An update of the linux package has been released.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:76739 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock() (CVE-2025-40149)

    * kernel: ipv6: add NULL checks for idev in SRv6 paths (CVE-2026-23442)

    * kernel: thermal: core: Fix thermal zone device registration error path (CVE-2026-43332)

    * kernel: KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (CVE-2026-46076)

    * kernel: gfs2: Fix slab-use-after-free in qd_put (CVE-2026-45861)

    * kernel: Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CVE-2026-46275)

    * kernel: KVM: arm64: Reassign nested_mmus array behind mmu_lock (CVE-2026-46317)

    * kernel: netfilter: nf_log: validate MAC header was set before dumping it (CVE-2026-52942)

    * kernel: gfs2: add some missing log locking (CVE-2026-53049)

    * kernel: netfilter: nf_conntrack_sip: don't use simple_strtoul (CVE-2026-52986)

    * kernel: Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CVE-2026-53357)

    * kernel: net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (CVE-2026-63829)

    * kernel: ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (CVE-2026-63924)

    * kernel: ipv6: exthdrs: refresh nh after handling HAO option (CVE-2026-63922)

    * kernel: ipv6: validate extension header length before copying to cmsg (CVE-2026-63920)

    * kernel: vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (CVE-2026-63993)

    * kernel: ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (CVE-2026-63984)

    * kernel: tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (CVE-2026-63992)

    * kernel: tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]()     (CVE-2026-63994)

    * kernel: Kernel SMB client: Double-free vulnerability allows remote denial of service or privilege     escalation (CVE-2026-64385)

    * kernel: Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CVE-2026-64557)

    * kernel: vxlan: require CAP_NET_ADMIN in the device netns for changelink (CVE-2026-68432)

    * kernel: net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (CVE-2026-72052)

    * kernel: dm-integrity: don't increment hash_offset twice (CVE-2026-72099)

    * kernel: KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CVE-2026-72289)

    * kernel: netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CVE-2026-72255)

    * kernel: KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (CVE-2026-74516)

    * kernel: netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CVE-2026-74569)

    * kernel: ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CVE-2026-74669)

    * kernel: netfilter: flowtable: publish GC-visible tuple last (CVE-2026-74746)

    * kernel: ipv6: fix use-after-free in ip6_finish_output2() (CVE-2026-80792)

    * kernel: KVM: s390: vsie: zero stale crypto bits (CVE-2026-80921)

    * kernel: nvme-tcp: reject a read that transferred too few bytes (CVE-2026-89480)

    * kernel: nvme-tcp: fix host memory disclosure on R2T for a read command (CVE-2026-89481)

    * kernel: nvme: add missing SRCU grace period in error path (CVE-2026-89972)

    * kernel: nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CVE-2026-90227)

    * kernel: netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CVE-2026-97417)

    * kernel: netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CVE-2026-93288)

    Bug Fix(es) and Enhancement(s):

    * [RHEL-9.8] kernel BUG at lib/list_debug.c:23! observed with liburing buf-ring-upgrade.t [rhel-9.8.z]     (JIRA:RHEL-254192)

    * hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info [rhel-9.8.z]     (JIRA:RHEL-262029)

    * RHEL9.4 - kernel: CPU hotplug unsupported by CPUMF [rhel-9.8.z] (JIRA:RHEL-270892)

    * Accel-DSA: dmaengine: idxd: kernel oops on unbind [rhel-9.8.z] (JIRA:RHEL-274410)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
333944	Photon OS 5.0: Linux PHSA-2026-5.0-92-0864	Nessus	PhotonOS Local Security Checks	8/10/2026	11/3/2026	high
340045	Ubuntu 26.04 LTS : Linux kernel (NVIDIA BaseOS) vulnerabilities (USN-8664-1)	Nessus	Ubuntu Local Security Checks	8/26/2026	11/11/2026	high
369302	RHEL 9 : kernel (RHSA-2026:76739)	Nessus	Red Hat Local Security Checks	10/21/2026	10/21/2026	high

Detections

Analytics

Plugins Search

high

high

high