It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2032 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    ipv6: use RCU in ip6_output() (CVE-2025-40158)

    In the Linux kernel, the following vulnerability has been resolved:

    xfrm: Wait for RCU readers during policy netns exit (CVE-2026-43091)

    In the Linux kernel, the following vulnerability has been resolved:

    net/sched: fix pedit partial COW leading to page cache corruption (CVE-2026-46331)

    In the Linux kernel, the following vulnerability has been resolved:

    ip6_vti: set netns_immutable on the fallback device. (CVE-2026-52909)

    In the Linux kernel, the following vulnerability has been resolved:

    af_unix: Reject SIOCATMARK on non-stream sockets (CVE-2026-52928)

    In the Linux kernel, the following vulnerability has been resolved:

    sched/psi: fix race between file release and pressure write (CVE-2026-52991)

    In the Linux kernel, the following vulnerability has been resolved:

    fuse: limit FUSE_NOTIFY_RETRIEVE to uptodate folios (CVE-2026-53167)

    In the Linux kernel, the following vulnerability has been resolved:

    sctp: validate embedded INIT chunk and address list lengths in cookie (CVE-2026-53224)

    In the Linux kernel, the following vulnerability has been resolved:

    sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (CVE-2026-53246)

    In the Linux kernel, the following vulnerability has been resolved:

    af_unix: Set gc_in_progress to true in unix_gc(). (CVE-2026-53361)

    In the Linux kernel, the following vulnerability has been resolved:

    virtiofs: fix UAF on submount umount

    iput() called from fuse_release_end() can Oops if the super block hasalready been destroyed.  Normally     this is prevented by waiting fornum_waiting to go down to zero before commencing with super block     shutdown.

    This only works, however, for the last submount instance, as the waitcounter is per connection, not per     superblock.

    Revert to using synchronous release requests for the auto_submounts case,which is virtiofs only at this     time. (CVE-2026-53381)

    In the Linux kernel, the following vulnerability has been resolved:

    vc_screen: fix null-ptr-deref in vcs_notifier() during concurrent vcs_write

    A KASAN null-ptr-deref was observed in vcs_notifier():

    BUG: KASAN: null-ptr-deref in vcs_notifier+0x98/0x130Read of size 2 at addr qmp_cmd_name:
    qmp_capabilities, arguments: {}

    The issue is a race condition in vcs_write(). When the console_lock istemporarily dropped (to copy data     from userspace), the vc_data pointerobtained from vcs_vc() may become stale. After re-acquiring the     lock,vcs_vc() is called again to re-validate the pointer. If the vc has beendeallocated in the meantime,     vcs_vc() returns NULL, and the while loopbreaks (with written > 0). However, after the loop,     vcs_scr_updated(vc)is still called with the now-NULL vc pointer, leading to a null pointerdereference in     the notifier chain (vcs_notifier dereferences param->vc).

    Fix this by adding a NULL check for vc before calling vcs_scr_updated(). (CVE-2026-53385)

    In the Linux kernel, the following vulnerability has been resolved:

    fuse: re-lock request before replacing page cache folio

    fuse_try_move_folio() unlocks the request on entry but does notre-lock it on the success path. This means     fuse_chan_abort() can end therequest and free the fuse_io_args (eg fuse_readpages_end()) while     thesubsequent copy chain logic after fuse_try_move_folio() accesses thefuse_io_args, leading to use-after-     free issues.

    Fix this by calling lock_request() before replace_page_cache_folio().This ensures the request is locked on     the success path which willprevent the fuse_io_args from being freed while the later copying logicruns,     and also ensures that the ap->folios[i]->mapping is never nullsince ap->folios[i] will always point to the     newfolio afterreplace_page_cache_folio(). (CVE-2026-53388)

    In the Linux kernel, the following vulnerability has been resolved:

    NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CVE-2026-53391)

    In the Linux kernel, the following vulnerability has been resolved:

    nfsd: fix posix_acl leak on SETACL decode failure (CVE-2026-53397)

    In the Linux kernel, the following vulnerability has been resolved:

    NFSD: Fix SECINFO_NO_NAME decode error cleanup (CVE-2026-53398)

    In the Linux kernel, the following vulnerability has been resolved:

    fbdev: Fix fb_new_modelist to prevent null-ptr-deref in fb_videomode_to_var

    info->var, a framebuffer's current mode, is expected to have a matchingentry in info->modelist.
    var_to_display() relies on this and treats afailed fb_match_mode() as This should not happen.
    fb_set_var() keeps ittrue by adding the mode to the list on every change, anddo_register_framebuffer()     does the same at registration.

    store_modes() replaces the modelist from userspace. fb_new_modelist()validates the new modes but does not     check that info->var still has amatch. It relies on fbcon_new_modelist() to re-point consoles, but     thatonly handles consoles mapped to the framebuffer. With fbcon unbound thereare none, so info->var is     left describing a mode that is no longer in thelist.

    A later console takeover runs var_to_display(), where fb_match_mode()returns NULL and leaves     fb_display[i].mode NULL. fbcon_switch() passes itto display_to_var(), and fb_videomode_to_var()     dereferences the NULL mode.

    Keep the current mode in the list in fb_new_modelist(), the same wayfb_set_var() does. (CVE-2026-53403)

    In the Linux kernel, the following vulnerability has been resolved:

    pNFS: Fix use-after-free in pnfs_update_layout() (CVE-2026-63800)

    In the Linux kernel, the following vulnerability has been resolved:

    tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (CVE-2026-63801)

    In the Linux kernel, the following vulnerability has been resolved:

    KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (CVE-2026-63807)

    In the Linux kernel, the following vulnerability has been resolved:

    exfat: fix potential use-after-free in exfat_find_dir_entry() (CVE-2026-63808)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf: use kvfree() for replaced sysctl write buffer (CVE-2026-63809)

    In the Linux kernel, the following vulnerability has been resolved:

    keys: Pin request_key_auth payload in instantiate paths (CVE-2026-63823)

    In the Linux kernel, the following vulnerability has been resolved:

    KEYS: fix overflow in keyctl_pkey_params_get_2() (CVE-2026-63824)

    In the Linux kernel, the following vulnerability has been resolved:

    net: skmsg: preserve sg.copy across SG transforms (CVE-2026-63830)

    In the Linux kernel, the following vulnerability has been resolved:

    ntfs3: reject direct userspace writes to reserved $LX* xattrs

    NTFS3 uses $LXUID, $LXGID, $LXMOD and $LXDEV as internal WSLpermission metadata and reloads them into     i_uid, i_gid and i_modefrom ntfs_get_wsl_perm().

    Because the empty-prefix xattr handler also lets file owners callsetxattr() on these names directly, an     unprivileged writer on awritable ntfs3 mount can plant root ownership and S_ISUID on their ownfile and     gain euid 0 after inode reload.

    Reject direct userspace writes to the reserved $LX* names. Internalntfs3 metadata updates are unchanged     because ntfs_save_wsl_perm()writes them via ntfs_set_ea() directly.

    [almaz.alexandrovich@paragon-software.com: added an additional check for non privileged users]     (CVE-2026-63833)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-100571 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    bpf: use kvfree() for replaced sysctl write buffer

    proc_sys_call_handler() allocates its temporary sysctl buffer with     kvzalloc() and passes it to __cgroup_bpf_run_filter_sysctl(). Since     kvzalloc() may fall back to vmalloc() for large allocations, freeing     that buffer with kfree() is wrong and can corrupt memory.

    Use kvfree() to safely handle both kmalloc and kvzalloc()/vmalloc     allocations.

    The bug was first flagged by an experimental analysis tool we are     developing for kernel memory-management bugs while analyzing     v6.13-rc1. The tool is still under development and is not yet publicly     available. Manual inspection confirms that the bug is still     present in v7.1-rc5.

    Reproduced the bug based on v7.1-rc4 in a QEMU x86_64 guest booted with     KASAN and CONFIG_FAILSLAB enabled. To exercise the replacement path, the     test tree also included the accompanying fix for the stale ret == 1     check in __cgroup_bpf_run_filter_sysctl(). The reproducer confines     failslab injections to the proc_sys_call_handler() range, uses     stacktrace-depth=32, and injects fail-nth=1 while writing 8191 bytes to     /proc/sys/kernel/domainname from a task in the target cgroup. Under     that setup, fail-nth=1 triggered the fault:

      BUG: unable to handle page fault for address: ffffeb0200024d48       #PF: supervisor read access in kernel mode       #PF: error_code(0x0000) - not-present page       PGD 0 P4D 0       Oops: Oops: 0000  SMP KASAN NOPTI       CPU: 2 UID: 0 PID: 209 Comm: repro_proc_sys_ Not tainted 7.1.0-rc4-00686-g97625979a5d4  PREEMPT(lazy)       Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.15.0-1 04/01/2014       RIP: 0010:kfree+0x6e/0x510       ...
      Call Trace:
       <TASK>        ? __cgroup_bpf_run_filter_sysctl+0x626/0xc30
       __cgroup_bpf_run_filter_sysctl+0x74d/0xc30        ? __pfx___cgroup_bpf_run_filter_sysctl+0x10/0x10        ? srso_return_thunk+0x5/0x5f        ? __kvmalloc_node_noprof+0x345/0x870        ? proc_sys_call_handler+0x250/0x480        ? srso_return_thunk+0x5/0x5f        proc_sys_call_handler+0x3a2/0x480        ? __pfx_proc_sys_call_handler+0x10/0x10        ? srso_return_thunk+0x5/0x5f        ? selinux_file_permission+0x39f/0x500        ? srso_return_thunk+0x5/0x5f        ? lock_is_held_type+0x9e/0x120        vfs_write+0x98e/0x1000        ...
       </TASK>

    With this fix applied on top of the same test setup, rerunning the     reproducer with fail-nth=1 yields no corresponding Oops reports.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
343532	Ubuntu 24.04 LTS / Pro Realtime 24.04 LTS : Linux kernel (GCP) vulnerabilities (USN-8728-1)	Nessus	Ubuntu Local Security Checks	9/7/2026	9/24/2026	high
332051	Amazon Linux 2023 : bpftool, kernel, kernel-devel (ALAS2023-2026-2032)	Nessus	Amazon Linux Local Security Checks	8/4/2026	9/23/2026	medium
336690	Unity Linux 20.1050a Security Update: kernel (UTSA-2026-100571)	Nessus	Unity Linux Local Security Checks	8/17/2026	8/17/2026	high
365381	Ubuntu 22.04 LTS : Linux kernel (GCP) vulnerabilities (USN-8877-1)	Nessus	Ubuntu Local Security Checks	10/13/2026	10/13/2026	high
365522	Ubuntu 24.04 LTS : Linux kernel vulnerabilities (USN-8917-1)	Nessus	Ubuntu Local Security Checks	10/14/2026	10/14/2026	medium

Detections

Analytics

Plugins Search

high

medium

high

high

medium