The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:67150 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: Linux kernel: Denial of Service in qla2xxx SCSI driver due to improper command handling after     chip reset (CVE-2025-68745)

    * kernel: drm/xe: Open-code GGTT MMIO access protection (CVE-2026-23466)

    * kernel: drm/xe: always keep track of remap prev/next (CVE-2026-31479)

    * kernel: drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CVE-2026-31566)

    * kernel: drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CVE-2026-31656)

    * kernel: rtnetlink: add missing netlink_ns_capable() check for peer netns (CVE-2026-31692)

    * kernel: Bluetooth: SMP: force responder MITM requirements before building the pairing response     (CVE-2026-43334)

    * kernel: drm/i915: Fix potential overflow of shmem scatterlist length (CVE-2026-43368)

    * kernel: drm/amdgpu: Fix use-after-free race in VM acquire (CVE-2026-43370)

    * kernel: Bluetooth: serialize accept_q access (CVE-2026-52918)

    * kernel: sctp: diag: reject stale associations in dump_one path (CVE-2026-52917)

    * kernel: net: pull headers in qdisc_pkt_len_segs_init() (CVE-2026-53091)

    * kernel: iommu/amd: Fix clone_alias() to use the original device's devid (CVE-2026-53053)

    * kernel: Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CVE-2026-53072)

    * kernel: net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (CVE-2026-52947)

    * kernel: Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CVE-2026-53256)

    * kernel: wifi: nl80211: reject oversized EMA RNR lists (CVE-2026-53182)

    * kernel: Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CVE-2026-53209)

    * kernel: sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (CVE-2026-53246)

    * kernel: Bluetooth: RFCOMM: validate skb length in MCC handlers (CVE-2026-53254)

    * kernel: tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (CVE-2026-63801)

    * kernel: scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CVE-2026-63889)

    * kernel: sctp: fix race between sctp_wait_for_connect and peeloff (CVE-2026-63971)

    * kernel: Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CVE-2026-63975)

    * kernel: Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CVE-2026-63947)

    * kernel: Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CVE-2026-63944)

    * kernel: Bluetooth: ISO: fix UAF in iso_recv_frame (CVE-2026-63946)

    * kernel: Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CVE-2026-63945)

    * kernel: wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (CVE-2026-64117)

    * kernel: wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (CVE-2026-64037)

    * kernel: ixgbevf: fix use-after-free in VEPA multicast source pruning (CVE-2026-64113)

    * kernel: wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (CVE-2026-64255)

    * kernel: wifi: mac80211: fix MLE defragmentation (CVE-2026-64515)

    * kernel: mm/khugepaged: write all dirty file folios when collapsing (CVE-2026-68086)

    * kernel: Linux kernel: Wi-Fi subsystem out-of-bounds read via crafted frames (CVE-2026-68402)

    * kernel: sctp: fix auth_hmacs array size in struct sctp_cookie (CVE-2026-68376)

    * kernel: wifi: cfg80211: validate PMSR FTM preamble range (CVE-2026-68406)

    * kernel: tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (CVE-2026-68117)

    * kernel: sctp: auth: verify auth requirement when auth_chunk is NULL (CVE-2026-68300)

    * kernel: drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (CVE-2026-68264)

    * kernel: sctp: validate stream count in sctp_process_strreset_inreq() (CVE-2026-68315)

    * kernel: dm-verity: fix buffer overflow in FEC calculation (CVE-2026-72098)

    Bug Fix(es) and Enhancement(s):

    *  gfs2: Various xfstests fixes [rhel-9.8.z] (JIRA:RHEL-178219)

    * rtla-timerlat-top doesn't stop properly when threshold is reached on multiple CPUs at once [rhel-9.8.z]     (JIRA:RHEL-193025)

    * qede: build_skb failure causes off-by-one BD ring corruption and kernel panic [rhel-9.8.z]     (JIRA:RHEL-193050)

    * Customer needs netfilter: nfnetlink_queue: optimize verdict lookup with hash table patch [rhel-9.8.z]     (JIRA:RHEL-224489)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-671500 advisory.

    - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098}
    - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332]     {CVE-2026-68086}
    - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370}
    - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481]     {CVE-2026-43368}
    - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417]     {CVE-2026-31656}
    - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275]     {CVE-2026-31566}
    - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479}
    - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466}
    - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (Jose Exposito) [RHEL-236583] {CVE-2026-68264}
    - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801}
    - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037]     {CVE-2026-68117}
    - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971}
    - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917}
    - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315}
    - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376}
    - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300}
    - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084}
    - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745}
    - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206]     {CVE-2026-53246}
    - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652]     {CVE-2026-68406}
    - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez)     [RHEL-237652] {CVE-2026-68406}
    - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652]     {CVE-2026-68406}
    - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652]     {CVE-2026-68406}
    - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez)     [RHEL-236961] {CVE-2026-68402}
    - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez)     [RHEL-232010] {CVE-2026-64255}
    - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez)     [RHEL-231682] {CVE-2026-64117}
    - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez)     [RHEL-231682] {CVE-2026-64117}
    - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez)     [RHEL-230975] {CVE-2026-64037}
    - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587]     {CVE-2026-53182}
    - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez)     [RHEL-229728] {CVE-2026-52947}
    - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619]     {CVE-2026-64515}
    - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515}
    - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670]     {CVE-2026-53072}
    - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059]     {CVE-2026-63947}
    - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073]     {CVE-2026-53209}
    - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944}
    - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756]     {CVE-2026-63975}
    - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721]     {CVE-2026-63889}
    - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946}
    - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882]     {CVE-2026-64113}
    - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport     Bot) [RHEL-227536] {CVE-2026-43334}
    - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454]     {CVE-2026-53053}
    - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431]     {CVE-2026-63945}
    - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646]     {CVE-2026-53254}
    - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254}
    - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576]     {CVE-2026-53256}
    - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918}
    - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091}
    - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091}
    - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091}
    - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228]     {CVE-2026-53091}
    - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091}
    - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091}
    - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091}
    - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532]     {CVE-2026-31692}
    - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532]     {CVE-2026-31692}
    - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692}
    - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692}
    - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692}
    - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1791741836 advisory.

  - In the Linux kernel, the following vulnerability has been resolved: vhost: fix hung thread due to     erroneous iotlb entries In vhost_iotlb_add_range_ctx(), range size can overflow to 0 when start is 0 and     last is ULONG_MAX. One instance where it can happen is when userspace sends an IOTLB message with     iova=size=uaddr=0 (vhost_process_iotlb_msg). So, an entry with size = 0, start = 0, last = ULONG_MAX ends     up in the iotlb. Next time a packet is sent, iotlb_access_ok() loops indefinitely due to that erroneous     entry. Call Trace: <TASK> iotlb_access_ok+0x21b/0x3e0 drivers/vhost/vhost.c:1340     vq_meta_prefetch+0xbc/0x280 drivers/vhost/vhost.c:1366 vhost_transport_do_send_pkt+0xe0/0xfd0     drivers/vhost/vsock.c:104 vhost_worker+0x23d/0x3d0 drivers/vhost/vhost.c:372 kthread+0x2e9/0x3a0     kernel/kthread.c:377 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295 </TASK> Reported by syzbot at:
    https://syzkaller.appspot.com/bug?extid=0abd373e2e50d704db87 To fix this, do two things: 1. Return -EINVAL     in vhost_chr_write_iter() when userspace asks to map a range with size 0. 2. Fix     vhost_iotlb_add_range_ctx() to handle the range [0, ULONG_MAX] by splitting it into two entries.
    (CVE-2022-48862)

  - In the Linux kernel, the following vulnerability has been resolved: net: hns3: add vlan list lock to     protect vlan list When adding port base VLAN, vf VLAN need to remove from HW and modify the vlan state in     vf VLAN list as false. If the periodicity task is freeing the same node, it may cause use after free     error. This patch adds a vlan list lock to protect the vlan list. (CVE-2022-49182)

  - In the Linux kernel, the following vulnerability has been resolved: perf/x86/amd: Fix crash due to race     between amd_pmu_enable_all, perf NMI and throttling amd_pmu_enable_all() does: if (!test_bit(idx,     cpuc->active_mask)) continue; amd_pmu_enable_event(cpuc->events[idx]); A perf NMI of another event can     come between these two steps. Perf NMI handler internally disables and enables _all_ events, including the     one which nmi-intercepted amd_pmu_enable_all() was in process of enabling. If that unintentionally enabled     event has very low sampling period and causes immediate successive NMI, causing the event to be throttled,     cpuc->events[idx] and cpuc->active_mask gets cleared by x86_pmu_stop(). This will result in     amd_pmu_enable_event() getting called with event=NULL when amd_pmu_enable_all() resumes after handling the     NMIs. This causes a kernel crash: BUG: kernel NULL pointer dereference, address: 0000000000000198 #PF:
    supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page [...] Call Trace: <TASK>     amd_pmu_enable_all+0x68/0xb0 ctx_resched+0xd9/0x150 event_function+0xb8/0x130 ?     hrtimer_start_range_ns+0x141/0x4a0 ? perf_duration_warn+0x30/0x30 remote_function+0x4d/0x60
    __flush_smp_call_function_queue+0xc4/0x500 flush_smp_call_function_queue+0x11d/0x1b0 do_idle+0x18f/0x2d0     cpu_startup_entry+0x19/0x20 start_secondary+0x121/0x160 secondary_startup_64_no_verify+0xe5/0xeb </TASK>     amd_pmu_disable_all()/amd_pmu_enable_all() calls inside perf NMI handler were recently added as part of     BRS enablement but I'm not sure whether we really need them. We can just disable BRS in the beginning and     enable it back while returning from NMI. This will solve the issue by not enabling those events whose     active_masks are set but are not yet enabled in hw pmu. (CVE-2022-49781)

  - In the Linux kernel, the following vulnerability has been resolved: blk-iolatency: Fix memory leak on     add_disk() failures When a gendisk is successfully initialized but add_disk() fails such as when a loop     device has invalid number of minor device numbers specified, blkcg_init_disk() is called during init and     then blkcg_exit_disk() during error handling. Unfortunately, iolatency gets initialized in the former but     doesn't get cleaned up in the latter. This is because, in non-error cases, the cleanup is performed by     del_gendisk() calling rq_qos_exit(), the assumption being that rq_qos policies, iolatency being one of     them, can only be activated once the disk is fully registered and visible. That assumption is true for wbt     and iocost, but not so for iolatency as it gets initialized before add_disk() is called. It is desirable     to lazy-init rq_qos policies because they are optional features and add to hot path overhead once     initialized - each IO has to walk all the registered rq_qos policies. So, we want to switch iolatency to     lazy init too. However, that's a bigger change. As a fix for the immediate problem, let's just add an     extra call to rq_qos_exit() in blkcg_exit_disk(). This is safe because duplicate calls to rq_qos_exit()     become noop's. (CVE-2022-50550)

  - In the Linux kernel, the following vulnerability has been resolved: i40e: Do not allow untrusted VF to     remove administratively set MAC Currently when PF administratively sets VF's MAC address and the VF is put     down (VF tries to delete all MACs) then the MAC is removed from MAC filters and primary VF MAC is zeroed.
    Do not allow untrusted VF to remove primary MAC when it was set administratively by PF. Reproducer: 1)     Create VF 2) Set VF interface up 3) Administratively set the VF's MAC 4) Put VF interface down [root@host     ~]# echo 1 > /sys/class/net/enp2s0f0/device/sriov_numvfs [root@host ~]# ip link set enp2s0f0v0 up     [root@host ~]# ip link set enp2s0f0 vf 0 mac fe:6c:b5:da:c7:7d [root@host ~]# ip link show enp2s0f0 23:
    enp2s0f0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP mode DEFAULT group default qlen     1000 link/ether 3c:ec:ef:b7:dd:04 brd ff:ff:ff:ff:ff:ff vf 0 link/ether fe:6c:b5:da:c7:7d brd     ff:ff:ff:ff:ff:ff, spoof checking on, link-state auto, trust off [root@host ~]# ip link set enp2s0f0v0     down [root@host ~]# ip link show enp2s0f0 23: enp2s0f0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc     mq state UP mode DEFAULT group default qlen 1000 link/ether 3c:ec:ef:b7:dd:04 brd ff:ff:ff:ff:ff:ff vf 0     link/ether 00:00:00:00:00:00 brd ff:ff:ff:ff:ff:ff, spoof checking on, link-state auto, trust off     (CVE-2024-26830)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: fix UAF in     iso_recv_frame iso_recv_frame reads conn->sk under iso_conn_lock but releases the lock before using sk,     with no reference held. A concurrent iso_sock_kill() can free sk in that window, causing use-after-free on     sk->sk_state and sock_queue_rcv_skb(). Fix by replacing the bare pointer read with iso_sock_hold(conn),     which calls sock_hold() while the spinlock is held, atomically elevating the refcount before the lock     drops. Add a drop_put label so sock_put() is called on all exit paths where the hold succeeded.
    (CVE-2026-63946)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote Ubuntu 22.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-8905-1 advisory.

    Several security issues were discovered in the Linux kernel. An attacker could possibly use these to     compromise the system. This update corrects flaws in the following subsystems:

    - ARM32 architecture;

    - ARM64 architecture;

    - MIPS architecture;

    - x86 architecture;

    - Intel NPU Driver;

    - Auxiliary display drivers;

    - Compressed RAM block device driver;

    - GPIO subsystem;

    - GPU drivers;

    - HID subsystem;

    - I2C subsystem;

    - IIO subsystem;

    - InfiniBand drivers;

    - Input Device core drivers;

    - Input Device (Mouse) drivers;

    - Multiple devices driver;

    - Media drivers;

    - Fastrpc Driver;

    - Ethernet bonding driver;

    - Network drivers;

    - Mellanox network drivers;

    - Microsoft Azure Network Adapter (MANA) driver;

    - Texas Instruments network drivers;

    - NVMEM (Non Volatile Memory) drivers;

    - Parport drivers;

    - SCSI subsystem;

    - SLIMbus drivers;

    - NVIDIA Tegra SoC drivers;

    - SPI subsystem;

    - Trusted Execution Environment drivers;

    - Thunderbolt and USB4 drivers;

    - TTY drivers;

    - USB Device Class drivers;

    - DesignWare USB2 driver;

    - USB Gadget drivers;

    - USB Dual Role (OTG-ready) Controller drivers;

    - USB Serial drivers;

    - USB Type-C support driver;

    - USB Type-C Port Controller Manager driver;

    - USB Type-C Connector System Software Interface driver;

    - USB over IP driver;

    - Framebuffer layer;

    - Ext4 file system;

    - FUSE (File system in Userspace);

    - File systems infrastructure;

    - SMB network file system;

    - Mellanox drivers;

    - Network traffic control;

    - Bluetooth subsystem;

    - IPv4 networking;

    - Netfilter;

    - IPv6 networking;

    - Network sockets;

    - XFRM subsystem;

    - IPC subsystem;

    - Signal handling mechanism;

    - Memory management;

    - 6LoWPAN network protocol;

    - IEEE 802 network protocols;

    - B.A.T.M.A.N. meshing protocol;

    - Ethernet bridge;

    - Networking core;

    - Devlink API;

    - Ethtool driver;

    - Handshake API;

    - HSR network protocol;

    - IEEE802154.4 network protocol;

    - IUCV driver;

    - L2TP protocol;

    - MAC80211 subsystem;

    - Management Component Transport Protocol (MCTP);

    - Multipath TCP;

    - NetLabel subsystem;

    - NFC subsystem;

    - Open vSwitch;

    - Qualcomm IPC Router (QRTR);

    - RDS protocol;

    - RxRPC session sockets;

    - SCTP protocol;

    - SMC sockets;

    - VMware vSockets driver;

    - Wireless networking;

    - ALSA framework;

    - Simple audio multiplexer codec driver;

    - Wolfson Microelectronics audio codecs;

    - KVM subsystem; (CVE-2025-68296, CVE-2025-68768, CVE-2026-23346, CVE-2026-31663, CVE-2026-43116,     CVE-2026-43219, CVE-2026-43240, CVE-2026-43303, CVE-2026-43311, CVE-2026-43331, CVE-2026-45850,     CVE-2026-45930, CVE-2026-46203, CVE-2026-46320, CVE-2026-46321, CVE-2026-46322, CVE-2026-52908,     CVE-2026-52910, CVE-2026-52913, CVE-2026-52917, CVE-2026-52923, CVE-2026-52927, CVE-2026-52929,     CVE-2026-52930, CVE-2026-52934, CVE-2026-52935, CVE-2026-52939, CVE-2026-52942, CVE-2026-52943,     CVE-2026-52944, CVE-2026-52947, CVE-2026-52948, CVE-2026-53080, CVE-2026-53132, CVE-2026-53133,     CVE-2026-53134, CVE-2026-53135, CVE-2026-53136, CVE-2026-53137, CVE-2026-53138, CVE-2026-53140,     CVE-2026-53143, CVE-2026-53144, CVE-2026-53146, CVE-2026-53147, CVE-2026-53148, CVE-2026-53149,     CVE-2026-53150, CVE-2026-53154, CVE-2026-53156, CVE-2026-53158, CVE-2026-53159, CVE-2026-53160,     CVE-2026-53161, CVE-2026-53168, CVE-2026-53177, CVE-2026-53181, CVE-2026-53182, CVE-2026-53183,     CVE-2026-53184, CVE-2026-53185, CVE-2026-53190, CVE-2026-53194, CVE-2026-53195, CVE-2026-53196,     CVE-2026-53198, CVE-2026-53199, CVE-2026-53202, CVE-2026-53205, CVE-2026-53208, CVE-2026-53209,     CVE-2026-53210, CVE-2026-53213, CVE-2026-53214, CVE-2026-53217, CVE-2026-53218, CVE-2026-53219,     CVE-2026-53220, CVE-2026-53223, CVE-2026-53227, CVE-2026-53229, CVE-2026-53230, CVE-2026-53232,     CVE-2026-53236, CVE-2026-53237, CVE-2026-53238, CVE-2026-53239, CVE-2026-53242, CVE-2026-53245,     CVE-2026-53249, CVE-2026-53251, CVE-2026-53252, CVE-2026-53253, CVE-2026-53254, CVE-2026-53255,     CVE-2026-53256, CVE-2026-53261, CVE-2026-53262, CVE-2026-53263, CVE-2026-53264, CVE-2026-53265,     CVE-2026-53266, CVE-2026-53267, CVE-2026-53268, CVE-2026-53269, CVE-2026-53270, CVE-2026-53273,     CVE-2026-53274, CVE-2026-53275, CVE-2026-53329, CVE-2026-53331, CVE-2026-53332, CVE-2026-53336,     CVE-2026-53337, CVE-2026-53339, CVE-2026-53343, CVE-2026-53345, CVE-2026-53347, CVE-2026-53349,     CVE-2026-53350, CVE-2026-53352, CVE-2026-53353, CVE-2026-53356, CVE-2026-53358, CVE-2026-63867,     CVE-2026-63868, CVE-2026-63869, CVE-2026-63870, CVE-2026-63871, CVE-2026-63875, CVE-2026-63876,     CVE-2026-63877, CVE-2026-63881, CVE-2026-63882, CVE-2026-63883, CVE-2026-63884, CVE-2026-63889,     CVE-2026-63890, CVE-2026-63891, CVE-2026-63892, CVE-2026-63893, CVE-2026-63895, CVE-2026-63896,     CVE-2026-63897, CVE-2026-63898, CVE-2026-63899, CVE-2026-63900, CVE-2026-63901, CVE-2026-63902,     CVE-2026-63903, CVE-2026-63904, CVE-2026-63905, CVE-2026-63906, CVE-2026-63908, CVE-2026-63909,     CVE-2026-63913, CVE-2026-63914, CVE-2026-63915, CVE-2026-63916, CVE-2026-63917, CVE-2026-63919,     CVE-2026-63920, CVE-2026-63921, CVE-2026-63925, CVE-2026-63926, CVE-2026-63927, CVE-2026-63928,     CVE-2026-63930, CVE-2026-63931, CVE-2026-63933, CVE-2026-63934, CVE-2026-63942, CVE-2026-63943,     CVE-2026-63944, CVE-2026-63945, CVE-2026-63946, CVE-2026-63947, CVE-2026-63948, CVE-2026-63949,     CVE-2026-63952, CVE-2026-63954, CVE-2026-63956, CVE-2026-63957, CVE-2026-63958, CVE-2026-63959,     CVE-2026-63960, CVE-2026-63961, CVE-2026-63964, CVE-2026-63967, CVE-2026-63968, CVE-2026-63969,     CVE-2026-63971, CVE-2026-63973, CVE-2026-63974, CVE-2026-63975, CVE-2026-63976, CVE-2026-63980,     CVE-2026-63985, CVE-2026-63990, CVE-2026-63991, CVE-2026-64001, CVE-2026-64002, CVE-2026-64003,     CVE-2026-64004, CVE-2026-64005, CVE-2026-64006, CVE-2026-64009, CVE-2026-64010, CVE-2026-64011,     CVE-2026-64012, CVE-2026-64014, CVE-2026-64026, CVE-2026-64090, CVE-2026-64093, CVE-2026-64094,     CVE-2026-64095, CVE-2026-64099, CVE-2026-64123, CVE-2026-64131, CVE-2026-64222, CVE-2026-64233,     CVE-2026-64234, CVE-2026-64237, CVE-2026-64239, CVE-2026-64240, CVE-2026-64242, CVE-2026-64243,     CVE-2026-64524, CVE-2026-64525, CVE-2026-64527, CVE-2026-64528, CVE-2026-72046, CVE-2026-92502)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
345600	RHEL 9 : kernel (RHSA-2026:67150)	Nessus	Red Hat Local Security Checks	9/14/2026	9/23/2026	high
345896	Oracle Linux 9 : ELSA-2026-67150-0: / kernel (ELSA-2026-671500)	Nessus	Oracle Linux Local Security Checks	9/15/2026	9/23/2026	high
364688	AlmaLinux 9.2 [TuxCare] Security Update: bpftool / kernel / kernel-64k / kernel-64k-core / kernel-64k-debug / etc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1791741836)	Nessus	Alma Linux Local Security Checks	10/12/2026	10/28/2026	critical
341024	SUSE SLED15 / SLES15 : Security update for the Linux Kernel (SUSE-SU-2026:3790-1)	Nessus	SuSE Local Security Checks	8/27/2026	9/29/2026	high
340045	Ubuntu 26.04 LTS : Linux kernel (NVIDIA BaseOS) vulnerabilities (USN-8664-1)	Nessus	Ubuntu Local Security Checks	8/26/2026	11/11/2026	high
328093	Linux Distros Unpatched Vulnerability : CVE-2026-63946	Nessus	Misc.	7/20/2026	11/13/2026	high
365464	Ubuntu 22.04 LTS : Linux kernel (GCP) vulnerabilities (USN-8905-1)	Nessus	Ubuntu Local Security Checks	10/13/2026	10/13/2026	high

Detections

Analytics

Plugins Search

high

high

critical

high

high

high

high