The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211_hwsim: fix typo in     frequency notification The NAN notification is for 5745 MHz which corresponds to channel 149 and not 5475     which is not actually a valid channel. This could result in a NULL pointer dereference in     cfg80211_next_nan_dw_notif. (CVE-2026-23040)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote AlmaLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:18134 advisory.

    * kernel: tcp_bpf: Fix the sk_mem_uncharge logic in tcp_bpf_sendmsg (CVE-2024-56633)
      * kernel: KVM: x86: Load DR6 with guest value only before entering .vcpu_run() loop (CVE-2025-21839)
      * kernel: block: fix resource leak in blk_register_queue() error path (CVE-2025-37980)
      * kernel: dmaengine: idxd: fix memory leak in error handling path of idxd_alloc (CVE-2025-38015)
      * kernel: espintcp: remove encap socket caching to avoid reference leak (CVE-2025-38097)
      * kernel: bpf: fix ktls panic with sockmap (CVE-2025-38166)
      * kernel: bpf: Check rcu_read_lock_trace_held() in bpf_map_lookup_percpu_elem() (CVE-2025-38202)
      * kernel: bpf: Do not include stack ptr register in precision backtracking bookkeeping (CVE-2025-38279)
      * kernel: ring-buffer: Do not trigger WARN_ON() due to a commit_overrun (CVE-2025-38267)
      * kernel: phy: qcom-qmp-usb: Fix an NULL vs IS_ERR() bug (CVE-2025-38275)
      * kernel: ftrace: Fix UAF when lookup kallsym after ftrace disabled (CVE-2025-38346)
      * kernel: ACPICA: fix acpi operand cache leak in dswstate.c (CVE-2025-38345)
      * kernel: nvmet: fix memory leak of bio integrity (CVE-2025-38405)
      * kernel: netfilter: flowtable: account for Ethernet header in nf_flow_pppoe_proto() (CVE-2025-38441)
      * kernel: net: vlan: fix VLAN 0 refcount imbalance of toggling filtering during runtime (CVE-2025-38470)
      * kernel: fs: writeback: fix use-after-free in __mark_inode_dirty() (CVE-2025-39866)
      * kernel: PCI/AER: Avoid NULL pointer dereference in aer_ratelimit() (CVE-2025-40034)
      * kernel: dm: fix NULL pointer dereference in __dm_suspend() (CVE-2025-40134)
      * kernel: Revert NFSD: Remove the cap on number of operations per NFSv4 COMPOUND (CVE-2025-40210)
      * kernel: Linux kernel MPTCP: Privilege escalation or denial of service via use-after-free in timer     handling (CVE-2025-40257)
      * kernel: smb: client: fix potential cfid UAF in smb2_query_info_compound (CVE-2025-40320)
      * kernel: wifi: mac80211_hwsim: fix typo in frequency notification (CVE-2026-23040)
      * kernel: Kernel: Privilege escalation or denial of service in nf_tables via inverted element activity     check (CVE-2026-23111)
      * kernel: Linux kernel: Denial of Service in ice driver due to race condition during VSI rebuild     (CVE-2026-23210)
      * kernel: Linux kernel: Denial of service and memory corruption in RDMA umad (CVE-2026-23243)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-18587 advisory.

    - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392]     {CVE-2026-46331}
    - scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414}
    - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102]     {CVE-2026-46135}
    - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158]     {CVE-2026-46117}
    - exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173}
    - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941]     {CVE-2026-43279}
    - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984}
    - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984}
    - bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260}
    - wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121]     {CVE-2026-46125}
    - RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145}
    - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057]     {CVE-2026-46152}
    - wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025]     {CVE-2026-46166}
    - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359]     {CVE-2026-46056}
    - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506]     {CVE-2026-31669}
    - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525]     {CVE-2026-31474}
    - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot)     [RHEL-172858] {CVE-2026-31772}
    - xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787}
    - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037}
    - net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539]     {CVE-2026-31508}
    - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181}
    - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408]     {CVE-2026-43501}
    - RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852}
    - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843]     {CVE-2026-43116}
    - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993]     {CVE-2026-43125}
    - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125}
    - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581}
    - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056}
    - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot)     [RHEL-165564] {CVE-2026-23216}
    - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068]     {CVE-2026-31419}
    - smb: client: reject userspace cifs.spnego descriptions (Paulo Alcantara) [RHEL-178944] {CVE-2026-46243}
    - Buffer overflow in drivers/xen/sys-hypervisor.c (Vitaly Kuznetsov) [RHEL-172510] {CVE-2026-31786}
    - smb: client: fix OOB reads parsing symlink error response (CKI Backport Bot) [RHEL-171471]     {CVE-2026-31613}
    - netfilter: xt_tcpmss: check remaining length before reading optlen (CKI Backport Bot) [RHEL-174216]     {CVE-2026-43190}
    - wifi: brcmfmac: validate bsscfg indices in IF events (CKI Backport Bot) [RHEL-173848] {CVE-2026-43110}
    - Bluetooth: SCO: fix race conditions in sco_sock_connect() (CKI Backport Bot) [RHEL-172599]     {CVE-2026-43023}
    - Bluetooth: MGMT: validate LTK enc_size on load (CKI Backport Bot) [RHEL-172572] {CVE-2026-43020}
    - proc: fix type confusion in pde_set_flags() (Abhi Das) [RHEL-163343] {CVE-2025-38653}
    - proc: fix missing pde_set_flags() for net proc files (Abhi Das) [RHEL-163343] {CVE-2025-38653}
    - proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (CKI Backport Bot)     [RHEL-163343] {CVE-2025-38653}
    - mm/page_alloc: clear page->private in free_pages_prepare() (Rafael Aquini) [RHEL-174750]     {CVE-2026-43303}
    - smb: client: validate the whole DACL before rewriting it in cifsacl (Paulo Alcantara) [RHEL-172821]     {CVE-2026-31709}
    - Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (David Marlin)     [RHEL-165063] {CVE-2026-31408}
    - xfs: fix freemap adjustments when adding xattrs to leaf blocks (CKI Backport Bot) [RHEL-174058]     {CVE-2026-43158}
    - xfs: delete attr leaf freemap entries when empty (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158}
    - HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CKI Backport Bot) [RHEL-172740]     {CVE-2026-43051}
    - netfilter: nf_conntrack_helper: pass helper to expect cleanup (CKI Backport Bot) [RHEL-172620]     {CVE-2026-43027}
    - netfilter: ip6t_eui64: reject invalid MAC header for all packets (CKI Backport Bot) [RHEL-171155]     {CVE-2026-31685}
    - net: sched: act_csum: validate nested VLAN headers (CKI Backport Bot) [RHEL-171138] {CVE-2026-31684}
    - nbd: defer config unlock in nbd_genl_connect (Jeff Moyer) [RHEL-166950] {CVE-2025-68366}
    - x86/mm: flush IOMMU before freeing kernel page table pages (Jerry Snitselaar) [RHEL-167100]     {CVE-2025-71089}
    - iommu/sva: add kernel page table IOTLB flush notification (Jerry Snitselaar) [RHEL-167100]     {CVE-2025-71089}
    - netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CKI Backport Bot) [RHEL-166987]     {CVE-2026-23455}
    - crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot)     [RHEL-166927] {CVE-2025-68724}
    - ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (Bruno Meneguele) [RHEL-169734]     {CVE-2025-68183}
    - netfilter: nf_tables: release flowtable after rcu grace period on error (CKI Backport Bot) [RHEL-160461]     {CVE-2026-23392}
    - net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176064]     {CVE-2026-46300}
    - net: move skb_gro_receive_list from udp to core (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300}
    - net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176064]     {CVE-2026-46300}
    - ptrace: slightly saner 'get_dumpable()' logic (Ricardo Robaina) [RHEL-176454] {CVE-2026-46333}
    - md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174091] {CVE-2026-43163}
    - RDMA/umem: Fix double dma_buf_unpin in failure path (CKI Backport Bot) [RHEL-174020] {CVE-2026-43128}
    - usbip: validate number_of_packets in usbip_pack_ret_submit() (CKI Backport Bot) [RHEL-171430]     {CVE-2026-31607}
    - can: raw: fix ro->uniq use-after-free in raw_rcv() (CKI Backport Bot) [RHEL-170759] {CVE-2026-31532}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-18134 advisory.

    - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188463] {CVE-2026-53016}
    - futex/requeue: Revert 'Prevent NULL pointer dereference in remove_waiter() on self-deadlock'' (CKI     Backport Bot) [RHEL-193250] {CVE-2026-53166}
    - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (CKI Backport Bot)     [RHEL-193250] {CVE-2026-43499}
    - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (CKI Backport Bot) [RHEL-193153]     {CVE-2026-43499}
    - rtmutex: Use waiter::task instead of current in remove_waiter() (CKI Backport Bot) [RHEL-193153]     {CVE-2026-43499}
    - md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174092] {CVE-2026-43163}
    - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192407]     {CVE-2026-53359}
    - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186698]     {CVE-2026-46113}
    - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport     Bot) [RHEL-183007] {CVE-2025-71066}
    - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot)     [RHEL-179854] {CVE-2026-46227}
    - eventpoll: Fix semi-unbounded recursion (Ian Kent) [RHEL-180776] {CVE-2025-38614}
    - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180776] {CVE-2026-46242}
    - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173832] {CVE-2026-43074}
    - smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180048]     {CVE-2026-46155}
    - procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot)     [RHEL-181902] {CVE-2026-46259}
    - net/ipv6: ioam6: prevent schema length wraparound in trace fill (Antoine Tenart) [RHEL-174786]     {CVE-2026-43341}
    - net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180277]     {CVE-2026-43276}
    - net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180277]     {CVE-2026-43276}
    - fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189491]     {CVE-2026-43112}
    - Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183592] {CVE-2025-10263}
    - arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183592]     {CVE-2025-10263}
    - arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183592] {CVE-2025-10263}
    - arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183592] {CVE-2025-10263}
    - arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183592] {CVE-2025-10263}
    - arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183592] {CVE-2025-10263}
    - arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183592] {CVE-2025-10263}
    - KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CKI Backport Bot)     [RHEL-183965] {CVE-2026-46316}
    - netfilter: nft_inner: Fix IPv6 inner_thoff desync (CKI Backport Bot) [RHEL-181936] {CVE-2026-46244}
    - drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot)     [RHEL-179912] {CVE-2026-46209}
    - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (CKI Backport Bot) [RHEL-179566]     {CVE-2026-45998}
    - rxrpc: Fix potential UAF after skb_unshare() failure (CKI Backport Bot) [RHEL-179566] {CVE-2026-45998}
    - RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-180001]     {CVE-2026-46176}
    - crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182759] {CVE-2026-31739}
    - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179965]     {CVE-2026-46189}
    - ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179317]     {CVE-2026-46090}
    - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173937]     {CVE-2026-43279}
    - tcp: fix potential race in tcp_v6_syn_recv_sock() (Paolo Abeni) [RHEL-174242] {CVE-2026-43198}
    - scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179755] {CVE-2026-43414}
    - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180155]     {CVE-2026-46117}
    - RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179665]     {CVE-2026-45898}
    - rxrpc: fix RESPONSE authenticator parser OOB read (CKI Backport Bot) [RHEL-171456] {CVE-2026-31636}
    - nvmet-tcp: fix race between ICReq handling and queue teardown (CKI Backport Bot) [RHEL-180106]     {CVE-2026-46135}
    - RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180090] {CVE-2026-46145}
    - ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172675]     {CVE-2026-43038}
    - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177380]     {CVE-2026-46331}
    - exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180009] {CVE-2026-46173}
    - crypto: caam - fix overflow on long hmac keys (CKI Backport Bot) [RHEL-179769] {CVE-2026-43330}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:18587 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: bonding: check xdp prog when set bond mode (CVE-2025-22105)

    * kernel: block: fix resource leak in blk_register_queue() error path (CVE-2025-37980)

    * kernel: dmaengine: idxd: fix memory leak in error handling path of idxd_alloc (CVE-2025-38015)

    * kernel: espintcp: remove encap socket caching to avoid reference leak (CVE-2025-38097)

    * kernel: bpf: fix ktls panic with sockmap (CVE-2025-38166)

    * kernel: bpf: Do not include stack ptr register in precision backtracking bookkeeping (CVE-2025-38279)

    * kernel: nfs: Clean up /proc/net/rpc/nfs when nfs_fs_proc_net_init() fails (CVE-2025-38400)

    * kernel: nvmet: fix memory leak of bio integrity (CVE-2025-38405)

    * kernel: netfilter: flowtable: account for Ethernet header in nf_flow_pppoe_proto() (CVE-2025-38441)

    * kernel: net: vlan: fix VLAN 0 refcount imbalance of toggling filtering during runtime (CVE-2025-38470)

    * kernel: fs: writeback: fix use-after-free in __mark_inode_dirty() (CVE-2025-39866)

    * kernel: dm: fix NULL pointer dereference in __dm_suspend() (CVE-2025-40134)

    * kernel: wifi: mac80211_hwsim: fix typo in frequency notification (CVE-2026-23040)

    * kernel: Linux kernel: Denial of service and memory corruption in RDMA umad (CVE-2026-23243)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 9 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:18134 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: tcp_bpf: Fix the sk_mem_uncharge logic in tcp_bpf_sendmsg (CVE-2024-56633)

    * kernel: KVM: x86: Load DR6 with guest value only before entering .vcpu_run() loop (CVE-2025-21839)

    * kernel: block: fix resource leak in blk_register_queue() error path (CVE-2025-37980)

    * kernel: dmaengine: idxd: fix memory leak in error handling path of idxd_alloc (CVE-2025-38015)

    * kernel: espintcp: remove encap socket caching to avoid reference leak (CVE-2025-38097)

    * kernel: bpf: fix ktls panic with sockmap (CVE-2025-38166)

    * kernel: bpf: Check rcu_read_lock_trace_held() in bpf_map_lookup_percpu_elem() (CVE-2025-38202)

    * kernel: bpf: Do not include stack ptr register in precision backtracking bookkeeping (CVE-2025-38279)

    * kernel: ring-buffer: Do not trigger WARN_ON() due to a commit_overrun (CVE-2025-38267)

    * kernel: phy: qcom-qmp-usb: Fix an NULL vs IS_ERR() bug (CVE-2025-38275)

    * kernel: ftrace: Fix UAF when lookup kallsym after ftrace disabled (CVE-2025-38346)

    * kernel: ACPICA: fix acpi operand cache leak in dswstate.c (CVE-2025-38345)

    * kernel: nvmet: fix memory leak of bio integrity (CVE-2025-38405)

    * kernel: netfilter: flowtable: account for Ethernet header in nf_flow_pppoe_proto() (CVE-2025-38441)

    * kernel: net: vlan: fix VLAN 0 refcount imbalance of toggling filtering during runtime (CVE-2025-38470)

    * kernel: fs: writeback: fix use-after-free in __mark_inode_dirty() (CVE-2025-39866)

    * kernel: PCI/AER: Avoid NULL pointer dereference in aer_ratelimit() (CVE-2025-40034)

    * kernel: dm: fix NULL pointer dereference in __dm_suspend() (CVE-2025-40134)

    * kernel: Revert NFSD: Remove the cap on number of operations per NFSv4 COMPOUND (CVE-2025-40210)

    * kernel: Linux kernel MPTCP: Privilege escalation or denial of service via use-after-free in timer     handling (CVE-2025-40257)

    * kernel: smb: client: fix potential cfid UAF in smb2_query_info_compound (CVE-2025-40320)

    * kernel: wifi: mac80211_hwsim: fix typo in frequency notification (CVE-2026-23040)

    * kernel: Kernel: Privilege escalation or denial of service in nf_tables via inverted element activity     check (CVE-2026-23111)

    * kernel: Linux kernel: Denial of Service in ice driver due to race condition during VSI rebuild     (CVE-2026-23210)

    * kernel: Linux kernel: Denial of service and memory corruption in RDMA umad (CVE-2026-23243)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 10 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
297932	Linux Distros Unpatched Vulnerability : CVE-2026-23040	Nessus	Misc.	2/4/2026	7/17/2026	high
319673	AlmaLinux 10 : kernel (ALSA-2026:18134)	Nessus	Alma Linux Local Security Checks	6/8/2026	6/8/2026	high
324335	Oracle Linux 9 : kernel (ELSA-2026-18587)	Nessus	Oracle Linux Local Security Checks	7/1/2026	7/1/2026	high
328759	Oracle Linux 10 : kernel (ELSA-2026-18134)	Nessus	Oracle Linux Local Security Checks	7/21/2026	7/21/2026	high
315372	RHEL 9 : kernel (RHSA-2026:18587)	Nessus	Red Hat Local Security Checks	5/19/2026	5/19/2026	high
315310	RHEL 10 : kernel (RHSA-2026:18134)	Nessus	Red Hat Local Security Checks	5/19/2026	5/19/2026	high

Detections

Analytics

Plugins Search

high

high

high

high

high

high