The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4668-1 advisory.

    The SUSE Linux Enterprise 15 SP4 kernel was updated to fix various security issues:

    The following security issues were fixed:

    - CVE-2022-50645: EDAC/i10nm: fix refcount leak in pci_get_dev_wrapper() (bsc#1254633).
    - CVE-2024-56644: net/ipv6: release expired exception dst cached in socket (bsc#1216813 bsc#1235133).
    - CVE-2025-39964: crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (bsc#1252682).
    - CVE-2025-40022: crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (bsc#1251966).
    - CVE-2026-53266: netfilter: bridge: make ebt_snat ARP rewrite writable (bsc#1269136).
    - CVE-2026-53400: i2c: core: fix adapter registration race (bsc#1271906).
    - CVE-2026-64279: i2c: core: fix adapter deregistration race (bsc#1273953).
    - CVE-2026-64319: nvmet-auth: fix return value check in auth send (bsc#1273339).
    - CVE-2026-64422: net: ipv4: bound TCP reordering sysctl writes and MTU probe sizes (bsc#1273290).
    - CVE-2026-64580: xfrm6: clear dst.dev on error to avoid double netdev_put in xfrm6_fill_dst()     (bsc#1274037).
    - CVE-2026-68376: sctp: fix auth_hmacs array size in struct sctp_cookie (bsc#1274836).
    - CVE-2026-68445: drm/vc4: Prevent shader BO mappings from becoming writable (bsc#1276277).
    - CVE-2026-68451: s390/zcrypt: Validate length for CCA ECC private key requests (bsc#1276287).
    - CVE-2026-68452: s390/zcrypt: Validate length for CCA AES cipher key requests (bsc#1276295).
    - CVE-2026-72051: net: ip6_tunnel: require CAP_NET_ADMIN in the device netns for changelink (bsc#1276801).
    - CVE-2026-72052: net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (bsc#1276803).
    - CVE-2026-72053: net: ipip: require CAP_NET_ADMIN in the device netns for changelink (bsc#1276814).
    - CVE-2026-72054: net: ip_vti: require CAP_NET_ADMIN in the device netns for changelink (bsc#1276818).
    - CVE-2026-72055: net: ip6_vti: require CAP_NET_ADMIN in the device netns for changelink (bsc#1276821).
    - CVE-2026-72061: net: sit: require CAP_NET_ADMIN in the device netns for changelink (bsc#1277249).
    - CVE-2026-72066: cpu: hotplug: Bound hotplug states sysfs output (bsc#1277149).
    - CVE-2026-72098: dm-verity: fix buffer overflow in FEC calculation (bsc#1275543).
    - CVE-2026-72129: nvmet-rdma: handle inline data with a nonzero offset (bsc#1275545).
    - CVE-2026-72136: xfrm: xfrm_interface: require CAP_NET_ADMIN in the device netns for changelink     (bsc#1277574).
    - CVE-2026-72157: net: thunderbolt: Fix frags[] overflow by bounding frame_count (bsc#1277544).
    - CVE-2026-72322: ipv6: mcast: Fix potential UAF in MLD delayed work (bsc#1275972).
    - CVE-2026-72348: netfilter: ip6tables: mark malformed IPv6 extension headers for hotdrop (bsc#1276007).
    - CVE-2026-72351: gue: validate REMCSUM private option length (bsc#1276009).
    - CVE-2026-72383: sctp: fix addr_wq_timer race in sctp_free_addr_wq() (bsc#1277857).
    - CVE-2026-72398: sctp: fix association labeling in the duplicate COOKIE-ECHO case (bsc#1276381).
    - CVE-2026-72434: netfilter: ipset: make sure gc is properly stopped (bsc#1278054).
    - CVE-2026-74267: net/sched: sch_codel: Do not call qdisc_tree_reduce_backlog during peek before restoring     qlen       (bsc#1276519).
    - CVE-2026-74283: tipc: require net admin for TIPCv2 netlink mutators (bsc#1276475).
    - CVE-2026-74330: configfs: fix lockless traversals of ->s_children (bsc#1277129).
    - CVE-2026-74398: ipv6: addrconf: bail out of dad_failure when state is no longer POSTDAD (bsc#1277410).
    - CVE-2026-74443: drm/vmwgfx: bound DMA command body size against suffix pointer (bsc#1278210).
    - CVE-2026-74444: drm/vmwgfx: validate DRAW_PRIMITIVES header size before division (bsc#1278211).
    - CVE-2026-74453: drm/vc4: Zero the tile state data array before each BIN job (bsc#1278178).
    - CVE-2026-74469: sctp: prevent peer transport count overflow (bsc#1277792).
    - CVE-2026-74473: vxlan: use pskb_network_may_pull() in route_shortcircuit() (bsc#1276340).
    - CVE-2026-74479: net: pktgen: fix proc entry use-after-free (bsc#1276354).
    - CVE-2026-74480: net: bridge: stop fast-leave after deleting a port group (bsc#1276353).
    - CVE-2026-74492: netfilter: ipset: do not update comments from kernel-side hash adds (bsc#1276337).
    - CVE-2026-74493: net/smc: fix socket use-after-free during link group termination (bsc#1276338).
    - CVE-2026-74540: Bluetooth: L2CAP: fix UAF in l2cap_le_connect_rsp (bsc#1275681).
    - CVE-2026-74586: sctp: clear new_transport when removing a peer (bsc#1277820).
    - CVE-2026-74588: sctp: keep chunk->transport in step with the list it is queued on (bsc#1277766).
    - CVE-2026-74589: bpf, sockmap: Fix sk_redir use-after-free in send verdict (bsc#1277904).
    - CVE-2026-74597: ip6_tunnel: clear skb2->cb in ip6ip6_err() (bsc#1277493).
    - CVE-2026-74609: tipc: read le->link under the node lock in tipc_node_link_down() (bsc#1277906).
    - CVE-2026-74630: ipv6: prevent in6_dev_get() from resurrecting inet6_dev (bsc#1278191).
    - CVE-2026-74688: sctp: clear control chunk transport if it is being removed (bsc#1277489).
    - CVE-2026-74700: net/sched: cls_api: Always acquire rtnl_lock when destroying locked classifiers     (bsc#1277626).
    - CVE-2026-74719: net/smc: fix qentry overwrite for CONFIRM_LINK and ADD_LINK_CONT in     smc_llc_event_handler()       (bsc#1276572).
    - CVE-2026-74744: ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (bsc#1278094).
    - CVE-2026-74752: sctp: validate cookie AUTH state before use (bsc#1278315).
    - CVE-2026-80540: drm/amdgpu: Fix UVD decode image min size calculation (bsc#1277590).
    - CVE-2026-80785: fbdev: serialize mode sysfs access with lock_fb_info() (bsc#1279619).
    - CVE-2026-80789: nvmet-tcp: bound SGL data length before allocating command buffers (bsc#1279621).
    - CVE-2026-80840: ipv6: seg6: clear IPv4 control block on IPIP decapsulation (bsc#1279875).
    - CVE-2026-80841: net/packet: defer vmalloc TX_RING free until skbs finish (bsc#1279835).
    - CVE-2026-80844: xfrm: ah6: validate routing header segments_left (bsc#1279786).
    - CVE-2026-80852: tls: device: fix out-of-bounds write in tls_append_frag() (bsc#1279532).
    - CVE-2026-81000: net: tun: bound receive headroom (bsc#1280263).
    - CVE-2026-89479: sctp: stop processing a packet once its association is deleted (bsc#1280786).
    - CVE-2026-89482: nvme-tcp: do not accept C2HData based on blk_rq_payload_bytes() alone (bsc#1280350).
    - CVE-2026-89532: svcrdma: Fix pcl_for_each_segment for empty chunks (bsc#1280985).
    - CVE-2026-89533: svcrdma: Fix offset arithmetic in read_chunk_range (bsc#1280993).
    - CVE-2026-89551: SUNRPC: xdr_buf_trim: clamp buf->len to avoid underflow (bsc#1280727).
    - CVE-2026-89569: Bluetooth: RFCOMM: serialize security confirmation handling (bsc#1280733).
    - CVE-2026-89603: entry: Fix seccomp bypass after ptrace with TSYNC (bsc#1280923).
    - CVE-2026-89631: smb: client: reject a tree connect response whose byte count is too small (bsc#1280496).
    - CVE-2026-89636: smb: client: clear ce->tgthint in free_tgts() (bsc#1281042).
    - CVE-2026-89638: smb: client: clear setuid/setgid bit on write with cifsacl/modefromsid/posix extensions     (bsc#1281046).
    - CVE-2026-89674: nfsd: fix XDR length calculation in nfsd4_ff_encode_layoutget (bsc#1280243).
    - CVE-2026-89932: KVM: nVMX: Always flush vpid02 on first use (bsc#1281360).
    - CVE-2026-89968: nvmet-tcp: reject unsolicited H2CData PDUs (bsc#1281229).
    - CVE-2026-90003: futex: Prevent rcuwait use-after-free during requeue PI (bsc#1281295).
    - CVE-2026-90104: NFSv4.1: zero referring call lists before decoding (bsc#1281546).
    - CVE-2026-90198: ALSA: core: Fix use-after-free in snd_card_do_free() (bsc#1281818).
    - CVE-2026-90413: IB/isert: reject login PDUs declaring more data than was received (bsc#1282113).
    - CVE-2026-90414: IB/isert: reject PDUs declaring more data than (bsc#1282110).
    - CVE-2026-93104: RDMA/rvt: Return NULL after port allocation failure (bsc#1282284).
    - CVE-2026-93782: vhost-scsi: flush backend after device ioctls (bsc#1282906).
    - CVE-2026-93787: smb: client: bound dirent name against end of SMB response in cifs_filldir     (bsc#1282932).
    - CVE-2026-100075: RDMA/srpt: Fix srpt_alloc_rw_ctxs() unwind counters (bsc#1282881).

    The following non security issues were fixed:

    - default_gfp(): avoid using the 'newfangled' __VA_OPT__ trick (bsc#1280139).
    - fbdev/sysfs: Fix locking (jsc#PED-1166 jsc#PED-1168 jsc#PED-1170 jsc#PED-1218 jsc#PED-1220 jsc#PED-1222     jsc#PED-1223       jsc#PED-1225).
    - i2c: core: fix irq domain leak on adapter registration failure (git-fixes).
    - slab: Introduce kmalloc_obj() and family (bsc#1280139).
    - slab: recognize @GFP parameter as optional in kernel-doc (bsc#1280139).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS7:CLSA-2026:1789037015 advisory.

  - In the Linux kernel, the following vulnerability has been resolved: scsi: iscsi: Fix conn use after free     during resets If we haven't done a unbind target call we can race where iscsi_conn_teardown wakes up the     EH thread and then frees the conn while those threads are still accessing the conn ehwait. We can only do     one TMF per session so this just moves the TMF fields from the conn to the session. We can then rely on     the iscsi_session_teardown->iscsi_remove_session->__iscsi_unbind_session call to remove the target and     it's devices, and know after that point there is no device or scsi-ml callout trying to access the     session. (CVE-2021-47328)

  - In the Linux kernel, the following vulnerability has been resolved: ext4: improve error handling from     ext4_dirhash() The ext4_dirhash() will *almost* never fail, especially when the hash tree feature was     first introduced. However, with the addition of support of encrypted, casefolded file names, that function     can most certainly fail today. So make sure the callers of ext4_dirhash() properly check for failures, and     reflect the errors back up to their callers. (CVE-2023-53473)

  - In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Clear Present bit before     tearing down context entry When tearing down a context entry, the current implementation zeros the entire     128-bit entry using multiple 64-bit writes. This creates a window where the hardware can fetch a torn     entry  where some fields are already zeroed while the 'Present' bit is still set  leading to     unpredictable behavior or spurious faults. While x86 provides strong write ordering, the compiler may     reorder writes to the two 64-bit halves of the context entry. Even without compiler reordering, the     hardware fetch is not guaranteed to be atomic with respect to multiple CPU writes. Align with the     Guidance to Software for Invalidations in the VT-d spec (Section 6.5.3.3) by implementing the     recommended ownership handshake: 1. Clear only the 'Present' (P) bit of the context entry first to signal     the transition of ownership from hardware to software. 2. Use dma_wmb() to ensure the cleared bit is     visible to the IOMMU. 3. Perform the required cache and context-cache invalidation to ensure hardware no     longer has cached references to the entry. 4. Fully zero out the entry only after the invalidation is     complete. Also, add a dma_wmb() to context_set_present() to ensure the entry is fully initialized before     the 'Present' bit becomes visible. (CVE-2026-45944)

  - In the Linux kernel, the following vulnerability has been resolved: ipmi: Add limits to event and receive     message requests The driver would just fetch events and receive messages until the BMC said it was done.
    To avoid issues with BMCs that never say they are done, add a limit of 10 fetches at a time. In addition,     an si interface has an attn state it can return from the hardware which is supposed to cause a flag fetch     to see if the driver needs to fetch events or message or a few other things. If the attn bit gets stuck,     it's a similar problem. So allow messages in between flag fetches so the driver itself doesn't get stuck.
    This is a more general fix than the previous fix for the specific bad BMC, but should fix the more general     issue of a BMC that won't stop saying it has data. This has been there from the beginning of the driver.
    It's not a bug per-se, but it is accounting for bugs in BMCs. (CVE-2026-46177)

  - In the Linux kernel, the following vulnerability has been resolved: PCI: use generic driver_override     infrastructure When a driver is probed through __driver_attach(), the bus' match() callback is called     without the device lock held, thus accessing the driver_override field without a lock, which can cause a     UAF. Fix this by using the driver-core driver_override infrastructure taking care of proper locking     internally. Note that calling match() from __driver_attach() without the device lock held is intentional.
    [1] (CVE-2026-53120)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS-STREAM8:CLSA-2026:1792239979 advisory.

  - In the Linux kernel, the following vulnerability has been resolved: kyber: fix out of bounds access when     preempted __blk_mq_sched_bio_merge() gets the ctx and hctx for the current CPU and passes the hctx to
    ->bio_merge(). kyber_bio_merge() then gets the ctx for the current CPU again and uses that to get the     corresponding Kyber context in the passed hctx. However, the thread may be preempted between the two calls     to blk_mq_get_ctx(), and the ctx returned the second time may no longer correspond to the passed hctx.
    This works accidentally most of the time, but it can cause us to read garbage if the second ctx came     from an hctx with more ctx's than the first one (i.e., if ctx->index_hw[hctx->type] > hctx->nr_ctx). This     manifested as this UBSAN array index out of bounds error reported by Jakub: UBSAN: array-index-out-of-     bounds in ../kernel/locking/qspinlock.c:130:9 index 13106 is out of range for type 'long unsigned int     [128]' Call Trace: dump_stack+0xa4/0xe5 ubsan_epilogue+0x5/0x40
    __ubsan_handle_out_of_bounds.cold.13+0x2a/0x34 queued_spin_lock_slowpath+0x476/0x480     do_raw_spin_lock+0x1c2/0x1d0 kyber_bio_merge+0x112/0x180 blk_mq_submit_bio+0x1f5/0x1100     submit_bio_noacct+0x7b0/0x870 submit_bio+0xc2/0x3a0 btrfs_map_bio+0x4f0/0x9d0     btrfs_submit_data_bio+0x24e/0x310 submit_one_bio+0x7f/0xb0 submit_extent_page+0xc4/0x440
    __extent_writepage_io+0x2b8/0x5e0 __extent_writepage+0x28d/0x6e0 extent_write_cache_pages+0x4d7/0x7a0     extent_writepages+0xa2/0x110 do_writepages+0x8f/0x180 __writeback_single_inode+0x99/0x7f0     writeback_sb_inodes+0x34e/0x790 __writeback_inodes_wb+0x9e/0x120 wb_writeback+0x4d2/0x660     wb_workfn+0x64d/0xa10 process_one_work+0x53a/0xa80 worker_thread+0x69/0x5b0 kthread+0x20b/0x240     ret_from_fork+0x1f/0x30 Only Kyber uses the hctx, so fix it by passing the request_queue to ->bio_merge()     instead. BFQ and mq-deadline just use that, and Kyber can map the queues itself to avoid the mismatch.
    (CVE-2021-46984)

  - A use-after-free flaw was found in the Linux kernel's SGI GRU driver in the way the first     gru_file_unlocked_ioctl function is called by the user, where a fail pass occurs in the     gru_check_chiplet_assignment function. This flaw allows a local user to crash or potentially escalate     their privileges on the system. (CVE-2022-3424)

  - In the Linux kernel, the following vulnerability has been resolved: bpf, test_run: Fix alignment problem     in bpf_prog_test_run_skb() We got a syzkaller problem because of aarch64 alignment fault if KFENCE     enabled. When the size from user bpf program is an odd number, like 399, 407, etc, it will cause the     struct skb_shared_info's unaligned access. As seen below: BUG: KFENCE: use-after-free read in
    __skb_clone+0x23c/0x2a0 net/core/skbuff.c:1032 Use-after-free read at 0xffff6254fffac077 (in kfence-#213):
    __lse_atomic_add arch/arm64/include/asm/atomic_lse.h:26 [inline] arch_atomic_add     arch/arm64/include/asm/atomic.h:28 [inline] arch_atomic_inc include/linux/atomic-arch-fallback.h:270     [inline] atomic_inc include/asm-generic/atomic-instrumented.h:241 [inline] __skb_clone+0x23c/0x2a0     net/core/skbuff.c:1032 skb_clone+0xf4/0x214 net/core/skbuff.c:1481 ____bpf_clone_redirect     net/core/filter.c:2433 [inline] bpf_clone_redirect+0x78/0x1c0 net/core/filter.c:2420     bpf_prog_d3839dd9068ceb51+0x80/0x330 bpf_dispatcher_nop_func include/linux/bpf.h:728 [inline]     bpf_test_run+0x3c0/0x6c0 net/bpf/test_run.c:53 bpf_prog_test_run_skb+0x638/0xa7c net/bpf/test_run.c:594     bpf_prog_test_run kernel/bpf/syscall.c:3148 [inline] __do_sys_bpf kernel/bpf/syscall.c:4441 [inline]
    __se_sys_bpf+0xad0/0x1634 kernel/bpf/syscall.c:4381 kfence-#213: 0xffff6254fffac000-0xffff6254fffac196,     size=407, cache=kmalloc-512 allocated by task 15074 on cpu 0 at 1342.585390s: kmalloc     include/linux/slab.h:568 [inline] kzalloc include/linux/slab.h:675 [inline]     bpf_test_init.isra.0+0xac/0x290 net/bpf/test_run.c:191 bpf_prog_test_run_skb+0x11c/0xa7c     net/bpf/test_run.c:512 bpf_prog_test_run kernel/bpf/syscall.c:3148 [inline] __do_sys_bpf     kernel/bpf/syscall.c:4441 [inline] __se_sys_bpf+0xad0/0x1634 kernel/bpf/syscall.c:4381
    __arm64_sys_bpf+0x50/0x60 kernel/bpf/syscall.c:4381 To fix the problem, we adjust @size so that (@size +     @hearoom) is a multiple of SMP_CACHE_BYTES. So we make sure the struct skb_shared_info is aligned to a     cache line. (CVE-2022-49840)

  - In the Linux kernel, the following vulnerability has been resolved: usbnet: Fix linkwatch use-after-free     on disconnect usbnet uses the work usbnet_deferred_kevent() to perform tasks which may sleep. On     disconnect, completion of the work was originally awaited in ->ndo_stop(). But in 2003, that was moved to
    ->disconnect() by historic commit [PATCH] USB: usbnet, prevent exotic rtnl deadlock:
    https://git.kernel.org/tglx/history/c/0f138bbfd83c The change was made because back then, the kernel's     workqueue implementation did not allow waiting for a single work. One had to wait for completion of *all*     work by calling flush_scheduled_work(), and that could deadlock when waiting for usbnet_deferred_kevent()     with rtnl_mutex held in ->ndo_stop(). The commit solved one problem but created another: It causes a use-     after-free in USB Ethernet drivers aqc111.c, asix_devices.c, ax88179_178a.c, ch9200.c and smsc75xx.c: * If     the drivers receive a link change interrupt immediately before disconnect, they raise EVENT_LINK_RESET in     their (non-sleepable) ->status() callback and schedule usbnet_deferred_kevent(). *     usbnet_deferred_kevent() invokes the driver's ->link_reset() callback, which calls     netif_carrier_{on,off}(). * That in turn schedules the work linkwatch_event(). Because     usbnet_deferred_kevent() is awaited after unregister_netdev(), netif_carrier_{on,off}() may operate on an     unregistered netdev and linkwatch_event() may run after free_netdev(), causing a use-after-free. In 2010,     usbnet was changed to only wait for a single instance of usbnet_deferred_kevent() instead of *all* work by     commit 23f333a2bfaf (drivers/net: don't use flush_scheduled_work()). Unfortunately the commit neglected     to move the wait back to ->ndo_stop(). Rectify that omission at long last. (CVE-2022-50220)

  - In the Linux kernel, the following vulnerability has been resolved: cifs: fix oops during encryption When     running xfstests against Azure the following oops occurred on an arm64 system Unable to handle kernel     write to read-only memory at virtual address ffff0001221cf000 Mem abort info: ESR = 0x9600004f EC = 0x25:
    DABT (current EL), IL = 32 bits SET = 0, FnV = 0 EA = 0, S1PTW = 0 FSC = 0x0f: level 3 permission fault     Data abort info: ISV = 0, ISS = 0x0000004f CM = 0, WnR = 1 swapper pgtable: 4k pages, 48-bit VAs,     pgdp=00000000294f3000 [ffff0001221cf000] pgd=18000001ffff8003, p4d=18000001ffff8003, pud=18000001ff82e003,     pmd=18000001ff71d003, pte=00600001221cf787 Internal error: Oops: 9600004f [#1] PREEMPT SMP ... pstate:
    80000005 (Nzcv daif -PAN -UAO -TCO BTYPE=--) pc : __memcpy+0x40/0x230 lr :
    scatterwalk_copychunks+0xe0/0x200 sp : ffff800014e92de0 x29: ffff800014e92de0 x28: ffff000114f9de80 x27:
    0000000000000008 x26: 0000000000000008 x25: ffff800014e92e78 x24: 0000000000000008 x23: 0000000000000001     x22: 0000040000000000 x21: ffff000000000000 x20: 0000000000000001 x19: ffff0001037c4488 x18:
    0000000000000014 x17: 235e1c0d6efa9661 x16: a435f9576b6edd6c x15: 0000000000000058 x14: 0000000000000001     x13: 0000000000000008 x12: ffff000114f2e590 x11: ffffffffffffffff x10: 0000040000000000 x9 :
    ffff8000105c3580 x8 : 2e9413b10000001a x7 : 534b4410fb86b005 x6 : 534b4410fb86b005 x5 : ffff0001221cf008     x4 : ffff0001037c4490 x3 : 0000000000000001 x2 : 0000000000000008 x1 : ffff0001037c4488 x0 :
    ffff0001221cf000 Call trace: __memcpy+0x40/0x230 scatterwalk_map_and_copy+0x98/0x100     crypto_ccm_encrypt+0x150/0x180 crypto_aead_encrypt+0x2c/0x40 crypt_message+0x750/0x880     smb3_init_transform_rq+0x298/0x340 smb_send_rqst.part.11+0xd8/0x180 smb_send_rqst+0x3c/0x100     compound_send_recv+0x534/0xbc0 smb2_query_info_compound+0x32c/0x440 smb2_set_ea+0x438/0x4c0     cifs_xattr_set+0x5d4/0x7c0 This is because in scatterwalk_copychunks(), we attempted to write to a buffer     (@sign) that was allocated in the stack (vmalloc area) by crypt_message() and thus accessing its remaining     8 (x2) bytes ended up crossing a page boundary. To simply fix it, we could just pass @sign kmalloc'd from     crypt_message() and then we're done. Luckily, we don't seem to pass any other vmalloc'd buffers in     smb_rqst::rq_iov... Instead, let's map the correct pages and offsets from vmalloc buffers as well in     cifs_sg_set_buf() and then avoiding such oopses. (CVE-2022-50341)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
365522	Ubuntu 24.04 LTS : Linux kernel vulnerabilities (USN-8917-1)	Nessus	Ubuntu Local Security Checks	10/14/2026	10/14/2026	medium
366062	SUSE SLES15: cluster-md-kmp-default / dlm-kmp-default / gfs2-kmp-default / etc (SUSE-SU-2026:4668-1)	Nessus	SuSE Local Security Checks	10/15/2026	10/15/2026	medium
352722	CentOS Linux 7 [TuxCare] Security Update: bpftool / kernel / kernel-debug / kernel-debug-devel / kernel-devel / etc Multiple Vulnerabilities (CENTOS7:CLSA-2026:1789037015)	Nessus	CentOS Local Security Checks	9/30/2026	10/15/2026	high
366781	CentOS Linux 8 [TuxCare] Security Update: bpftool / kernel / kernel-core / kernel-cross-headers / etc Multiple Vulnerabilities (CENTOS-STREAM8:CLSA-2026:1792239979)	Nessus	CentOS Local Security Checks	10/17/2026	10/17/2026	high

Detections

Analytics

Plugins Search

medium

medium

high

high