An update of the linux package has been released.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - In the Linux kernel, the following vulnerability has been resolved: iio: buffer: Fix DMA fence leak in     iio_buffer_enqueue_dmabuf() iio_buffer_enqueue_dmabuf() allocates a struct iio_dma_fence (104 bytes,     kmalloc-128) via kmalloc_obj()+dma_fence_init(), which sets the initial kref to 1. It then calls     dma_resv_add_fence() which takes a second reference (kref=2), and stores a raw pointer in block->fence. On     the success path the function returns without calling dma_fence_put() to release the initial reference, so     every buffer enqueue permanently leaks one kmalloc-128 allocation. The iio_buffer_cleanup() work item only     releases the temporary reference taken during completion signalling by iio_buffer_signal_dmabuf_done();
    the initial reference from dma_fence_init() is never released. With four iio_rwdev instances at 240kHz and     512 samples per buffer, this produces ~1875 kmalloc-128 allocations per second matching the observed slab     growth exactly. A test with ftrace confirmed that the dma_fence_destroy event was never triggered. Fix by     calling dma_fence_put() after dma_resv_add_fence(), transferring ownership of the fence to the DMA     reservation object. The DMA fence then gets properly discarded after being signalled. (CVE-2026-63929)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Published	Updated	Severity
322944	Photon OS 5.0: Linux PHSA-2026-5.0-0895	Nessus	PhotonOS Local Security Checks	6/26/2026	8/1/2026	high
328275	Linux Distros Unpatched Vulnerability : CVE-2026-63929	Nessus	Misc.	7/20/2026	7/31/2026	high

Detections

Analytics

Plugins Search

high

high