE-2026-31671: xfrm_user: fix info leak in build_report() (bsc#1263115).
    - CVE-2026-31683: batman-adv: avoid OGM aggregation when skb tailroom is insufficient (bsc#1263594).
    - CVE-2026-31703: writeback: Fix use after free in inode_switch_wbs_work_fn() (bsc#1263883).
    - CVE-2026-31774: io_uring/net: fix slab-out-of-bounds read in io_bundle_nbufs() (bsc#1264040).
    - CVE-2026-43026: netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (bsc#1263932).
    - CVE-2026-43030: bpf: Fix regsafe() for pointers to packet (bsc#1264000).
    - CVE-2026-43040: net: ipv6: ndisc: fix ndisc_ra_useropt to initialize       nduseropt_padX fields to zero to prevent an info-leak (bsc#1264091).
    - CVE-2026-43063: xfs: don't irele after failing to iget in xfs_attri_recover_work (bsc#1264196).
    - CVE-2026-43065: ext4: always drain queued discard work in ext4_mb_release() (bsc#1264243).
    - CVE-2026-43066: ext4: fix iloc.bh leak in ext4_fc_replay_inode() error paths (bsc#1264245).
    - CVE-2026-43068: ext4: avoid allocate block from corrupted group in ext4_mb_find_by_goal() (bsc#1264255).
    - CVE-2026-43109: x86: shadow stacks: proper error handling for mmap lock (bsc#1264484).
    - CVE-2026-43150: perf/arm-cmn: Reject unsupported hardware configurations (bsc#1264415).
    - CVE-2026-43184: rnbd-srv: Zero the rsp buffer before using it (bsc#1264622).
    - CVE-2026-43197: netconsole: avoid OOB reads, msg is not nul-terminated (bsc#1264609).
    - CVE-2026-43332: thermal: core: Fix thermal zone device registration error path (bsc#1265114).
    - CVE-2026-43393: btrfs: fix chunk map leak in btrfs_map_block() after btrfs_chunk_map_num_copies()     (bsc#1264723).
    - CVE-2026-43394: nfsd: Fix cred ref leak in nfsd_nl_listener_set_doit() (bsc#1265081).
    - CVE-2026-43411: tipc: fix divide-by-zero in tipc_sk_filter_connect() (bsc#1264672).
    - CVE-2026-43455: net: mctp: Ensure keys maintain only one ref to corresponding dev (bsc#1264765).
    - CVE-2026-45842: slip: reject VJ receive packets on instances with no rstate array (bsc#1266400).
    - CVE-2026-45846: bareudp: fix NULL pointer dereference in bareudp_fill_metadata_dst() (bsc#1266394).
    - CVE-2026-45852: RDMA/rxe: Fix double free in rxe_srq_from_init (bsc#1266711).
    - CVE-2026-45856: RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (bsc#1266720).
    - CVE-2026-45886: bpf: Fix bpf_xdp_store_bytes proto for read-only arg (bsc#1266810).
    - CVE-2026-45898: RDMA/iwcm: Fix workqueue list corruption by removing work_list (bsc#1266888).
    - CVE-2026-45910: RDMA/rxe: Fix race condition in QP timer handlers (bsc#1266889).
    - CVE-2026-45932: bpf: Fix tcx/netkit detach permissions when prog fd isn't given (bsc#1266827).
    - CVE-2026-45942: ext4: fix e4b bitmap inconsistency reports (bsc#1266914).
    - CVE-2026-45970: bonding: alb: fix UAF in rlb_arp_recv during bond up/down (bsc#1267205).
    - CVE-2026-45984: gfs2: Fix use-after-free in iomap inline data write path (bsc#1267214).
    - CVE-2026-46021: thermal: core: Fix thermal zone governor cleanup issues (bsc#1267220).
    - CVE-2026-46043: RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (bsc#1266901).
    - CVE-2026-46083: spi: fix resource leaks on device setup failure (bsc#1266696).
    - CVE-2026-46090: ALSA: aloop: Use guard() for spin locks (bsc#1267531).
    - CVE-2026-46094: ext4: fix bounds check in check_xattrs() to prevent out-of-bounds access (bsc#1266927).
    - CVE-2026-46114: RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (bsc#1266972).
    - CVE-2026-46159: btrfs: fix btrfs_ioctl_space_info() slot_count TOCTOU which can lead to info-leak     (bsc#1267652).
    - CVE-2026-46176: RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (bsc#1266816).
    - CVE-2026-46181: RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (bsc#1266826).

    The following non security issues were fixed:

    - accel/ivpu: Add bounds checks for firmware log indices (git-fixes).
    - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (git-fixes).
    - ALSA: PCM: Fix wait queue list corruption in snd_pcm_drain() on linked streams (git-fixes).
    - ALSA: seq: dummy: fix UMP event stack overread (git-fixes).
    - arm64: tlb: Allow XZR argument to TLBI ops (git-fixes).
    - arm64: tlb: Optimize ARM64_WORKAROUND_REPEAT_TLBI (git-fixes).
    - Bluetooth: bnep: reject short frames before parsing (git-fixes).
    - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (git-fixes).
    - Bluetooth: ISO: Fix not releasing hdev reference on iso_conn_big_sync (git-fixes).
    - Bluetooth: MGMT: Fix backward compatibility with userspace (git-fixes).
    - Bluetooth: MGMT: validate advertising TLV before type checks (git-fixes).
    - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (git-fixes).
    - Bluetooth: RFCOMM: validate skb length in MCC handlers (git-fixes).
    - config: remove DEBUG_FS_DISALLOW_MOUNT
    - debugfs: Remove broken no-mount mode (bsc#1265186).
    - debugfs: Fix default access mode config check (bsc#1265186).
    - debugfs: Remove broken no-mount mode (bsc#1265186).
    - debugfs: Remove redundant access mode checks (bsc#1265186).
    - drm/amd/display: Bound VBIOS record-chain walk loops (git-fixes).
    - drm/amd/display: Clamp HDMI HDCP2 rx_id_list read to buffer size (git-fixes).
    - drm/amd/display: Fix NULL deref and buffer over-read in SDP debugfs (git-fixes).
    - drm/amd/display: Reject gpio_bitshift >= 32 in bios_parser_get_gpio_pin_info() (git-fixes).
    - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (git-fixes).
    - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (git-fixes).
    - drm/amdkfd: fix NULL dereference in get_queue_ids() (git-fixes).
    - drm/imx: Fix three kernel-doc warnings in dcss-scaler.c (git-fixes).
    - drm/v3d: Fix vaddr leak when indirect CSD has zeroed workgroups (git-fixes).
    - drm/xe: Clear pending_disable before signaling suspend fence (git-fixes).
    - ima: return error early if file xattr cannot be changed (bsc#1261041).
    - Input: atkbd - skip deactivate for HONOR BCC-N's internal keyboard (git-fixes).
    - KVM: arm64: Reassign nested_mmus array behind mmu_lock (git-fixes).
    - KVM: arm64: Take the SRCU lock for page table walks in fault injection and AT emulation (git-fixes).
    - KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (git-fixes).
    - KVM: SEV: Check PSC request indices against the actual size of the buffer (git-fixes).
    - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (git-fixes).
    - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (git-fixes).
    - KVM: SEV: Ignore MMIO requests of length '0' (git-fixes).
    - KVM: SEV: Ignore Port I/O requests of length '0' (git-fixes).
    - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (git-fixes).
    - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (git-fixes).
    - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (git-fixes).
    - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (git-fixes).
    - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (git-fixes).
    - KVM: SVM: Convert plain error code numbers to defines (git-fixes).
    - KVM: SVM: Flush the current TLB when transitioning from xAVIC => x2AVIC (git-fixes).
    - KVM: SVM: Provide helpers to set the error code (git-fixes).
    - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (git-fixes).
    - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (git-fixes).
    - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (git-fixes).
    - KVM: x86: Move MMIO write tracing into vcpu_mmio_write() (git-fixes).
    - KVM: x86: Open code handling of completed MMIO reads in emulator_read_write() (git-fixes).
    - KVM: x86: Open code read vs. write userspace MMIO exits in emulator_read_write() (git-fixes).
    - KVM: x86: Trace unsatisfied MMIO reads on a per-page basis (git-fixes).
    - KVM: x86: Use local MMIO fragment variable to clean up emulator_read_write() (git-fixes).
    - mmc: core: Fix host controller programming for fixed driver type (git-fixes).
    - mmc: dw_mmc-rockchip: Add missing private data for very old controllers (git-fixes).
    - mmc: litex_mmc: Set mandatory idle clocks before CMD0 (git-fixes).
    - mmc: litex_mmc: Use DIV_ROUND_UP for more accurate clock calculation (git-fixes).
    - mmc: renesas_sdhi: Add OF entry for RZ/G2H SoC (git-fixes).
    - mmc: sdhci: add signal voltage switch in sdhci_resume_host (git-fixes).
    - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (git-fixes).
    - wifi: nl80211: reject oversized EMA RNR lists (git-fixes).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:41236 advisory.

    The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with     extremely high determinism requirements.

    Security Fix(es):

    * kernel: Linux kernel: Denial of service and memory corruption in RDMA umad (CVE-2026-23243)

    * kernel: netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CVE-2026-23455)

    * kernel: can: raw: fix ro->uniq use-after-free in raw_rcv() (CVE-2026-31532)

    * kernel: usbip: validate number_of_packets in usbip_pack_ret_submit() (CVE-2026-31607)

    * kernel: netfilter: ip6t_eui64: reject invalid MAC header for all packets (CVE-2026-31685)

    * kernel: ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (CVE-2026-43037)

    * kernel: wifi: brcmfmac: validate bsscfg indices in IF events (CVE-2026-43110)

    * kernel: md/bitmap: fix GPF in write_page caused by resize race (CVE-2026-43163)

    * kernel: netfilter: xt_tcpmss: check remaining length before reading optlen (CVE-2026-43190)

    * kernel: xfs: fix freemap adjustments when adding xattrs to leaf blocks (CVE-2026-43158)

    * kernel: tcp: fix potential race in tcp_v6_syn_recv_sock() (CVE-2026-43198)

    * kernel: dlm: validate length in dlm_search_rsb_tree (CVE-2026-43125)

    * kernel: Linux kernel: smb: client: reject userspace cifs.spnego descriptions (CVE-2026-46243)

    * kernel: ALSA: aloop: Fix peer runtime UAF during format-change stop (CVE-2026-46090)

    * kernel: RDMA/rxe: Fix double free in rxe_srq_from_init (CVE-2026-45852)

    * kernel: RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (CVE-2026-46181)

    Bug Fix(es) and Enhancement(s):

    * RHEL-124698 missed the last line of the backport (JIRA:RHEL-168608)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-788:42 advisory.

    * kernel: geneve: Fix use-after-free in geneve_find_dev(). (CVE-2025-21858)
      * kernel: smc: Fix use-after-free in tcp_write_timer_handler() (CVE-2023-53781)
      * kernel: nbd: defer config unlock in nbd_genl_connect (CVE-2025-68366)
      * kernel: libceph: prevent potential out-of-bounds reads in handle_auth_done() (CVE-2026-22984)
      * kernel: libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CVE-2026-22990)
      * kernel: netfilter: nf_tables: release flowtable after rcu grace period on error (CVE-2026-23392)
      * kernel: ALSA: 6fire: fix use-after-free on disconnect (CVE-2026-31581)
      * kernel: smb: client: fix OOB reads parsing symlink error response (CVE-2026-31613)
      * kernel: ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (CVE-2026-43037)
      * kernel: ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (CVE-2026-43038)
      * kernel: dlm: validate length in dlm_search_rsb_tree (CVE-2026-43125)
      * kernel: RDMA/rxe: Fix double free in rxe_srq_from_init (CVE-2026-45852)
      * kernel: RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (CVE-2026-46181)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-25121 advisory.

    - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172640] {CVE-2026-43037}
    - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173986]     {CVE-2026-43125}
    - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173986] {CVE-2026-43125}
    - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179982] {CVE-2026-46181}
    - ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172664]     {CVE-2026-43038}
    - ALSA: 6fire: fix use-after-free on disconnect (Jaroslav Kysela) [RHEL-172963] {CVE-2026-31581}
    - ALSA: 6fire: Release resources at card release (Jaroslav Kysela) [RHEL-172963] {CVE-2024-53239}
    - RDMA/rxe: Fix double free in rxe_srq_from_init (Kamal Heib) [RHEL-179702] {CVE-2026-45852}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-2026_1435 advisory.

    This advisory aggregates security fixes for the kernel SRPM in CIQ LTS 9.6. It addresses 16 CVEs:
    CVE-2026-43128, CVE-2026-46181, CVE-2026-45852, CVE-2026-23191, CVE-2026-43329, and 11 more.

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-2026_25121 advisory.

    * kernel: geneve: Fix use-after-free in geneve_find_dev(). (CVE-2025-21858)

    * kernel: smc: Fix use-after-free in tcp_write_timer_handler() (CVE-2023-53781)

    * kernel: nbd: defer config unlock in nbd_genl_connect (CVE-2025-68366)

    * kernel: libceph: prevent potential out-of-bounds reads in handle_auth_done() (CVE-2026-22984)

    * kernel: libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CVE-2026-22990)

    * kernel: netfilter: nf_tables: release flowtable after rcu grace period on error (CVE-2026-23392)

    * kernel: ALSA: 6fire: fix use-after-free on disconnect (CVE-2026-31581)

    * kernel: smb: client: fix OOB reads parsing symlink error response (CVE-2026-31613)

    * kernel: ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (CVE-2026-43037)

    * kernel: ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (CVE-2026-43038)

    * kernel: dlm: validate length in dlm_search_rsb_tree (CVE-2026-43125)

    * kernel: RDMA/rxe: Fix double free in rxe_srq_from_init (CVE-2026-45852)

    * kernel: RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (CVE-2026-46181)

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-102092 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event()

    Sashiko points out the radix_tree itself is RCU safe, but nothing ever     frees the mlx4_srq struct with RCU, and it isn't even accessed within the     RCU critical section. It also will crash if an event is delivered before     the srq object is finished initializing.

    Use the spinlock since it isn't easy to make RCU work, use     refcount_inc_not_zero() to protect against partially initialized objects,     and order the refcount_set() to be after the srq is fully initialized.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
321697	SUSE SLES16 Security Update : kernel (SUSE-SU-2026:22099-1)	Nessus	SuSE Local Security Checks	6/20/2026	6/20/2026	high
327652	RHEL 7 : kernel-rt (RHSA-2026:41236)	Nessus	Red Hat Local Security Checks	7/17/2026	7/27/2026	high
321155	MiracleLinux 8 : kernel-4.18.0-553.132.1.el8_10 (AXSA:2026-788:42)	Nessus	Miracle Linux Local Security Checks	6/16/2026	6/16/2026	high
321180	Oracle Linux 8 : kernel (ELSA-2026-25121)	Nessus	Oracle Linux Local Security Checks	6/16/2026	6/16/2026	high
348098	EulerOS Virtualization 2.11.0 : kernel (EulerOS-SA-2026-3511)	Nessus	Huawei Local Security Checks	9/18/2026	10/5/2026	critical
343532	Ubuntu 24.04 LTS / Pro Realtime 24.04 LTS : Linux kernel (GCP) vulnerabilities (USN-8728-1)	Nessus	Ubuntu Local Security Checks	9/7/2026	9/24/2026	high
354642	Rocky Linux 9.6 [CIQ] Security Update: kernel / kernel-64k / kernel-64k-core / kernel-64k-debug / etc Multiple Vulnerabilities (ciqsa-2026_1435)	Nessus	Rocky Linux Local Security Checks	10/1/2026	10/5/2026	high
357909	Rocky Linux 8 [CIQ] Security Update: bpftool / kernel / kernel-abi-stablelists / kernel-core / etc Multiple Vulnerabilities (crlsa-2026_25121)	Nessus	Rocky Linux Local Security Checks	10/1/2026	10/1/2026	high
338547	Unity Linux 20.1050e Security Update: kernel (UTSA-2026-102092)	Nessus	Unity Linux Local Security Checks	8/21/2026	8/21/2026	high

Detections

Analytics

Plugins Search

high

high

high

high

critical

high

high

high

high