Linux/Unix 主機上安裝了一個或多個受到弱點影響的套件，且廠商未提供可用的修補程式。

  - dm-integrity：修正具有較大標籤大小的捨棄時的無限迴圈 當 integrity_metadata 處理捨棄時，它會用DISCARD_FILLER填滿緩衝區，並將其寫入標籤上，一次max_blocks區塊。如果 kmalloc 失敗，則緩衝區是堆疊上陣列checksums_onstack，max_size設定為 HASH_MAX_DIGESTSIZE。因此，如果標籤大小大於 HASH_MAX_DIGESTSIZE，則max_blocks為零，bi_size永遠不會遞減，迴圈也永遠不會終止。使用 sizeof（checksums_onstack） 作為max_size來修正此問題。
    自提交 b93b6643e9b5 （dm 完整性：修正標籤大小異常大的損毀） 以來，陣列有 MAX_TAG_SIZE 個位元組，因此max_blocks至少為 1。（CVE-2026-99135）

請注意，Nessus 的判定取決於廠商所報告的套件是否存在。

Linux/Unix 主机中安装的一个或多个程序包受到一个漏洞影响，而供应商没有提供补丁程序。

  - dm-integrity：修复丢弃具有大标签大小时的无限循环 integrity_metadata 处理丢弃时，它会用DISCARD_FILLER填充缓冲区并将其写入标签上，一次max_blocks块。如果 kmalloc 失败，则缓冲区是堆栈上的数组checksums_onstack，max_size 设置为 HASH_MAX_DIGESTSIZE。因此，如果标记大小大于 HASH_MAX_DIGESTSIZE，则max_blocks为零，bi_size 永远不会递减，循环也永远不会终止。使用 sizeof（checksums_onstack） 作为max_size修复此问题。
    自提交 b93b6643e9b5（dm 完整性：修复标签大小异常大导致的崩溃）以来，数组MAX_TAG_SIZE字节，因此max_blocks至少为 1。（CVE-2026-99135）

请注意，Nessus 依赖供应商报告的程序包是否存在进行判断。

Linux/Unix ホストには、ベンダーが提供するパッチが利用できない脆弱性の影響を受ける複数のパッケージがインストールされています。

  - dm-integrity:大きなタグサイズの破棄の無限ループを修正します integrity_metadata が破棄を処理するとき、バッファを DISCARD_FILLER で満たし、それをタグの上に書き込むことで、一度にブロックmax_blocksします。kmalloc が失敗する場合、バッファはオンスタック配列checksums_onstackであり、max_sizeは HASH_MAX_DIGESTSIZE に設定されます。そのため、タグサイズが HASH_MAX_DIGESTSIZE より大きい場合、max_blocks は 0 であり、bi_sizeは減らず、ループは終了しません。max_sizeとして sizeof(checksums_onstack) を使用してこれを修正します。
    配列にはコミット b93b6643e9b5(dm 整合性:異常に大きなタグサイズによるクラッシュを修正)以来MAX_TAG_SIZEバイトがあるため、max_blocks は少なくとも 1 です。(CVE-2026-99135)

Nessus は、ベンダーから報告されたパッケージの存在に依存していることに注意してください。

The AlmaLinux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1793866396 advisory.

  - In the Linux kernel, the following vulnerability has been resolved: rv: Use strings in da monitors     tracepoints Using DA monitors tracepoints with KASAN enabled triggers the following warning: BUG: KASAN:
    global-out-of-bounds in do_trace_event_raw_event_event_da_monitor+0xd6/0x1a0 Read of size 32 at addr     ffffffffaada8980 by task ... Call Trace: <TASK> [...] do_trace_event_raw_event_event_da_monitor+0xd6/0x1a0     ? __pfx_do_trace_event_raw_event_event_da_monitor+0x10/0x10 ? trace_event_sncid+0x83/0x200     trace_event_sncid+0x163/0x200 [...] The buggy address belongs to the variable: automaton_snep+0x4e0/0x5e0     This is caused by the tracepoints reading 32 bytes __array instead of __string from the automata     definition. Such strings are literals and reading 32 bytes ends up in out of bound memory accesses (e.g.
    the next automaton's data in this case). The error is harmless as, while printing the string, we stop at     the null terminator, but it should still be fixed. Use the __string facilities while defining the     tracepoints to avoid reading out of bound memory. (CVE-2025-38636)

  - In the Linux kernel, the following vulnerability has been resolved: iommufd: Prevent ALIGN() overflow When     allocating IOVA the candidate range gets aligned to the target alignment. If the range is close to     ULONG_MAX then the ALIGN() can wrap resulting in a corrupted iova. Open code the ALIGN() using     get_add_overflow() to prevent this. This simplifies the checks as we don't need to check for length     earlier either. Consolidate the two copies of this code under a single helper. This bug would allow     userspace to create a mapping that overlaps with some other mapping or a reserved range. (CVE-2025-38688)

  - In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: fix NULL dereference in     ath11k_qmi_m3_load() If ab->fw.m3_data points to data, then fw pointer remains null. Further, if m3_mem is     not allocated, then fw is dereferenced to be passed to ath11k_err function. Replace fw->size by m3_len.
    Found by Linux Verification Center (linuxtesting.org) with SVACE. (CVE-2025-39991)

  - In the Linux kernel, the following vulnerability has been resolved: libceph: prevent potential out-of-     bounds writes in handle_auth_session_key() The len field originates from untrusted network packets.
    Boundary checks have been added to prevent potential out-of-bounds writes when decrypting the connection     secret or processing service tickets. [ idryomov: changelog ] (CVE-2025-68284)

  - In the Linux kernel, the following vulnerability has been resolved: tipc: fix bc_ackers underflow on     duplicate GRP_ACK_MSG The GRP_ACK_MSG handler in tipc_group_proto_rcv() currently decrements bc_ackers on     every inbound group ACK, even when the same member has already acknowledged the current broadcast round.
    Because bc_ackers is a u16, a duplicate ACK received after the last legitimate ACK wraps the counter to     65535. Once wrapped, tipc_group_bc_cong() keeps reporting congestion and later group broadcasts on the     affected socket stay blocked until the group is recreated. Fix this by ignoring duplicate or stale ACKs     before touching bc_acked or bc_ackers. This makes repeated GRP_ACK_MSG handling idempotent and prevents     the underflow path. (CVE-2026-31662)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1793866396 advisory.

  - In the Linux kernel, the following vulnerability has been resolved: rv: Use strings in da monitors     tracepoints Using DA monitors tracepoints with KASAN enabled triggers the following warning: BUG: KASAN:
    global-out-of-bounds in do_trace_event_raw_event_event_da_monitor+0xd6/0x1a0 Read of size 32 at addr     ffffffffaada8980 by task ... Call Trace: <TASK> [...] do_trace_event_raw_event_event_da_monitor+0xd6/0x1a0     ? __pfx_do_trace_event_raw_event_event_da_monitor+0x10/0x10 ? trace_event_sncid+0x83/0x200     trace_event_sncid+0x163/0x200 [...] The buggy address belongs to the variable: automaton_snep+0x4e0/0x5e0     This is caused by the tracepoints reading 32 bytes __array instead of __string from the automata     definition. Such strings are literals and reading 32 bytes ends up in out of bound memory accesses (e.g.
    the next automaton's data in this case). The error is harmless as, while printing the string, we stop at     the null terminator, but it should still be fixed. Use the __string facilities while defining the     tracepoints to avoid reading out of bound memory. (CVE-2025-38636)

  - In the Linux kernel, the following vulnerability has been resolved: iommufd: Prevent ALIGN() overflow When     allocating IOVA the candidate range gets aligned to the target alignment. If the range is close to     ULONG_MAX then the ALIGN() can wrap resulting in a corrupted iova. Open code the ALIGN() using     get_add_overflow() to prevent this. This simplifies the checks as we don't need to check for length     earlier either. Consolidate the two copies of this code under a single helper. This bug would allow     userspace to create a mapping that overlaps with some other mapping or a reserved range. (CVE-2025-38688)

  - In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: fix NULL dereference in     ath11k_qmi_m3_load() If ab->fw.m3_data points to data, then fw pointer remains null. Further, if m3_mem is     not allocated, then fw is dereferenced to be passed to ath11k_err function. Replace fw->size by m3_len.
    Found by Linux Verification Center (linuxtesting.org) with SVACE. (CVE-2025-39991)

  - In the Linux kernel, the following vulnerability has been resolved: libceph: prevent potential out-of-     bounds writes in handle_auth_session_key() The len field originates from untrusted network packets.
    Boundary checks have been added to prevent potential out-of-bounds writes when decrypting the connection     secret or processing service tickets. [ idryomov: changelog ] (CVE-2025-68284)

  - In the Linux kernel, the following vulnerability has been resolved: tipc: fix bc_ackers underflow on     duplicate GRP_ACK_MSG The GRP_ACK_MSG handler in tipc_group_proto_rcv() currently decrements bc_ackers on     every inbound group ACK, even when the same member has already acknowledged the current broadcast round.
    Because bc_ackers is a u16, a duplicate ACK received after the last legitimate ACK wraps the counter to     65535. Once wrapped, tipc_group_bc_cong() keeps reporting congestion and later group broadcasts on the     affected socket stay blocked until the group is recreated. Fix this by ignoring duplicate or stale ACKs     before touching bc_acked or bc_ackers. This makes repeated GRP_ACK_MSG handling idempotent and prevents     the underflow path. (CVE-2026-31662)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - dm-integrity: fix infinite loop on discard with large tag size When integrity_metadata handles a discard,     it fills a buffer with DISCARD_FILLER and writes it over the tags, max_blocks blocks at a time. If the     kmalloc fails, the buffer is the on-stack array checksums_onstack and max_size is set to     HASH_MAX_DIGESTSIZE. So if the tag size is larger than HASH_MAX_DIGESTSIZE, max_blocks is zero, bi_size is     never decremented and the loop never terminates. Fix this by using sizeof(checksums_onstack) as max_size.
    The array has MAX_TAG_SIZE bytes since commit b93b6643e9b5 (dm integrity: fix a crash with unusually     large tag size), so max_blocks is at least 1. (CVE-2026-99135)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	名前	製品	ファミリー	公開日	更新日	深刻度
373301	Linux Distros 未修補弱點：CVE-2026-99135	Nessus	Misc.	2026/10/28	2026/11/7	medium
373301	Linux Distros 未修补的漏洞：CVE-2026-99135	Nessus	Misc.	2026/10/28	2026/11/7	medium
373301	Linux Distros のパッチ未適用の脆弱性: CVE-2026-99135	Nessus	Misc.	2026/10/28	2026/11/7	medium
376433	AlmaLinux 9.6 [TuxCare] Security Update: kernel / kernel-64k / kernel-64k-core / kernel-64k-debug / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1793866396)	Nessus	Alma Linux Local Security Checks	2026/11/5	2026/11/5	high
376432	Rocky Linux 9.6 [TuxCare] Security Update: kernel / kernel-64k / kernel-64k-core / kernel-64k-debug / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1793866396)	Nessus	Rocky Linux Local Security Checks	2026/11/5	2026/11/5	high
373301	Linux Distros Unpatched Vulnerability : CVE-2026-99135	Nessus	Misc.	2026/10/28	2026/11/7	medium

検出

プラグインの検索

medium

medium

medium

high

high

medium