The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:1690 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: Linux kernel: irqchip/gic-v2m use-after-free vulnerability (CVE-2025-37819)

    * kernel: RDMA/core: Fix KASAN: slab-use-after-free Read in ib_register_device problem (CVE-2025-38022)

    * kernel: Linux kernel use-after-free in eventpoll (CVE-2025-38349)

    * kernel: io_uring/msg_ring: ensure io_kiocb freeing is deferred for RCU (CVE-2025-38453)

    * kernel: net/sched: mqprio: fix stack out-of-bounds write in tc entry parsing (CVE-2025-38568)

    * kernel: drm/xe: Fix vm_bind_ioctl double free bug (CVE-2025-38731)

    * kernel: ASoC: Intel: bytcr_rt5640: Fix invalid quirk input mapping (CVE-2025-40154)

    * kernel: net: use dst_dev_rcu() in sk_setup_caps() (CVE-2025-40170)

    * kernel: ipv6: use RCU in ip6_xmit() (CVE-2025-40135)

    * kernel: ipv6: use RCU in ip6_output() (CVE-2025-40158)

    * kernel: Linux kernel: vsock vulnerability may lead to memory corruption (CVE-2025-40248)

    * kernel: mptcp: fix race condition in mptcp_schedule_work() (CVE-2025-40258)

    * kernel: devlink: rate: Unset parent pointer in devl_rate_nodes_destroy (CVE-2025-40251)

    * kernel: Linux kernel: Use-after-free in proc_readdir_de() can lead to privilege escalation or denial of     service. (CVE-2025-40271)

    * kernel: Linux kernel: Out-of-bounds write in Bluetooth MGMT can lead to information disclosure and     denial of service (CVE-2025-40294)

    * kernel: Linux kernel: Information disclosure and denial of service in Bluetooth HCI event handling     (CVE-2025-40301)

    * kernel: Bluetooth: hci_sync: fix race in hci_cmd_sync_dequeue_once (CVE-2025-40318)

    * kernel: net: atlantic: fix fragment overflow handling in RX path (CVE-2025-68301)

    * kernel: Bluetooth: hci_sock: Prevent race in socket write iter and sock bind (CVE-2025-68305)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:1690 advisory.

    * kernel: Linux kernel: irqchip/gic-v2m use-after-free vulnerability (CVE-2025-37819)

    * kernel: RDMA/core: Fix KASAN: slab-use-after-free Read in ib_register_device problem (CVE-2025-38022)

    * kernel: Linux kernel use-after-free in eventpoll (CVE-2025-38349)

    * kernel: io_uring/msg_ring: ensure io_kiocb freeing is deferred for RCU (CVE-2025-38453)

    * kernel: net/sched: mqprio: fix stack out-of-bounds write in tc entry parsing (CVE-2025-38568)

    * kernel: drm/xe: Fix vm_bind_ioctl double free bug (CVE-2025-38731)

    * kernel: ASoC: Intel: bytcr_rt5640: Fix invalid quirk input mapping (CVE-2025-40154)

    * kernel: net: use dst_dev_rcu() in sk_setup_caps() (CVE-2025-40170)

    * kernel: ipv6: use RCU in ip6_xmit() (CVE-2025-40135)

    * kernel: ipv6: use RCU in ip6_output() (CVE-2025-40158)

    * kernel: Linux kernel: vsock vulnerability may lead to memory corruption (CVE-2025-40248)

    * kernel: mptcp: fix race condition in mptcp_schedule_work() (CVE-2025-40258)

    * kernel: devlink: rate: Unset parent pointer in devl_rate_nodes_destroy (CVE-2025-40251)

    * kernel: Linux kernel: Use-after-free in proc_readdir_de() can lead to privilege escalation or denial of     service. (CVE-2025-40271)

    * kernel: Linux kernel: Out-of-bounds write in Bluetooth MGMT can lead to information disclosure and     denial of service (CVE-2025-40294)

    * kernel: Linux kernel: Information disclosure and denial of service in Bluetooth HCI event handling     (CVE-2025-40301)

    * kernel: Bluetooth: hci_sync: fix race in hci_cmd_sync_dequeue_once (CVE-2025-40318)

    * kernel: net: atlantic: fix fragment overflow handling in RX path (CVE-2025-68301)

    * kernel: Bluetooth: hci_sock: Prevent race in socket write iter and sock bind (CVE-2025-68305)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The AlmaLinux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1786824415 advisory.

  - In the Linux kernel, the following vulnerability has been resolved: CDC-NCM: avoid overflow in sanity     checking A broken device may give an extreme offset like 0xFFF0 and a reasonable length for a fragment. In     the sanity check as formulated now, this will create an integer overflow, defeating the sanity check. Both     offset and offset + len need to be checked in such a manner that no overflow can occur. And those     quantities should be unsigned. (CVE-2022-48938)

  - In the Linux kernel, the following vulnerability has been resolved: pinctrl: devicetree: fix null pointer     dereferencing in pinctrl_dt_to_map Here is the BUG report by KASAN about null pointer dereference: BUG:
    KASAN: null-ptr-deref in strcmp+0x2e/0x50 Read of size 1 at addr 0000000000000000 by task python3/2640     Call Trace: strcmp __of_find_property of_find_property pinctrl_dt_to_map kasprintf() would return NULL     pointer when kmalloc() fail to allocate. So directly return ENOMEM, if kasprintf() return NULL pointer.
    (CVE-2022-49832)

  - In the Linux kernel, the following vulnerability has been resolved: hugetlbfs: fix null-ptr-deref in     hugetlbfs_parse_param() Syzkaller reports a null-ptr-deref bug as follows:
    ====================================================== KASAN: null-ptr-deref in range     [0x0000000000000000-0x0000000000000007] RIP: 0010:hugetlbfs_parse_param+0x1dd/0x8e0     fs/hugetlbfs/inode.c:1380 [...] Call Trace: <TASK> vfs_parse_fs_param fs/fs_context.c:148 [inline]     vfs_parse_fs_param+0x1f9/0x3c0 fs/fs_context.c:129 vfs_parse_fs_string+0xdb/0x170 fs/fs_context.c:191     generic_parse_monolithic+0x16f/0x1f0 fs/fs_context.c:231 do_new_mount fs/namespace.c:3036 [inline]     path_mount+0x12de/0x1e20 fs/namespace.c:3370 do_mount fs/namespace.c:3383 [inline] __do_sys_mount     fs/namespace.c:3591 [inline] __se_sys_mount fs/namespace.c:3568 [inline] __x64_sys_mount+0x27f/0x300     fs/namespace.c:3568 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x35/0xb0     arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd [...] </TASK>     ====================================================== According to commit vfs: parse: deal with zero     length string value, kernel will set the param->string to null pointer in vfs_parse_fs_string() if fs     string has zero length. Yet the problem is that, hugetlbfs_parse_param() will dereference the     param->string, without checking whether it is a null pointer. To be more specific, if     hugetlbfs_parse_param() parses an illegal mount parameter, such as size=,, kernel will constructs struct     fs_parameter with null pointer in vfs_parse_fs_string(), then passes this struct fs_parameter to     hugetlbfs_parse_param(), which triggers the above null-ptr-deref bug. This patch solves it by adding     sanity check on param->string in hugetlbfs_parse_param(). (CVE-2022-50334)

  - In the Linux kernel, the following vulnerability has been resolved: Input: cyapa - add missing input core     locking to suspend/resume functions Grab input->mutex during suspend/resume functions like it is done in     other input drivers. This fixes the following warning during system suspend/resume cycle on Samsung     Exynos5250-based Snow Chromebook: ------------[ cut here ]------------ WARNING: CPU: 1 PID: 1680 at     drivers/input/input.c:2291 input_device_enabled+0x68/0x6c Modules linked in: ... CPU: 1 PID: 1680 Comm:
    kworker/u4:12 Tainted: G W 6.6.0-rc5-next-20231009 #14109 Hardware name: Samsung Exynos (Flattened Device     Tree) Workqueue: events_unbound async_run_entry_fn unwind_backtrace from show_stack+0x10/0x14 show_stack     from dump_stack_lvl+0x58/0x70 dump_stack_lvl from __warn+0x1a8/0x1cc __warn from     warn_slowpath_fmt+0x18c/0x1b4 warn_slowpath_fmt from input_device_enabled+0x68/0x6c input_device_enabled     from cyapa_gen3_set_power_mode+0x13c/0x1dc cyapa_gen3_set_power_mode from cyapa_reinitialize+0x10c/0x15c     cyapa_reinitialize from cyapa_resume+0x48/0x98 cyapa_resume from dpm_run_callback+0x90/0x298     dpm_run_callback from device_resume+0xb4/0x258 device_resume from async_resume+0x20/0x64 async_resume from     async_run_entry_fn+0x40/0x15c async_run_entry_fn from process_scheduled_works+0xbc/0x6a8     process_scheduled_works from worker_thread+0x188/0x454 worker_thread from kthread+0x108/0x140 kthread from     ret_from_fork+0x14/0x28 Exception stack(0xf1625fb0 to 0xf1625ff8) ... ---[ end trace 0000000000000000 ]---     ... ------------[ cut here ]------------ WARNING: CPU: 1 PID: 1680 at drivers/input/input.c:2291     input_device_enabled+0x68/0x6c Modules linked in: ... CPU: 1 PID: 1680 Comm: kworker/u4:12 Tainted: G W     6.6.0-rc5-next-20231009 #14109 Hardware name: Samsung Exynos (Flattened Device Tree) Workqueue:
    events_unbound async_run_entry_fn unwind_backtrace from show_stack+0x10/0x14 show_stack from     dump_stack_lvl+0x58/0x70 dump_stack_lvl from __warn+0x1a8/0x1cc __warn from warn_slowpath_fmt+0x18c/0x1b4     warn_slowpath_fmt from input_device_enabled+0x68/0x6c input_device_enabled from     cyapa_gen3_set_power_mode+0x13c/0x1dc cyapa_gen3_set_power_mode from cyapa_reinitialize+0x10c/0x15c     cyapa_reinitialize from cyapa_resume+0x48/0x98 cyapa_resume from dpm_run_callback+0x90/0x298     dpm_run_callback from device_resume+0xb4/0x258 device_resume from async_resume+0x20/0x64 async_resume from     async_run_entry_fn+0x40/0x15c async_run_entry_fn from process_scheduled_works+0xbc/0x6a8     process_scheduled_works from worker_thread+0x188/0x454 worker_thread from kthread+0x108/0x140 kthread from     ret_from_fork+0x14/0x28 Exception stack(0xf1625fb0 to 0xf1625ff8) ... ---[ end trace 0000000000000000 ]---     (CVE-2023-52884)

  - In the Linux kernel, the following vulnerability has been resolved: tracing: Do not let histogram values     have some modifiers Histogram values can not be strings, stacktraces, graphs, symbols, syscalls, or     grouped in buckets or log. Give an error if a value is set to do so. Note, the histogram code was not     prepared to handle these modifiers for histograms and caused a bug. Mark Rutland reported: # echo     'p:copy_to_user __arch_copy_to_user n=$arg2' >> /sys/kernel/tracing/kprobe_events # echo     'hist:keys=n:vals=hitcount.buckets=8:sort=hitcount' >     /sys/kernel/tracing/events/kprobes/copy_to_user/trigger # cat     /sys/kernel/tracing/events/kprobes/copy_to_user/hist [ 143.694628] Unable to handle kernel NULL pointer     dereference at virtual address 0000000000000000 [ 143.695190] Mem abort info: [ 143.695362] ESR =     0x0000000096000004 [ 143.695604] EC = 0x25: DABT (current EL), IL = 32 bits [ 143.695889] SET = 0, FnV = 0     [ 143.696077] EA = 0, S1PTW = 0 [ 143.696302] FSC = 0x04: level 0 translation fault [ 143.702381] Data     abort info: [ 143.702614] ISV = 0, ISS = 0x00000004 [ 143.702832] CM = 0, WnR = 0 [ 143.703087] user     pgtable: 4k pages, 48-bit VAs, pgdp=00000000448f9000 [ 143.703407] [0000000000000000]     pgd=0000000000000000, p4d=0000000000000000 [ 143.704137] Internal error: Oops: 0000000096000004 [#1]     PREEMPT SMP [ 143.704714] Modules linked in: [ 143.705273] CPU: 0 PID: 133 Comm: cat Not tainted     6.2.0-00003-g6fc512c10a7c #3 [ 143.706138] Hardware name: linux,dummy-virt (DT) [ 143.706723] pstate:
    80000005 (Nzcv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 143.707120] pc :
    hist_field_name.part.0+0x14/0x140 [ 143.707504] lr : hist_field_name.part.0+0x104/0x140 [ 143.707774] sp :
    ffff800008333a30 [ 143.707952] x29: ffff800008333a30 x28: 0000000000000001 x27: 0000000000400cc0 [     143.708429] x26: ffffd7a653b20260 x25: 0000000000000000 x24: ffff10d303ee5800 [ 143.708776] x23:
    ffffd7a6539b27b0 x22: ffff10d303fb8c00 x21: 0000000000000001 [ 143.709127] x20: ffff10d303ec2000 x19:
    0000000000000000 x18: 0000000000000000 [ 143.709478] x17: 0000000000000000 x16: 0000000000000000 x15:
    0000000000000000 [ 143.709824] x14: 0000000000000000 x13: 203a6f666e692072 x12: 6567676972742023 [     143.710179] x11: 0a230a6d6172676f x10: 000000000000002c x9 : ffffd7a6521e018c [ 143.710584] x8 :
    000000000000002c x7 : 7f7f7f7f7f7f7f7f x6 : 000000000000002c [ 143.710915] x5 : ffff10d303b0103e x4 :
    ffffd7a653b20261 x3 : 000000000000003d [ 143.711239] x2 : 0000000000020001 x1 : 0000000000000001 x0 :
    0000000000000000 [ 143.711746] Call trace: [ 143.712115] hist_field_name.part.0+0x14/0x140 [ 143.712642]     hist_field_name.part.0+0x104/0x140 [ 143.712925] hist_field_print+0x28/0x140 [ 143.713125]     event_hist_trigger_print+0x174/0x4d0 [ 143.713348] hist_show+0xf8/0x980 [ 143.713521]     seq_read_iter+0x1bc/0x4b0 [ 143.713711] seq_read+0x8c/0xc4 [ 143.713876] vfs_read+0xc8/0x2a4 [ 143.714043]     ksys_read+0x70/0xfc [ 143.714218] __arm64_sys_read+0x24/0x30 [ 143.714400] invoke_syscall+0x50/0x120 [     143.714587] el0_svc_common.constprop.0+0x4c/0x100 [ 143.714807] do_el0_svc+0x44/0xd0 [ 143.714970]     el0_svc+0x2c/0x84 [ 143.715134] el0t_64_sync_handler+0xbc/0x140 [ 143.715334] el0t_64_sync+0x190/0x194 [     143.715742] Code: a9bd7bfd 910003fd a90153f3 aa0003f3 (f9400000) [ 143.716510] ---[ end trace     0000000000000000 ]--- Segmentation fault (CVE-2023-53093)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The CentOS Linux 8.5 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS8.5:CLSA-2026:1782146775 advisory.

  - Linux kernel CIFS implementation, version 4.9.0 is vulnerable to a relative paths injection in directory     entry lists. (CVE-2019-10220)

  - The KVM implementation in the Linux kernel through 4.20.5 has a Use-after-Free. (CVE-2019-7221)

  - Improper input validation in BlueZ may allow an unauthenticated user to potentially enable escalation of     privilege via adjacent access. (CVE-2020-12351)

  - Improper access control in BlueZ may allow an unauthenticated user to potentially enable information     disclosure via adjacent access. (CVE-2020-12352)

  - Improper buffer restrictions in BlueZ may allow an unauthenticated user to potentially enable denial of     service via adjacent access. This affects all Linux kernel versions that support BlueZ. (CVE-2020-24490)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:2378 advisory.

    The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with     extremely high determinism requirements.

    Security Fix(es):

    * kernel: vsock/vmci: Clear the vmci transport packet properly when initializing it (CVE-2025-38403)

    * kernel: net: use dst_dev_rcu() in sk_setup_caps() (CVE-2025-40170)

    * kernel: ipv6: use RCU in ip6_xmit() (CVE-2025-40135)

    * kernel: ipv6: use RCU in ip6_output() (CVE-2025-40158)

    * kernel: Linux kernel ALSA USB audio driver: Buffer overflow leading to information disclosure and denial     of service (CVE-2025-40269)

    * kernel: ext4: fix use-after-free in ext4_orphan_cleanup (CVE-2022-50673)

    * kernel: NFSv4/pNFS: Clear NFS_INO_LAYOUTCOMMIT in pnfs_mark_layout_stateid_invalid (CVE-2025-68349)

    * kernel: nvme-tcp: fix NULL pointer dereferences in nvmet_tcp_build_pdu_iovec (CVE-2026-22998)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
296481	SUSE SLES15 Security Update : kernel (SUSE-SU-2026:0278-1)	Nessus	SuSE Local Security Checks	1/24/2026	1/24/2026	high
297575	RHEL 10 : kernel (RHSA-2026:1690)	Nessus	Red Hat Local Security Checks	2/2/2026	2/2/2026	high
298315	RockyLinux 10 : kernel (RLSA-2026:1690)	Nessus	Rocky Linux Local Security Checks	2/8/2026	2/8/2026	high
359602	AlmaLinux 9.6 [TuxCare] Security Update: kernel / kernel-64k / kernel-64k-core / kernel-64k-debug / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1786824415)	Nessus	Alma Linux Local Security Checks	10/1/2026	10/28/2026	critical
360215	CentOS Linux 8.5 [TuxCare] Security Update: bpftool / kernel / kernel-core / kernel-cross-headers / etc Multiple Vulnerabilities (CENTOS8.5:CLSA-2026:1782146775)	Nessus	CentOS Local Security Checks	10/1/2026	10/1/2026	high
298489	RHEL 8 : kernel-rt (RHSA-2026:2378)	Nessus	Red Hat Local Security Checks	2/10/2026	2/10/2026	high
319325	EulerOS Virtualization 2.13.0 : kernel (EulerOS-SA-2026-2171)	Nessus	Huawei Local Security Checks	6/6/2026	6/6/2026	high

Detections

Analytics

Plugins Search

high

high

high

critical

high

high

high