The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:5066 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: block: null pointer dereference in ioctl.c when length and logical block size are misaligned     (CVE-2023-52458)

    * kernel: ext4: regenerate buddy after block freeing failed if under fc replay (CVE-2024-26601)

    * kernel: PM / devfreq: Synchronize devfreq_monitor_[start/stop] (CVE-2023-52635)

    * kernel: bpf: Fix racing between bpf_timer_cancel_and_free and bpf_timer_cancel (CVE-2024-26737)

    * kernel: bnxt: prevent skb UAF after handing over to PTP worker (CVE-2022-48637)

    * kernel: ARM: 9359/1: flush: check if the folio is reserved for no-mapping addresses (CVE-2024-26947)

    * kernel: scsi: qla2xxx: Fix double free of the ha->vp_map pointer (CVE-2024-26930)

    * kernel: nouveau: lock the client object tree. (CVE-2024-27062)

    * kernel: octeontx2-af: Use separate handlers for interrupts (CVE-2024-27030)

    * kernel: vt: fix unicode buffer corruption when deleting characters (CVE-2024-35823)

    * kernel: netfilter: validate user input for expected length (CVE-2024-35896)

    * kernel: mlxbf_gige: stop interface during shutdown (CVE-2024-35885)

    * kernel: netfilter: complete validation of user input (CVE-2024-35962)

    * kernel: scsi: libfc: Fix potential NULL pointer dereference in fc_lport_ptp_setup() (CVE-2023-52809)

    * kernel: i40e: fix vf may be used uninitialized in this function warning (CVE-2024-36020)

    * kernel: rtnetlink: Correct nested IFLA_VF_VLAN_LIST attribute validation (CVE-2024-36017)

    * kernel: net: core: reject skb_copy(_expand) for fraglist GSO skbs (CVE-2024-36929)

    * kernel: drm/vmwgfx: Fix invalid reads in fence signaled events (CVE-2024-36960)

    * kernel: ipvlan: Dont Use skb->sk in ipvlan_process_v{4,6}_outbound (CVE-2024-33621)

    * kernel: blk-cgroup: fix list corruption from reorder of WRITE ->lqueued (CVE-2024-38384)

    * kernel: blk-cgroup: fix list corruption from resetting io stat (CVE-2024-38663)

    * kernel: SUNRPC: Fix UAF in svc_tcp_listen_data_ready() (CVE-2023-52885)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Rocky Linux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-2026_1233 advisory.

    This advisory aggregates security fixes for the kernel SRPM in CIQ LTS 9.2. It addresses 9 CVEs:
    CVE-2023-51779, CVE-2025-38352, CVE-2023-51043, CVE-2023-52439, CVE-2022-3545, and 4 more.

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2024:1725293298 advisory.

  - A NULL pointer dereference vulnerability was found in vmwgfx driver in drivers/gpu/vmxgfx/vmxgfx_execbuf.c     in GPU component of Linux kernel with device file '/dev/dri/renderD128 (or Dxxx)'. This flaw allows a     local attacker with a user account on the system to gain privilege, causing a denial of service(DoS).
    (CVE-2022-38096)

  - In the Linux kernel, the following vulnerability has been resolved: bnxt: prevent skb UAF after handing     over to PTP worker When reading the timestamp is required bnxt_tx_int() hands over the ownership of the     completed skb to the PTP worker. The skb should not be used afterwards, as the worker may run before the     rest of our code and free the skb, leading to a use-after-free. Since dev_kfree_skb_any() accepts NULL     make the loss of ownership more obvious and set skb to NULL. (CVE-2022-48637)

  - An issue was discovered in the Linux kernel before 6.5.9, exploitable by local users with userspace access     to MMIO registers. Incorrect access checking in the #VC handler and instruction emulation of the SEV-ES     emulation of MMIO accesses could lead to arbitrary write access to kernel memory (and thus privilege     escalation). This depends on a race condition through which userspace can replace an instruction before     the #VC handler reads it. (CVE-2023-46813)

  - In the Linux kernel, the following vulnerability has been resolved: PM / devfreq: Synchronize     devfreq_monitor_[start/stop] There is a chance if a frequent switch of the governor done in a loop result     in timer list corruption where timer cancel being done from two place one from cancel_delayed_work_sync()     and followed by expire_timers() can be seen from the traces[1]. while true do echo simple_ondemand >     /sys/class/devfreq/1d84000.ufshc/governor echo performance > /sys/class/devfreq/1d84000.ufshc/governor     done It looks to be issue with devfreq driver where device_monitor_[start/stop] need to synchronized so     that delayed work should get corrupted while it is either being queued or running or being cancelled.
    Let's use polling flag and devfreq lock to synchronize the queueing the timer instance twice and work data     being corrupted. [1] ... .. <idle>-0 [003] 9436.209662: timer_cancel timer=0xffffff80444f0428 <idle>-0     [003] 9436.209664: timer_expire_entry timer=0xffffff80444f0428 now=0x10022da1c     function=__typeid__ZTSFvP10timer_listE_global_addr baseclk=0x10022da1c <idle>-0 [003] 9436.209718:
    timer_expire_exit timer=0xffffff80444f0428 kworker/u16:6-14217 [003] 9436.209863: timer_start     timer=0xffffff80444f0428 function=__typeid__ZTSFvP10timer_listE_global_addr expires=0x10022da2b     now=0x10022da1c flags=182452227 vendor.xxxyyy.ha-1593 [004] 9436.209888: timer_cancel     timer=0xffffff80444f0428 vendor.xxxyyy.ha-1593 [004] 9436.216390: timer_init timer=0xffffff80444f0428     vendor.xxxyyy.ha-1593 [004] 9436.216392: timer_start timer=0xffffff80444f0428     function=__typeid__ZTSFvP10timer_listE_global_addr expires=0x10022da2c now=0x10022da1d flags=186646532     vendor.xxxyyy.ha-1593 [005] 9436.220992: timer_cancel timer=0xffffff80444f0428 xxxyyyTraceManag-7795 [004]     9436.261641: timer_cancel timer=0xffffff80444f0428 [2] 9436.261653][ C4] Unable to handle kernel paging     request at virtual address dead00000000012a [ 9436.261664][ C4] Mem abort info: [ 9436.261666][ C4] ESR =     0x96000044 [ 9436.261669][ C4] EC = 0x25: DABT (current EL), IL = 32 bits [ 9436.261671][ C4] SET = 0, FnV     = 0 [ 9436.261673][ C4] EA = 0, S1PTW = 0 [ 9436.261675][ C4] Data abort info: [ 9436.261677][ C4] ISV =     0, ISS = 0x00000044 [ 9436.261680][ C4] CM = 0, WnR = 1 [ 9436.261682][ C4] [dead00000000012a] address     between user and kernel address ranges [ 9436.261685][ C4] Internal error: Oops: 96000044 [#1] PREEMPT SMP     [ 9436.261701][ C4] Skip md ftrace buffer dump for: 0x3a982d0 ... [ 9436.262138][ C4] CPU: 4 PID: 7795     Comm: TraceManag Tainted: G S W O 5.10.149-android12-9-o-g17f915d29d0c #1 [ 9436.262141][ C4] Hardware     name: Qualcomm Technologies, Inc. (DT) [ 9436.262144][ C4] pstate: 22400085 (nzCv daIf +PAN -UAO +TCO     BTYPE=--) [ 9436.262161][ C4] pc : expire_timers+0x9c/0x438 [ 9436.262164][ C4] lr :
    expire_timers+0x2a4/0x438 [ 9436.262168][ C4] sp : ffffffc010023dd0 [ 9436.262171][ C4] x29:
    ffffffc010023df0 x28: ffffffd0636fdc18 [ 9436.262178][ C4] x27: ffffffd063569dd0 x26: ffffffd063536008 [     9436.262182][ C4] x25: 0000000000000001 x24: ffffff88f7c69280 [ 9436.262185][ C4] x23: 00000000000000e0     x22: dead000000000122 [ 9436.262188][ C4] x21: 000000010022da29 x20: ffffff8af72b4e80 [ 9436.262191][ C4]     x19: ffffffc010023e50 x18: ffffffc010025038 [ 9436.262195][ C4] x17: 0000000000000240 x16:
    0000000000000201 [ 9436.262199][ C4] x15: ffffffffffffffff x14: ffffff889f3c3100 [ 9436.262203][ C4] x13:
    ffffff889f3c3100 x12: 00000000049f56b8 [ 9436.262207][ C4] x11: 00000000049f56b8 x10: 00000000ffffffff [     9436.262212][ C4] x9 : ffffffc010023e50 x8 : dead000000000122 [ 9436.262216][ C4] x7 : ffffffffffffffff x6     : ffffffc0100239d8 [ 9436.262220][ C4] x5 : 0000000000000000 x4 : 0000000000000101 [ 9436.262223][ C4] x3     : 0000000000000080 x2 : ffffff8 ---truncated--- (CVE-2023-52635)

  - In the Linux kernel, the following vulnerability has been resolved: sched/psi: Fix use-after-free in     ep_remove_wait_queue() If a non-root cgroup gets removed when there is a thread that registered trigger     and is polling on a pressure file within the cgroup, the polling waitqueue gets freed in the following     path: do_rmdir cgroup_rmdir kernfs_drain_open_files cgroup_file_release cgroup_pressure_release     psi_trigger_destroy However, the polling thread still has a reference to the pressure file and will access     the freed waitqueue when the file is closed or upon exit: fput ep_eventpoll_release ep_free     ep_remove_wait_queue remove_wait_queue This results in use-after-free as pasted below. The fundamental     problem here is that cgroup_file_release() (and consequently waitqueue's lifetime) is not tied to the     file's real lifetime. Using wake_up_pollfree() here might be less than ideal, but it is in line with the     comment at commit 42288cb44c4b (wait: add wake_up_pollfree()) since the waitqueue's lifetime is not tied     to file's one and can be considered as another special case. While this would be fixable by somehow making     cgroup_file_release() be tied to the fput(), it would require sizable refactoring at cgroups or higher     layer which might be more justifiable if we identify more cases like this. BUG: KASAN: use-after-free in
    _raw_spin_lock_irqsave+0x60/0xc0 Write of size 4 at addr ffff88810e625328 by task a.out/4404 CPU: 19 PID:
    4404 Comm: a.out Not tainted 6.2.0-rc6 #38 Hardware name: Amazon EC2 c5a.8xlarge/, BIOS 1.0 10/16/2017     Call Trace: <TASK> dump_stack_lvl+0x73/0xa0 print_report+0x16c/0x4e0 kasan_report+0xc3/0xf0     kasan_check_range+0x2d2/0x310 _raw_spin_lock_irqsave+0x60/0xc0 remove_wait_queue+0x1a/0xa0     ep_free+0x12c/0x170 ep_eventpoll_release+0x26/0x30 __fput+0x202/0x400 task_work_run+0x11d/0x170     do_exit+0x495/0x1130 do_group_exit+0x100/0x100 get_signal+0xd67/0xde0 arch_do_signal_or_restart+0x2a/0x2b0     exit_to_user_mode_prepare+0x94/0x100 syscall_exit_to_user_mode+0x20/0x40 do_syscall_64+0x52/0x90     entry_SYSCALL_64_after_hwframe+0x63/0xcd </TASK> Allocated by task 4404: kasan_set_track+0x3d/0x60
    __kasan_kmalloc+0x85/0x90 psi_trigger_create+0x113/0x3e0 pressure_write+0x146/0x2e0     cgroup_file_write+0x11c/0x250 kernfs_fop_write_iter+0x186/0x220 vfs_write+0x3d8/0x5c0     ksys_write+0x90/0x110 do_syscall_64+0x43/0x90 entry_SYSCALL_64_after_hwframe+0x63/0xcd Freed by task 4407:
    kasan_set_track+0x3d/0x60 kasan_save_free_info+0x27/0x40 ____kasan_slab_free+0x11d/0x170     slab_free_freelist_hook+0x87/0x150 __kmem_cache_free+0xcb/0x180 psi_trigger_destroy+0x2e8/0x310     cgroup_file_release+0x4f/0xb0 kernfs_drain_open_files+0x165/0x1f0 kernfs_drain+0x162/0x1a0
    __kernfs_remove+0x1fb/0x310 kernfs_remove_by_name_ns+0x95/0xe0 cgroup_addrm_files+0x67f/0x700     cgroup_destroy_locked+0x283/0x3c0 cgroup_rmdir+0x29/0x100 kernfs_iop_rmdir+0xd1/0x140 vfs_rmdir+0xfe/0x240     do_rmdir+0x13d/0x280 __x64_sys_rmdir+0x2c/0x30 do_syscall_64+0x43/0x90     entry_SYSCALL_64_after_hwframe+0x63/0xcd (CVE-2023-52707)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Rocky Linux 8.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-2026_0871 advisory.

    This advisory aggregates security fixes for the kernel SRPM in CIQ LTS 8.6. It addresses 28 CVEs:
    CVE-2025-21919, CVE-2022-50020, CVE-2022-48796, CVE-2022-49114, CVE-2024-46858, and 23 more.

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名前	製品	ファミリー	公開日	更新日	深刻度
205152	RHEL 9 : kernel (RHSA-2024:5066)	Nessus	Red Hat Local Security Checks	2024/8/7	2024/11/7	high
356072	Rocky Linux 9.2 [CIQ] Security Update: bpftool / bpftool-debuginfo Multiple Vulnerabilities (ciqsa-2026_1233)	Nessus	Rocky Linux Local Security Checks	2026/10/1	2026/10/2	high
353033	AlmaLinux 9.2 [TuxCare] Security Update: bpftool / kernel / kernel-abi-stablelists / kernel-core / etc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2024:1725293298)	Nessus	Alma Linux Local Security Checks	2026/9/30	2026/9/30	high
355129	Rocky Linux 8.6 [CIQ] Security Update: bpftool / bpftool-debuginfo / kernel / kernel-abi-stablelists / etc Multiple Vulnerabilities (ciqsa-2026_0871)	Nessus	Rocky Linux Local Security Checks	2026/10/1	2026/10/12	high

検出

プラグインの検索

high

high

high

high