According to the versions of the kernel packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

    iommu/sva: invalidate stale IOTLB entries for kernel address space(CVE-2025-71202)

    iommu: disable SVA when CONFIG_X86 is set(CVE-2025-71089)

    tls: Fix race condition in tls_sw_cancel_work_tx()(CVE-2026-23240)

    apparmor: replace recursive profile removal with iterative approach(CVE-2026-23404)

    macvlan: observe an RCU grace period in macvlan_common_newlink() error path(CVE-2026-23273)

    mm/hugetlb: fix hugetlb_pmd_shared()(CVE-2026-23100)

    leds: led-class: Only Add LED to leds_list when it is fully ready(CVE-2026-23101)

    smb: client: Don#39;t log plaintext credentials in cifs_set_cifscreds(CVE-2026-23303)

    net/sched: teql: fix NULL pointer dereference in iptunnel_xmit on TEQL slave xmit(CVE-2026-23277)

    crypto: algif_aead - Revert to operating out-of-place(CVE-2026-31431)

    netfilter: xt_CT: drop pending enqueued packets on template removal(CVE-2026-23391)

    apparmor: validate DFA start states are in bounds in unpack_pdb(CVE-2026-23269)

    net: usb: kaweth: validate USB endpoints(CVE-2026-23312)

    NFSD: Defer sub-object cleanup in export put callbacks(CVE-2026-31404)

    apparmor: fix side-effect bug in match_char() macro usage(CVE-2026-23406)

    nfnetlink_osf: validate individual option lengths in fingerprints(CVE-2026-23397)

    crypto: virtio - Add spinlock protection with virtqueue notification(CVE-2026-23229)

    Squashfs: check metadata block offset is within range(CVE-2026-23388)

    net: add xmit recursion limit to tunnel xmit functions(CVE-2026-23276)

    RDMA/umad: Reject negative data_len in ib_umad_write(CVE-2026-23243)

    net: annotate data-races around sk-gt;sk_{data_ready,write_space}(CVE-2026-23302)

    drm/vmwgfx: Return the correct value in vmw_translate_ptr functions(CVE-2026-23317)

    net: usb: kalmia: validate USB endpoints(CVE-2026-23365)

    tcp: secure_seq: add back ports to TS offset(CVE-2026-23247)

    net: usb: pegasus: validate USB endpoints(CVE-2026-23290)

    bonding: provide a net pointer to __skb_flow_dissect()(CVE-2026-23119)

    nvme-fc: release admin tagset if init fails(CVE-2026-23261)

    sctp: move SCTP_CMD_ASSOC_SHKEY right after SCTP_CMD_PEER_INIT(CVE-2026-23125)

    icmp: fix NULL pointer dereference in icmp_tag_validation()(CVE-2026-23398)

    net: vxlan: fix nd_tbl NULL dereference when IPv6 is disabled(CVE-2026-23293)

    netfilter: xt_IDLETIMER: reject rev0 reuse of ALARM timer labels(CVE-2026-23274)

    vsock/virtio: fix potential underflow in virtio_transport_get_credit()(CVE-2026-23069)

    platform/x86: classmate-laptop: Add missing NULL pointer checks(CVE-2026-23237)

    ipv6: add NULL checks for idev in SRv6 paths(CVE-2026-23442)

    scsi: qla2xxx: Fix bsg_done() causing double free(CVE-2025-71238)

    vsock/virtio: cap TX credit to local buffer size(CVE-2026-23086)

    sched/deadline: Fix missing ENQUEUE_REPLENISH during PI de-boosting(CVE-2026-23371)

    apparmor: fix race on rawdata dereference(CVE-2026-23410)

    apparmor: Fix double free of ns_name in aa_replace_profiles()(CVE-2026-23408)

    apparmor: fix race between freeing data and fs accessing it(CVE-2026-23411)

    netfilter: nf_tables: unconditionally bump set-gt;nelems before insertion(CVE-2026-23272)

    apparmor: fix differential encoding verification(CVE-2026-23409)

    net: sched: avoid qdisc_reset_all_tx_gt() vs dequeue race for lockless qdiscs(CVE-2026-23340)

    scsi: target: Fix recursive locking in __configfs_open_file()(CVE-2026-23292)

    netfilter: nft_set_pipapo: split gc into unlink and reclaim phase(CVE-2026-23351)

    net: ipv6: fix panic when IPv4 route references loopback IPv6 nexthop(CVE-2026-23300)

    apparmor: fix: limit the number of levels of policy namespaces(CVE-2026-23405)

    perf: Fix __perf_event_overflow() vs perf_remove_from_context() race(CVE-2026-23271)

    blktrace: fix __this_cpu_read/write in preemptible context(CVE-2026-23374)

    apparmor: fix unprivileged local user can do privileged policy management(CVE-2026-23268)

    ipv6: fix NULL pointer deref in ip6_rt_get_dev_rcu()(CVE-2026-23304)

    apparmor: fix missing bounds check on DEFAULT table in verify_dfa()(CVE-2026-23407)

    ext4: fix iloc.bh leak in ext4_xattr_inode_update_ref(CVE-2026-23145)

    media: dvb-core: fix wrong reinitialization of ringbuffer on reopen(CVE-2026-23253)

    net: phy: register phy led_triggers during probe to avoid AB-BA deadlock(CVE-2026-23368)

    net: bridge: fix nd_tbl NULL dereference when IPv6 is disabled(CVE-2026-23381)

    apparmor: fix memory leak in verify_header(CVE-2026-23403)

    x86/efi: defer freeing of boot services memory(CVE-2026-23352)

    net: add proper RCU protection to /proc/net/ptype(CVE-2026-23255)

    ice: Fix memory leak in ice_set_ringparam()(CVE-2026-23389)

    bonding: limit BOND_MODE_8023AD to Ethernet devices(CVE-2026-23099)

    uacce: ensure safe queue release with state management(CVE-2026-23063)

    uacce: implement mremap in uacce_vm_ops to return -EPERM(CVE-2026-23056)

    macvlan: fix error recovery in macvlan_common_newlink()(CVE-2026-23209)

    regmap: Fix race condition in hwspinlock irqsave routine(CVE-2026-23071)

    net/sched: Enforce that teql can only be used as root qdisc(CVE-2026-23074)

    scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count()(CVE-2026-23216)

    net/sched: qfq: Use cl_is_active to determine whether class is active in qfq_rm_from_ag(CVE-2026-23105)

    nvmet-tcp: fixup hang in nvmet_tcp_listen_data_ready()(CVE-2026-23179)

    scsi: qla2xxx: Delay module unload while fabric scan in progress(CVE-2025-71235)

    tracing: Add recursion protection in kernel stack trace recording(CVE-2026-23138)

    scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count()(CVE-2026-23193)

    bonding: annotate data-races around slave-gt;last_rx(CVE-2026-23212)

    be2net: Fix NULL pointer dereference in be_cmd_get_mac_from_list(CVE-2026-23084)

    net/sched: cls_u32: use skb_header_pointer_careful()(CVE-2026-23204)

    scsi: qla2xxx: Validate sp before freeing associated memory(CVE-2025-71236)

    nvmet-tcp: add bounds checks in nvmet_tcp_build_pdu_iovec(CVE-2026-23112)

    scsi: qla2xxx: Free sp in error path to fix system crash(CVE-2025-71232)

    net: fix segmentation of forwarding fraglist GRO(CVE-2026-23154)

    crypto: authencesn - reject too-short AAD (assoclenlt;8) to match ESP/ESN spec(CVE-2026-23060)

    l2tp: avoid one data-race in l2tp_tunnel_del_work()(CVE-2026-23120)

    KVM: Don#39;t clobber irqfd routing type when deassigning irqfd(CVE-2026-23198)

    netdevsim: fix a race issue related to the operation on bpf_bound_progs list(CVE-2026-23126)

Tenable has extracted the preceding description block directly from the EulerOS Virtualization kernel security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    Input: alps - fix use-after-free bugs caused by dev3_register_work(CVE-2025-68822)

    ext4: reject mount if bigalloc with s_first_data_block != 0(CVE-2026-31447)

    tls: Fix race condition in tls_sw_cancel_work_tx()(CVE-2026-23240)

    apparmor: replace recursive profile removal with iterative approach(CVE-2026-23404)

    ethtool: Avoid overflowing userspace buffer on stats query(CVE-2025-68795)

    ipv6: avoid overflows in ip6_datagram_send_ctl()(CVE-2026-31415)

    ceph: add a bunch of missing ceph_path_info initializers(CVE-2026-43408)

    netfilter: nf_conntrack_helper: pass helper to expect cleanup(CVE-2026-43027)

    netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp()(CVE-2026-23457)

    PM: runtime: Fix a race condition related to device removal(CVE-2026-23452)

    net/sched: sch_hfsc: fix divide-by-zero in rtsc_min()(CVE-2026-31423)

    mm: blk-cgroup: fix use-after-free in cgwb_release_workfn()(CVE-2026-31586)

    drm/ioc32: stop speculation on the drm_compat_ioctl path(CVE-2026-31781)

    module: Fix kernel panic when a symbol st_shndx is out of bounds(CVE-2026-31521)

    serial: core: fix infinite loop in handle_tx() for PORT_UNKNOWN(CVE-2026-23472)

    net/tcp-md5: Fix MAC comparison to be constant-time(CVE-2026-43383)

    ext4: avoid infinite loops caused by residual data(CVE-2026-31448)

    smb: client: Don#39;t log plaintext credentials in cifs_set_cifscreds(CVE-2026-23303)

    dmaengine: idxd: Fix memory leak when a wq is reset(CVE-2026-31441)

    bridge: br_nd_send: linearize skb before parsing ND options(CVE-2026-31682)

    net/sched: teql: fix NULL pointer dereference in iptunnel_xmit on TEQL slave xmit(CVE-2026-23277)

    crypto: af_alg - limit RX SG extraction by receive buffer budget(CVE-2026-31677)

    netfilter: xt_CT: drop pending enqueued packets on template removal(CVE-2026-23391)

    apparmor: validate DFA start states are in bounds in unpack_pdb(CVE-2026-23269)

    net: bonding: fix use-after-free in bond_xmit_broadcast()(CVE-2026-31419)

    NFSD: Hold net reference for the lifetime of /proc/fs/nfs/exports fd(CVE-2026-31403)

    ipv4: nexthop: allocate skb dynamically in rtm_get_nexthop()(CVE-2026-31531)

    netfilter: ipset: drop logically empty buckets in mtype_del(CVE-2026-31418)

    dcache: Limit the minimal number of bucket to two(CVE-2026-43071)

    HID: multitouch: Check to ensure report responses match the request(CVE-2026-43047)

    smb: client: fix krb5 mount with username option(CVE-2026-31392)

    net: usb: kaweth: validate USB endpoints(CVE-2026-23312)

    net: usb: cdc_ncm: add ndpoffset to NDP16 nframes bounds check(CVE-2026-23448)

    nvmet: move async event work off nvmet-wq(CVE-2026-31557)

    NFSD: Defer sub-object cleanup in export put callbacks(CVE-2026-31404)

    apparmor: fix side-effect bug in match_char() macro usage(CVE-2026-23406)

    nfnetlink_osf: validate individual option lengths in fingerprints(CVE-2026-23397)

    Squashfs: check metadata block offset is within range(CVE-2026-23388)

    net: add xmit recursion limit to tunnel xmit functions(CVE-2026-23276)

    libceph: Fix potential out-of-bounds access in ceph_handle_auth_reply()(CVE-2026-43407)

    xfs: fix undersized l_iclog_roundoff values(CVE-2026-43365)

    ixgbevf: add missing negotiate_features op to Hyper-V ops table(CVE-2026-43094)

    drm/vmwgfx: Return the correct value in vmw_translate_ptr functions(CVE-2026-23317)

    af_unix: read UNIX_DIAG_VFS data under unix_state_lock(CVE-2026-31673)

    af_key: validate families in pfkey_send_migrate()(CVE-2026-31515)

    smb: client: fix OOB read in smb2_ioctl_query_info QUERY_INFO path(CVE-2026-31708)

    usb: cdns3: gadget: fix NULL pointer dereference in ep_queue(CVE-2026-31755)

    netfilter: nfnetlink_log: account for netlink header size(CVE-2026-31416)

    sunrpc: fix cache_request leak in cache_release(CVE-2026-31400)

    dmaengine: idxd: fix possible wrong descriptor completion in llist_abort_desc()(CVE-2026-31436)

    net: usb: kalmia: validate USB endpoints(CVE-2026-23365)

    ptrace: slightly saner #39;get_dumpable()#39; logic(CVE-2026-46333)

    net: usb: pegasus: validate USB endpoints(CVE-2026-23290)

    bonding: provide a net pointer to __skb_flow_dissect()(CVE-2026-23119)

    KVM: SEV: Drop WARN on large size for KVM_MEMORY_ENCRYPT_REG_REGION(CVE-2026-31590)

    nvme-fc: release admin tagset if init fails(CVE-2026-23261)

    icmp: fix NULL pointer dereference in icmp_tag_validation()(CVE-2026-23398)

    netfilter: nft_ct: fix use-after-free in timeout object destroy(CVE-2026-31665)

    net: correctly handle tunneled traffic on IPV6_CSUM GSO fallback(CVE-2026-43057)

    netfilter: nf_conntrack_expect: skip expectations in other netns via proc(CVE-2026-31496)

    HID: alps: fix NULL pointer dereference in alps_raw_event()(CVE-2026-31625)

    net: usb: pegasus: enable basic endpoint checking(CVE-2026-43156)

    udp: Fix wildcard bind conflict check when using hash2(CVE-2026-31503)

    net/sched: sch_netem: fix out-of-bounds access in packet corruption(CVE-2026-31675)

    net: usb: cdc_ncm: add ndpoffset to NDP32 nframes bounds check(CVE-2026-23447)

    netfilter: ip6t_eui64: reject invalid MAC header for all packets(CVE-2026-31685)

    net: openvswitch: Avoid releasing netdev before teardown completes(CVE-2026-31508)

    net: vxlan: fix nd_tbl NULL dereference when IPv6 is disabled(CVE-2026-23293)

    netfilter: xt_IDLETIMER: reject rev0 reuse of ALARM timer labels(CVE-2026-23274)

    HID: core: Mitigate potential OOB by removing bogus memset()(CVE-2026-43048)

    x86/CPU/AMD: Add RDSEED fix for Zen5(CVE-2025-68313)

    net: ipv6: flowlabel: defer exclusive option free until RCU teardown(CVE-2026-31680)

    mmc: vub300: fix NULL-deref on disconnect(CVE-2026-31651)

    ipv6: add NULL checks for idev in SRv6 paths(CVE-2026-23442)

    openvswitch: defer tunnel netdev_put to RCU release(CVE-2026-31678)

    x86/apic: Disable x2apic on resume if the kernel expects so(CVE-2026-43363)

    netfilter: nf_conntrack_h323: check for zero length in DecodeQ931()(CVE-2026-23455)

    virtio_net: Fix UAF on dst_ops when IFF_XMIT_DST_RELEASE is cleared and napi_tx is false(CVE-2026-31469)

    netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct()(CVE-2026-23458)

    net: consume xmit errors of GSO frames(CVE-2026-43194)

    dmaengine: idxd: Fix not releasing workqueue on .release()(CVE-2026-43064)

    nvdimm/bus: Fix potential use after free in asynchronous initialization(CVE-2026-31399)

    nfsd: fix heap overflow in NFSv4.0 LOCK replay cache(CVE-2026-31402)

    ext4: publish jinode after initialization(CVE-2026-31450)

    net/sched: teql: Fix double-free in teql_master_xmit(CVE-2026-23449)

    media: mc, v4l2: serialize REINIT and REQBUFS with req_queue_mutex(CVE-2026-31473)

    ACPI: EC: clean up handlers on probe failure in acpi_ec_setup()(CVE-2026-31426)

    crypto: af-alg - fix NULL pointer dereference in scatterwalk(CVE-2026-43043)

    netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check()(CVE-2026-31674)

    sched/deadline: Fix missing ENQUEUE_REPLENISH during PI de-boosting(CVE-2026-23371)

    apparmor: fix race on rawdata dereference(CVE-2026-23410)

    apparmor: Fix double free of ns_name in aa_replace_profiles()(CVE-2026-23408)

    e1000/e1000e: Fix leak in DMA error cleanup(CVE-2026-43445)

    futex: Clear stale exiting pointer in futex_lock_pi() retry path(CVE-2026-31555)

    apparmor: fix race between freeing data and fs accessing it(CVE-2026-23411)

    netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case(CVE-2026-23456)

    driver core: platform: use generic driver_override infrastructure(CVE-2026-31527)

    xfs: stop reclaim before pushing AIL during unmount(CVE-2026-31455)

    netfilter: nf_tables: unconditionally bump set-gt;nelems before insertion(CVE-2026-23272)

    ceph: supply snapshot context in ceph_zero_partial_object()(CVE-2026-43273)

    ext4: convert inline data to extents when truncate exceeds inline size(CVE-2026-31452)

    apparmor: fix differential encoding verification(CVE-2026-23409)

    HID: core: clamp report_size in s32ton() to avoid undefined shift(CVE-2026-31624)

    EFI/CPER: don#39;t dump the entire memory region(CVE-2026-43171)

    pstore: ram_core: fix incorrect success return when vmap() fails(CVE-2026-43124)

    USB: usbtmc: Use usb_bulk_msg_killable() with user-specified timeouts(CVE-2026-43429)

    net: sched: avoid qdisc_reset_all_tx_gt() vs dequeue race for lockless qdiscs(CVE-2026-23340)

    scsi: target: Fix recursive locking in __configfs_open_file()(CVE-2026-23292)

    netfilter: ctnetlink: use netlink policy range checks(CVE-2026-31495)

    netfilter: nft_set_pipapo: split gc into unlink and reclaim phase(CVE-2026-23351)

    kprobes: avoid crash when rmmod/insmod after ftrace killed(CVE-2026-43409)

    xfs: avoid dereferencing log items after push callbacks(CVE-2026-31453)

    net: ipv6: fix panic when IPv4 route references loopback IPv6 nexthop(CVE-2026-23300)

    netfilter: x_tables: ensure names are nul-terminated(CVE-2026-43028)

    apparmor: fix: limit the number of levels of policy namespaces(CVE-2026-23405)

    net/sched: cls_fw: fix NULL pointer dereference on shared blocks(CVE-2026-31421)

    openvswitch: validate MPLS set/set_masked payload length(CVE-2026-31679)

    perf: Fix __perf_event_overflow() vs perf_remove_from_context() race(CVE-2026-23271)

    bpf: Fix regsafe() for pointers to packet(CVE-2026-43030)

    tipc: fix bc_ackers underflow on duplicate GRP_ACK_MSG(CVE-2026-31662)

    net/sched: cls_flow: fix NULL pointer dereference on shared blocks(CVE-2026-31422)

    KVM: x86: Use scratch field in MMIO fragment to hold small write values(CVE-2026-31588)

    PCI: Fix pci_slot_trylock() error handling(CVE-2026-43211)

    net: rfkill: prevent unlimited numbers of rfkill events from being created(CVE-2026-31670)

    apparmor: fix unprivileged local user can do privileged policy management(CVE-2026-23268)

    comedi: dt2815: add hardware detection to prevent crash(CVE-2026-31751)

    netfilter: nf_conntrack_sip: fix use of uninitialized rtp_addr in process_sdp(CVE-2026-31427)

    ipv6: fix NULL pointer deref in ip6_rt_get_dev_rcu()(CVE-2026-23304)

    apparmor: fix missing bounds check on DEFAULT table in verify_dfa()(CVE-2026-23407)

    xfs: save ailp before dropping the AIL lock in push callbacks(CVE-2026-31454)

    ext4: avoid allocate block from corrupted group in ext4_mb_find_by_goal()(CVE-2026-43068)

    media: dvb-core: fix wrong reinitialization of ringbuffer on reopen(CVE-2026-23253)

    ext4: validate p_idx bounds in ext4_ext_correct_indexes(CVE-2026-31449)

    netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD(CVE-2026-31428)

    xfrm: prevent policy_hthresh.work from racing with netns teardown(CVE-2026-31516)

    media: dvb-net: fix OOB access in ULE extension header tables(CVE-2026-31405)

    perf/x86/intel/uncore: Fix die ID init and look up bugs(CVE-2026-43344)

    crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption(CVE-2026-43033)

    powerpc, perf: Check that current-gt;mm is alive before getting user callchain(CVE-2026-43416)

    net: phy: register phy led_triggers during probe to avoid AB-BA deadlock(CVE-2026-23368)

    net: bridge: fix nd_tbl NULL dereference when IPv6 is disabled(CVE-2026-23381)

    perf/x86/intel/uncore: Skip discovery table for offline dies(CVE-2026-43079)

    apparmor: fix memory leak in verify_header(CVE-2026-23403)

    nvme-pci: ensure we#39;re polling a polled queue(CVE-2026-31523)

    xfrm: clear trailing padding in build_polexpire()(CVE-2026-31664)

    x86/efi: defer freeing of boot services memory(CVE-2026-23352)

    netfilter: nf_conntrack_expect: use expect-gt;helper(CVE-2026-31414)

    net: add proper RCU protection to /proc/net/ptype(CVE-2026-23255)

    ice: Fix memory leak in ice_set_ringparam()(CVE-2026-23389)

    usb: typec: ucsi: validate connector number in ucsi_notify_common()(CVE-2026-31729)

    ipv6: icmp: clear skb2-gt;cb[] in ip6_err_gen_icmpv6_unreach()(CVE-2026-43038)

    netfilter: nf_conntrack_h323: fix OOB read in decode_choice()(CVE-2026-43233)

    net: skbuff: propagate shared-frag marker through frag-transfer helpers(CVE-2026-43503)

    mailbox: Prevent out-of-bounds access in fw_mbox_index_xlate()(CVE-2026-43281)

    netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop()(CVE-2026-43453)

    xfs: fix freemap adjustments when adding xattrs to leaf blocks(CVE-2026-43158)

    xfs: delete attr leaf freemap entries when empty(CVE-2026-43187)

    netfilter: x_tables: guard option walkers against 1-byte tail reads(CVE-2026-43452)

    crypto: pcrypt - Fix handling of MAY_BACKLOG requests(CVE-2026-43493)

    netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table()(CVE-2026-43450)

    usb: ulpi: fix double free in ulpi_register_interface() error path(CVE-2026-31759)

    net: ipv6: ndisc: fix ndisc_ra_useropt to initialize nduseropt_padX fields to zero to prevent an info-     leak(CVE-2026-43040)

    ip6_tunnel: clear skb2-gt;cb[] in ip4ip6_err()(CVE-2026-43037)

    net: usb: kaweth: remove TX queue manipulation in kaweth_set_rx_mode(CVE-2026-43180)

    usb: usbtmc: Flush anchored URBs in usbtmc_release(CVE-2026-31758)

    netfilter: nft_ct: drop pending enqueued packets on removal(CVE-2026-43060)

Tenable has extracted the preceding description block directly from the EulerOS kernel security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 10 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-50372 advisory.

    - net/sched: fix pedit partial COW leading to page cache corruption (Rajat Gupta)   {CVE-2026-46331}
    - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Christian Brauner)  [Orabug: 39668743]     {CVE-2026-46242}
    - net: skbuff: fix missing zerocopy reference in pskb_carve helpers (Minh Nguyen)  [Orabug: 39656679]     {CVE-2026-52943}
    - arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Rutland)  [Orabug: 39548792]     {CVE-2025-10263}
    - openvswitch: vport: fix self-deadlock on release of tunnel ports (Ilya Maximets) {CVE-2026-46165}
    - iommu/amd: serialize sequence allocation under concurrent TLB invalidations (Ankit Soni)     {CVE-2026-43220}
    - usb: ulpi: fix memory leak on ulpi_register() error paths (Felix Gu) {CVE-2026-46109}
    - smb: client: reject userspace cifs.spnego descriptions (Asim Viladi Oglu Manizada)  [Orabug: 39463671]     {CVE-2026-46243}
    - net: skbuff: propagate shared-frag marker through frag-transfer helpers (Hyunwoo Kim) [Orabug:
    39368826,39441323] {CVE-2026-43503,CVE-2026-46300}
    - net: skbuff: preserve shared-frag marker during coalescing (William Bowling) [Orabug: 39368826]     {CVE-2026-46300}
    - netfilter: reject zero shift in nft_bitwise (Kai Ma) [Orabug: 39452464] {CVE-2026-46101}
    - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Andrea Mayer) [Orabug: 39452457]     {CVE-2026-46099}
    - ALSA: caiaq: fix usb_dev refcount leak on probe failure (Deepanshu Kartikey) [Orabug: 39452739]     {CVE-2026-46048}
    - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Greg Kroah-Hartman) [Orabug: 39426003]     {CVE-2026-43501}
    - ALSA: caiaq: Fix potentially leftover ep1_in_urb at error path (Takashi Iwai) [Orabug: 39452746]     {CVE-2026-45992}
    - net: bonding: fix use-after-free in bond_xmit_broadcast() (Xiang Mei) [Orabug: 39205989]     {CVE-2026-31419}
    - crypto: authencesn - reject short ahash digests during instance creation (Yucheng Lu) [Orabug: 39452231]     {CVE-2026-46033}
    - spi: fix resource leaks on device setup failure (Johan Hovold) [Orabug: 39452400] {CVE-2026-46083}
    - net: qrtr: ns: Limit the total number of nodes (Manivannan Sadhasivam) [Orabug: 39452123]     {CVE-2026-46003}
    - net: bridge: use a stable FDB dst snapshot in RCU readers (Zhengchuan Liang) [Orabug: 39452411]     {CVE-2026-46086}
    - net: qrtr: ns: Limit the maximum number of lookups (Manivannan Sadhasivam) [Orabug: 39452207]     {CVE-2026-46026}
    - net: qrtr: ns: Limit the maximum server registration per node (Manivannan Sadhasivam) [Orabug: 39410851]     {CVE-2026-43491}
    - RDMA/mana_ib: Disable RX steering on RSS QP destroy (Long Li) [Orabug: 39452406] {CVE-2026-46084}
    - media: rc: igorplugusb: heed coherency rules (Oliver Neukum) [Orabug: 39452432] {CVE-2026-46091}
    - wifi: mwifiex: fix use-after-free in mwifiex_adapter_cleanup() (Daniel Hodges) [Orabug: 39452343]     {CVE-2026-46069}
    - thermal: core: Fix thermal zone governor cleanup issues (Rafael J. Wysocki) [Orabug: 39452186]     {CVE-2026-46021}
    - smb: client: validate the whole DACL before rewriting it in cifsacl (Michael Bommarito) [Orabug:
    39300611] {CVE-2026-31709}
    - scsi: sd: fix missing put_disk() when device_add(&disk_dev) fails (Yang Xiuwei) [Orabug: 39452100]     {CVE-2026-45997}
    - rtmutex: Use waiter::task instead of current in remove_waiter() (Keenan Dong) [Orabug: 39425998]     {CVE-2026-43499}
    - ceph: only d_add() negative dentries when they are unhashed (Max Kellermann) [Orabug: 39452291]     {CVE-2026-46052}
    - dm mirror: fix integer overflow in create_dirty_log() (Junrui Luo) [Orabug: 39452196] {CVE-2026-46023}
    - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (Shuvam Pandey) [Orabug: 39452304]     {CVE-2026-46056}
    - tcp: call sk_data_ready() after listener migration (Zhenzhong Wu) [Orabug: 39452159] {CVE-2026-46015}
    - inotify: fix watch count leak when fsnotify_add_inode_mark_locked() fails (Chia-Ming Chang) [Orabug:
    39452250] {CVE-2026-46040}
    - md/raid5: validate payload size before accessing journal metadata (Junrui Luo) [Orabug: 39452349]     {CVE-2026-46070}
    - md/raid5: fix soft lockup in retry_aligned_read() (Chia-Ming Chang) [Orabug: 39452287] {CVE-2026-46051}
    - ext4: fix missing brelse() in ext4_xattr_inode_dec_ref_all() (Sohei Koyama) [Orabug: 39452269]     {CVE-2026-46046}
    - ext4: fix bounds check in check_xattrs() to prevent out-of-bounds access (Deepanshu Kartikey) [Orabug:
    39452442] {CVE-2026-46094}
    - io_uring/poll: fix multishot recv missing EOF on wakeup race (Jens Axboe) {CVE-2026-23473}
    - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Kevin Cheng) [Orabug: 39452372]     {CVE-2026-46076}
    - KVM: SVM: Inject #UD for INVLPGA if EFER.SVME=0 (Kevin Cheng) [Orabug: 39452394] {CVE-2026-46082}
    - KVM: nSVM: Sync interrupt shadow to cached vmcb12 after VMRUN of L2 (Yosry Ahmed) [Orabug: 39452061]     {CVE-2026-45987}
    - xfs: fix a resource leak in xfs_alloc_buftarg() (Haoxiang Li) [Orabug: 39452131] {CVE-2026-46005}
    - libceph: Prevent potential null-ptr-deref in ceph_handle_auth_reply() (Raphael Zimmer) [Orabug:
    39452201] {CVE-2026-46024}
    - ipv4: icmp: validate reply type before using icmp_pointers (Ruide Cao) [Orabug: 39452243]     {CVE-2026-46037}
    - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Hkbinbin) [Orabug: 39452259]     {CVE-2026-46043}
    - net: qrtr: ns: Free the node during ctrl_cmd_bye() (Manivannan Sadhasivam) [Orabug: 39452246]     {CVE-2026-46038}
    - rxrpc: Fix rxkad crypto unalignment handling (David Howells) [Orabug: 39452728] {CVE-2026-46085}
    - ALSA: caiaq: Handle probe errors properly (Takashi Iwai) [Orabug: 39452126] {CVE-2026-46004}
    - rbd: fix null-ptr-deref when device_add_disk() fails (Dawei Feng) [Orabug: 39452385] {CVE-2026-46079}
    - md/raid10: fix deadlock with check operation and nowait requests (Josh Hunt) [Orabug: 39452284]     {CVE-2026-46050}
    - jbd2: fix deadlock in jbd2_journal_cancel_revoke() (Zhang Yi) [Orabug: 39452318] {CVE-2026-46061}
    - erofs: fix the out-of-bounds nameoff handling for trailing dirents (Gao Xiang) [Orabug: 39452380]     {CVE-2026-46078}
    - ALSA: ctxfi: Add fallback to default RSR for S/PDIF (Harin Lee) [Orabug: 39452280] {CVE-2026-46049}
    - ext2: reject inodes with zero i_nlink and valid mode in ext2_iget() (Vasiliy Kovalev) [Orabug: 39452119]     {CVE-2026-46002}
    - net: qrtr: ns: Fix use-after-free in driver remove() (Manivannan Sadhasivam) [Orabug: 39452274]     {CVE-2026-46047}
    - net: strparser: fix skb_head leak in strp_abort_strp() (Luxiao Xu) [Orabug: 39452468] {CVE-2026-46102}
    - ALSA: control: Validate buf_len before strnlen() in snd_ctl_elem_init_enum_names() (Ziqing Chen)     [Orabug: 39452416] {CVE-2026-46088}
    - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Herbert Xu) [Orabug: 39410863] {CVE-2026-43493}
    - wifi: rtw88: check for PCI upstream bridge existence (Fedor Pchelkin) [Orabug: 39452437]     {CVE-2026-46092}
    - zram: do not forget to endio for partial discard requests (Sergey Senozhatsky) [Orabug: 39452420]     {CVE-2026-46089}
    - ocfs2: split transactions in dio completion to avoid credit exhaustion (Heming Zhao) [Orabug: 39452388]     {CVE-2026-46080}
    - drm/amdgpu: Limit BO list entry count to prevent resource exhaustion (Jesse Zhang) [Orabug: 39167551]     {CVE-2026-23468}
    - padata: Fix pd UAF once and for all (Herbert Xu) [Orabug: 38335055] {CVE-2025-38584}
    - drm/nouveau: fix u32 overflow in pushbuf reloc bounds check (Greg Kroah-Hartman) [Orabug: 39452133]     {CVE-2026-46006}
    - ALSA: usb-audio: stop parsing UAC2 rates at MAX_NR_RATES (Cassio Gabriel) [Orabug: 39452170]     {CVE-2026-46018}
    - Buffer overflow in drivers/xen/sys-hypervisor.c (Juergen Gross) [Orabug: 39305898] {CVE-2026-31786}
    - xen/privcmd: fix double free via VMA splitting (Juergen Gross) [Orabug: 39305908] {CVE-2026-31787}
    - rxrpc: Fix missing validation of ticket length in non-XDR key preparsing (Anderson Nascimento) [Orabug:
    39300563] {CVE-2026-31696}
    - crypto: ccp: Don't attempt to copy ID to userspace if PSP command failed (Sean Christopherson)     {CVE-2026-31697}
    - crypto: ccp: Don't attempt to copy PDH cert to userspace if PSP command failed (Sean Christopherson)     {CVE-2026-31698}
    - crypto: ccp: Don't attempt to copy CSR to userspace if PSP command failed (Sean Christopherson)     {CVE-2026-31699}
    - net/packet: fix TOCTOU race on mmap'd vnet_hdr in tpacket_snd() (Bingquan Chen) {CVE-2026-31700}
    - ALSA: caiaq: take a reference on the USB device in create_card() (Berk Cem Goksel) [Orabug: 39300586]     {CVE-2026-31701}
    - smb: client: fix OOB read in smb2_ioctl_query_info QUERY_INFO path (Michael Bommarito) [Orabug:
    39300607] {CVE-2026-31708}
    - smb: client: require a full NFS mode SID before reading mode bits (Michael Bommarito) [Orabug: 39343707]     {CVE-2026-43350}
    - fuse: reject oversized dirents in page cache (Samuel Page) [Orabug: 39300556] {CVE-2026-31694}
    - mm/pagewalk: fix race between concurrent split and refault (Max Boone) [Orabug: 39250782]     {CVE-2026-31456}
    - wifi: mac80211: always free skb on ieee80211_tx_prepare_skb() failure (Felix Fietkau) [Orabug: 39167472]     {CVE-2026-23444}
    - mm/userfaultfd: fix hugetlb fault mutex hash calculation (Jianhui Zhou) [Orabug: 39273453]     {CVE-2026-31575}
    - ipv6: add NULL checks for idev in SRv6 paths (Heminhong) [Orabug: 39167467] {CVE-2026-23442}
    - ocfs2: fix out-of-bounds write in ocfs2_write_end_inline (Joseph Qi) [Orabug: 39331090] {CVE-2026-43075}
    - ocfs2: validate inline data i_size during inode read (Deepanshu Kartikey) [Orabug: 39331097]     {CVE-2026-43076}
    - media: as102: fix to not free memory after the device is registered in as102_usb_probe() (Jeongjun Park)     [Orabug: 39273467] {CVE-2026-31578}
    - bcache: fix cached_dev.sb_bio use-after-free and crash (Mingzhe Zou) [Orabug: 39273481] {CVE-2026-31580}
    - ALSA: 6fire: fix use-after-free on disconnect (Berk Cem Goksel) [Orabug: 39273486] {CVE-2026-31581}
    - media: em28xx: fix use-after-free in em28xx_v4l2_open() (Abhishek Kumar) [Orabug: 39273493]     {CVE-2026-31583}
    - mm: blk-cgroup: fix use-after-free in cgwb_release_workfn() (Breno Leitao) [Orabug: 39273507]     {CVE-2026-31586}
    - KVM: x86: Use scratch field in MMIO fragment to hold small write values (Sean Christopherson) [Orabug:
    39273521] {CVE-2026-31588}
    - x86-64: rename misleadingly named '__copy_user_nocache()' function (Linus Torvalds) [Orabug: 39323162]     {CVE-2026-43073}
    - kernel: be more careful about dup_mmap() failures and uprobe registering (Liam R. Howlett)     {CVE-2025-21709}
    - gpiolib: fix race condition for gdev->srcu (Pawel Narewski) [Orabug: 38887677] {CVE-2026-22986}
    - KVM: SEV: Drop WARN on large size for KVM_MEMORY_ENCRYPT_REG_REGION (Sean Christopherson) [Orabug:
    39273529] {CVE-2026-31590}
    - KVM: SEV: Reject attempts to sync VMSA of an already-launched/encrypted vCPU (Sean Christopherson)     [Orabug: 39273553] {CVE-2026-31593}
    - ocfs2: handle invalid dinode in ocfs2_group_extend (Zhengyuan Huang) [Orabug: 39273569] {CVE-2026-31596}
    - ocfs2: fix use-after-free in ocfs2_fault() when VM_FAULT_RETRY (Tejas Bharambe) [Orabug: 39273578]     {CVE-2026-31597}
    - ocfs2: fix possible deadlock between unlink and dio_end_io_write (Joseph Qi) [Orabug: 39273586]     {CVE-2026-31598}
    - dcache: Limit the minimal number of bucket to two (Zhihao Cheng) [Orabug: 39323133] {CVE-2026-43071}
    - ALSA: ctxfi: Limit PTP to a single page (Harin Lee) [Orabug: 39273608] {CVE-2026-31602}
    - wifi: rtw88: fix device leak on probe failure (Johan Hovold) [Orabug: 39273620] {CVE-2026-31604}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1778769697 advisory.

  - In the Linux kernel, the following vulnerability has been resolved: xprtrdma: treat all calls not a bcall     when bc_serv is NULL When a rdma server returns a fault format reply, nfs v3 client may treats it as a     bcall when bc service is not exist. The debug message at rpcrdma_bc_receive_call are, [56579.837169] RPC:
    rpcrdma_bc_receive_call: callback XID 00000001, length=20 [56579.837174] RPC: rpcrdma_bc_receive_call: 00     00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 After that, rpcrdma_bc_receive_call will meets     NULL pointer as, [ 226.057890] BUG: unable to handle kernel NULL pointer dereference at 00000000000000c8     ... [ 226.058704] RIP: 0010:_raw_spin_lock+0xc/0x20 ... [ 226.059732] Call Trace: [ 226.059878]     rpcrdma_bc_receive_call+0x138/0x327 [rpcrdma] [ 226.060011] __ib_process_cq+0x89/0x170 [ib_core] [     226.060092] ib_cq_poll_work+0x26/0x80 [ib_core] [ 226.060257] process_one_work+0x1a7/0x360 [ 226.060367] ?     create_worker+0x1a0/0x1a0 [ 226.060440] worker_thread+0x30/0x390 [ 226.060500] ? create_worker+0x1a0/0x1a0     [ 226.060574] kthread+0x116/0x130 [ 226.060661] ? kthread_flush_work_fn+0x10/0x10 [ 226.060724]     ret_from_fork+0x35/0x40 ... (CVE-2022-49321)

  - In the Linux kernel, the following vulnerability has been resolved: af_unix: Fix a data-race in     unix_dgram_peer_wake_me(). unix_dgram_poll() calls unix_dgram_peer_wake_me() without `other`'s lock held     and check if its receive queue is full. Here we need to use unix_recvq_full_lockless() instead of     unix_recvq_full(), otherwise KCSAN will report a data-race. (CVE-2022-49344)

  - In the Linux kernel, the following vulnerability has been resolved: x86/MCE/AMD: Fix memory leak when     threshold_create_bank() fails In mce_threshold_create_device(), if threshold_create_bank() fails, the     previously allocated threshold banks array @bp will be leaked because the call to     mce_threshold_remove_device() will not free it. This happens because mce_threshold_remove_device() fetches     the pointer through the threshold_banks per-CPU variable but bp is written there only after the bank     creation is successful, and not before, when threshold_create_bank() fails. Add a helper which unwinds all     the bank creation work previously done and pass into it the previously allocated threshold banks array for     freeing. [ bp: Massage. ] (CVE-2022-49549)

  - In the Linux kernel, the following vulnerability has been resolved: mm/mempolicy: fix uninit-value in     mpol_rebind_policy() mpol_set_nodemask()(mm/mempolicy.c) does not set up nodemask when pol->mode is     MPOL_LOCAL. Check pol->mode before access pol->w.cpuset_mems_allowed in     mpol_rebind_policy()(mm/mempolicy.c). BUG: KMSAN: uninit-value in mpol_rebind_policy mm/mempolicy.c:352     [inline] BUG: KMSAN: uninit-value in mpol_rebind_task+0x2ac/0x2c0 mm/mempolicy.c:368 mpol_rebind_policy     mm/mempolicy.c:352 [inline] mpol_rebind_task+0x2ac/0x2c0 mm/mempolicy.c:368 cpuset_change_task_nodemask     kernel/cgroup/cpuset.c:1711 [inline] cpuset_attach+0x787/0x15e0 kernel/cgroup/cpuset.c:2278     cgroup_migrate_execute+0x1023/0x1d20 kernel/cgroup/cgroup.c:2515 cgroup_migrate     kernel/cgroup/cgroup.c:2771 [inline] cgroup_attach_task+0x540/0x8b0 kernel/cgroup/cgroup.c:2804
    __cgroup1_procs_write+0x5cc/0x7a0 kernel/cgroup/cgroup-v1.c:520 cgroup1_tasks_write+0x94/0xb0     kernel/cgroup/cgroup-v1.c:539 cgroup_file_write+0x4c2/0x9e0 kernel/cgroup/cgroup.c:3852     kernfs_fop_write_iter+0x66a/0x9f0 fs/kernfs/file.c:296 call_write_iter include/linux/fs.h:2162 [inline]     new_sync_write fs/read_write.c:503 [inline] vfs_write+0x1318/0x2030 fs/read_write.c:590     ksys_write+0x28b/0x510 fs/read_write.c:643 __do_sys_write fs/read_write.c:655 [inline] __se_sys_write     fs/read_write.c:652 [inline] __x64_sys_write+0xdb/0x120 fs/read_write.c:652 do_syscall_x64     arch/x86/entry/common.c:51 [inline] do_syscall_64+0x54/0xd0 arch/x86/entry/common.c:82     entry_SYSCALL_64_after_hwframe+0x44/0xae Uninit was created at: slab_post_alloc_hook mm/slab.h:524     [inline] slab_alloc_node mm/slub.c:3251 [inline] slab_alloc mm/slub.c:3259 [inline]     kmem_cache_alloc+0x902/0x11c0 mm/slub.c:3264 mpol_new mm/mempolicy.c:293 [inline]     do_set_mempolicy+0x421/0xb70 mm/mempolicy.c:853 kernel_set_mempolicy mm/mempolicy.c:1504 [inline]
    __do_sys_set_mempolicy mm/mempolicy.c:1510 [inline] __se_sys_set_mempolicy+0x44c/0xb60 mm/mempolicy.c:1507
    __x64_sys_set_mempolicy+0xd8/0x110 mm/mempolicy.c:1507 do_syscall_x64 arch/x86/entry/common.c:51 [inline]     do_syscall_64+0x54/0xd0 arch/x86/entry/common.c:82 entry_SYSCALL_64_after_hwframe+0x44/0xae KMSAN: uninit-     value in mpol_rebind_task (2)     https://syzkaller.appspot.com/bug?id=d6eb90f952c2a5de9ea718a1b873c55cb13b59dc This patch seems to fix     below bug too. KMSAN: uninit-value in mpol_rebind_mm (2)     https://syzkaller.appspot.com/bug?id=f2fecd0d7013f54ec4162f60743a2b28df40926b The uninit-value is     pol->w.cpuset_mems_allowed in mpol_rebind_policy(). When syzkaller reproducer runs to the beginning of     mpol_new(), mpol_new() mm/mempolicy.c do_mbind() mm/mempolicy.c kernel_mbind() mm/mempolicy.c `mode` is     1(MPOL_PREFERRED), nodes_empty(*nodes) is `true` and `flags` is 0. Then mode = MPOL_LOCAL; ...
    policy->mode = mode; policy->flags = flags; will be executed. So in mpol_set_nodemask(),     mpol_set_nodemask() mm/mempolicy.c do_mbind() kernel_mbind() pol->mode is 4 (MPOL_LOCAL), that `nodemask`     in `pol` is not initialized, which will be accessed in mpol_rebind_policy(). (CVE-2022-49567)

  - In the Linux kernel, the following vulnerability has been resolved: i2c: piix4: Fix a memory leak in the     EFCH MMIO support The recently added support for EFCH MMIO regions introduced a memory leak in that code     path. The leak is caused by the fact that release_resource() merely removes the resource from the tree but     does not free its memory. We need to call release_mem_region() instead, which does free the memory. As a     nice side effect, this brings back some symmetry between the legacy and MMIO paths. (CVE-2022-49653)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
320742	EulerOS Virtualization 2.13.0 : kernel (EulerOS-SA-2026-2400)	Nessus	Huawei Local Security Checks	6/12/2026	6/15/2026	high
326126	EulerOS 2.0 SP12 : kernel (EulerOS-SA-2026-2595)	Nessus	Huawei Local Security Checks	7/10/2026	10/15/2026	high
311340	Amazon Linux 2023 : bpftool6.18, kernel6.18, kernel6.18-devel (ALAS2023-2026-1596)	Nessus	Amazon Linux Local Security Checks	4/30/2026	6/17/2026	high
311745	SUSE SLED15 / SLES15 : Security update for the Linux Kernel (SUSE-SU-2026:1661-1)	Nessus	SuSE Local Security Checks	5/2/2026	9/29/2026	high
320698	EulerOS Virtualization 2.13.1 : kernel (EulerOS-SA-2026-2371)	Nessus	Huawei Local Security Checks	6/12/2026	6/15/2026	high
325292	Oracle Linux 10 / 9 : Unbreakable Enterprise kernel (ELSA-2026-50372)	Nessus	Oracle Linux Local Security Checks	7/6/2026	7/8/2026	high
362341	AlmaLinux 9.2 [TuxCare] Security Update: bpftool / kernel / kernel-abi-stablelists / kernel-core / etc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1778769697)	Nessus	Alma Linux Local Security Checks	10/1/2026	10/2/2026	high

Detections

Analytics

Plugins Search

high

high

high

high

high

high

high