The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:71232 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: block: zero non-PI portion of auto integrity buffer (CVE-2026-23007)

    * kernel: af_unix: Drop all SCM attributes for SOCKMAP (CVE-2026-53005)

    * kernel: mac802154: llsec: add skb_cow_data() before in-place crypto (CVE-2026-63831)

    * kernel: blk-cgroup: fix UAF in __blkcg_rstat_flush() (CVE-2026-63802)

    * kernel: block: don't overwrite bip_vcnt in bio_integrity_copy_user() (CVE-2026-64053)

    * kernel: smb: client: fix double-free in SMB2_flush() replay (CVE-2026-64383)

    * kernel: nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CVE-2026-64534)

    * kernel: sctp: don't free the ASCONF's own transport in DEL-IP processing (CVE-2026-64564)

    * kernel: ALSA: timer: drain a slave's callback before its master detaches it (CVE-2026-68201)

    * kernel: ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CVE-2026-72261)

    * kernel: xfrm: ah6: validate routing header segments_left (CVE-2026-80844)

    * kernel: net: tun: bound receive headroom (CVE-2026-81000)

    * kernel: scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CVE-2026-89846)

    Bug Fix(es) and Enhancement(s):

    * sctp: prevent peer transport count overflow [rhel-9.8.z] (JIRA:RHEL-216251)

    * netfilter: nftables CVE and memory safety backports for 9.8 (JIRA:RHEL-236634)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the kernel-5.14.0-754.el9 build changelog.

  - In the Linux kernel, the following vulnerability has been resolved: crypto: af_alg - Cap AEAD AD length to     0x80000000 In order to prevent arithmetic overflows when checking the TX buffer size, cap the associated     data length to 0x80000000. (CVE-2026-52972)

  - In the Linux kernel, the following vulnerability has been resolved: crypto: ccp - Fix a crash due to     incorrect cleanup usage of kfree Annotating a local pointer variable, which will be assigned with the     kmalloc-family functions, with the `__cleanup(kfree)` attribute will make the address of the local     variable, rather than the address returned by kmalloc, passed to kfree directly and lead to a crash due to     invalid deallocation of stack address. According to other places in the repo, the correct usage should be     `__free(kfree)`. The code coincidentally compiled because the parameter type `void *` of kfree is     compatible with the desired type `struct { ... } **`. (CVE-2026-45959)

  - In the Linux kernel, the following vulnerability has been resolved: fhandle: fix UAF due to unlocked
    ->mnt_ns read in may_decode_fh() may_decode_fh() accesses mount::mnt_ns without holding any locks; that     means the mount can concurrently be unmounted, and the mnt_namespace can concurrently be freed after an     RCU grace period. This race can happens as follows, assuming that the mount point was created by     open_tree(..., OPEN_TREE_CLONE): thread 1 thread 2 RCU __do_sys_open_by_handle_at do_handle_open     handle_to_path may_decode_fh is_mounted [mount::mnt_ns access] [mount::mnt_ns access] __do_sys_close     fput_close_sync __fput dissolve_on_fput umount_tree class_namespace_excl_destructor namespace_unlock     free_mnt_ns mnt_ns_tree_remove call_rcu(mnt_ns_release_rcu) mnt_ns_release_rcu mnt_ns_release kfree     [mnt_namespace::user_ns access] **UAF** Fix it by taking rcu_read_lock() around the mount::mnt_ns access,     like in __prepend_path(). Additionally, document the semantics of mount::mnt_ns, and use WRITE_ONCE() for     writers that can race with lockless readers. This bug is unreachable unless one of the following is set: -     CONFIG_PREEMPTION - CONFIG_RCU_STRICT_GRACE_PERIOD because it requires an RCU grace period to happen     during a syscall without an explicit preemption. This doesn't seem to have interesting security impact;
    worst-case, it could leak the result of an integer comparison to userspace (from the level check in     cap_capable()), cause an endless loop, or crash the kernel by dereferencing an invalid address.
    (CVE-2026-53341)

  - In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: check INIT_FAILED before     nvmet_req_uninit in digest error path In nvmet_tcp_try_recv_ddgst(), when a data digest mismatch is     detected, nvmet_req_uninit() is called unconditionally. However, if the command arrived via the     nvmet_tcp_handle_req_failure() path, nvmet_req_init() had returned false and percpu_ref_tryget_live() was     never executed. The unconditional percpu_ref_put() inside nvmet_req_uninit() then causes a refcount     underflow, leading to a WARNING in percpu_ref_switch_to_atomic_rcu, a use-after-free diagnostic, and     eventually a permanent workqueue deadlock. Check cmd->flags & NVMET_TCP_F_INIT_FAILED before calling     nvmet_req_uninit(), matching the existing pattern in nvmet_tcp_execute_request(). (CVE-2026-64534)

  - In the Linux kernel, the following vulnerability has been resolved: perf/core: Detach event groups during     remove_on_exec perf_event_remove_on_exec() removes events by calling perf_event_exit_event(). For top-     level events, this removes the event from the context with DETACH_EXIT only. This can leave inconsistent     group state when a removed event is a group leader and the group contains siblings without remove_on_exec.
    If the group was active, the surviving siblings can remain active and attached to the removed leader's     sibling list, but are no longer represented by a valid group leader on the PMU context active lists. A     later close of the removed leader uses DETACH_GROUP and can promote the still-active siblings from this     stale group state. The next schedule-in can then add an already-linked active_list entry again, corrupting     the PMU context active list. With DEBUG_LIST enabled, this is caught as a list_add double-add in     merge_sched_in(). Fix this by detaching group relationships when remove_on_exec removes an event. This     preserves the existing task-exit and revoke behavior, while ensuring surviving siblings are ungrouped     before the removed event leaves the context. (CVE-2026-64556)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4717 advisory.

    - -------------------------------------------------------------------------     Debian LTS Advisory DLA-4717-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/               Emilio Pozuelo Monfort     August 05, 2026                               https://wiki.debian.org/LTS
    - -------------------------------------------------------------------------

    Package        : linux     Version        : 5.10.262-1     CVE ID         : CVE-2022-49803 CVE-2022-50114 CVE-2023-52494 CVE-2025-23131                      CVE-2025-39931 CVE-2026-23204 CVE-2026-31451 CVE-2026-31755                      CVE-2026-43216 CVE-2026-43219 CVE-2026-43499 CVE-2026-46116                      CVE-2026-46135 CVE-2026-46252 CVE-2026-46331 CVE-2026-52942                      CVE-2026-53138 CVE-2026-53157 CVE-2026-53158 CVE-2026-53159                      CVE-2026-53167 CVE-2026-53177 CVE-2026-53325 CVE-2026-53329                      CVE-2026-53332 CVE-2026-53381 CVE-2026-53382 CVE-2026-53385                      CVE-2026-53392 CVE-2026-53393 CVE-2026-53397 CVE-2026-53398                      CVE-2026-53399 CVE-2026-53400 CVE-2026-53402 CVE-2026-53403                      CVE-2026-63794 CVE-2026-63796 CVE-2026-63798 CVE-2026-63800                      CVE-2026-63801 CVE-2026-63803 CVE-2026-63806 CVE-2026-63808                      CVE-2026-63809 CVE-2026-63814 CVE-2026-63815 CVE-2026-63818                      CVE-2026-63822 CVE-2026-63823 CVE-2026-63824 CVE-2026-63827                      CVE-2026-63828 CVE-2026-63829 CVE-2026-63830 CVE-2026-63831                      CVE-2026-63834 CVE-2026-63835 CVE-2026-63836 CVE-2026-64188                      CVE-2026-64189 CVE-2026-64191 CVE-2026-64206 CVE-2026-64249                      CVE-2026-64252 CVE-2026-64266 CVE-2026-64268 CVE-2026-64271                      CVE-2026-64273 CVE-2026-64274 CVE-2026-64275 CVE-2026-64276                      CVE-2026-64277 CVE-2026-64296 CVE-2026-64298 CVE-2026-64299                      CVE-2026-64303 CVE-2026-64304 CVE-2026-64306 CVE-2026-64312                      CVE-2026-64313 CVE-2026-64315 CVE-2026-64316 CVE-2026-64317                      CVE-2026-64318 CVE-2026-64322 CVE-2026-64323 CVE-2026-64324                      CVE-2026-64329 CVE-2026-64330 CVE-2026-64331 CVE-2026-64332                      CVE-2026-64333 CVE-2026-64334 CVE-2026-64335 CVE-2026-64337                      CVE-2026-64338 CVE-2026-64340 CVE-2026-64342 CVE-2026-64343                      CVE-2026-64344 CVE-2026-64345 CVE-2026-64347 CVE-2026-64348                      CVE-2026-64351 CVE-2026-64359 CVE-2026-64360 CVE-2026-64361                      CVE-2026-64362 CVE-2026-64363 CVE-2026-64364 CVE-2026-64370                      CVE-2026-64371 CVE-2026-64372 CVE-2026-64373 CVE-2026-64374                      CVE-2026-64375 CVE-2026-64378 CVE-2026-64379 CVE-2026-64380                      CVE-2026-64381 CVE-2026-64403 CVE-2026-64406 CVE-2026-64408                      CVE-2026-64411 CVE-2026-64412 CVE-2026-64413 CVE-2026-64420                      CVE-2026-64422 CVE-2026-64423 CVE-2026-64425 CVE-2026-64429                      CVE-2026-64435 CVE-2026-64436 CVE-2026-64438 CVE-2026-64442                      CVE-2026-64445 CVE-2026-64446 CVE-2026-64448 CVE-2026-64450                      CVE-2026-64452 CVE-2026-64455 CVE-2026-64456 CVE-2026-64461                      CVE-2026-64462 CVE-2026-64465 CVE-2026-64468 CVE-2026-64469                      CVE-2026-64470 CVE-2026-64471 CVE-2026-64475 CVE-2026-64478                      CVE-2026-64483 CVE-2026-64484 CVE-2026-64487 CVE-2026-64488                      CVE-2026-64494 CVE-2026-64495 CVE-2026-64496 CVE-2026-64497                      CVE-2026-64500 CVE-2026-64503 CVE-2026-64504 CVE-2026-64505                      CVE-2026-64510 CVE-2026-64514 CVE-2026-64529 CVE-2026-64534                      CVE-2026-64538 CVE-2026-64540 CVE-2026-64541 CVE-2026-64544                      CVE-2026-64546 CVE-2026-64547 CVE-2026-64548 CVE-2026-64549                      CVE-2026-64550 CVE-2026-64551 CVE-2026-64553 CVE-2026-64554                      CVE-2026-64560

    Several vulnerabilities have been discovered in the Linux kernel that     may lead to a privilege escalation, denial of service or information     leaks.

    For Debian 11 bullseye, these problems have been fixed in version     5.10.262-1. This version additionally includes many more bug fixes     from stable updates 5.10.260-5.10.262.

    We recommend that you upgrade your linux packages.

    For the detailed security status of linux please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/linux

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1946:88 advisory.

    * kernel: crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CVE-2025-39964)
      * kernel: Linux kernel Bluetooth: Denial of Service via race condition in hidp_session_thread     (CVE-2023-54120)
      * kernel: Bluetooth: L2CAP: Fix potential user-after-free (CVE-2023-54214)
      * kernel: Bluetooth: btusb: revert use of devm_kzalloc in btusb (CVE-2025-71082)
      * kernel: Bluetooth: SMP: force responder MITM requirements before building the pairing response     (CVE-2026-43334)
      * kernel: iommu/vt-d: Clear Present bit before tearing down PASID entry (CVE-2026-45894)
      * kernel: RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (CVE-2026-46043)
      * kernel: RDMA/rxe: Reject unknown opcodes before ICRC processing (CVE-2026-46133)
      * kernel: Bluetooth: serialize accept_q access (CVE-2026-52918)
      * kernel: dm cache policy smq: fix missing locks in invalidating cache blocks (CVE-2026-53062)
      * kernel: iommu/amd: Fix clone_alias() to use the original device's devid (CVE-2026-53053)
      * kernel: Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CVE-2026-53256)
      * kernel: Bluetooth: RFCOMM: validate skb length in MCC handlers (CVE-2026-53254)
      * kernel: keys: Pin request_key_auth payload in instantiate paths (CVE-2026-63823)
      * kernel: Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CVE-2026-63975)
      * kernel: Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CVE-2026-63947)
      * kernel: nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CVE-2026-64534)
      * kernel: RDMA/rxe: Fix a use-after-free problem in rxe_mmap (CVE-2026-64582)
      * kernel: net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CVE-2026-68293)
      * kernel: Linux kernel Bluetooth RFCOMM: Denial of Service via use-after-free in set_termios     (CVE-2026-68188)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
349668	RHEL 9 : kernel (RHSA-2026:71232)	Nessus	Red Hat Local Security Checks	9/24/2026	9/30/2026	medium
352255	CentOS 9 : kernel-5.14.0-754.el9	Nessus	CentOS Local Security Checks	9/30/2026	9/30/2026	medium
332715	Debian dla-4717 : ata-modules-5.10.0-43-armmp-di - security update	Nessus	Debian Local Security Checks	8/5/2026	9/23/2026	high
362460	MiracleLinux 8 : kernel-4.18.0-553.166.1.el8_10 (AXSA:2026-1946:88)	Nessus	Miracle Linux Local Security Checks	10/1/2026	10/5/2026	high
337224	Amazon Linux 2 : kernel (ALASKERNEL-5.10-2026-129)	Nessus	Amazon Linux Local Security Checks	8/18/2026	9/10/2026	high

Detections

Analytics

Plugins Search

medium

medium

high

high

high