The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level When recovering hugepages in     the shadow MMU, verify that the base gfn of the shadow page is actually contained within the target     memslot, *before* querying the max mapping level given the shadow page's gfn. Failure to pre-check the     validity of the gfn can lead to an out-of-bounds access to the slot's lpage_info (which typically     manifests as a host #PF because the lpage_info is vmalloc'd) if the guest creates a hugepage mapping (in     its PTEs) that extends below the bounds of a memslot. When faulting in memory for a guest, and the size     of the guest mapping is greater than KVM's (current) max mapping, then KVM will create a direct shadow     page (direct in that there are no gPTEs to shadow, and so the target gfn is a direct calculation given the     base gfn of the shadow page). The hugepage recovery flow looks for such direct shadow pages, as forcing     4KiB mappings when dirty logging generates the guest > host mapping size case. When the 4KiB restriction     is lifted, then KVM can replace the shadow page with a hugepage. But if KVM originally used a smaller     mapping than the guest because the range of memory covered by the guest hugepage exceeds the bounds of a     memslot, then KVM will link a direct shadow page with a gfn that is outside the bounds of the memslot     being used to fault in memory. The rmap entry added for the leaf mapping is correct and within bounds, but     the gfn of the leaf SPTE's parent shadow page will be out of bounds. BUG: unable to handle page fault for     address: ffffc90000806ffc #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present     page PGD 100000067 P4D 100000067 PUD 1002a7067 PMD 10612f067 PTE 0 Oops: Oops: 0000 [#1] SMP CPU: 13 UID:
    1000 PID: 757 Comm: mmu_stress_test Not tainted 7.1.0-rc1-48ce1e26eace-x86_pir_to_irr_comments-vm #341     PREEMPT Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015 RIP:
    0010:kvm_mmu_max_mapping_level+0x79/0x2b0 [kvm] Call Trace: <TASK> kvm_mmu_recover_huge_pages+0x21b/0x320     [kvm] kvm_set_memslot+0x1ee/0x590 [kvm] kvm_set_memory_region.part.0+0x3a1/0x4d0 [kvm]     kvm_vm_ioctl+0x9bf/0x15d0 [kvm] __x64_sys_ioctl+0x8a/0xd0 do_syscall_64+0xb7/0xbb0     entry_SYSCALL_64_after_hwframe+0x4b/0x53 RIP: 0033:0x7f21c0f1a9bf </TASK> Don't bother pre-checking the     bounds of the potential hugepage, i.e. don't check that e.g. sp->gfn + KVM_PAGES_PER_HPAGE(sp->role.level     + 1) is also within the memslot, as the checks performed by kvm_mmu_max_mapping_level() are a superset of     the basic bounds checks. I.e. pre-checking the full range would be a dubious micro-optimization.
    (CVE-2026-63807)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4700 advisory.

    -------------------------------------------------------------------------     Debian LTS Advisory DLA-4700-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                        Ben Hutchings     July 26, 2026                                 https://wiki.debian.org/LTS
    -------------------------------------------------------------------------

    Package        : linux-6.1     Version        : 6.1.177-1~deb11u1     CVE ID         : CVE-2025-23131 CVE-2026-23272 CVE-2026-23278 CVE-2026-23302                      CVE-2026-31451 CVE-2026-46252 CVE-2026-52928 CVE-2026-53138                      CVE-2026-53139 CVE-2026-53157 CVE-2026-53158 CVE-2026-53163                      CVE-2026-53167 CVE-2026-53325 CVE-2026-53327 CVE-2026-53359                      CVE-2026-53362 CVE-2026-53366 CVE-2026-53381 CVE-2026-53382                      CVE-2026-53383 CVE-2026-53384 CVE-2026-53385 CVE-2026-53388                      CVE-2026-53390 CVE-2026-53391 CVE-2026-53397 CVE-2026-53398                      CVE-2026-53403 CVE-2026-63794 CVE-2026-63795 CVE-2026-63796                      CVE-2026-63798 CVE-2026-63800 CVE-2026-63801 CVE-2026-63803                      CVE-2026-63807 CVE-2026-63808 CVE-2026-63809 CVE-2026-63814                      CVE-2026-63817 CVE-2026-63822 CVE-2026-63823 CVE-2026-63824                      CVE-2026-63827 CVE-2026-63828 CVE-2026-63830 CVE-2026-63831                      CVE-2026-63833 CVE-2026-63834 CVE-2026-63835 CVE-2026-63836                      CVE-2026-64188 CVE-2026-64191 CVE-2026-64246 CVE-2026-64249                      CVE-2026-64252 CVE-2026-64254 CVE-2026-64529     Debian Bug     : 1130365

    Several vulnerabilities have been discovered in the Linux kernel that     may lead to a privilege escalation, denial of service or information     leaks.

    For Debian 11 bullseye, these problems have been fixed in version     6.1.177-1~deb11u1.  This version additionally updates the Microsoft     Azure Network Adapter (mana) driver, and includes many more bug fixes     from stable update 6.1.177.

    We recommend that you upgrade your linux-6.1 packages.

    For the detailed security status of linux-6.1 please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/linux-6.1

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS     Attachment:
    signature.asc     Description: PGP signature

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:49030 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (CVE-2025-40026)

    * kernel: KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (CVE-2026-63807)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the linux package has been released.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1969 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    sctp: disable BH before calling udp_tunnel_xmit_skb() (CVE-2026-53070)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf: Fix same-register dst/src OOB read and pointer leak in sock_ops (CVE-2026-53078)

    In the Linux kernel, the following vulnerability has been resolved:

    KVM: x86: Fix shadow paging use-after-free due to unexpected role (CVE-2026-53359)

    In the Linux kernel, the following vulnerability has been resolved:

    af_unix: Set gc_in_progress to true in unix_gc(). (CVE-2026-53361)

    In the Linux kernel, the following vulnerability has been resolved:

    virtiofs: fix UAF on submount umount

    iput() called from fuse_release_end() can Oops if the super block hasalready been destroyed.  Normally     this is prevented by waiting fornum_waiting to go down to zero before commencing with super block     shutdown.

    This only works, however, for the last submount instance, as the waitcounter is per connection, not per     superblock.

    Revert to using synchronous release requests for the auto_submounts case,which is virtiofs only at this     time. (CVE-2026-53381)

    In the Linux kernel, the following vulnerability has been resolved:

    vc_screen: fix null-ptr-deref in vcs_notifier() during concurrent vcs_write

    A KASAN null-ptr-deref was observed in vcs_notifier():

    BUG: KASAN: null-ptr-deref in vcs_notifier+0x98/0x130Read of size 2 at addr qmp_cmd_name:
    qmp_capabilities, arguments: {}

    The issue is a race condition in vcs_write(). When the console_lock istemporarily dropped (to copy data     from userspace), the vc_data pointerobtained from vcs_vc() may become stale. After re-acquiring the     lock,vcs_vc() is called again to re-validate the pointer. If the vc has beendeallocated in the meantime,     vcs_vc() returns NULL, and the while loopbreaks (with written > 0). However, after the loop,     vcs_scr_updated(vc)is still called with the now-NULL vc pointer, leading to a null pointerdereference in     the notifier chain (vcs_notifier dereferences param->vc).

    Fix this by adding a NULL check for vc before calling vcs_scr_updated(). (CVE-2026-53385)

    In the Linux kernel, the following vulnerability has been resolved:

    fuse: re-lock request before replacing page cache folio

    fuse_try_move_folio() unlocks the request on entry but does notre-lock it on the success path. This means     fuse_chan_abort() can end therequest and free the fuse_io_args (eg fuse_readpages_end()) while     thesubsequent copy chain logic after fuse_try_move_folio() accesses thefuse_io_args, leading to use-after-     free issues.

    Fix this by calling lock_request() before replace_page_cache_folio().This ensures the request is locked on     the success path which willprevent the fuse_io_args from being freed while the later copying logicruns,     and also ensures that the ap->folios[i]->mapping is never nullsince ap->folios[i] will always point to the     newfolio afterreplace_page_cache_folio(). (CVE-2026-53388)

    In the Linux kernel, the following vulnerability has been resolved:

    net/tcp-ao: fix use-after-free of key in del_async path (CVE-2026-53389)

    In the Linux kernel, the following vulnerability has been resolved:

    NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CVE-2026-53391)

    In the Linux kernel, the following vulnerability has been resolved:

    NFSv4/flexfiles: reject zero filehandle version count (CVE-2026-53392)

    In the Linux kernel, the following vulnerability has been resolved:

    nfsd: reset write verifier on deferred writeback errors (CVE-2026-53393)

    In the Linux kernel, the following vulnerability has been resolved:

    nfsd: avoid leaking pre-allocated openowner on unconfirmed retry race (CVE-2026-53394)

    In the Linux kernel, the following vulnerability has been resolved:

    nfsd: fix posix_acl leak on SETACL decode failure (CVE-2026-53397)

    In the Linux kernel, the following vulnerability has been resolved:

    i2c: core: fix adapter registration race

    Adapters can be looked up based on their id using i2c_get_adapter()which takes a reference to the embedded     struct device.

    Make sure that the adapter (including its struct device) has beeninitialised before adding it to the IDR     to avoid accessing uninitialiseddata which could, for example, lead to NULL-pointer dereferences oruse-     after-free.

    Note that the i2c-dev chardev, which is registered from a bus notifier,currently uses i2c_get_adapter() so     the adapter needs to be added to theIDR before registration. (CVE-2026-53400)

    In the Linux kernel, the following vulnerability has been resolved:

    fbdev: Fix fb_new_modelist to prevent null-ptr-deref in fb_videomode_to_var

    info->var, a framebuffer's current mode, is expected to have a matchingentry in info->modelist.
    var_to_display() relies on this and treats afailed fb_match_mode() as This should not happen.
    fb_set_var() keeps ittrue by adding the mode to the list on every change, anddo_register_framebuffer()     does the same at registration.

    store_modes() replaces the modelist from userspace. fb_new_modelist()validates the new modes but does not     check that info->var still has amatch. It relies on fbcon_new_modelist() to re-point consoles, but     thatonly handles consoles mapped to the framebuffer. With fbcon unbound thereare none, so info->var is     left describing a mode that is no longer in thelist.

    A later console takeover runs var_to_display(), where fb_match_mode()returns NULL and leaves     fb_display[i].mode NULL. fbcon_switch() passes itto display_to_var(), and fb_videomode_to_var()     dereferences the NULL mode.

    Keep the current mode in the list in fb_new_modelist(), the same wayfb_set_var() does. (CVE-2026-53403)

    In the Linux kernel, the following vulnerability has been resolved:

    pNFS: Fix use-after-free in pnfs_update_layout() (CVE-2026-63800)

    In the Linux kernel, the following vulnerability has been resolved:

    blk-cgroup: fix UAF in __blkcg_rstat_flush() (CVE-2026-63802)

    In the Linux kernel, the following vulnerability has been resolved:

    KVM: Replace guest-triggerable BUG_ON() in ioeventfd datamatch with get_unaligned() (CVE-2026-63806)

    In the Linux kernel, the following vulnerability has been resolved:

    KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (CVE-2026-63807)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf: use kvfree() for replaced sysctl write buffer (CVE-2026-63809)

    In the Linux kernel, the following vulnerability has been resolved:

    block: Avoid mounting the bdev pseudo-filesystem in userspace (CVE-2026-63810)

    In the Linux kernel, the following vulnerability has been resolved:

    keys: Pin request_key_auth payload in instantiate paths (CVE-2026-63823)

    In the Linux kernel, the following vulnerability has been resolved:

    KEYS: fix overflow in keyctl_pkey_params_get_2() (CVE-2026-63824)

    In the Linux kernel, the following vulnerability has been resolved:

    fbdev: fix use-after-free in store_modes() (CVE-2026-63826)

    In the Linux kernel, the following vulnerability has been resolved:

    apparmor: mediate the implicit connect of TCP fast open sendmsg (CVE-2026-63828)

    In the Linux kernel, the following vulnerability has been resolved:

    net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (CVE-2026-63829)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of kernel installed on the remote host is prior to 5.15.211-149.249. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.15-2026-111 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: replace BUG_ON with proper error handling in ext4_read_inline_folio (CVE-2026-31451)

    In the Linux kernel, the following vulnerability has been resolved:

    net/sched: fix pedit partial COW leading to page cache corruption (CVE-2026-46331)

    In the Linux kernel, the following vulnerability has been resolved:

    ip6_vti: set netns_immutable on the fallback device. (CVE-2026-52909)

    In the Linux kernel, the following vulnerability has been resolved:

    af_unix: Reject SIOCATMARK on non-stream sockets (CVE-2026-52928)

    In the Linux kernel, the following vulnerability has been resolved:

    fuse: limit FUSE_NOTIFY_RETRIEVE to uptodate folios (CVE-2026-53167)

    In the Linux kernel, the following vulnerability has been resolved:

    KVM: x86: Fix shadow paging use-after-free due to unexpected role (CVE-2026-53359)

    In the Linux kernel, the following vulnerability has been resolved:

    virtiofs: fix UAF on submount umount

    iput() called from fuse_release_end() can Oops if the super block hasalready been destroyed.  Normally     this is prevented by waiting fornum_waiting to go down to zero before commencing with super block     shutdown.

    This only works, however, for the last submount instance, as the waitcounter is per connection, not per     superblock.

    Revert to using synchronous release requests for the auto_submounts case,which is virtiofs only at this     time. (CVE-2026-53381)

    In the Linux kernel, the following vulnerability has been resolved:

    vc_screen: fix null-ptr-deref in vcs_notifier() during concurrent vcs_write

    A KASAN null-ptr-deref was observed in vcs_notifier():

    BUG: KASAN: null-ptr-deref in vcs_notifier+0x98/0x130Read of size 2 at addr qmp_cmd_name:
    qmp_capabilities, arguments: {}

    The issue is a race condition in vcs_write(). When the console_lock istemporarily dropped (to copy data     from userspace), the vc_data pointerobtained from vcs_vc() may become stale. After re-acquiring the     lock,vcs_vc() is called again to re-validate the pointer. If the vc has beendeallocated in the meantime,     vcs_vc() returns NULL, and the while loopbreaks (with written > 0). However, after the loop,     vcs_scr_updated(vc)is still called with the now-NULL vc pointer, leading to a null pointerdereference in     the notifier chain (vcs_notifier dereferences param->vc).

    Fix this by adding a NULL check for vc before calling vcs_scr_updated(). (CVE-2026-53385)

    In the Linux kernel, the following vulnerability has been resolved:

    fuse: re-lock request before replacing page cache folio

    fuse_try_move_folio() unlocks the request on entry but does notre-lock it on the success path. This means     fuse_chan_abort() can end therequest and free the fuse_io_args (eg fuse_readpages_end()) while     thesubsequent copy chain logic after fuse_try_move_folio() accesses thefuse_io_args, leading to use-after-     free issues.

    Fix this by calling lock_request() before replace_page_cache_folio().This ensures the request is locked on     the success path which willprevent the fuse_io_args from being freed while the later copying logicruns,     and also ensures that the ap->folios[i]->mapping is never nullsince ap->folios[i] will always point to the     newfolio afterreplace_page_cache_folio(). (CVE-2026-53388)

    In the Linux kernel, the following vulnerability has been resolved:

    NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CVE-2026-53391)

    In the Linux kernel, the following vulnerability has been resolved:

    nfsd: fix posix_acl leak on SETACL decode failure (CVE-2026-53397)

    In the Linux kernel, the following vulnerability has been resolved:

    fbdev: Fix fb_new_modelist to prevent null-ptr-deref in fb_videomode_to_var

    info->var, a framebuffer's current mode, is expected to have a matchingentry in info->modelist.
    var_to_display() relies on this and treats afailed fb_match_mode() as This should not happen.
    fb_set_var() keeps ittrue by adding the mode to the list on every change, anddo_register_framebuffer()     does the same at registration.

    store_modes() replaces the modelist from userspace. fb_new_modelist()validates the new modes but does not     check that info->var still has amatch. It relies on fbcon_new_modelist() to re-point consoles, but     thatonly handles consoles mapped to the framebuffer. With fbcon unbound thereare none, so info->var is     left describing a mode that is no longer in thelist.

    A later console takeover runs var_to_display(), where fb_match_mode()returns NULL and leaves     fb_display[i].mode NULL. fbcon_switch() passes itto display_to_var(), and fb_videomode_to_var()     dereferences the NULL mode.

    Keep the current mode in the list in fb_new_modelist(), the same wayfb_set_var() does. (CVE-2026-53403)

    In the Linux kernel, the following vulnerability has been resolved:

    KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CVE-2026-63794)

    In the Linux kernel, the following vulnerability has been resolved:

    pNFS: Fix use-after-free in pnfs_update_layout() (CVE-2026-63800)

    In the Linux kernel, the following vulnerability has been resolved:

    KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (CVE-2026-63807)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf: use kvfree() for replaced sysctl write buffer (CVE-2026-63809)

    In the Linux kernel, the following vulnerability has been resolved:

    keys: Pin request_key_auth payload in instantiate paths (CVE-2026-63823)

    In the Linux kernel, the following vulnerability has been resolved:

    KEYS: fix overflow in keyctl_pkey_params_get_2() (CVE-2026-63824)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
328106	Linux Distros Unpatched Vulnerability : CVE-2026-63807	Nessus	Misc.	7/20/2026	7/25/2026	high
330014	Debian dla-4700 : linux-config-6.1 - security update	Nessus	Debian Local Security Checks	7/26/2026	7/26/2026	high
331504	RHEL 10 : kernel (RHSA-2026:49030)	Nessus	Red Hat Local Security Checks	7/31/2026	7/31/2026	high
329326	Photon OS 5.0: Linux PHSA-2026-5.0-0926	Nessus	PhotonOS Local Security Checks	7/24/2026	7/28/2026	high
326038	Photon OS 5.0: Linux PHSA-2026-5.0-0916	Nessus	PhotonOS Local Security Checks	7/9/2026	8/1/2026	high
328468	Amazon Linux 2023 : bpftool6.18, kernel6.18, kernel6.18-devel (ALAS2023-2026-1969)	Nessus	Amazon Linux Local Security Checks	7/20/2026	7/31/2026	medium
330281	Amazon Linux 2 : kernel, --advisory ALAS2KERNEL-5.15-2026-111 (ALASKERNEL-5.15-2026-111)	Nessus	Amazon Linux Local Security Checks	7/28/2026	7/31/2026	high

Detections

Analytics

Plugins Search

high

high

high

high

high

medium

high