The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:93412 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: sctp: stream: fully roll back denied add-stream state (CVE-2026-52929)

    * kernel: ipv6: sit: reload inner IPv6 header after GSO offloads (CVE-2026-53228)

    * kernel: ipvs: clear the svc scheduler ptr early on edit (CVE-2026-53270)

    * kernel: spi: fsl-lpspi: terminate the RX channel on TX prepare failure path (CVE-2026-64303)

    * kernel: mptcp: pm: userspace: fix use-after-free in get_local_id (CVE-2026-68169)

    * kernel: scsi: target: core: Fix iSCSI ISID use-after-free in REGISTER AND MOVE (CVE-2026-72083)

    * kernel: tipc: require net admin for TIPCv2 netlink mutators (CVE-2026-74283)

    * kernel: Bluetooth: mgmt: fix UAF in pair command cancellation (CVE-2026-74510)

    * kernel: packet: use consistent hard_header_len in non-ring send paths (CVE-2026-74582)

    * kernel: mptcp: options: reset DSS fields in case of unexpected size (CVE-2026-80586)

    * kernel: entry: Fix seccomp bypass after ptrace with TSYNC (CVE-2026-89603)

    * kernel: scsi: target: iscsi: Reserve a terminator byte for the login payload (CVE-2026-90011)

    * kernel: virtio-fs: avoid double-free on failed queue setup (CVE-2026-93827)

    * kernel: smb: client: bound dirent name against end of SMB response in cifs_filldir (CVE-2026-93787)

    * kernel: xfrm: hold net_device reference under RCU in bundle creation (CVE-2026-98364)

    * kernel: ipv4: free inet_opt and ireq_opt after an RCU grace period (CVE-2026-98432)

    * kernel: KVM: arm64: Transfer the hyp stack pages out of the host stage-2 (CVE-2026-98466)

    * kernel: nvmet-auth: fix out-of-bounds write in nvmet_auth_challenge() (CVE-2026-98725)

    * kernel: ZDI-CAN-33367: Linux Kernel skbuff skb_zerocopy Improper Ownership Management Local Privilege     Escalation Vulnerability ()

    Bug Fix(es) and Enhancement(s):

    * kernel panic in percpu_counter_add_batch() via submit_bio_noacct() due to NULL pointer     (JIRA:RHEL-250378)

    * ipv4: ip_gre: make ipgre_header() robust (rhel-9.8.z) (JIRA:RHEL-271127)

    * ip6_gre: make ip6gre_header() robust (rhel-9.8.z) (JIRA:RHEL-271130)

    * Backport sched: The newidle balance regression series to rhel 9.8 [rhel-9.8.z] (JIRA:RHEL-288067)

    * RHEL is missing support for conntrack zone filtering in dump/delete requests (9.10) [rhel-9.8.z]     (JIRA:RHEL-291352)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:93413 advisory.

    * kernel: Kernel: Denial of Service in network socket error handling (CVE-2026-22977)

    * kernel: x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (CVE-2026-46174)

    * kernel: i2c: stub: Reject I2C block transfers with invalid length (CVE-2026-64191)

    * kernel: Linux kernel: PPP over L2TP Use-After-Free vulnerability (CVE-2026-68398)

    * kernel: mptcp: pm: userspace: fix use-after-free in get_local_id (CVE-2026-68169)

    * kernel: tipc: require net admin for TIPCv2 netlink mutators (CVE-2026-74283)

    * kernel: mptcp: options: reset DSS fields in case of unexpected size (CVE-2026-80586)

    * kernel: entry: Fix seccomp bypass after ptrace with TSYNC (CVE-2026-89603)

    * kernel: KVM: nVMX: Always flush vpid02 on first use (CVE-2026-89932)

    * kernel: scsi: target: iscsi: Reserve a terminator byte for the login payload (CVE-2026-90011)

    * kernel: virtio-fs: avoid double-free on failed queue setup (CVE-2026-93827)

    * kernel: smb: client: bound dirent name against end of SMB response in cifs_filldir (CVE-2026-93787)

    * kernel: KEYS: encrypted: fix integer overflow of datablob_len (CVE-2026-98222)

    * kernel: xfrm: hold net_device reference under RCU in bundle creation (CVE-2026-98364)

    * kernel: ipv4: free inet_opt and ireq_opt after an RCU grace period (CVE-2026-98432)

    * kernel: nvmet-auth: fix out-of-bounds write in nvmet_auth_challenge() (CVE-2026-98725)

    Bug Fix(es) and Enhancement(s):

    * ipv4: ip_gre: make ipgre_header() robust (rhel-10.2.z) (JIRA:Rocky Linux-270702)

    * ip6_gre: make ip6gre_header() robust (rhel-10.2.z) (JIRA:Rocky Linux-270721)

    * Rocky Linux is missing support for conntrack zone filtering in dump/delete requests (10.4) [rhel-10.2.z]     (JIRA:Rocky Linux-291348)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:93412 advisory.

    * kernel: sctp: stream: fully roll back denied add-stream state (CVE-2026-52929)

    * kernel: ipv6: sit: reload inner IPv6 header after GSO offloads (CVE-2026-53228)

    * kernel: ipvs: clear the svc scheduler ptr early on edit (CVE-2026-53270)

    * kernel: spi: fsl-lpspi: terminate the RX channel on TX prepare failure path (CVE-2026-64303)

    * kernel: mptcp: pm: userspace: fix use-after-free in get_local_id (CVE-2026-68169)

    * kernel: scsi: target: core: Fix iSCSI ISID use-after-free in REGISTER AND MOVE (CVE-2026-72083)

    * kernel: tipc: require net admin for TIPCv2 netlink mutators (CVE-2026-74283)

    * kernel: Bluetooth: mgmt: fix UAF in pair command cancellation (CVE-2026-74510)

    * kernel: packet: use consistent hard_header_len in non-ring send paths (CVE-2026-74582)

    * kernel: mptcp: options: reset DSS fields in case of unexpected size (CVE-2026-80586)

    * kernel: entry: Fix seccomp bypass after ptrace with TSYNC (CVE-2026-89603)

    * kernel: scsi: target: iscsi: Reserve a terminator byte for the login payload (CVE-2026-90011)

    * kernel: virtio-fs: avoid double-free on failed queue setup (CVE-2026-93827)

    * kernel: smb: client: bound dirent name against end of SMB response in cifs_filldir (CVE-2026-93787)

    * kernel: xfrm: hold net_device reference under RCU in bundle creation (CVE-2026-98364)

    * kernel: ipv4: free inet_opt and ireq_opt after an RCU grace period (CVE-2026-98432)

    * kernel: KVM: arm64: Transfer the hyp stack pages out of the host stage-2 (CVE-2026-98466)

    * kernel: nvmet-auth: fix out-of-bounds write in nvmet_auth_challenge() (CVE-2026-98725)

    * kernel: ZDI-CAN-33367: Linux Kernel skbuff skb_zerocopy Improper Ownership Management Local Privilege     Escalation Vulnerability ()

    Bug Fix(es) and Enhancement(s):

    * kernel panic in percpu_counter_add_batch() via submit_bio_noacct() due to NULL pointer (JIRA:Rocky     Linux-250378)

    * ipv4: ip_gre: make ipgre_header() robust (rhel-9.8.z) (JIRA:Rocky Linux-271127)

    * ip6_gre: make ip6gre_header() robust (rhel-9.8.z) (JIRA:Rocky Linux-271130)

    * Backport sched: The newidle balance regression series to rhel 9.8 [rhel-9.8.z] (JIRA:Rocky     Linux-288067)

    * Rocky Linux is missing support for conntrack zone filtering in dump/delete requests (9.10) [rhel-9.8.z]     (JIRA:Rocky Linux-291352)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - xfrm: hold net_device reference under RCU in bundle creation xfrm_bundle_create() and     xfrm_create_dummy_bundle() read dst->dev into a local pointer without taking a device reference, then pass     it to xfrm_fill_dst(). A concurrent RTM_DELLINK replaces dst->dev via dst_dev_put() and frees the old     net_device, causing a use-after-free when xfrm6_fill_dst() later dereferences the stale dev pointer. BUG:
    KASAN: slab-use-after-free in xfrm6_fill_dst+0x82c/0x860 (net/ipv6/xfrm6_policy.c:86 netdev_hold()) Read     of size 8 at addr ffff8880142fe588 by task exploit/153 Call Trace: xfrm6_fill_dst+0x82c/0x860     xfrm_resolve_and_create_bundle+0x21d4/0x2bd0 xfrm_lookup_with_ifid+0x485/0x1640     ip6_dst_lookup_flow+0x19b/0x1e0 udpv6_sendmsg+0x1443/0x2dd0 Fix this by reading dst->dev via dst_dev_rcu()     and keeping the RCU read-side critical section active until xfrm_fill_dst() has taken the required device     references. (CVE-2026-98364)

Note that Nessus relies on the presence of the package as reported by the vendor.

The CentOS Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS6:CLSA-2026:1791949745 advisory.

  - In the Linux kernel, the following vulnerability has been resolved: HID: core: zero-initialize the report     buffer Since the report buffer is used by all kinds of drivers in various ways, let's zero-initialize it     during allocation to make sure that it can't be ever used to leak kernel memory via specially-crafted     report. (CVE-2024-50302)

  - In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Fix potential out-of-     bound accesses for Extigy and Mbox devices A bogus device can provide a bNumConfigurations value that     exceeds the initial value used in usb_get_configuration for allocating dev->config. This can lead to out-     of-bounds accesses later, e.g. in usb_destroy_configuration. (CVE-2024-53197)

  - In the Linux kernel, the following vulnerability has been resolved: smb: client: reject userspace     cifs.spnego descriptions cifs.spnego key descriptions contain authority-bearing fields such as pid, uid,     creduid, and upcall_target that cifs.upcall treats as kernel-originating inputs. However, userspace can     also create keys of this type through request_key(2) or add_key(2), allowing those fields to be supplied     without CIFS origin. Only accept cifs.spnego descriptions while CIFS is using its private spnego_cred to     request the key. (CVE-2026-46243)

  - In the Linux kernel, the following vulnerability has been resolved: Bluetooth: serialize accept_q access     bt_sock_poll() walks the accept queue without synchronization, while child teardown can unlink the same     socket and drop its last reference. The unsynchronized accept queue walk has existed since the initial     Bluetooth import. Protect accept_q with a dedicated lock for queue updates and polling. Also rework     bt_accept_dequeue() to take temporary child references under the queue lock before dropping it and locking     the child socket. (CVE-2026-52918)

  - In the Linux kernel, the following vulnerability has been resolved: netfilter: bridge: make ebt_snat ARP     rewrite writable The ebtables SNAT target keeps the Ethernet source address rewrite behind     skb_ensure_writable(skb, 0). This is intentional: at the bridge ebtables hooks the Ethernet header is     addressed through skb_mac_header()/eth_hdr(), while skb->data points at the Ethernet payload. Asking     skb_ensure_writable() for ETH_HLEN bytes would check the payload, not the Ethernet header, and would     reintroduce the small packet regression fixed by commit 63137bc5882a. However, the optional ARP sender     hardware address rewrite is different. It writes through skb_store_bits() at an offset relative to     skb->data: skb_store_bits(skb, sizeof(struct arphdr), info->mac, ETH_ALEN) skb_header_pointer() only     safely reads the ARP header; it does not make the later sender hardware address range writable. If that     range is still held in a nonlinear skb fragment backed by a splice-imported file page, skb_store_bits()     maps the frag page and copies the new MAC address directly into it. Ensure the ARP SHA range is writable     before reading the ARP header and before calling skb_store_bits(). (CVE-2026-53266)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The CentOS Linux 8.5 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS8.5:CLSA-2026:1792750763 advisory.

  - In the Linux kernel, the following vulnerability has been resolved: RDMA: Fix use-after-free in     rxe_queue_cleanup On error handling path in rxe_qp_from_init() qp->sq.queue is freed and then     rxe_create_qp() will drop last reference to this object. qp clean up function will try to free this queue     one time and it causes UAF bug. Fix it by zeroing queue pointer after freeing queue in rxe_qp_from_init().
    (CVE-2021-47616)

  - In the Linux kernel, the following vulnerability has been resolved: mrp: introduce active flags to prevent     UAF when applicant uninit The caller of del_timer_sync must prevent restarting of the timer, If we have no     this synchronization, there is a small probability that the cancellation will not be successful. And     syzbot report the fellowing crash: ================================================================== BUG:
    KASAN: use-after-free in hlist_add_head include/linux/list.h:929 [inline] BUG: KASAN: use-after-free in     enqueue_timer+0x18/0xa4 kernel/time/timer.c:605 Write at addr f9ff000024df6058 by task syz-fuzzer/2256     Pointer tag: [f9], memory tag: [fe] CPU: 1 PID: 2256 Comm: syz-fuzzer Not tainted     6.1.0-rc5-syzkaller-00008- ge01d50cbd6ee #0 Hardware name: linux,dummy-virt (DT) Call trace:
    dump_backtrace.part.0+0xe0/0xf0 arch/arm64/kernel/stacktrace.c:156 dump_backtrace     arch/arm64/kernel/stacktrace.c:162 [inline] show_stack+0x18/0x40 arch/arm64/kernel/stacktrace.c:163
    __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x68/0x84 lib/dump_stack.c:106     print_address_description mm/kasan/report.c:284 [inline] print_report+0x1a8/0x4a0 mm/kasan/report.c:395     kasan_report+0x94/0xb4 mm/kasan/report.c:495 __do_kernel_fault+0x164/0x1e0 arch/arm64/mm/fault.c:320     do_bad_area arch/arm64/mm/fault.c:473 [inline] do_tag_check_fault+0x78/0x8c arch/arm64/mm/fault.c:749     do_mem_abort+0x44/0x94 arch/arm64/mm/fault.c:825 el1_abort+0x40/0x60 arch/arm64/kernel/entry-common.c:367     el1h_64_sync_handler+0xd8/0xe4 arch/arm64/kernel/entry-common.c:427 el1h_64_sync+0x64/0x68     arch/arm64/kernel/entry.S:576 hlist_add_head include/linux/list.h:929 [inline] enqueue_timer+0x18/0xa4     kernel/time/timer.c:605 mod_timer+0x14/0x20 kernel/time/timer.c:1161 mrp_periodic_timer_arm     net/802/mrp.c:614 [inline] mrp_periodic_timer+0xa0/0xc0 net/802/mrp.c:627     call_timer_fn.constprop.0+0x24/0x80 kernel/time/timer.c:1474 expire_timers+0x98/0xc4     kernel/time/timer.c:1519 To fix it, we can introduce a new active flags to make sure the timer will not     restart. (CVE-2022-50697)

  - In the Linux kernel, the following vulnerability has been resolved: mm/khugepaged: fix ->anon_vma race If     an ->anon_vma is attached to the VMA, collapse_and_free_pmd() requires it to be locked. Page table     traversal is allowed under any one of the mmap lock, the anon_vma lock (if the VMA is associated with an     anon_vma), and the mapping lock (if the VMA is associated with a mapping); and so to be able to remove     page tables, we must hold all three of them. retract_page_tables() bails out if an ->anon_vma is attached,     but does this check before holding the mmap lock (as the comment above the check explains). If we racily     merged an existing ->anon_vma (shared with a child process) from a neighboring VMA, subsequent rmap     traversals on pages belonging to the child will be able to see the page tables that we are concurrently     removing while assuming that nothing else can access them. Repeat the ->anon_vma check once we hold the     mmap lock to ensure that there really is no concurrent page table access. Hitting this bug causes a     lockdep warning in collapse_and_free_pmd(), in the line     lockdep_assert_held_write(&vma->anon_vma->root->rwsem). It can also lead to use-after-free access.
    (CVE-2023-52935)

  - In the Linux kernel, the following vulnerability has been resolved: SUNRPC: make sure cache entry active     before cache_show The function `c_show` was called with protection from RCU. This only ensures that `cp`     will not be freed. Therefore, the reference count for `cp` can drop to zero, which will trigger a refcount     use-after-free warning when `cache_get` is called. To resolve this issue, use `cache_get_rcu` to ensure     that `cp` remains active. ------------[ cut here ]------------ refcount_t: addition on 0; use-after-free.
    WARNING: CPU: 7 PID: 822 at lib/refcount.c:25 refcount_warn_saturate+0xb1/0x120 CPU: 7 UID: 0 PID: 822     Comm: cat Not tainted 6.12.0-rc3+ #1 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS     1.16.1-2.fc37 04/01/2014 RIP: 0010:refcount_warn_saturate+0xb1/0x120 Call Trace: <TASK> c_show+0x2fc/0x380     [sunrpc] seq_read_iter+0x589/0x770 seq_read+0x1e5/0x270 proc_reg_read+0xe1/0x140 vfs_read+0x125/0x530     ksys_read+0xc1/0x160 do_syscall_64+0x5f/0x170 entry_SYSCALL_64_after_hwframe+0x76/0x7e (CVE-2024-53174)

  - In the Linux kernel, the following vulnerability has been resolved: net: skbuff: propagate shared-frag     marker through frag-transfer helpers Two frag-transfer helpers (__pskb_copy_fclone() and skb_shift()) fail     to propagate the SKBFL_SHARED_FRAG bit in skb_shinfo()->flags when moving frags from source to     destination. __pskb_copy_fclone() defers the rest of the shinfo metadata to skb_copy_header() after     copying frag descriptors, but that helper only carries over gso_{size,segs, type} and never touches     skb_shinfo()->flags; skb_shift() moves frag descriptors directly and leaves flags untouched. As a result,     the destination skb keeps a reference to the same externally-owned or page-cache-backed pages while     reporting skb_has_shared_frag() as false. The mismatch is harmful in any in-place writer that uses     skb_has_shared_frag() to decide whether shared pages must be detoured through skb_cow_data(). ESP input is     one such writer (esp4.c, esp6.c), and a single nft 'dup to <local>' rule -- or any other nf_dup_ipv4() /     xt_TEE caller -- is enough to land a pskb_copy()'d skb in esp_input() with the marker stripped, letting an     unprivileged user write into the page cache of a root-owned read-only file via authencesn-ESN stray     writes. Set SKBFL_SHARED_FRAG on the destination whenever frag descriptors were actually moved from the     source. skb_copy() and skb_copy_expand() share skb_copy_header() too but linearize all paged data into     freshly allocated head storage and emerge with nr_frags == 0, so skb_has_shared_frag() returns false on     its own; they need no change. The same omission exists in skb_gro_receive() and skb_gro_receive_list().
    The former moves the incoming skb's frag descriptors into the accumulator's last sub-skb via two paths (a     direct frag-move loop and the head_frag + memcpy path); the latter chains the incoming skb whole onto p's     frag_list. Downstream skb_segment() reads only skb_shinfo(p)->flags, and skb_segment_list() reuses each     sub-skb's shinfo as the nskb -- both p and lp must carry the marker. The same omission also exists in     tcp_clone_payload(), which builds an MTU probe skb by moving frag descriptors from skbs on sk_write_queue     into a freshly allocated nskb. The helper falls into the same family and warrants the same fix for     consistency; no TCP TX-side in-place writer is currently known to reach a user page through this gap, but     a future consumer depending on the marker would regress silently. The same omission exists in     skb_segment(): the per-iteration flag merge takes only head_skb's flag, and the inner switch that rebinds     frag_skb to list_skb on head_skb-frags exhaustion does not fold the new frag_skb's flag into nskb. Fold     frag_skb's flag at both sites so segments drawing frags from frag_list members carry the marker.
    (CVE-2026-43503)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-93412 advisory.

    - ipv4: free inet_opt and ireq_opt after an RCU grace period (CKI Backport Bot) [RHEL-295635]     {CVE-2026-98432}
    - nvmet-auth: fix out-of-bounds write in nvmet_auth_challenge() (Maurizio Lombardi) [RHEL-290719]     {CVE-2026-98725}
    - spi: fsl-lpspi: terminate the RX channel on TX prepare failure path (Iker Pedrosa) [RHEL-234297]     {CVE-2026-64303}
    - spi: fsl-lpspi: replace dmaengine_terminate_all() with dmaengine_terminate_sync() (Iker Pedrosa)     [RHEL-234297] {CVE-2026-64303}
    - xfrm: hold net_device reference under RCU in bundle creation (Abhishek Rawal) [RHEL-277984]     {CVE-2026-98364}
    - entry: Fix seccomp bypass after ptrace with TSYNC (Audra Mitchell) [RHEL-271399] {CVE-2026-89603}
    - smb: client: bound dirent name against end of SMB response in cifs_filldir (CKI Backport Bot)     [RHEL-278331] {CVE-2026-93787}
    - sctp: stream: fully roll back denied add-stream state (CKI Backport Bot) [RHEL-277123] {CVE-2026-52929}
    - tipc: require net admin for TIPCv2 netlink mutators (CKI Backport Bot) [RHEL-273181] {CVE-2026-74283}
    - Bluetooth: mgmt: fix UAF in pair command cancellation (CKI Backport Bot) [RHEL-254650] {CVE-2026-74510}
    - ipvs: clear the svc scheduler ptr early on edit (CKI Backport Bot) [RHEL-225993] {CVE-2026-53270}
    - KVM: arm64: Transfer the hyp stack pages out of the host stage-2 (CKI Backport Bot) [RHEL-287053]     {CVE-2026-98466}
    - mptcp: pm: userspace: fix use-after-free in get_local_id (Prasenjit Mukherjee) [RHEL-236687]     {CVE-2026-68169}
    - mptcp: options: reset DSS fields in case of unexpected size (Prasenjit Mukherjee) [RHEL-250609]     {CVE-2026-80586}
    - virtio-fs: avoid double-free on failed queue setup (Miklos Szeredi) [RHEL-278131] {CVE-2026-93827}
    - scsi: target: iscsi: Reserve a terminator byte for the login payload (CKI Backport Bot) [RHEL-285602]     {CVE-2026-90011}
    - scsi: target: core: Fix iSCSI ISID use-after-free in REGISTER AND MOVE (CKI Backport Bot) [RHEL-283505]     {CVE-2026-72083}
    - packet: use consistent hard_header_len in non-ring send paths (Toke Hoiland-Jorgensen) [RHEL-244551]     {CVE-2026-74582}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-2261:117 advisory.

    * kernel: sctp: stream: fully roll back denied add-stream state (CVE-2026-52929)
      * kernel: ipv6: sit: reload inner IPv6 header after GSO offloads (CVE-2026-53228)
      * kernel: ipvs: clear the svc scheduler ptr early on edit (CVE-2026-53270)
      * kernel: spi: fsl-lpspi: terminate the RX channel on TX prepare failure path (CVE-2026-64303)
      * kernel: mptcp: pm: userspace: fix use-after-free in get_local_id (CVE-2026-68169)
      * kernel: scsi: target: core: Fix iSCSI ISID use-after-free in REGISTER AND MOVE (CVE-2026-72083)
      * kernel: tipc: require net admin for TIPCv2 netlink mutators (CVE-2026-74283)
      * kernel: Bluetooth: mgmt: fix UAF in pair command cancellation (CVE-2026-74510)
      * kernel: packet: use consistent hard_header_len in non-ring send paths (CVE-2026-74582)
      * kernel: mptcp: options: reset DSS fields in case of unexpected size (CVE-2026-80586)
      * kernel: entry: Fix seccomp bypass after ptrace with TSYNC (CVE-2026-89603)
      * kernel: scsi: target: iscsi: Reserve a terminator byte for the login payload (CVE-2026-90011)
      * kernel: virtio-fs: avoid double-free on failed queue setup (CVE-2026-93827)
      * kernel: smb: client: bound dirent name against end of SMB response in cifs_filldir (CVE-2026-93787)
      * kernel: xfrm: hold net_device reference under RCU in bundle creation (CVE-2026-98364)
      * kernel: ipv4: free inet_opt and ireq_opt after an RCU grace period (CVE-2026-98432)
      * kernel: KVM: arm64: Transfer the hyp stack pages out of the host stage-2 (CVE-2026-98466)
      * kernel: nvmet-auth: fix out-of-bounds write in nvmet_auth_challenge() (CVE-2026-98725)
      * kernel: ZDI-CAN-33367: Linux Kernel skbuff skb_zerocopy Improper Ownership Management Local Privilege     Escalation Vulnerability ()

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名前	製品	ファミリー	公開日	更新日	深刻度
374859	RHEL 9 : kernel (RHSA-2026:93412)	Nessus	Red Hat Local Security Checks	2026/11/1	2026/11/5	critical
375443	RockyLinux 10 : kernel (RLSA-2026:93413)	Nessus	Rocky Linux Local Security Checks	2026/11/3	2026/11/9	medium
375444	RockyLinux 9 : kernel (RLSA-2026:93412)	Nessus	Rocky Linux Local Security Checks	2026/11/3	2026/11/9	critical
363245	Linux Distros Unpatched Vulnerability : CVE-2026-98364	Nessus	Misc.	2026/10/6	2026/11/5	high
367921	CentOS Linux 6 [TuxCare] Security Update: kernel / kernel-abi-whitelists / kernel-debug / kernel-debug-devel / etc Multiple Vulnerabilities (CENTOS6:CLSA-2026:1791949745)	Nessus	CentOS Local Security Checks	2026/10/20	2026/10/22	high
371224	CentOS Linux 8.5 [TuxCare] Security Update: bpftool / kernel / kernel-core / kernel-cross-headers / etc Multiple Vulnerabilities (CENTOS8.5:CLSA-2026:1792750763)	Nessus	CentOS Local Security Checks	2026/10/23	2026/10/26	high
375516	Oracle Linux 9 : kernel (ELSA-2026-93412)	Nessus	Oracle Linux Local Security Checks	2026/11/3	2026/11/3	critical
376292	MiracleLinux 9 : kernel-5.14.0-687.64.1.el9_8 (AXSA:2026-2261:117)	Nessus	Miracle Linux Local Security Checks	2026/11/5	2026/11/9	critical

検出

プラグインの検索

critical

medium

critical

high

high

high

critical

critical