Linux/Unix 主机中安装的一个或多个程序包受到一个漏洞影响，而供应商没有提供补丁程序。

  - net/sched：codel：限制每次出列调用的丢弃循环CoDel 控制律使用配置的间隔 （codel_params.interval） 将下一次丢弃安排在上一次丢弃之后一个间隔/sqrt（count） 。
    对于很小的间隔，计划的步骤向下舍入到零，因此 codel_dequeue（） 中的终止循环永远不会前进并在一次调用中耗尽 qdisc 锁定下的整个 backlog，非特权用户可通过此方式触发软锁定。修复了 codel 和 fq_codel 使用的共享 codel 代码：1.使 control-law 步骤至少刻度 1 次，以便终止循环始终向前移动。2.将丢弃循环上限为每次codel_dequeue（）调用CODEL_MAX_DROPS_PER_DEQUEUE（256）次丢弃，当达到上限时，将drop_next重新同步到现在：欠循环的追赶随着空闲间隙和积压而增长，间隔阈值无法限制。这是长时间空闲间隔后的故意行为改变。该上限适用于 fq_codel （4b549a2ef4be） 和 mac80211 TXQ 路径（固定间隔，仅限端点）。目标停留延迟 （codel_params.target） 未经验证：它不馈送控制律，因此子刻度值是激进的，而不是容易死锁的。重现缺陷的条件：- tc qdisc add dev lo root 句柄 1：tbf 速率 1kbit 突发 2kb 限制 1000000 - tc qdisc add dev lo 父 1:1 句柄 10：codel 间隔 2us 目标 1ms noecn 限制 1000000（与 fq_codel 相同） - 未经修补的内核：tc 接受;1kbit tbf 软锁定下的 UDP 洪流（监视程序：BUG：软锁定），而一个 codel_dequeue（） 调用终止 qdisc 锁定下的 backlog - 修补后的内核： 相同的设置，每个出列调用最多丢弃 256 次，无软锁定测试：声明重现和间隔 2us/3us 变体干净运行;TDC qdisc 类别传递（请参阅 selftests 修补程序）。（CVE-2026-98427）

请注意，Nessus 依赖供应商报告的程序包是否存在进行判断。

Linux/Unix 主機上安裝了一個或多個受到弱點影響的套件，且廠商未提供可用的修補程式。

  - net/sched： codel：綁定每個出隊呼叫的丟棄迴圈 CoDel 控制律使用配置的間隔 （codel_params.interval） 安排下一次丟棄在上一次丟棄之後一個間隔/sqrt（計數）。
    在非常小的間隔內，排定的步驟會向下捨入為零，因此 codel_dequeue（） 中的丟棄迴圈永遠不會前進，並在一次呼叫中耗盡 qdisc 鎖定下的整個積壓 - 無權限的使用者可以透過這種方式觸發軟鎖定。修正 codel 和 fq_codel 使用的共用 codel 程式碼： 1. 使控制律步長至少為 1 刻，以便丟棄迴圈始終向前移動。2.將丟棄環路限制為每個codel_dequeue（）調用CODEL_MAX_DROPS_PER_DEQUEUE（256）次丟棄，當達到上限時，drop_next重新同步到現在：對環路的追趕隨著空閒間隙和積壓而增長，任何間隔閾值都無法限制。這是在長時間閒置後故意改變行為。此上限適用於 fq_codel （4b549a2ef4be） 和 mac80211 TXQ 路徑 （固定間隔，僅限上限）。目標滯留延遲 （codel_params.target） 未經過驗證：它不提供控制律，因此子刻度值是積極的，而不是容易發生死鎖。重新建立錯誤的條件： - tc qdisc add dev lo root handle 1：tbf 速率 1kbit 突發 2kb 限制 1000000 - tc qdisc add dev lo 父 1:1 句柄 10：codel interval 2us target 1ms noecn limit 1000000 （fq_codel 相同） - 未修補的核心：tc 接受它;1kbit tbf 軟鎖定下的 UDP 溢流（監控程式：錯誤：軟鎖定），而一個 codel_dequeue（） 呼叫會刪除 qdisc 鎖定下的積壓 - 修補的核心： 相同的設定，每次出列呼叫最多 256 次丟棄，無軟鎖定測試：宣告重現和間隔 2us/3us 變體乾淨地執行;TDC QDISC 類別通過 （請參閱 Selftests 修補程式）。（CVE-2026-98427）

請注意，Nessus 的判定取決於廠商所報告的套件是否存在。

Linux/Unix ホストには、ベンダーが提供するパッチが利用できない脆弱性の影響を受ける複数のパッケージがインストールされています。

  - net/sched:codel:dequeue 呼び出しごとにドロップループをバインドします。CoDel コントロール法則では、構成された間隔(codel_params.interval)を使用して、前のドロップから 1 interval/sqrt(count) 後の次のドロップをスケジュールします。
    ごく小さな間隔では、スケジュールされたステップはゼロに切り捨てられるため、codel_dequeue() のドロップループは決して進まず、qdisc ロックの下でバックログ全体を 1 回の呼び出しで排出します。権限のないユーザーが、この方法でソフトロックアップを発生させる可能性があります。codel と fq_codel の両方で使用される共有 codel コードで修正:1. ドロップループが常に前進するように、コントロールローステップを少なくとも 1 ティックにします。2. ドロップループを codel_dequeue() 呼び出しごとに CODEL_MAX_DROPS_PER_DEQUEUE(256) ドロップで制限し、上限に達すると現在にdrop_next再同期します。ループに負われるキャッチアップは、アイドルギャップとバックログとともに大きくなり、間隔しきい値はバインドできません。これは、長いアイドル状態の後の意図的な動作の変化です。cap は、fq_codel(4b549a2ef4be)および mac80211 TXQ パス(固定間隔、cap のみ)に適用されます。ターゲット滞在遅延(codel_params.target)は検証されません。コントロール法則を供給しないため、サブティック値はデッドロックが発生しやすいのではなく、アグレッシブです。バグを再現するための条件: - tc qdisc add dev lo root ハンドル 1:tbf レート 1kbit バースト 2kb 制限 1000000 - tc qdisc add dev lo parent 1:1 ハンドル 10:codel 間隔 2us ターゲット 1ms noecn 制限 1000000(fq_codel も同様) - パッチ未適用のカーネル:tc がこれを受け入れます。1kbit tbf ソフトロックアップ(ウォッチドッグ:BUG:ソフトロックアップ)の下での UDP フラッド一方、1 つの codel_dequeue() 呼び出しが qdisc ロックのバックログを破棄します - パッチ済みカーネル: 同じセットアップ、dequeue 呼び出しあたり最大 256 ドロップ、ソフトロックアップなし テスト:クレームリプリケーターおよび間隔 2us/3us バリアントはクリーンを実行します。TDC qdisc カテゴリが合格します(セルフテストパッチを参照)。(CVE-2026-98427)

Nessus は、ベンダーから報告されたパッケージの存在に依存していることに注意してください。

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1793786843 advisory.

  - In the Linux kernel, the following vulnerability has been resolved: soc: qcom: qmi_encdec: Restrict string     length in decode The QMI TLV value for strings in a lot of qmi element info structures account for null     terminated strings with MAX_LEN + 1. If a string is actually MAX_LEN + 1 length, this will cause an out of     bounds access when the NULL character is appended in decoding. (CVE-2023-53729)

  - In the Linux kernel, the following vulnerability has been resolved: rv: Use strings in da monitors     tracepoints Using DA monitors tracepoints with KASAN enabled triggers the following warning: BUG: KASAN:
    global-out-of-bounds in do_trace_event_raw_event_event_da_monitor+0xd6/0x1a0 Read of size 32 at addr     ffffffffaada8980 by task ... Call Trace: <TASK> [...] do_trace_event_raw_event_event_da_monitor+0xd6/0x1a0     ? __pfx_do_trace_event_raw_event_event_da_monitor+0x10/0x10 ? trace_event_sncid+0x83/0x200     trace_event_sncid+0x163/0x200 [...] The buggy address belongs to the variable: automaton_snep+0x4e0/0x5e0     This is caused by the tracepoints reading 32 bytes __array instead of __string from the automata     definition. Such strings are literals and reading 32 bytes ends up in out of bound memory accesses (e.g.
    the next automaton's data in this case). The error is harmless as, while printing the string, we stop at     the null terminator, but it should still be fixed. Use the __string facilities while defining the     tracepoints to avoid reading out of bound memory. (CVE-2025-38636)

  - In the Linux kernel, the following vulnerability has been resolved: perf: arm_spe: Prevent overflow in     PERF_IDX2OFF() Cast nr_pages to unsigned long to avoid overflow when handling large AUX buffer sizes (>= 2     GiB). (CVE-2025-40081)

  - In the Linux kernel, the following vulnerability has been resolved: arch_topology: Fix incorrect error     check in topology_parse_cpu_capacity() Fix incorrect use of PTR_ERR_OR_ZERO() in     topology_parse_cpu_capacity() which causes the code to proceed with NULL clock pointers. The current logic     uses !PTR_ERR_OR_ZERO(cpu_clk) which evaluates to true for both valid pointers and NULL, leading to     potential NULL pointer dereference in clk_get_rate(). Per include/linux/err.h documentation,     PTR_ERR_OR_ZERO(ptr) returns: The error code within @ptr if it is an error pointer; 0 otherwise. This     means PTR_ERR_OR_ZERO() returns 0 for both valid pointers AND NULL pointers. Therefore     !PTR_ERR_OR_ZERO(cpu_clk) evaluates to true (proceed) when cpu_clk is either valid or NULL, causing     clk_get_rate(NULL) to be called when of_clk_get() returns NULL. Replace with !IS_ERR_OR_NULL(cpu_clk)     which only proceeds for valid pointers, preventing potential NULL pointer dereference in clk_get_rate().
    (CVE-2025-40346)

  - In the Linux kernel, the following vulnerability has been resolved: platform/x86/amd/pmc: Add support for     Van Gogh SoC The ROG Xbox Ally (non-X) SoC features a similar architecture to the Steam Deck. While the     Steam Deck supports S3 (s2idle causes a crash), this support was dropped by the Xbox Ally which only S0ix     suspend. Since the handler is missing here, this causes the device to not suspend and the AMD GPU driver     to crash while trying to resume afterwards due to a power hang. (CVE-2025-68334)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - net/sched: codel: bound the dropping loop per dequeue call The CoDel control law schedules the next drop     one interval/sqrt(count) after the previous drop, using the configured interval (codel_params.interval).
    For very small intervals the scheduled step rounds down to zero, so the dropping loop in codel_dequeue()     never advances and drains the entire backlog under the qdisc lock in one call - an unprivileged user can     trigger a soft lockup this way. Fix in the shared codel code used by both codel and fq_codel: 1. Make the     control-law step at least 1 tick so the dropping loop always moves forward. 2. Cap the dropping loop at     CODEL_MAX_DROPS_PER_DEQUEUE (256) drops per codel_dequeue() call, resyncing drop_next to now when the cap     is hit: the catch-up owed to the loop grows with the idle gap and the backlog, which no interval threshold     can bound. This is a deliberate behaviour change after long idle gaps. The cap applies to fq_codel     (4b549a2ef4be) and the mac80211 TXQ path (fixed interval, cap only). The target sojourn delay     (codel_params.target) is not validated: it does not feed the control law, so a sub-tick value is     aggressive rather than deadlock-prone. Conditions to recreate the bug: - tc qdisc add dev lo root handle     1: tbf rate 1kbit burst 2kb limit 1000000 - tc qdisc add dev lo parent 1:1 handle 10: codel interval 2us     target 1ms noecn limit 1000000 (same for fq_codel) - unpatched kernel: tc accepts it; a UDP flood under     the 1kbit tbf soft-lockups (watchdog: BUG: soft lockup) while one codel_dequeue() call drops the backlog     under the qdisc lock - patched kernel: same setup, at most 256 drops per dequeue call, no soft lockup     Testing: claim reproducer and interval 2us/3us variants run clean; tdc qdisc category passes (see the     selftests patch). (CVE-2026-98427)

Note that Nessus relies on the presence of the package as reported by the vendor.

The CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS7:CLSA-2026:1793321383 advisory.

  - In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Fix premature hw access     after PCI error After a recoverable PCI error has been detected and recovered, qla driver needs to check     to see if the error condition still persist and/or wait for the OS to give the resume signal. Sep 8     22:26:03 localhost kernel: WARNING: CPU: 9 PID: 124606 at qla_tmpl.c:440 qla27xx_fwdt_entry_t266+0x55/0x60     [qla2xxx] Sep 8 22:26:03 localhost kernel: RIP: 0010:qla27xx_fwdt_entry_t266+0x55/0x60 [qla2xxx] Sep 8     22:26:03 localhost kernel: Call Trace: Sep 8 22:26:03 localhost kernel: ? qla27xx_walk_template+0xb1/0x1b0     [qla2xxx] Sep 8 22:26:03 localhost kernel: ? qla27xx_execute_fwdt_template+0x12a/0x160 [qla2xxx] Sep 8     22:26:03 localhost kernel: ? qla27xx_fwdump+0xa0/0x1c0 [qla2xxx] Sep 8 22:26:03 localhost kernel: ?     qla2xxx_pci_mmio_enabled+0xfb/0x120 [qla2xxx] Sep 8 22:26:03 localhost kernel: ?     report_mmio_enabled+0x44/0x80 Sep 8 22:26:03 localhost kernel: ? report_slot_reset+0x80/0x80 Sep 8     22:26:03 localhost kernel: ? pci_walk_bus+0x70/0x90 Sep 8 22:26:03 localhost kernel: ?     aer_dev_correctable_show+0xc0/0xc0 Sep 8 22:26:03 localhost kernel: ? pcie_do_recovery+0x1bb/0x240 Sep 8     22:26:03 localhost kernel: ? aer_recover_work_func+0xaa/0xd0 Sep 8 22:26:03 localhost kernel: ?     process_one_work+0x1a7/0x360 .. Sep 8 22:26:03 localhost kernel: qla2xxx [0000:42:00.2]-8041:22: detected     PCI disconnect. Sep 8 22:26:03 localhost kernel: qla2xxx [0000:42:00.2]-107ff:22: qla27xx_fwdt_entry_t262:
    dump ram MB failed. Area 5h start 198013h end 198013h Sep 8 22:26:03 localhost kernel: qla2xxx     [0000:42:00.2]-107ff:22: Unable to capture FW dump Sep 8 22:26:03 localhost kernel: qla2xxx     [0000:42:00.2]-1015:22: cmd=0x0, waited 5221 msecs Sep 8 22:26:03 localhost kernel: qla2xxx     [0000:42:00.2]-680d:22: mmio enabled returning. Sep 8 22:26:03 localhost kernel: qla2xxx     [0000:42:00.2]-d04c:22: MBX Command timeout for cmd 0, iocontrol=ffffffff jiffies=10140f2e5     mb[0-3]=[0xffff 0xffff 0xffff 0xffff] (CVE-2022-49157)

  - In the Linux kernel, the following vulnerability has been resolved: mrp: introduce active flags to prevent     UAF when applicant uninit The caller of del_timer_sync must prevent restarting of the timer, If we have no     this synchronization, there is a small probability that the cancellation will not be successful. And     syzbot report the fellowing crash: ================================================================== BUG:
    KASAN: use-after-free in hlist_add_head include/linux/list.h:929 [inline] BUG: KASAN: use-after-free in     enqueue_timer+0x18/0xa4 kernel/time/timer.c:605 Write at addr f9ff000024df6058 by task syz-fuzzer/2256     Pointer tag: [f9], memory tag: [fe] CPU: 1 PID: 2256 Comm: syz-fuzzer Not tainted     6.1.0-rc5-syzkaller-00008- ge01d50cbd6ee #0 Hardware name: linux,dummy-virt (DT) Call trace:
    dump_backtrace.part.0+0xe0/0xf0 arch/arm64/kernel/stacktrace.c:156 dump_backtrace     arch/arm64/kernel/stacktrace.c:162 [inline] show_stack+0x18/0x40 arch/arm64/kernel/stacktrace.c:163
    __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x68/0x84 lib/dump_stack.c:106     print_address_description mm/kasan/report.c:284 [inline] print_report+0x1a8/0x4a0 mm/kasan/report.c:395     kasan_report+0x94/0xb4 mm/kasan/report.c:495 __do_kernel_fault+0x164/0x1e0 arch/arm64/mm/fault.c:320     do_bad_area arch/arm64/mm/fault.c:473 [inline] do_tag_check_fault+0x78/0x8c arch/arm64/mm/fault.c:749     do_mem_abort+0x44/0x94 arch/arm64/mm/fault.c:825 el1_abort+0x40/0x60 arch/arm64/kernel/entry-common.c:367     el1h_64_sync_handler+0xd8/0xe4 arch/arm64/kernel/entry-common.c:427 el1h_64_sync+0x64/0x68     arch/arm64/kernel/entry.S:576 hlist_add_head include/linux/list.h:929 [inline] enqueue_timer+0x18/0xa4     kernel/time/timer.c:605 mod_timer+0x14/0x20 kernel/time/timer.c:1161 mrp_periodic_timer_arm     net/802/mrp.c:614 [inline] mrp_periodic_timer+0xa0/0xc0 net/802/mrp.c:627     call_timer_fn.constprop.0+0x24/0x80 kernel/time/timer.c:1474 expire_timers+0x98/0xc4     kernel/time/timer.c:1519 To fix it, we can introduce a new active flags to make sure the timer will not     restart. (CVE-2022-50697)

  - In the Linux kernel, the following vulnerability has been resolved: crypto: qat - fix DMA transfer     direction When CONFIG_DMA_API_DEBUG is selected, while running the crypto self test on the QAT crypto     algorithms, the function add_dma_entry() reports a warning similar to the one below, saying that     overlapping mappings are not supported. This occurs in tests where the input and the output scatter list     point to the same buffers (i.e. two different scatter lists which point to the same chunks of memory). The     logic that implements the mapping uses the flag DMA_BIDIRECTIONAL for both the input and the output     scatter lists which leads to overlapped write mappings. These are not supported by the DMA layer. Fix by     specifying the correct DMA transfer directions when mapping buffers. For in-place operations where the     input scatter list matches the output scatter list, buffers are mapped once with DMA_BIDIRECTIONAL,     otherwise input buffers are mapped using the flag DMA_TO_DEVICE and output buffers are mapped with     DMA_FROM_DEVICE. Overlapping a read mapping with a write mapping is a valid case in dma-coherent devices     like QAT. The function that frees and unmaps the buffers, qat_alg_free_bufl() has been changed accordingly     to the changes to the mapping function. DMA-API: 4xxx 0000:06:00.0: cacheline tracking EEXIST, overlapping     mappings aren't supported WARNING: CPU: 53 PID: 4362 at kernel/dma/debug.c:570 add_dma_entry+0x1e9/0x270     ... Call Trace: dma_map_page_attrs+0x82/0x2d0 ? preempt_count_add+0x6a/0xa0     qat_alg_sgl_to_bufl+0x45b/0x990 [intel_qat] qat_alg_aead_dec+0x71/0x250 [intel_qat]     crypto_aead_decrypt+0x3d/0x70 test_aead_vec_cfg+0x649/0x810 ? number+0x310/0x3a0 ? vsnprintf+0x2a3/0x550 ?     scnprintf+0x42/0x70 ? valid_sg_divisions.constprop.0+0x86/0xa0 ? test_aead_vec+0xdf/0x120     test_aead_vec+0xdf/0x120 alg_test_aead+0x185/0x400 alg_test+0x3d8/0x500 ?     crypto_acomp_scomp_free_ctx+0x30/0x30 ? __schedule+0x32a/0x12a0 ? ttwu_queue_wakelist+0xbf/0x110 ?
    _raw_spin_unlock_irqrestore+0x23/0x40 ? try_to_wake_up+0x83/0x570 ? _raw_spin_unlock_irqrestore+0x23/0x40     ? __set_cpus_allowed_ptr_locked+0xea/0x1b0 ? crypto_acomp_scomp_free_ctx+0x30/0x30     cryptomgr_test+0x27/0x50 kthread+0xe6/0x110 ? kthread_complete_and_exit+0x20/0x20 ret_from_fork+0x1f/0x30     (CVE-2022-50774)

  - In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: cfg80211: Pass the PMK     in binary instead of hex Apparently the hex passphrase mechanism does not work on newer chips/firmware     (e.g. BCM4387). It seems there was a simple way of passing it in binary all along, so use that and avoid     the hexification. OpenBSD has been doing it like this from the beginning, so this should work on all     chips. Also clear the structure before setting the PMK. This was leaking uninitialized stack contents to     the device. (CVE-2023-53715)

  - In the Linux kernel, the following vulnerability has been resolved: posix-timers: Ensure timer ID search-     loop limit is valid posix_timer_add() tries to allocate a posix timer ID by starting from the cached ID     which was stored by the last successful allocation. This is done in a loop searching the ID space for a     free slot one by one. The loop has to terminate when the search wrapped around to the starting point. But     that's racy vs. establishing the starting point. That is read out lockless, which leads to the following     problem: CPU0 CPU1 posix_timer_add() start = sig->posix_timer_id; lock(hash_lock); ... posix_timer_add()     if (++sig->posix_timer_id < 0) start = sig->posix_timer_id; sig->posix_timer_id = 0; So CPU1 can observe a     negative start value, i.e. -1, and the loop break never happens because the condition can never be true:
    if (sig->posix_timer_id == start) break; While this is unlikely to ever turn into an endless loop as the     ID space is huge (INT_MAX), the racy read of the start value caught the attention of KCSAN and Dmitry     unearthed that incorrectness. Rewrite it so that all id operations are under the hash lock.
    (CVE-2023-53728)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名前	製品	ファミリー	公開日	更新日	深刻度
365969	Linux Distros 未修补的漏洞：CVE-2026-98427	Nessus	Misc.	2026/10/14	2026/11/11	medium
365969	Linux Distros 未修補弱點：CVE-2026-98427	Nessus	Misc.	2026/10/14	2026/11/11	medium
365969	Linux Distros のパッチ未適用の脆弱性: CVE-2026-98427	Nessus	Misc.	2026/10/14	2026/11/11	medium
376201	AlmaLinux 9.2 [TuxCare] Security Update: bpftool / kernel / kernel-64k / kernel-64k-core / kernel-64k-debug / etc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1793786843)	Nessus	Alma Linux Local Security Checks	2026/11/5	2026/11/5	high
376443	Ubuntu 24.04 LTS / 26.04 LTS : Linux kernel vulnerabilities (USN-8959-1)	Nessus	Ubuntu Local Security Checks	2026/11/5	2026/11/5	high
365969	Linux Distros Unpatched Vulnerability : CVE-2026-98427	Nessus	Misc.	2026/10/14	2026/11/11	medium
375672	CentOS Linux 7 [TuxCare] Security Update: bpftool / kernel / kernel-debug / kernel-debug-devel / kernel-devel / etc Multiple Vulnerabilities (CENTOS7:CLSA-2026:1793321383)	Nessus	CentOS Local Security Checks	2026/11/3	2026/11/3	high

検出

プラグインの検索

medium

medium

medium

high

high

medium

high