The remote SUSE Linux SLES12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3594-1 advisory.

    The SUSE Linux Enterprise 12 SP5 kernel was updated to fix various security issues:

    The following security issues were fixed:

    - CVE-2026-31450: ext4: publish jinode after initialization (bsc#1262618).
    - CVE-2026-31510: Bluetooth: L2CAP: Fix null-ptr-deref on l2cap_sock_ready_cb (bsc#1262603).
    - CVE-2026-31624: HID: core: clamp report_size in s32ton() to avoid undefined shift (bsc#1263657).
    - CVE-2026-43068: ext4: avoid allocate block from corrupted group in ext4_mb_find_by_goal() (bsc#1264255).
    - CVE-2026-43069: Bluetooth: hci_ll: Fix firmware leak on error path (bsc#1264190).
    - CVE-2026-43123: fbcon: check return value of con2fb_acquire_newinfo() (bsc#1264598).
    - CVE-2026-43124: pstore: ram_core: fix incorrect success return when vmap() fails (bsc#1264545).
    - CVE-2026-43156: net: usb: pegasus: enable basic endpoint checking (bsc#1265092).
    - CVE-2026-43168: ocfs2: fix reflink preserve cleanup issue (bsc#1264537).
    - CVE-2026-43180: net: usb: kaweth: remove TX queue manipulation in kaweth_set_rx_mode (bsc#1265093).
    - CVE-2026-43211: PCI: Fix pci_slot_trylock() error handling (bsc#1264387).
    - CVE-2026-43216: net: Drop the lock in skb_may_tx_timestamp() (bsc#1264319).
    - CVE-2026-43226: net/rds: No shortcut out of RDS_CONN_ERROR (bsc#1264544).
    - CVE-2026-43230: net/rds: Clear reconnect pending bit (bsc#1264539).
    - CVE-2026-43244: kcm: fix zero-frag skb in frag_list on partial sendmsg error (bsc#1264321).
    - CVE-2026-43253: iommu/amd: move wait_on_sem() out of spinlock (bsc#1264419).
    - CVE-2026-43266: EFI/CPER: don't go past the ARM processor CPER record buffer (bsc#1264418).
    - CVE-2026-43268: hfsplus: pretend special inodes as regular files (bsc#1265083).
    - CVE-2026-43273: ceph: supply snapshot context in ceph_zero_partial_object() (bsc#1264446).
    - CVE-2026-43281: mailbox: Prevent out-of-bounds access in fw_mbox_index_xlate() (bsc#1264534).
    - CVE-2026-43287: drm: Account property blob allocations to memcg (bsc#1265037).
    - CVE-2026-43308: btrfs: don't BUG() on unexpected delayed ref type in run_one_delayed_ref()     (bsc#1264712).
    - CVE-2026-43309: md raid: fix hang when stopping arrays with metadata through dm-raid (bsc#1264827).
    - CVE-2026-43313: ACPI: processor: Fix NULL-pointer dereference in acpi_processor_errata_piix4()     (bsc#1264821).
    - CVE-2026-43370: drm/amdgpu: Fix use-after-free race in VM acquire (bsc#1264782).
    - CVE-2026-43373: net: ncsi: fix skb leak in error paths (bsc#1265079).
    - CVE-2026-43383: net/tcp-md5: Fix MAC comparison to be constant-time (bsc#1264744).
    - CVE-2026-43425: usb: image: mdc800: kill download URB on timeout (bsc#1265133).
    - CVE-2026-43427: usb: class: cdc-wdm: fix reordering issue in read code path (bsc#1264746).
    - CVE-2026-43445: e1000/e1000e: Fix leak in DMA error cleanup (bsc#1265041).
    - CVE-2026-43449: nvme-pci: Fix slab-out-of-bounds in nvme_dbbuf_set (bsc#1265023).
    - CVE-2026-43450: netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (bsc#1264794).
    - CVE-2026-43451: netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (bsc#1265009).
    - CVE-2026-43452: netfilter: x_tables: guard option walkers against 1-byte tail reads (bsc#1265142).
    - CVE-2026-43466: net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (bsc#1264790).
    - CVE-2026-43493: crypto: pcrypt - Fix handling of MAY_BACKLOG requests (bsc#1265627).
    - CVE-2026-43496: net/sched: sch_red: Replace direct dequeue call with peek and qdisc_dequeue_peeked     (bsc#1266000).
    - CVE-2026-45857: scsi: csiostor: Fix dereference of null pointer rn (bsc#1266458).
    - CVE-2026-45858: ext4: subdivide EXT4_EXT_DATA_VALID1 (bsc#1266773).
    - CVE-2026-45871: tpm: st33zp24: Fix missing cleanup on get_burstcount() error (bsc#1266755).
    - CVE-2026-45877: HID: intel-ish-hid: fix NULL-ptr-deref in ishtp_bus_remove_all_clients (bsc#1266468).
    - CVE-2026-45899: ext4: drop extent cache when splitting extent fails (bsc#1266883).
    - CVE-2026-45905: xfrm: fix ip_rt_bug race in icmp_route_lookup reverse path (bsc#1266685).
    - CVE-2026-45915: fat: avoid parent link count underflow in rmdir (bsc#1266896).
    - CVE-2026-45917: ipvs: do not keep dest_dst if dev is going down (bsc#1266900).
    - CVE-2026-45920: ext4: fix dirtyclusters double decrement on fs shutdown (bsc#1266893).
    - CVE-2026-45923: net: usb: catc: enable basic endpoint checking (bsc#1266894).
    - CVE-2026-45981: s390/cio: Fix device lifecycle handling in css_alloc_subchannel() (bsc#1267204).
    - CVE-2026-45985: ext4: don't set EXT4_GET_BLOCKS_CONVERT when splitting before submitting I/O     (bsc#1266700).
    - CVE-2026-45994: ibmasm: fix OOB reads in command_file_write due to missing size checks (bsc#1267432).
    - CVE-2026-45997: scsi: sd: fix missing put_disk() when device_add(&disk_dev) fails (bsc#1266740).
    - CVE-2026-46018: ALSA: usb-audio: stop parsing UAC2 rates at MAX_NR_RATES (bsc#1266751).
    - CVE-2026-46023: dm mirror: fix integer overflow in create_dirty_log() (bsc#1267449).
    - CVE-2026-46027: net/smc: avoid early lgr access in smc_clc_wait_msg (bsc#1266744).
    - CVE-2026-46033: crypto: authencesn - reject short ahash digests during instance creation (bsc#1266692).
    - CVE-2026-46040: inotify: fix watch count leak when fsnotify_add_inode_mark_locked() fails (bsc#1267472).
    - CVE-2026-46049: ALSA: ctxfi: Add fallback to default RSR for S/PDIF (bsc#1267448).
    - CVE-2026-46051: md/raid5: fix soft lockup in retry_aligned_read() (bsc#1267360).
    - CVE-2026-46056: Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (bsc#1267435).
    - CVE-2026-46064: ibmasm: fix heap over-read in ibmasm_send_i2o_message() (bsc#1267497).
    - CVE-2026-46068: crypto: nx - fix bounce buffer leaks in nx842_crypto_{alloc,free}_ctx (bsc#1267592).
    - CVE-2026-46086: net: bridge: use a stable FDB dst snapshot in RCU readers (bsc#1267524).
    - CVE-2026-46088: ALSA: control: Validate buf_len before strnlen() in snd_ctl_elem_init_enum_names()     (bsc#1267226).
    - CVE-2026-46102: net: strparser: fix skb_head leak in strp_abort_strp() (bsc#1267502).
    - CVE-2026-46146: ALSA: usb-audio: Avoid potential endless loop in convert_chmap_v3() (bsc#1267571).
    - CVE-2026-46149: scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show()     (bsc#1267648).
    - CVE-2026-46161: md/raid10: fix divide-by-zero in setup_geo() with zero far_copies (bsc#1266838).
    - CVE-2026-46167: usb: usblp: fix uninitialized heap leak via LPGETSTATUS ioctl (bsc#1266832).
    - CVE-2026-46177: ipmi: Add limits to event and receive message requests (bsc#1267725).
    - CVE-2026-46178: RDMA/mlx4: Fix resource leak on error in mlx4_ib_create_srq() (bsc#1267493).
    - CVE-2026-46180: wifi: brcmfmac: Fix potential use-after-free issue when stopping watchdog task     (bsc#1266813).
    - CVE-2026-46184: sound: ua101: fix division by zero at probe (bsc#1266864).
    - CVE-2026-46189: RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (bsc#1266918).
    - CVE-2026-46191: fbcon: Avoid OOB font access if console rotation fails (bsc#1267690).
    - CVE-2026-46193: xfrm: ah: account for ESN high bits in async callbacks (bsc#1267656).
    - CVE-2026-46220: drm/amdgpu/sdma4: replace BUG_ON with WARN_ON in fence emission (bsc#1267704).
    - CVE-2026-46245: drm/amd/display: Fix dc_link NULL handling in HPD init (bsc#1267678).
    - CVE-2026-46252: regulator: core: fix locking in regulator_resolve_supply() error path (bsc#1267676).
    - CVE-2026-46294: dm: fix a buffer overflow in ioctl processing (bsc#1267939).
    - CVE-2026-46307: wifi: ath5k: do not access array OOB (bsc#1267987).
    - CVE-2026-46321: tun: free page on short-frame rejection in tun_xdp_one() (bsc#1268024).
    - CVE-2026-46322: tun: free page on build_skb failure in tun_xdp_one() (bsc#1267994).
    - CVE-2026-52910: bpf: Free reuseport cBPF prog after RCU grace period (bsc#1268659).
    - CVE-2026-52915: netfilter: ip6t_hbh: reject oversized option lists (bsc#1269001).
    - CVE-2026-52927: netfilter: ebtables: fix OOB read in compat_mtw_from_user (bsc#1269027).
    - CVE-2026-52930: ipc/shm: serialize orphan cleanup with shm_nattch updates (bsc#1269003).
    - CVE-2026-52942: netfilter: nf_log: validate MAC header was set before dumping it (bsc#1268967).
    - CVE-2026-52948: i2c: dev: prevent integer overflow in I2C_TIMEOUT ioctl (bsc#1269116).
    - CVE-2026-52956: libceph: Fix potential out-of-bounds access in __ceph_x_decrypt() (bsc#1269172).
    - CVE-2026-52958: libceph: Fix potential out-of-bounds access in osdmap_decode() (bsc#1269174).
    - CVE-2026-52981: neigh: let neigh_xmit take skb ownership (bsc#1269254).
    - CVE-2026-52982: net: usb: rtl8150: fix use-after-free in rtl8150_start_xmit() (bsc#1269258).
    - CVE-2026-52984: net/sched: netem: fix queue limit check to include reordered packets (bsc#1269272).
    - CVE-2026-52986: netfilter: nf_conntrack_sip: don't use simple_strtoul (bsc#1269289).
    - CVE-2026-52995: net/rds: zero per-item info buffer before handing it to visitors (bsc#1269124).
    - CVE-2026-52998: netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (bsc#1269118).
    - CVE-2026-53002: netfilter: conntrack: remove sprintf usage (bsc#1269112).
    - CVE-2026-53004: sctp: fix OOB write to userspace in sctp_getsockopt_peer_auth_chunks (bsc#1269106).
    - CVE-2026-53006: ipv6: fix possible UAF in icmpv6_rcv() (bsc#1269104).
    - CVE-2026-53016: crypto: ccp - copy IV using skcipher ivsize (bsc#1269090).
    - CVE-2026-53021: scsi: target: core: Fix integer overflow in UNMAP bounds check (bsc#1269151).
    - CVE-2026-53036: bpf, arm64: Reject out-of-range B.cond targets (bsc#1269389).
    - CVE-2026-53039: ocfs2: validate group add input before caching (bsc#1269392).
    - CVE-2026-53060: dm cache metadata: fix memory leak on metadata abort retry (bsc#1269164).
    - CVE-2026-53062: dm cache policy smq: fix missing locks in invalidating cache blocks (bsc#1269658).
    - CVE-2026-53063: dm cache: fix write hang in passthrough mode (bsc#1269659).
    - CVE-2026-53064: dm cache: fix null-deref with concurrent writes in passthrough mode (bsc#1269132).
    - CVE-2026-53093: wifi: brcmfmac: Fix error pointer dereference (bsc#1269414).
    - CVE-2026-53129: fs/mbcache: cancel shrink work before destroying the cache (bsc#1269633).
    - CVE-2026-53131: netfilter: require Ethernet MAC header before using eth_hdr() (bsc#1269773).
    - CVE-2026-53134: netfilter: nft_fib: fix stale stack leak via the OIFNAME register (bsc#1269819).
    - CVE-2026-53146: thunderbolt: Limit XDomain response copy to actual frame size (bsc#1269826).
    - CVE-2026-53147: thunderbolt: Validate XDomain request packet size before type cast (bsc#1269709).
    - CVE-2026-53149: thunderbolt: Bound root directory content to block size (bsc#1269733).
    - CVE-2026-53167: fuse: limit FUSE_NOTIFY_RETRIEVE to uptodate folios (bsc#1269768).
    - CVE-2026-53176: IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (bsc#1269710).
    - CVE-2026-53181: vsock/vmci: fix sk_ack_backlog leak on failed handshake (bsc#1269886).
    - CVE-2026-53186: RDMA/srp: bound SRP_RSP sense copy by the received length (bsc#1269663).
    - CVE-2026-53196: USB: serial: io_ti: fix heap overflow in get_manuf_info() (bsc#1269986).
    - CVE-2026-53208: Bluetooth: L2CAP: reject BR/EDR signaling packets over MTUsig (bsc#1269899).
    - CVE-2026-53213: drm/vc4: fix krealloc() memory leak (bsc#1269283).
    - CVE-2026-53218: netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (bsc#1269273).
    - CVE-2026-53224: sctp: validate embedded INIT chunk and address list lengths in cookie (bsc#1269997).
    - CVE-2026-53225: sctp: fix uninit-value in __sctp_rcv_asconf_lookup() (bsc#1269711).
    - CVE-2026-53227: net: openvswitch: fix possible kfree_skb of ERR_PTR (bsc#1269877).
    - CVE-2026-53236: tcp: restrict SO_ATTACH_FILTER to priv users (bsc#1269994).
    - CVE-2026-53242: ALSA: PCM: Fix wait queue list corruption in snd_pcm_drain() on linked streams     (bsc#1269236).
    - CVE-2026-53245: net/802/mrp: fix vector attribute parsing in mrp_pdu_parse_vecattr (bsc#1269675).
    - CVE-2026-53246: sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (bsc#1269988).
    - CVE-2026-53249: ipv4: restrict IPOPT_SSRR and IPOPT_LSRR options (bsc#1269992).
    - CVE-2026-53252: adaption to srcu change of hci_dev in hci_sysfs (bsc#1269307).
    - CVE-2026-53254: Bluetooth: RFCOMM: validate skb length in MCC handlers (bsc#1269996).
    - CVE-2026-53255: Bluetooth: MGMT: validate advertising TLV before type checks (bsc#1269378).
    - CVE-2026-53256: Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (bsc#1269993).
    - CVE-2026-53262: l2tp: remove pppol2tp_session_close() (bsc#1270000).
    - CVE-2026-53267: netfilter: nft_ct: bail out on template ct in get eval (bsc#1269577).
    - CVE-2026-53268: netfilter: conntrack_irc: fix possible out-of-bounds read (bsc#1269257).
    - CVE-2026-53270: ipvs: clear the svc scheduler ptr early on edit (bsc#1269240).
    - CVE-2026-53273: tee: optee: prevent use-after-free when the client exits before the supplicant     (bsc#1269713).
    - CVE-2026-53275: ipv6: mcast: Fix use-after-free when processing MLD queries (bsc#1269810).
    - CVE-2026-53306: tty: hvc_iucv: fix off-by-one in number of supported devices (bsc#1269814).
    - CVE-2026-53325: agp/amd64: Fix broken error propagation in agp_amd64_probe() (bsc#1269726).
    - CVE-2026-53354: arm64: errata: Mitigate TLBI errata on various Arm CPUs (bsc#1270230).
    - CVE-2026-53355: net: rds: clear i_sends on setup unwind (bsc#1270249).
    - CVE-2026-53369: udf: reject descriptors with oversized CRC length (bsc#1271818).
    - CVE-2026-53374: drm/amdgpu: zero-initialize GART table on allocation (bsc#1271827).
    - CVE-2026-53375: drm/amdgpu/vce: Prevent partial address patches (bsc#1271899).
    - CVE-2026-53376: drm/amdkfd: Add upper bound check for num_of_nodes (bsc#1271831).
    - CVE-2026-53388: fuse: re-lock request before replacing page cache folio (bsc#1271825).
    - CVE-2026-53391: NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (bsc#1271904).
    - CVE-2026-53392: NFSv4/flexfiles: reject zero filehandle version count (bsc#1271826).
    - CVE-2026-53397: nfsd: fix posix_acl leak on SETACL decode failure (bsc#1271869).
    - CVE-2026-53399: nfsd: release layout stid on setlease failure (bsc#1271832).
    - CVE-2026-63794: KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (bsc#1271964).
    - CVE-2026-63806: KVM: Replace guest-triggerable BUG_ON() in ioeventfd datamatch with get_unaligned()     (bsc#1272268).
    - CVE-2026-63826: fbdev: fix use-after-free in store_modes() (bsc#1272183).
    - CVE-2026-63829: net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (bsc#1272176).
    - CVE-2026-63893: thunderbolt: property: Reject u32 wrap in tb_property_entry_valid() (bsc#1272607).
    - CVE-2026-63899: USB: serial: mxuport: fix memory corruption with small endpoint (bsc#1272494).
    - CVE-2026-63901: USB: serial: digi_acceleport: fix memory corruption with small endpoints (bsc#1272501).
    - CVE-2026-63915: nfc: hci: fix out-of-bounds read in HCP header parsing (bsc#1272897).
    - CVE-2026-63922,CVE-2026-63924: ipv6: exthdrs: recompute network header pointer once (bsc#1272855).
    - CVE-2026-63927: usb: dwc2: Fix use after free in debug code (bsc#1272892).
    - CVE-2026-63928: USB: serial: omninet: fix memory corruption with small endpoint (bsc#1272891).
    - CVE-2026-63958: usb: typec: ucsi: validate connector number in ucsi_connector_change() (bsc#1272467).
    - CVE-2026-64298: NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (bsc#1273550).
    - CVE-2026-64330: usb: typec: tcpm: Validate SVID index in svdm_consume_modes() (bsc#1272681).
    - CVE-2026-64465: usb: xhci: Fix sleep in atomic context in xhci_free_streams() (bsc#1272843).
    - CVE-2026-64564: sctp: don't free the ASCONF's own transport in DEL-IP processing (bsc#1274072).
    - CVE-2026-64600: xfs: resample the data fork mapping after cycling ILOCK (bsc#1271526).

    The following non security issues were fixed:

    - ACPI: processor: Fix previous acpi_processor_errata_piix4() fix (bsc#1264821).
    - dm cache policy smq: check allocation under invalidate lock (git-fixes).
    - dm cache: fix missing return in invalidate_committed's error path (git-fixes).
    - HID: Intel-ish-hid: Ishtp: Fix sensor reads after ACPI S3 suspend (bsc#1266468).
    - KVM: nVMX: use vm_exit_controls_init() to write exit controls for vmcs02 (bsc#1249414).
    - kvm: vmx: Fix entry number check for add_atomic_switch_msr() (git-fixes).
    - mkspec-dtb: Skip missing DTBs.
    - pkspec-dtb: Fix dtb-al rename.
    - sctp: validate embedded address parameter length (git-fixes).
    - tee: fix possible error pointer ctx dereferencing (git-fixes).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The CentOS Linux 8.4 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS8.4:CLSA-2026:1792979607 advisory.

  - In the Linux kernel, the following vulnerability has been resolved: mrp: introduce active flags to prevent     UAF when applicant uninit The caller of del_timer_sync must prevent restarting of the timer, If we have no     this synchronization, there is a small probability that the cancellation will not be successful. And     syzbot report the fellowing crash: ================================================================== BUG:
    KASAN: use-after-free in hlist_add_head include/linux/list.h:929 [inline] BUG: KASAN: use-after-free in     enqueue_timer+0x18/0xa4 kernel/time/timer.c:605 Write at addr f9ff000024df6058 by task syz-fuzzer/2256     Pointer tag: [f9], memory tag: [fe] CPU: 1 PID: 2256 Comm: syz-fuzzer Not tainted     6.1.0-rc5-syzkaller-00008- ge01d50cbd6ee #0 Hardware name: linux,dummy-virt (DT) Call trace:
    dump_backtrace.part.0+0xe0/0xf0 arch/arm64/kernel/stacktrace.c:156 dump_backtrace     arch/arm64/kernel/stacktrace.c:162 [inline] show_stack+0x18/0x40 arch/arm64/kernel/stacktrace.c:163
    __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x68/0x84 lib/dump_stack.c:106     print_address_description mm/kasan/report.c:284 [inline] print_report+0x1a8/0x4a0 mm/kasan/report.c:395     kasan_report+0x94/0xb4 mm/kasan/report.c:495 __do_kernel_fault+0x164/0x1e0 arch/arm64/mm/fault.c:320     do_bad_area arch/arm64/mm/fault.c:473 [inline] do_tag_check_fault+0x78/0x8c arch/arm64/mm/fault.c:749     do_mem_abort+0x44/0x94 arch/arm64/mm/fault.c:825 el1_abort+0x40/0x60 arch/arm64/kernel/entry-common.c:367     el1h_64_sync_handler+0xd8/0xe4 arch/arm64/kernel/entry-common.c:427 el1h_64_sync+0x64/0x68     arch/arm64/kernel/entry.S:576 hlist_add_head include/linux/list.h:929 [inline] enqueue_timer+0x18/0xa4     kernel/time/timer.c:605 mod_timer+0x14/0x20 kernel/time/timer.c:1161 mrp_periodic_timer_arm     net/802/mrp.c:614 [inline] mrp_periodic_timer+0xa0/0xc0 net/802/mrp.c:627     call_timer_fn.constprop.0+0x24/0x80 kernel/time/timer.c:1474 expire_timers+0x98/0xc4     kernel/time/timer.c:1519 To fix it, we can introduce a new active flags to make sure the timer will not     restart. (CVE-2022-50697)

  - In the Linux kernel, the following vulnerability has been resolved: wifi: ath10k: add peer map clean up     for peer delete in ath10k_sta_state() When peer delete failed in a disconnect operation, use-after-free     detected by KFENCE in below log. It is because for each vdev_id and address, it has only one struct     ath10k_peer, it is allocated in ath10k_peer_map_event(). When connected to an AP, it has more than one     HTT_T2H_MSG_TYPE_PEER_MAP reported from firmware, then the array peer_map of struct ath10k will be set     muti-elements to the same ath10k_peer in ath10k_peer_map_event(). When peer delete failed in     ath10k_sta_state(), the ath10k_peer will be free for the 1st peer id in array peer_map of struct ath10k,     and then use-after-free happened for the 2nd peer id because they map to the same ath10k_peer. And clean     up all peers in array peer_map for the ath10k_peer, then user-after-free disappeared peer map event log: [     306.911021] wlan0: authenticate with b0:2a:43:e6:75:0e [ 306.957187] ath10k_pci 0000:01:00.0: mac vdev 0     peer create b0:2a:43:e6:75:0e (new sta) sta 1 / 32 peer 1 / 33 [ 306.957395] ath10k_pci 0000:01:00.0: htt     peer map vdev 0 peer b0:2a:43:e6:75:0e id 246 [ 306.957404] ath10k_pci 0000:01:00.0: htt peer map vdev 0     peer b0:2a:43:e6:75:0e id 198 [ 306.986924] ath10k_pci 0000:01:00.0: htt peer map vdev 0 peer     b0:2a:43:e6:75:0e id 166 peer unmap event log: [ 435.715691] wlan0: deauthenticating from     b0:2a:43:e6:75:0e by local choice (Reason: 3=DEAUTH_LEAVING) [ 435.716802] ath10k_pci 0000:01:00.0: mac     vdev 0 peer delete b0:2a:43:e6:75:0e sta ffff990e0e9c2b50 (sta gone) [ 435.717177] ath10k_pci     0000:01:00.0: htt peer unmap vdev 0 peer b0:2a:43:e6:75:0e id 246 [ 435.717186] ath10k_pci 0000:01:00.0:
    htt peer unmap vdev 0 peer b0:2a:43:e6:75:0e id 198 [ 435.717193] ath10k_pci 0000:01:00.0: htt peer unmap     vdev 0 peer b0:2a:43:e6:75:0e id 166 use-after-free log: [21705.888627] wlan0: deauthenticating from     d0:76:8f:82:be:75 by local choice (Reason: 3=DEAUTH_LEAVING) [21713.799910] ath10k_pci 0000:01:00.0:
    failed to delete peer d0:76:8f:82:be:75 for vdev 0: -110 [21713.799925] ath10k_pci 0000:01:00.0: found sta     peer d0:76:8f:82:be:75 (ptr 0000000000000000 id 102) entry on vdev 0 after it was supposedly removed     [21713.799968] ================================================================== [21713.799991] BUG:
    KFENCE: use-after-free read in ath10k_sta_state+0x265/0xb8a [ath10k_core] [21713.799991] [21713.799997]     Use-after-free read at 0x00000000abe1c75e (in kfence-#69): [21713.800010] ath10k_sta_state+0x265/0xb8a     [ath10k_core] [21713.800041] drv_sta_state+0x115/0x677 [mac80211] [21713.800059]
    __sta_info_destroy_part2+0xb1/0x133 [mac80211] [21713.800076] __sta_info_flush+0x11d/0x162 [mac80211]     [21713.800093] ieee80211_set_disassoc+0x12d/0x2f4 [mac80211] [21713.800110]     ieee80211_mgd_deauth+0x26c/0x29b [mac80211] [21713.800137] cfg80211_mlme_deauth+0x13f/0x1bb [cfg80211]     [21713.800153] nl80211_deauthenticate+0xf8/0x121 [cfg80211] [21713.800161] genl_rcv_msg+0x38e/0x3be     [21713.800166] netlink_rcv_skb+0x89/0xf7 [21713.800171] genl_rcv+0x28/0x36 [21713.800176]     netlink_unicast+0x179/0x24b [21713.800181] netlink_sendmsg+0x3a0/0x40e [21713.800187]     sock_sendmsg+0x72/0x76 [21713.800192] ____sys_sendmsg+0x16d/0x1e3 [21713.800196] ___sys_sendmsg+0x95/0xd1     [21713.800200] __sys_sendmsg+0x85/0xbf [21713.800205] do_syscall_64+0x43/0x55 [21713.800210]     entry_SYSCALL_64_after_hwframe+0x44/0xa9 [21713.800213] [21713.800219] kfence-#69:
    0x000000009149b0d5-0x000000004c0697fb, size=1064, cache=kmalloc-2k [21713.800219] [21713.800224] allocated     by task 13 on cpu 0 at 21705.501373s: [21713.800241] ath10k_peer_map_event+0x7e/0x154 [ath10k_core]     [21713.800254] ath10k_htt_t2h_msg_handler+0x586/0x1039 [ath10k_core] [21713.800265]     ath10k_htt_htc_t2h_msg_handler+0x12/0x28 [ath10k_core] [21713.800277]     ath10k_htc_rx_completion_handler+0x14c/0x1b5 [ath10k_core] [21713.800283]     ath10k_pci_process_rx_cb+0x195/0x1d ---truncated--- (CVE-2022-50880)

  - In the Linux kernel, the following vulnerability has been resolved: ubi: Fix use-after-free when volume     resizing failed There is an use-after-free problem reported by KASAN:
    ================================================================== BUG: KASAN: use-after-free in     ubi_eba_copy_table+0x11f/0x1c0 [ubi] Read of size 8 at addr ffff888101eec008 by task ubirsvol/4735 CPU: 2     PID: 4735 Comm: ubirsvol Not tainted 6.1.0-rc1-00003-g84fa3304a7fc-dirty #14 Hardware name: QEMU Standard     PC (i440FX + PIIX, 1996), BIOS 1.14.0-1.fc33 04/01/2014 Call Trace: <TASK> dump_stack_lvl+0x34/0x44     print_report+0x171/0x472 kasan_report+0xad/0x130 ubi_eba_copy_table+0x11f/0x1c0 [ubi]     ubi_resize_volume+0x4f9/0xbc0 [ubi] ubi_cdev_ioctl+0x701/0x1850 [ubi] __x64_sys_ioctl+0x11d/0x170     do_syscall_64+0x35/0x80 entry_SYSCALL_64_after_hwframe+0x46/0xb0 </TASK> When ubi_change_vtbl_record()     returns an error in ubi_resize_volume(), new_eba_tbl will be freed on error handing path, but it is     holded by vol->eba_tbl in ubi_eba_replace_table(). It means that the liftcycle of vol->eba_tbl and     vol are different, so when resizing volume in next time, it causing an use-after-free fault. Fix it by     not freeing new_eba_tbl after it replaced in ubi_eba_replace_table(), while will be freed in next volume     resizing. (CVE-2023-53800)

  - In the Linux kernel, the following vulnerability has been resolved: crypto: essiv - Handle EBUSY correctly     As it is essiv only handles the special return value of EINPROGERSS, which means that in all other cases     it will free data related to the request. However, as the caller of essiv may specify MAY_BACKLOG, we also     need to expect EBUSY and treat it in the same way. Otherwise backlogged requests will trigger a use-after-     free. (CVE-2023-54046)

  - In the Linux kernel, the following vulnerability has been resolved: net: avoid potential underflow in     qdisc_pkt_len_init() with UFO After commit 7c6d2ecbda83 (net: be more gentle about silly gso requests     coming from user) virtio_net_hdr_to_skb() had sanity check to detect malicious attempts from user space     to cook a bad GSO packet. Then commit cf9acc90c80ec (net: virtio_net_hdr_to_skb: count transport header     in UFO) while fixing one issue, allowed user space to cook a GSO packet with the following characteristic     : IPv4 SKB_GSO_UDP, gso_size=3, skb->len = 28. When this packet arrives in qdisc_pkt_len_init(), we end up     with hdr_len = 28 (IPv4 header + UDP header), matching skb->len Then the following sets gso_segs to 0 :
    gso_segs = DIV_ROUND_UP(skb->len - hdr_len, shinfo->gso_size); Then later we set     qdisc_skb_cb(skb)->pkt_len to back to zero :/ qdisc_skb_cb(skb)->pkt_len += (gso_segs - 1) * hdr_len; This     leads to the following crash in fq_codel [1] qdisc_pkt_len_init() is best effort, we only want an     estimation of the bytes sent on the wire, not crashing the kernel. This patch is fixing this particular     issue, a following one adds more sanity checks for another potential bug. [1] [ 70.724101] BUG: kernel     NULL pointer dereference, address: 0000000000000000 [ 70.724561] #PF: supervisor read access in kernel     mode [ 70.724561] #PF: error_code(0x0000) - not-present page [ 70.724561] PGD 10ac61067 P4D 10ac61067 PUD     107ee2067 PMD 0 [ 70.724561] Oops: Oops: 0000 [#1] SMP NOPTI [ 70.724561] CPU: 11 UID: 0 PID: 2163 Comm:
    b358537762 Not tainted 6.11.0-virtme #991 [ 70.724561] Hardware name: QEMU Standard PC (i440FX + PIIX,     1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 70.724561] RIP: 0010:fq_codel_enqueue     (net/sched/sch_fq_codel.c:120 net/sched/sch_fq_codel.c:168 net/sched/sch_fq_codel.c:230) sch_fq_codel [     70.724561] Code: 24 08 49 c1 e1 06 44 89 7c 24 18 45 31 ed 45 31 c0 31 ff 89 44 24 14 4c 03 8b 90 01 00 00     eb 04 39 ca 73 37 4d 8b 39 83 c7 01 <49> 8b 17 49 89 11 41 8b 57 28 45 8b 5f 34 49 c7 07 00 00 00 00 49     All code ======== 0: 24 08 and $0x8,%al 2: 49 c1 e1 06 shl $0x6,%r9 6: 44 89 7c 24 18 mov %r15d,0x18(%rsp)     b: 45 31 ed xor %r13d,%r13d e: 45 31 c0 xor %r8d,%r8d 11: 31 ff xor %edi,%edi 13: 89 44 24 14 mov     %eax,0x14(%rsp) 17: 4c 03 8b 90 01 00 00 add 0x190(%rbx),%r9 1e: eb 04 jmp 0x24 20: 39 ca cmp %ecx,%edx     22: 73 37 jae 0x5b 24: 4d 8b 39 mov (%r9),%r15 27: 83 c7 01 add $0x1,%edi 2a:* 49 8b 17 mov (%r15),%rdx     <-- trapping instruction 2d: 49 89 11 mov %rdx,(%r9) 30: 41 8b 57 28 mov 0x28(%r15),%edx 34: 45 8b 5f 34     mov 0x34(%r15),%r11d 38: 49 c7 07 00 00 00 00 movq $0x0,(%r15) 3f: 49 rex.WB Code starting with the     faulting instruction =========================================== 0: 49 8b 17 mov (%r15),%rdx 3: 49 89 11     mov %rdx,(%r9) 6: 41 8b 57 28 mov 0x28(%r15),%edx a: 45 8b 5f 34 mov 0x34(%r15),%r11d e: 49 c7 07 00 00 00     00 movq $0x0,(%r15) 15: 49 rex.WB [ 70.724561] RSP: 0018:ffff95ae85e6fb90 EFLAGS: 00000202 [ 70.724561]     RAX: 0000000002000000 RBX: ffff95ae841de000 RCX: 0000000000000000 [ 70.724561] RDX: 0000000000000000 RSI:
    0000000000000001 RDI: 0000000000000001 [ 70.724561] RBP: ffff95ae85e6fbf8 R08: 0000000000000000 R09:
    ffff95b710a30000 [ 70.724561] R10: 0000000000000000 R11: bdf289445ce31881 R12: ffff95ae85e6fc58 [     70.724561] R13: 0000000000000000 R14: 0000000000000040 R15: 0000000000000000 [ 70.724561] FS:
    000000002c5c1380(0000) GS:ffff95bd7fcc0000(0000) knlGS:0000000000000000 [ 70.724561] CS: 0010 DS: 0000 ES:
    0000 C ---truncated--- (CVE-2024-49949)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
335089	SUSE SLES12: cluster-md-kmp-default / dlm-kmp-default / gfs2-kmp-default / etc (SUSE-SU-2026:3594-1)	Nessus	SuSE Local Security Checks	8/13/2026	9/7/2026	high
347998	EulerOS Virtualization 2.12.0 : kernel (EulerOS-SA-2026-3644)	Nessus	Huawei Local Security Checks	9/18/2026	11/3/2026	high
339226	EulerOS Virtualization 2.13.1 : kernel (EulerOS-SA-2026-3176)	Nessus	Huawei Local Security Checks	8/25/2026	10/23/2026	high
372044	CentOS Linux 8.4 [TuxCare] Security Update: bpftool / kernel / kernel-core / kernel-cross-headers / etc Multiple Vulnerabilities (CENTOS8.4:CLSA-2026:1792979607)	Nessus	CentOS Local Security Checks	10/26/2026	11/2/2026	high

Detections

Analytics

Plugins Search

high

high

high

high