An update of the linux package has been released.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - debugobjects: Plug race against a concurrent OOM disable syzbot reported a puzzling splat: WARNING:
    kernel/time/hrtimer.c:443 at stub_timer+0xa/0x20 stub_timer() is installed as timer callback function in     hrtimer_fixup_assert_init(), which is invoked when debug_object_assert_init() can't find a shadow object.
    In that case debug objects emits a warning about it before invoking the fixup. Though the provided console     log lacks this warning and instead has the following a few seconds before the splat: ODEBUG: Out of     memory. ODEBUG disabled So the object was looked up in debug_object_assert_init() and the lookup failed     due a concurrent out of memory situation which disabled debug objects and freed the shadow objects:
    debug_object_assert_init() if (!debug_objects_enabled) return; obj = alloc(); if (!obj) { // Out of memory     debug_objects_enabled = false; free_objects(); obj = lookup_or_alloc(); // The lookup failed because the     other side // removed the objects, so this returns // an error code as the object in question // is not     statically initialized if (!IS_ERR_OR_NULL(obj)) return; if (!obj) { debug_oom(); return; } print(...) if     (!debug_objects_enabled) return; fixup(...) The debug object splat is skipped because     debug_objects_enabled is false, but the fixup callback is invoked unconditionally, which makes the timer     disfunctional. This is only a problem in debug_object_assert_init() and debug_object_activate() as both     have to handle statically initialized objects and therefore must handle the error pointer return case     gracefully. All other places only handle the found/not found case and the NULL pointer return is a signal     for OOM. Otherwise they get a valid shadow object. Plug the hole by checking whether debug objects are     still enabled before invoking the print and fixup function in those two places. (CVE-2026-68090)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Published	Updated	Severity
337207	Amazon Linux 2023 : bpftool6.18, kernel6.18, kernel6.18-devel (ALAS2023-2026-2045)	Nessus	Amazon Linux Local Security Checks	8/18/2026	8/21/2026	high
332499	Photon OS 5.0: Linux PHSA-2026-5.0-92-0928	Nessus	PhotonOS Local Security Checks	8/5/2026	8/21/2026	high
334510	Linux Distros Unpatched Vulnerability : CVE-2026-68090	Nessus	Misc.	8/11/2026	8/27/2026	medium
337239	Amazon Linux 2023 : bpftool6.12, kernel6.12, kernel6.12-devel (ALAS2023-2026-2057)	Nessus	Amazon Linux Local Security Checks	8/18/2026	8/21/2026	medium

Detections

Analytics

Plugins Search

high

high

medium

medium