Linux/Unix 主机中安装的一个或多个程序包受到一个漏洞影响，而供应商没有提供补丁程序。

  - ipv4：nexthop 群组缩小时停止调整路由通知大小 提交 680aea08e78c（net：ipv4：更改 fib 硬件标记时发出通知） 针对异步硬件标记通知添加了仅限 RCU 的 fib_nlmsg_size（） 调用。fib_nlmsg_size（） 在每次迭代前检查 fib_info_num_path（），然后 fib_info_nhc（） 独立地重新加载 nh->nh_grp。如果 RTM_NEWNEXTHOP 在这些加载之间替换路径较少的组，则 fib_info_nhc（） 返回 NULL，而 fib_nexthop_nlmsg_size（） 会取消引用它。
    索引路径不存在时停止调整大小。Nexthop 组较密集，因此当前快照没有更高版本的路径。（CVE-2026-99072）

请注意，Nessus 依赖供应商报告的程序包是否存在进行判断。

Linux/Unix 主機上安裝了一個或多個受到弱點影響的套件，且廠商未提供可用的修補程式。

  - ipv4：當 nexthop 群組縮小時停止路由通知大小調整 提交 680aea08e78c （net：ipv4：當 fib 硬體旗標變更時發出通知） 新增了非同步硬體旗標通知的僅 RCU fib_nlmsg_size（） 呼叫。fib_nlmsg_size（） 在每次迭代之前檢查 fib_info_num_path（），然後 fib_info_nhc（） 獨立重新載入 nh->nh_grp。如果 RTM_NEWNEXTHOP 取代這些載入之間路徑較少的群組，則 fib_info_nhc（） 會傳回 NULL，而 fib_nexthop_nlmsg_size（） 會取消參照它。
    當索引路徑不存在時，停止調整大小。下一躍點群組很密集，因此目前的快照沒有後續路徑。（CVE-2026-99072）

請注意，Nessus 的判定取決於廠商所報告的套件是否存在。

Linux/Unix ホストには、ベンダーが提供するパッチが利用できない脆弱性の影響を受ける複数のパッケージがインストールされています。

  - ipv4:nexthop グループが縮小する際に、ルート通知のサイズを停止します コミット 680aea08e78c(net:ipv4:fib ハードウェアフラグが変更されたときに通知を発行します) 非同期ハードウェアフラグ通知に対する RCU 専用の fib_nlmsg_size() 呼び出しを追加しました。fib_nlmsg_size() は各反復の前に fib_info_num_path() をチェックしてから、fib_info_nhc() は個別に nh->nh_grp をリロードします。RTM_NEWNEXTHOP がこれらのロード間のパスの数が少ないグループを置き換えると、fib_info_nhc() は NULL を返し、fib_nexthop_nlmsg_size() はそれを逆参照します。
    インデックス付きパスがない場合はサイジングを停止します。Nexthop グループは密度が高いため、現在のスナップショットには後のパスがありません。(CVE-2026-99072)

Nessus は、ベンダーから報告されたパッケージの存在に依存していることに注意してください。

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - ipv4: stop route notification sizing when nexthop group shrinks Commit 680aea08e78c (net: ipv4: Emit     notification when fib hardware flags are changed) added an RCU-only fib_nlmsg_size() call for     asynchronous hardware flag notifications. fib_nlmsg_size() checks fib_info_num_path() before each     iteration, then fib_info_nhc() independently reloads nh->nh_grp. If RTM_NEWNEXTHOP replaces a group with     fewer paths between those loads, fib_info_nhc() returns NULL and fib_nexthop_nlmsg_size() dereferences it.
    Stop sizing when the indexed path is absent. Nexthop groups are dense, so the current snapshot has no     later path. (CVE-2026-99072)

Note that Nessus relies on the presence of the package as reported by the vendor.

An update of the linux package has been released.

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1793786843 advisory.

  - In the Linux kernel, the following vulnerability has been resolved: soc: qcom: qmi_encdec: Restrict string     length in decode The QMI TLV value for strings in a lot of qmi element info structures account for null     terminated strings with MAX_LEN + 1. If a string is actually MAX_LEN + 1 length, this will cause an out of     bounds access when the NULL character is appended in decoding. (CVE-2023-53729)

  - In the Linux kernel, the following vulnerability has been resolved: rv: Use strings in da monitors     tracepoints Using DA monitors tracepoints with KASAN enabled triggers the following warning: BUG: KASAN:
    global-out-of-bounds in do_trace_event_raw_event_event_da_monitor+0xd6/0x1a0 Read of size 32 at addr     ffffffffaada8980 by task ... Call Trace: <TASK> [...] do_trace_event_raw_event_event_da_monitor+0xd6/0x1a0     ? __pfx_do_trace_event_raw_event_event_da_monitor+0x10/0x10 ? trace_event_sncid+0x83/0x200     trace_event_sncid+0x163/0x200 [...] The buggy address belongs to the variable: automaton_snep+0x4e0/0x5e0     This is caused by the tracepoints reading 32 bytes __array instead of __string from the automata     definition. Such strings are literals and reading 32 bytes ends up in out of bound memory accesses (e.g.
    the next automaton's data in this case). The error is harmless as, while printing the string, we stop at     the null terminator, but it should still be fixed. Use the __string facilities while defining the     tracepoints to avoid reading out of bound memory. (CVE-2025-38636)

  - In the Linux kernel, the following vulnerability has been resolved: perf: arm_spe: Prevent overflow in     PERF_IDX2OFF() Cast nr_pages to unsigned long to avoid overflow when handling large AUX buffer sizes (>= 2     GiB). (CVE-2025-40081)

  - In the Linux kernel, the following vulnerability has been resolved: arch_topology: Fix incorrect error     check in topology_parse_cpu_capacity() Fix incorrect use of PTR_ERR_OR_ZERO() in     topology_parse_cpu_capacity() which causes the code to proceed with NULL clock pointers. The current logic     uses !PTR_ERR_OR_ZERO(cpu_clk) which evaluates to true for both valid pointers and NULL, leading to     potential NULL pointer dereference in clk_get_rate(). Per include/linux/err.h documentation,     PTR_ERR_OR_ZERO(ptr) returns: The error code within @ptr if it is an error pointer; 0 otherwise. This     means PTR_ERR_OR_ZERO() returns 0 for both valid pointers AND NULL pointers. Therefore     !PTR_ERR_OR_ZERO(cpu_clk) evaluates to true (proceed) when cpu_clk is either valid or NULL, causing     clk_get_rate(NULL) to be called when of_clk_get() returns NULL. Replace with !IS_ERR_OR_NULL(cpu_clk)     which only proceeds for valid pointers, preventing potential NULL pointer dereference in clk_get_rate().
    (CVE-2025-40346)

  - In the Linux kernel, the following vulnerability has been resolved: platform/x86/amd/pmc: Add support for     Van Gogh SoC The ROG Xbox Ally (non-X) SoC features a similar architecture to the Steam Deck. While the     Steam Deck supports S3 (s2idle causes a crash), this support was dropped by the Xbox Ally which only S0ix     suspend. Since the handler is missing here, this causes the device to not suspend and the AMD GPU driver     to crash while trying to resume afterwards due to a power hang. (CVE-2025-68334)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名前	製品	ファミリー	公開日	更新日	深刻度
373466	Amazon Linux 2023：bpftool6.12、kernel6.12、kernel6.12-devel （ALAS2023-2026-3335）	Nessus	Amazon Linux Local Security Checks	2026/10/29	2026/11/4	medium
371533	Linux Distros 未修补的漏洞：CVE-2026-99072	Nessus	Misc.	2026/10/23	2026/11/7	medium
373466	Amazon Linux 2023：bpftool6.12、kernel6.12、kernel6.12-devel （ALAS2023-2026-3335）	Nessus	Amazon Linux Local Security Checks	2026/10/29	2026/11/4	medium
371533	Linux Distros 未修補弱點：CVE-2026-99072	Nessus	Misc.	2026/10/23	2026/11/7	medium
371533	Linux Distros のパッチ未適用の脆弱性: CVE-2026-99072	Nessus	Misc.	2026/10/23	2026/11/7	medium
373466	2023 Amazon Linux:bpftool6.12、kernel6.12、kernel6.12-devel(ALAS2023-2026-3335)	Nessus	Amazon Linux Local Security Checks	2026/10/29	2026/11/4	medium
371533	Linux Distros Unpatched Vulnerability : CVE-2026-99072	Nessus	Misc.	2026/10/23	2026/11/7	medium
373466	Amazon Linux 2023 : bpftool6.12, kernel6.12, kernel6.12-devel (ALAS2023-2026-3335)	Nessus	Amazon Linux Local Security Checks	2026/10/29	2026/11/4	medium
375086	Photon OS 5.0: Linux PHSA-2026-5.0-92-1044	Nessus	PhotonOS Local Security Checks	2026/11/2	2026/11/2	critical
376201	AlmaLinux 9.2 [TuxCare] Security Update: bpftool / kernel / kernel-64k / kernel-64k-core / kernel-64k-debug / etc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1793786843)	Nessus	Alma Linux Local Security Checks	2026/11/5	2026/11/5	high

検出

プラグインの検索

medium

medium

medium

medium

medium

medium

medium

medium

critical

high