Linux/Unix 主機上安裝了一個或多個受到弱點影響的套件，且廠商未提供可用的修補程式。

  - wifi：cfg80211：ibss：ref 加入事件的 BSS 項目 加入 IBSS 時，我們只記錄事件中的 BSSID/通道，並在處理時查詢 BSS 項目。但是，這是不正確的，例如，使用 NL80211_SCAN_FLAG_FLUSH 的新掃描可能會將其刪除，從而在事件工作中導致警告： ！bss 警告：
    net/wireless/ibss.c：37 at __cfg80211_ibss_joined+0x3d3/0x440 工作佇列：cfg80211 cfg80211_event_work cfg80211_process_wdev_events+0x39f/0x5b0 net/wireless/util.c：1144 cfg80211_process_rdev_events+0xa1/0x110 net/wireless/util.c：1179 cfg80211_event_work+0x2f/0x40 net/wireless/core.c：393 儘早進行查詢 （驅動程式應僅加入具有 BSS 項目的 IBSS） 並保留對它的參照。（CVE-2026-98338）

請注意，Nessus 的判定取決於廠商所報告的套件是否存在。

Linux/Unix 主机中安装的一个或多个程序包受到一个漏洞影响，而供应商没有提供补丁程序。

  - wifi：cfg80211：ibss：引用加入事件的 BSS 条目加入 IBSS 后，我们只会记录事件中的 BSSID/通道，并在处理时查找 BSS 条目。但是，这很争用，例如，带有NL80211_SCAN_FLAG_FLUSH的新扫描可将其删除，从而在事件工作中造成警告：！bss 警告：
    net/wireless/ibss.c：37 at __cfg80211_ibss_joined+0x3d3/0x440 工作队列：cfg80211 cfg80211_event_work cfg80211_process_wdev_events+0x39f/0x5b0 net/wireless/util.c：1144 cfg80211_process_rdev_events+0xa1/0x110 net/wireless/util.c：1179 cfg80211_event_work+0x2f/0x40 net/wireless/core.c：393 尽早进行查找（驱动程序预期仅加入具有 BSS 条目的 IBSS）并保留对它的引用。（CVE-2026-98338）

请注意，Nessus 依赖供应商报告的程序包是否存在进行判断。

Linux/Unix ホストには、ベンダーが提供するパッチが利用できない脆弱性の影響を受ける複数のパッケージがインストールされています。

  - wifi:cfg80211:ibss:参加したイベントの BSS エントリを参照 IBSS が参加するとき、イベントの BSSID/チャネルのみを記録し、処理時に BSS エントリを検索します。ただし、これは危険です。たとえば、NL80211_SCAN_FLAG_FLUSHを含む新しいスキャンで削除され、イベントで警告が work: !bss 警告:
    net/wireless/ibss.c:37 at __cfg80211_ibss_joined+0x3d3/0x440 Workqueue: cfg80211 cfg80211_event_work cfg80211_process_wdev_events+0x39f/0x5b0 net/wireless/util.c:1144 cfg80211_process_rdev_events+0xa1/0x110 net/wireless/util.c:1179 cfg80211_event_work+0x2f/0x40 net/wireless/core.c:393 検索を早めに行い(ドライバーは BSS エントリを持つ IBSS にのみ参加することが期待されます)、それへの参照を保持します。(CVE-2026-98338)

Nessus は、ベンダーから報告されたパッケージの存在に依存していることに注意してください。

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - wifi: cfg80211: ibss: ref BSS entry for joined event When the IBSS is joined, we only record the     BSSID/channel in the event and look up the BSS entry when processing it. However, that's racy, e.g. a new     scan with NL80211_SCAN_FLAG_FLUSH can remove it, causing a warning in the event work: !bss WARNING:
    net/wireless/ibss.c:37 at __cfg80211_ibss_joined+0x3d3/0x440 Workqueue: cfg80211 cfg80211_event_work     cfg80211_process_wdev_events+0x39f/0x5b0 net/wireless/util.c:1144 cfg80211_process_rdev_events+0xa1/0x110     net/wireless/util.c:1179 cfg80211_event_work+0x2f/0x40 net/wireless/core.c:393 Do the lookup early (the     driver is expected to only join an IBSS that has a BSS entry) and keep a reference to it. (CVE-2026-98338)

Note that Nessus relies on the presence of the package as reported by the vendor.

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1793786843 advisory.

  - In the Linux kernel, the following vulnerability has been resolved: soc: qcom: qmi_encdec: Restrict string     length in decode The QMI TLV value for strings in a lot of qmi element info structures account for null     terminated strings with MAX_LEN + 1. If a string is actually MAX_LEN + 1 length, this will cause an out of     bounds access when the NULL character is appended in decoding. (CVE-2023-53729)

  - In the Linux kernel, the following vulnerability has been resolved: rv: Use strings in da monitors     tracepoints Using DA monitors tracepoints with KASAN enabled triggers the following warning: BUG: KASAN:
    global-out-of-bounds in do_trace_event_raw_event_event_da_monitor+0xd6/0x1a0 Read of size 32 at addr     ffffffffaada8980 by task ... Call Trace: <TASK> [...] do_trace_event_raw_event_event_da_monitor+0xd6/0x1a0     ? __pfx_do_trace_event_raw_event_event_da_monitor+0x10/0x10 ? trace_event_sncid+0x83/0x200     trace_event_sncid+0x163/0x200 [...] The buggy address belongs to the variable: automaton_snep+0x4e0/0x5e0     This is caused by the tracepoints reading 32 bytes __array instead of __string from the automata     definition. Such strings are literals and reading 32 bytes ends up in out of bound memory accesses (e.g.
    the next automaton's data in this case). The error is harmless as, while printing the string, we stop at     the null terminator, but it should still be fixed. Use the __string facilities while defining the     tracepoints to avoid reading out of bound memory. (CVE-2025-38636)

  - In the Linux kernel, the following vulnerability has been resolved: perf: arm_spe: Prevent overflow in     PERF_IDX2OFF() Cast nr_pages to unsigned long to avoid overflow when handling large AUX buffer sizes (>= 2     GiB). (CVE-2025-40081)

  - In the Linux kernel, the following vulnerability has been resolved: arch_topology: Fix incorrect error     check in topology_parse_cpu_capacity() Fix incorrect use of PTR_ERR_OR_ZERO() in     topology_parse_cpu_capacity() which causes the code to proceed with NULL clock pointers. The current logic     uses !PTR_ERR_OR_ZERO(cpu_clk) which evaluates to true for both valid pointers and NULL, leading to     potential NULL pointer dereference in clk_get_rate(). Per include/linux/err.h documentation,     PTR_ERR_OR_ZERO(ptr) returns: The error code within @ptr if it is an error pointer; 0 otherwise. This     means PTR_ERR_OR_ZERO() returns 0 for both valid pointers AND NULL pointers. Therefore     !PTR_ERR_OR_ZERO(cpu_clk) evaluates to true (proceed) when cpu_clk is either valid or NULL, causing     clk_get_rate(NULL) to be called when of_clk_get() returns NULL. Replace with !IS_ERR_OR_NULL(cpu_clk)     which only proceeds for valid pointers, preventing potential NULL pointer dereference in clk_get_rate().
    (CVE-2025-40346)

  - In the Linux kernel, the following vulnerability has been resolved: platform/x86/amd/pmc: Add support for     Van Gogh SoC The ROG Xbox Ally (non-X) SoC features a similar architecture to the Steam Deck. While the     Steam Deck supports S3 (s2idle causes a crash), this support was dropped by the Xbox Ally which only S0ix     suspend. Since the handler is missing here, this causes the device to not suspend and the AMD GPU driver     to crash while trying to resume afterwards due to a power hang. (CVE-2025-68334)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名前	製品	ファミリー	公開日	更新日	深刻度
363200	Linux Distros 未修補弱點：CVE-2026-98338	Nessus	Misc.	2026/10/6	2026/11/11	medium
363200	Linux Distros 未修补的漏洞：CVE-2026-98338	Nessus	Misc.	2026/10/6	2026/11/11	medium
363200	Linux Distros のパッチ未適用の脆弱性: CVE-2026-98338	Nessus	Misc.	2026/10/6	2026/11/11	medium
363200	Linux Distros Unpatched Vulnerability : CVE-2026-98338	Nessus	Misc.	2026/10/6	2026/11/11	medium
376443	Ubuntu 24.04 LTS / 26.04 LTS : Linux kernel vulnerabilities (USN-8959-1)	Nessus	Ubuntu Local Security Checks	2026/11/5	2026/11/5	high
376201	AlmaLinux 9.2 [TuxCare] Security Update: bpftool / kernel / kernel-64k / kernel-64k-core / kernel-64k-debug / etc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1793786843)	Nessus	Alma Linux Local Security Checks	2026/11/5	2026/11/13	high

検出

プラグインの検索

medium

medium

medium

medium

high

high