Linux/Unix 主機上安裝了一個或多個受到弱點影響的套件，且廠商未提供可用的修補程式。

  - net： team：佇列覆寫後停止重複使用 skb 非零 dev_queue_xmit（） 結果不會傳回 skb 的所有權。當覆蓋埠的 qdisc 刪除它時，佇列覆蓋協助程式用於嘗試另一個埠或使用釋放的 skb 的模式傳輸操作。將交接決定與傳輸成功分開傳回。僅選擇 RCU 下的第一個覆蓋端口，並在將其交給 skb 後停止，無論較低的傳輸結果如何。保持現有的成功並放棄會計。錯誤：KASAN：sk_skb_reason_drop 中 slab-use-after-free 依任務 poc/5040 寫入大小 4 sk_skb_reason_drop （net/core/skbuff.c：1240） dev_kfree_skb_any_reason （net/core/dev.c：3470） ab_transmit （drivers/net/team/team_mode_activebackup.c：49） team_xmit （drivers/net/team/team_core.c：1849）
    __dev_direct_xmit （net/core/dev.c：4934） 由任務 5040 釋放： __tcf_kfree_skb_list （net/sched/sch_generic.c：43） __dev_queue_xmit （net/core/dev.c：4831） team_xmit （drivers/net/team/team_core.c：1846） 核心錯誤 - 未同步： KASAN：panic_on_warn設定 ...
    (CVE-2026-99027)

請注意，Nessus 依賴供應商報告的套件存在。

Linux/Unix 主机中安装的一个或多个程序包受到一个漏洞影响，而供应商没有提供补丁程序。

  - net：team：队列替代后停止重用 skb 非零 dev_queue_xmit（） 结果不会返回 skb 的所有权。当替代端口的 qdisc 丢弃它时，队列替代帮助程序用于尝试使用释放的 skb 尝试其他端口或模式传输 op。将切换决定与传输成功分开返回。仅选择 RCU 下的第一个覆盖端口，并在向其传递 skb 后停止，无论较低的传输结果如何。保持现有的成功并放弃会计。缺陷：KASAN：sk_skb_reason_drop 中的释放后使用 slab-use-size，按任务 poc/5040 写入 sk_skb_reason_drop （net/core/skbuff.c：1240） dev_kfree_skb_any_reason （net/core/dev.c：3470） ab_transmit （drivers/net/team/team_mode_activebackup.c：49） team_xmit （drivers/net/team/team_core.c：1849）
    __dev_direct_xmit （net/core/dev.c：4934） 由任务 5040 释放： __tcf_kfree_skb_list （net/sched/sch_generic.c：43） __dev_queue_xmit （net/core/dev.c：4831） team_xmit （drivers/net/team/team_core.c：1846） 内核错误 - 不同步： KASAN： panic_on_warn 设置 ...
    (CVE-2026-99027)

请注意，Nessus 依赖供应商报告的程序包是否存在进行判断。

Linux/Unix ホストには、ベンダーが提供するパッチが利用できない脆弱性の影響を受ける複数のパッケージがインストールされています。

  - net:team:キューオーバーライド後の skb の再利用を停止します ゼロ以外の dev_queue_xmit() の結果は skb の所有権を返しません。オーバーライドポートの qdisc がドロップされると、キューオーバーライドヘルパーは、解放された skb で他のポートまたはモード送信操作を試すのに使用していました。ハンドオフ決定を、送信の成功とは別に返します。RCU 下の最初のオーバーライド ポートのみを選択し、送信結果が下がるかどうかに関係なく、skb を受け渡してから停止します。既存の成功を維持し、会計をドロップします。バグ:KASAN:sk_skb_reason_drop の slab-use-after-free タスクによるサイズ 4 の書き込み poc/5040 sk_skb_reason_drop(net/core/skbuff.c:1240)dev_kfree_skb_any_reason(net/core/dev.c:3470)ab_transmit(drivers/net/team/team_mode_activebackup.c:49)team_xmit(drivers/net/team/team_core.c:1849)
    __dev_direct_xmit(net/core/dev.c:4934)タスク 5040 により解放:__tcf_kfree_skb_list(net/sched/sch_generic.c:43) __dev_queue_xmit(net/core/dev.c:4831)team_xmit(drivers/net/team/team_core.c:1846) カーネルパニック - 同期していない:KASAN:panic_on_warn設定 ...
    (CVE-2026-99027)

Nessus は、ベンダーによって報告されたパッケージの存在に依存していることに注意してください。

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1793786843 advisory.

  - In the Linux kernel, the following vulnerability has been resolved: soc: qcom: qmi_encdec: Restrict string     length in decode The QMI TLV value for strings in a lot of qmi element info structures account for null     terminated strings with MAX_LEN + 1. If a string is actually MAX_LEN + 1 length, this will cause an out of     bounds access when the NULL character is appended in decoding. (CVE-2023-53729)

  - In the Linux kernel, the following vulnerability has been resolved: rv: Use strings in da monitors     tracepoints Using DA monitors tracepoints with KASAN enabled triggers the following warning: BUG: KASAN:
    global-out-of-bounds in do_trace_event_raw_event_event_da_monitor+0xd6/0x1a0 Read of size 32 at addr     ffffffffaada8980 by task ... Call Trace: <TASK> [...] do_trace_event_raw_event_event_da_monitor+0xd6/0x1a0     ? __pfx_do_trace_event_raw_event_event_da_monitor+0x10/0x10 ? trace_event_sncid+0x83/0x200     trace_event_sncid+0x163/0x200 [...] The buggy address belongs to the variable: automaton_snep+0x4e0/0x5e0     This is caused by the tracepoints reading 32 bytes __array instead of __string from the automata     definition. Such strings are literals and reading 32 bytes ends up in out of bound memory accesses (e.g.
    the next automaton's data in this case). The error is harmless as, while printing the string, we stop at     the null terminator, but it should still be fixed. Use the __string facilities while defining the     tracepoints to avoid reading out of bound memory. (CVE-2025-38636)

  - In the Linux kernel, the following vulnerability has been resolved: perf: arm_spe: Prevent overflow in     PERF_IDX2OFF() Cast nr_pages to unsigned long to avoid overflow when handling large AUX buffer sizes (>= 2     GiB). (CVE-2025-40081)

  - In the Linux kernel, the following vulnerability has been resolved: arch_topology: Fix incorrect error     check in topology_parse_cpu_capacity() Fix incorrect use of PTR_ERR_OR_ZERO() in     topology_parse_cpu_capacity() which causes the code to proceed with NULL clock pointers. The current logic     uses !PTR_ERR_OR_ZERO(cpu_clk) which evaluates to true for both valid pointers and NULL, leading to     potential NULL pointer dereference in clk_get_rate(). Per include/linux/err.h documentation,     PTR_ERR_OR_ZERO(ptr) returns: The error code within @ptr if it is an error pointer; 0 otherwise. This     means PTR_ERR_OR_ZERO() returns 0 for both valid pointers AND NULL pointers. Therefore     !PTR_ERR_OR_ZERO(cpu_clk) evaluates to true (proceed) when cpu_clk is either valid or NULL, causing     clk_get_rate(NULL) to be called when of_clk_get() returns NULL. Replace with !IS_ERR_OR_NULL(cpu_clk)     which only proceeds for valid pointers, preventing potential NULL pointer dereference in clk_get_rate().
    (CVE-2025-40346)

  - In the Linux kernel, the following vulnerability has been resolved: platform/x86/amd/pmc: Add support for     Van Gogh SoC The ROG Xbox Ally (non-X) SoC features a similar architecture to the Steam Deck. While the     Steam Deck supports S3 (s2idle causes a crash), this support was dropped by the Xbox Ally which only S0ix     suspend. Since the handler is missing here, this causes the device to not suspend and the AMD GPU driver     to crash while trying to resume afterwards due to a power hang. (CVE-2025-68334)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - net: team: stop reusing skb after queue override A nonzero dev_queue_xmit() result does not return     ownership of the skb. When an override port's qdisc drops it, the queue override helper used to try     another port or the mode transmit op with the freed skb. Return the handoff decision separately from     transmit success. Select only the first override port under RCU and stop after handing it the skb,     regardless of the lower transmit result. Keep the existing success and drop accounting. BUG: KASAN: slab-     use-after-free in sk_skb_reason_drop Write of size 4 by task poc/5040 sk_skb_reason_drop     (net/core/skbuff.c:1240) dev_kfree_skb_any_reason (net/core/dev.c:3470) ab_transmit     (drivers/net/team/team_mode_activebackup.c:49) team_xmit (drivers/net/team/team_core.c:1849)
    __dev_direct_xmit (net/core/dev.c:4934) Freed by task 5040: __tcf_kfree_skb_list     (net/sched/sch_generic.c:43) __dev_queue_xmit (net/core/dev.c:4831) team_xmit     (drivers/net/team/team_core.c:1846) Kernel panic - not syncing: KASAN: panic_on_warn set ...
    (CVE-2026-99027)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	名前	製品	ファミリー	公開日	更新日	深刻度
371562	Linux Distros 未修補弱點：CVE-2026-99027	Nessus	Misc.	2026/10/23	2026/11/13	high
371562	Linux Distros 未修补的漏洞：CVE-2026-99027	Nessus	Misc.	2026/10/23	2026/11/13	high
371562	Linux Distros のパッチ未適用の脆弱性: CVE-2026-99027	Nessus	Misc.	2026/10/23	2026/11/13	high
379844	Amazon Linux 2 : kernel (ALASKERNEL-5.10-2026-139)	Nessus	Amazon Linux Local Security Checks	2026/11/12	2026/11/12	critical
376201	AlmaLinux 9.2 [TuxCare] Security Update: bpftool / kernel / kernel-64k / kernel-64k-core / kernel-64k-debug / etc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1793786843)	Nessus	Alma Linux Local Security Checks	2026/11/5	2026/11/13	high
371562	Linux Distros Unpatched Vulnerability : CVE-2026-99027	Nessus	Misc.	2026/10/23	2026/11/13	high
379876	Amazon Linux 2 : kernel (ALASKERNEL-5.15-2026-121)	Nessus	Amazon Linux Local Security Checks	2026/11/12	2026/11/12	critical
377900	Amazon Linux 2023 : bpftool6.12, kernel6.12, kernel6.12-devel (ALAS2023-2026-3402)	Nessus	Amazon Linux Local Security Checks	2026/11/9	2026/11/11	high

検出

プラグインの検索

high

high

high

critical

high

high

critical

high