The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:82806 advisory.

    The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with     extremely high determinism requirements.

    Security Fix(es):

    * kernel: openvswitch: defer tunnel netdev_put to RCU release (CVE-2026-31678)

    * kernel: ipv6: validate extension header length before copying to cmsg (CVE-2026-63920)

    * kernel: drm/amd/display: set new_stream to NULL after release (CVE-2026-68236)

    * kernel: drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CVE-2026-68278)

    * kernel: wifi: mac80211: defer link RX stats percpu free to RCU (CVE-2026-68409)

    * kernel: drm/amdgpu/vce: fix integer overflow in image size (CVE-2026-68108)

    * kernel: drm/vmwgfx: use check_add_overflow for shader size+offset bound (CVE-2026-80887)

    * kernel: drm/amdkfd: Add TLB flush after MES queue eviction/suspension (CVE-2026-89811)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:82807 advisory.

    * kernel: openvswitch: defer tunnel netdev_put to RCU release (CVE-2026-31678)
      * kernel: ipv6: validate extension header length before copying to cmsg (CVE-2026-63920)
      * kernel: drm/amd/display: set new_stream to NULL after release (CVE-2026-68236)
      * kernel: drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CVE-2026-68278)
      * kernel: wifi: mac80211: defer link RX stats percpu free to RCU (CVE-2026-68409)
      * kernel: drm/amdgpu/vce: fix integer overflow in image size (CVE-2026-68108)
      * kernel: cifs: validate DFS referral string offsets (CVE-2026-72318)
      * kernel: drm/vmwgfx: use check_add_overflow for shader size+offset bound (CVE-2026-80887)
      * kernel: drm/amdkfd: Add TLB flush after MES queue eviction/suspension (CVE-2026-89811)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:82806 advisory.

    * kernel: openvswitch: defer tunnel netdev_put to RCU release (CVE-2026-31678)

    * kernel: ipv6: validate extension header length before copying to cmsg (CVE-2026-63920)

    * kernel: drm/amd/display: set new_stream to NULL after release (CVE-2026-68236)

    * kernel: drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CVE-2026-68278)

    * kernel: wifi: mac80211: defer link RX stats percpu free to RCU (CVE-2026-68409)

    * kernel: drm/amdgpu/vce: fix integer overflow in image size (CVE-2026-68108)

    * kernel: drm/vmwgfx: use check_add_overflow for shader size+offset bound (CVE-2026-80887)

    * kernel: drm/amdkfd: Add TLB flush after MES queue eviction/suspension (CVE-2026-89811)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:82807 advisory.

    * kernel: openvswitch: defer tunnel netdev_put to RCU release (CVE-2026-31678)

    * kernel: ipv6: validate extension header length before copying to cmsg (CVE-2026-63920)

    * kernel: drm/amd/display: set new_stream to NULL after release (CVE-2026-68236)

    * kernel: drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CVE-2026-68278)

    * kernel: wifi: mac80211: defer link RX stats percpu free to RCU (CVE-2026-68409)

    * kernel: drm/amdgpu/vce: fix integer overflow in image size (CVE-2026-68108)

    * kernel: cifs: validate DFS referral string offsets (CVE-2026-72318)

    * kernel: drm/vmwgfx: use check_add_overflow for shader size+offset bound (CVE-2026-80887)

    * kernel: drm/amdkfd: Add TLB flush after MES queue eviction/suspension (CVE-2026-89811)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:65334 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CVE-2026-43133)

    * kernel: Bluetooth: SMP: force responder MITM requirements before building the pairing response     (CVE-2026-43334)

    * kernel: Bluetooth: virtio_bt: clamp rx length before skb_put (CVE-2026-46123)

    * kernel: Bluetooth: serialize accept_q access (CVE-2026-52918)

    * kernel: net: pull headers in qdisc_pkt_len_segs_init() (CVE-2026-53091)

    * kernel: Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CVE-2026-53072)

    * kernel: net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (CVE-2026-52947)

    * kernel: Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CVE-2026-53256)

    * kernel: wifi: nl80211: reject oversized EMA RNR lists (CVE-2026-53182)

    * kernel: Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CVE-2026-53209)

    * kernel: Bluetooth: RFCOMM: validate skb length in MCC handlers (CVE-2026-53254)

    * kernel: vfio/pci: Clean up DMABUFs before disabling function (CVE-2026-53322)

    * kernel: Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CVE-2026-63975)

    * kernel: security/keys: fix missed RCU read section on lookup (CVE-2026-64015)

    * kernel: Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CVE-2026-63947)

    * kernel: Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CVE-2026-63944)

    * kernel: Bluetooth: ISO: fix UAF in iso_recv_frame (CVE-2026-63946)

    * kernel: wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (CVE-2026-64117)

    * kernel: wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (CVE-2026-64037)

    * kernel: ixgbevf: fix use-after-free in VEPA multicast source pruning (CVE-2026-64113)

    * kernel: vfio/pci: Check BAR resources before exporting a DMABUF (CVE-2026-64042)

    * kernel: accel/qaic: Add overflow check to remap_pfn_range during mmap (CVE-2026-64051)

    * kernel: wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (CVE-2026-64255)

    * kernel: wifi: mac80211: fix MLE defragmentation (CVE-2026-64515)

    * kernel: wifi: mac80211: defer link RX stats percpu free to RCU (CVE-2026-68409)

    * kernel: wifi: mt76: mt7925: fix crash in reset link replay (CVE-2026-68307)

    * kernel: wifi: mt76: mt7925: drop TXRX_NOTIFY on non-mmio buses (CVE-2026-68193)

    * kernel: dm-verity: fix buffer overflow in FEC calculation (CVE-2026-72098)

    * kernel: nvmet-rdma: handle inline data with a nonzero offset (CVE-2026-72129)

    Bug Fix(es) and Enhancement(s):

    * rtla-timerlat-top doesn't stop properly when threshold is reached on multiple CPUs at once [rhel-10.2.z]     (JIRA:RHEL-193027)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Rocky Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-2026_65334 advisory.

    * kernel: KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CVE-2026-43133)

    * kernel: Bluetooth: SMP: force responder MITM requirements before building the pairing response     (CVE-2026-43334)

    * kernel: Bluetooth: virtio_bt: clamp rx length before skb_put (CVE-2026-46123)

    * kernel: Bluetooth: serialize accept_q access (CVE-2026-52918)

    * kernel: net: pull headers in qdisc_pkt_len_segs_init() (CVE-2026-53091)

    * kernel: Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CVE-2026-53072)

    * kernel: net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (CVE-2026-52947)

    * kernel: Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CVE-2026-53256)

    * kernel: wifi: nl80211: reject oversized EMA RNR lists (CVE-2026-53182)

    * kernel: Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CVE-2026-53209)

    * kernel: Bluetooth: RFCOMM: validate skb length in MCC handlers (CVE-2026-53254)

    * kernel: vfio/pci: Clean up DMABUFs before disabling function (CVE-2026-53322)

    * kernel: Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CVE-2026-63975)

    * kernel: security/keys: fix missed RCU read section on lookup (CVE-2026-64015)

    * kernel: Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CVE-2026-63947)

    * kernel: Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CVE-2026-63944)

    * kernel: Bluetooth: ISO: fix UAF in iso_recv_frame (CVE-2026-63946)

    * kernel: wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (CVE-2026-64117)

    * kernel: wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (CVE-2026-64037)

    * kernel: ixgbevf: fix use-after-free in VEPA multicast source pruning (CVE-2026-64113)

    * kernel: vfio/pci: Check BAR resources before exporting a DMABUF (CVE-2026-64042)

    * kernel: accel/qaic: Add overflow check to remap_pfn_range during mmap (CVE-2026-64051)

    * kernel: wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (CVE-2026-64255)

    * kernel: wifi: mac80211: fix MLE defragmentation (CVE-2026-64515)

    * kernel: wifi: mac80211: defer link RX stats percpu free to RCU (CVE-2026-68409)

    * kernel: wifi: mt76: mt7925: fix crash in reset link replay (CVE-2026-68307)

    * kernel: wifi: mt76: mt7925: drop TXRX_NOTIFY on non-mmio buses (CVE-2026-68193)

    * kernel: dm-verity: fix buffer overflow in FEC calculation (CVE-2026-72098)

    * kernel: nvmet-rdma: handle inline data with a nonzero offset (CVE-2026-72129)

    Bug Fix(es) and Enhancement(s):

    * rtla-timerlat-top doesn't stop properly when threshold is reached on multiple CPUs at once [rhel-10.2.z]     (JIRA:Rocky Linux-193027)

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:83156 advisory.

    * kernel: net/sched: act_ct: Only release RCU read lock after ct_ft (CVE-2026-46319)

    * kernel: net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CVE-2026-53011)

    * kernel: wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (CVE-2026-64030)

    * kernel: wifi: cfg80211: use wiphy work for socket owner autodisconnect (CVE-2026-68404)

    * kernel: Linux kernel: Denial of Service due to use-after-free in act_tunnel_key (CVE-2026-68377)

    * kernel: net/iucv: fix use-after-free of a severed iucv_path (CVE-2026-68140)

    * kernel: wifi: mac80211: defer link RX stats percpu free to RCU (CVE-2026-68409)

    * kernel: KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling     (CVE-2026-72288)

    * kernel: ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CVE-2026-72262)

    * kernel: netfilter: nft_lookup: fix catchall element handling with inverted lookups (CVE-2026-72320)

    * kernel: ALSA: usx2y: bound the hwdep mmap fault offset (CVE-2026-74641)

    * kernel: udp: fix potential use-after-free in tunnel segmentation (CVE-2026-74705)

    * kernel: net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (CVE-2026-80985)

    * kernel: svcrdma: Validate Read chunk positions before reconstruction (CVE-2026-89526)

    * kernel: net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CVE-2026-81003)

    * kernel: NFSD: Prevent client use-after-free during blocked-lock reaping (CVE-2026-90036)

    * kernel: SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (CVE-2026-93207)

    * kernel: svcrdma: Reject Write/Reply chunks with segcount 0 (CVE-2026-93228)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-82807 advisory.

    - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (Jocelyn Falempe) [RHEL-262108]     {CVE-2026-89811}
    - drm/amd/display: set new_stream to NULL after release (Jocelyn Falempe) [RHEL-260521] {CVE-2026-68236}
    - drm/vmwgfx: use check_add_overflow for shader size+offset bound (Jocelyn Falempe) [RHEL-258131]     {CVE-2026-80887}
    - drm/amdgpu/vce: fix integer overflow in image size (Jocelyn Falempe) [RHEL-237823 RHEL-268877]     {CVE-2026-68108}
    - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (Jocelyn Falempe) [RHEL-240862]     {CVE-2026-68278}
    - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225371]     {CVE-2026-63920}
    - wifi: mac80211: defer link RX stats percpu free to RCU (CKI Backport Bot) [RHEL-263760] {CVE-2026-68409}
    - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261990] {CVE-2026-72318}
    - openvswitch: vport: fix self-deadlock on release of tunnel ports (Timothy Redaelli) [RHEL-253844]     {CVE-2026-31678}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The AlmaLinux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1793866396 advisory.

  - In the Linux kernel, the following vulnerability has been resolved: rv: Use strings in da monitors     tracepoints Using DA monitors tracepoints with KASAN enabled triggers the following warning: BUG: KASAN:
    global-out-of-bounds in do_trace_event_raw_event_event_da_monitor+0xd6/0x1a0 Read of size 32 at addr     ffffffffaada8980 by task ... Call Trace: <TASK> [...] do_trace_event_raw_event_event_da_monitor+0xd6/0x1a0     ? __pfx_do_trace_event_raw_event_event_da_monitor+0x10/0x10 ? trace_event_sncid+0x83/0x200     trace_event_sncid+0x163/0x200 [...] The buggy address belongs to the variable: automaton_snep+0x4e0/0x5e0     This is caused by the tracepoints reading 32 bytes __array instead of __string from the automata     definition. Such strings are literals and reading 32 bytes ends up in out of bound memory accesses (e.g.
    the next automaton's data in this case). The error is harmless as, while printing the string, we stop at     the null terminator, but it should still be fixed. Use the __string facilities while defining the     tracepoints to avoid reading out of bound memory. (CVE-2025-38636)

  - In the Linux kernel, the following vulnerability has been resolved: iommufd: Prevent ALIGN() overflow When     allocating IOVA the candidate range gets aligned to the target alignment. If the range is close to     ULONG_MAX then the ALIGN() can wrap resulting in a corrupted iova. Open code the ALIGN() using     get_add_overflow() to prevent this. This simplifies the checks as we don't need to check for length     earlier either. Consolidate the two copies of this code under a single helper. This bug would allow     userspace to create a mapping that overlaps with some other mapping or a reserved range. (CVE-2025-38688)

  - In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: fix NULL dereference in     ath11k_qmi_m3_load() If ab->fw.m3_data points to data, then fw pointer remains null. Further, if m3_mem is     not allocated, then fw is dereferenced to be passed to ath11k_err function. Replace fw->size by m3_len.
    Found by Linux Verification Center (linuxtesting.org) with SVACE. (CVE-2025-39991)

  - In the Linux kernel, the following vulnerability has been resolved: libceph: prevent potential out-of-     bounds writes in handle_auth_session_key() The len field originates from untrusted network packets.
    Boundary checks have been added to prevent potential out-of-bounds writes when decrypting the connection     secret or processing service tickets. [ idryomov: changelog ] (CVE-2025-68284)

  - In the Linux kernel, the following vulnerability has been resolved: tipc: fix bc_ackers underflow on     duplicate GRP_ACK_MSG The GRP_ACK_MSG handler in tipc_group_proto_rcv() currently decrements bc_ackers on     every inbound group ACK, even when the same member has already acknowledged the current broadcast round.
    Because bc_ackers is a u16, a duplicate ACK received after the last legitimate ACK wraps the counter to     65535. Once wrapped, tipc_group_bc_cong() keeps reporting congestion and later group broadcasts on the     affected socket stay blocked until the group is recreated. Fix this by ignoring duplicate or stale ACKs     before touching bc_acked or bc_ackers. This makes repeated GRP_ACK_MSG handling idempotent and prevents     the underflow path. (CVE-2026-31662)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名前	製品	ファミリー	公開日	更新日	深刻度
365583	RHEL 8 : kernel-rt (RHSA-2026:82806)	Nessus	Red Hat Local Security Checks	2026/10/14	2026/10/14	high
365610	AlmaLinux 8 : kernel (ALSA-2026:82807)	Nessus	Alma Linux Local Security Checks	2026/10/14	2026/10/14	critical
366113	RockyLinux 8 : kernel-rt (RLSA-2026:82806)	Nessus	Rocky Linux Local Security Checks	2026/10/15	2026/10/15	high
366116	RockyLinux 8 : kernel (RLSA-2026:82807)	Nessus	Rocky Linux Local Security Checks	2026/10/15	2026/10/15	critical
343886	RHEL 10 : kernel (RHSA-2026:65334)	Nessus	Red Hat Local Security Checks	2026/9/8	2026/9/8	critical
353741	Rocky Linux 10 [CIQ] Security Update: kernel / kernel-64k / kernel-64k-core / kernel-64k-debug / etc Multiple Vulnerabilities (crlsa-2026_65334)	Nessus	Rocky Linux Local Security Checks	2026/10/1	2026/10/1	critical
365768	Ubuntu 26.04 LTS : Linux kernel (Azure) vulnerabilities (USN-8888-1)	Nessus	Ubuntu Local Security Checks	2026/10/14	2026/10/14	medium
366496	RockyLinux 9 : kernel (RLSA-2026:83156)	Nessus	Rocky Linux Local Security Checks	2026/10/16	2026/10/16	critical
366692	Oracle Linux 8 : kernel (ELSA-2026-82807)	Nessus	Oracle Linux Local Security Checks	2026/10/16	2026/10/16	critical
376433	AlmaLinux 9.6 [TuxCare] Security Update: kernel / kernel-64k / kernel-64k-core / kernel-64k-debug / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1793866396)	Nessus	Alma Linux Local Security Checks	2026/11/5	2026/11/5	high

検出

プラグインの検索

high

critical

high

critical

critical

critical

medium

critical

critical

high