The CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS7:CLSA-2026:1768110920 advisory.

  - A flaw use after free in the Linux kernel NILFS file system was found in the way user triggers function     security_inode_alloc to fail with following call to function nilfs_mdt_destroy. A local user could use     this flaw to crash the system or potentially escalate their privileges on the system. (CVE-2022-2978)

  - The Linux kernel NFSD implementation prior to versions 5.19.17 and 6.0.2 are vulnerable to buffer     overflow. NFSD tracks the number of pages held by each NFSD thread by combining the receive and send     buffers of a remote procedure call (RPC) into a single array of pages. A client can force the send buffer     to shrink by sending an RPC message over TCP with garbage data added at the end of the message. The RPC     message with garbage data is still correctly formed according to the specification and is passed forward     to handlers. Vulnerable code in NFSD is not expecting the oversized request and writes beyond the     allocated buffer space. CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H (CVE-2022-43945)

  - In the Linux kernel, the following vulnerability has been resolved: fs: fix UAF/GPF bug in     nilfs_mdt_destroy In alloc_inode, inode_init_always() could return -ENOMEM if security_inode_alloc()     fails, which causes inode->i_private uninitialized. Then nilfs_is_metadata_file_inode() returns true and     nilfs_free_inode() wrongly calls nilfs_mdt_destroy(), which frees the uninitialized inode->i_private and     leads to crashes(e.g., UAF/GPF). Fix this by moving security_inode_alloc just prior to     this_cpu_inc(nr_inodes) (CVE-2022-50367)

  - In the Linux kernel, the following vulnerability has been resolved: NFSD: Protect against send buffer     overflow in NFSv2 READ Since before the git era, NFSD has conserved the number of pages held by each nfsd     thread by combining the RPC receive and send buffers into a single array of pages. This works because     there are no cases where an operation needs a large RPC Call message and a large RPC Reply at the same     time. Once an RPC Call has been received, svc_process() updates svc_rqst::rq_res to describe the part of     rq_pages that can be used for constructing the Reply. This means that the send buffer (rq_res) shrinks     when the received RPC record containing the RPC Call is large. A client can force this shrinkage on TCP by     sending a correctly- formed RPC Call header contained in an RPC record that is excessively large. The full     maximum payload size cannot be constructed in that case. (CVE-2022-50410)

  - In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Wait for io return on     terminate rport System crash due to use after free. Current code allows terminate_rport_io to exit before     making sure all IOs has returned. For FCP-2 device, IO's can hang on in HW because driver has not tear     down the session in FW at first sign of cable pull. When dev_loss_tmo timer pops, terminate_rport_io is     called and upper layer is about to free various resources. Terminate_rport_io trigger qla to do the final     cleanup, but the cleanup might not be fast enough where it leave qla still holding on to the same     resource. Wait for IO's to return to upper layer before resources are freed. (CVE-2023-53322)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 10 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2025-20530 advisory.

    - sunrpc: handle SVC_GARBAGE during svc auth processing as auth error (Jeff Layton)  [Orabug: 38137447]     {CVE-2025-38089}
    - Add Zen34 clients (Borislav Petkov (AMD))  [Orabug: 38172252]  {CVE-2024-36350} {CVE-2024-36357}
    - x86/process: Move the buffer clearing before MONITOR (Kim Phillips)  [Orabug: 38172252]     {CVE-2024-36350} {CVE-2024-36357}
    - Add normal counters (Borislav Petkov (AMD))  [Orabug: 38172252]  {CVE-2024-36350} {CVE-2024-36357}
    - KVM: SVM: Advertize TSA CPUID bits to guests (Borislav Petkov (AMD))  [Orabug: 38172252]     {CVE-2024-36350} {CVE-2024-36357}
    - x86/bugs: Add a Transient Scheduler Attacks mitigation (Borislav Petkov (AMD))  [Orabug: 38172252]     {CVE-2024-36350} {CVE-2024-36357}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:98608 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: virt: tdx-guest: Just leak decrypted memory on unrecoverable errors (CVE-2024-57793)

    * kernel: OPP: add index check to assert to avoid buffer overflow in _read_freq() (CVE-2024-57998)

    * kernel: can: bcm: add locking for bcm_op runtime updates (CVE-2025-38004)

    * kernel: calipso: Don't call calipso functions for AF_INET sk. (CVE-2025-38147)

    * kernel: openvswitch: defer tunnel netdev_put to RCU release (CVE-2026-31678)

    * kernel: vhost: move vdpa group bound check to vhost_vdpa (CVE-2026-43248)

    * kernel: KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (CVE-2026-46076)

    * kernel: RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CVE-2026-46176)

    * kernel: net/sched: act_ct: Only release RCU read lock after ct_ft (CVE-2026-46319)

    * kernel: net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CVE-2026-53011)

    * kernel: net/sched: act_api: use RCU with deferred freeing for action lifecycle (CVE-2026-53264)

    * kernel: af_unix: Set gc_in_progress to true in unix_gc() (CVE-2026-53361)

    * kernel: vsock/virtio: fix zerocopy completion for multi-skb sends (CVE-2026-53365)

    * kernel: NFSD: Fix SECINFO_NO_NAME decode error cleanup (CVE-2026-53398)

    * kernel: KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CVE-2026-63794)

    * kernel: fuse: re-lock request before replacing page cache folio (CVE-2026-53388)

    * kernel: USB: serial: mxuport: fix memory corruption with small endpoint (CVE-2026-63899)

    * kernel: usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (CVE-2026-63962)

    * kernel: vsock/virtio: bind uarg before filling zerocopy skb (CVE-2026-63970)

    * kernel: idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (CVE-2026-64162)

    * kernel: vfio/pci: Check BAR resources before exporting a DMABUF (CVE-2026-64042)

    * kernel: vsock/vmci: fix UAF when peer resets connection during handshake (CVE-2026-64115)

    * kernel: i2c: stub: Reject I2C block transfers with invalid length (CVE-2026-64191)

    * kernel: ALSA: hda/cs35l41: Fix firmware load work teardown (CVE-2026-64481)

    * kernel: fuse: re-lock request before returning from fuse_ref_folio() (CVE-2026-64266)

    * kernel: bpf: Support for hardening against JIT spraying (CVE-2026-64508)

    * kernel: x86/bugs: Enable IBPB flush on BPF JIT allocation (CVE-2026-64507)

    * kernel: spi: fsl-lpspi: terminate the RX channel on TX prepare failure path (CVE-2026-64303)

    * kernel: drm/amd/display: set new_stream to NULL after release (CVE-2026-68236)

    * kernel: Linux kernel SLIP: Out-of-bounds write due to race condition during MTU change (CVE-2026-68143)

    * kernel: ALSA: seq: close a re-opened queue timer in the destructor (CVE-2026-68202)

    * kernel: Linux kernel: Denial of Service due to use-after-free in act_tunnel_key (CVE-2026-68377)

    * kernel: drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CVE-2026-68278)

    * kernel: drm/amdgpu/vce: fix integer overflow in image size (CVE-2026-68108)

    * kernel: drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CVE-2026-68245)

    * kernel: openvswitch: fix GSO userspace truncation underflow (CVE-2026-68123)

    * kernel: ovl: check access to copy_file_range source with src mounter creds (CVE-2026-68448)

    * kernel: scsi: target: core: Fix iSCSI ISID use-after-free in REGISTER AND MOVE (CVE-2026-72083)

    * kernel: KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CVE-2026-72289)

    * kernel: SUNRPC: pin upper rpc_clnt across the TLS connect_worker (CVE-2026-72317)

    * kernel: tipc: require net admin for TIPCv2 netlink mutators (CVE-2026-74283)

    * kernel: Bluetooth: hci_sync: Fix advertising data UAFs (CVE-2026-74509)

    * kernel: Bluetooth: mgmt: fix UAF in pair command cancellation (CVE-2026-74510)

    * kernel: dmaengine: idxd: fix fdev setup failure cleanup in idxd_cdev_open() (CVE-2026-74574)

    * kernel: KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (CVE-2026-74516)

    * kernel: ALSA: usx2y: bound the hwdep mmap fault offset (CVE-2026-74641)

    * kernel: udp: fix potential use-after-free in tunnel segmentation (CVE-2026-74705)

    * kernel: af_unix: Unlink scc_entry in unix_del_edge() (CVE-2026-80521)

    * kernel: netfilter: flowtable: publish GC-visible tuple last (CVE-2026-74746)

    * kernel: xfs: bounds-check buffer log item's dirty bitmap (CVE-2026-80536)

    * kernel: usb: usbfs: fix use-after-free of usb_device in usbdev_release() (CVE-2026-80824)

    * kernel: drm/vmwgfx: use check_add_overflow for shader size+offset bound (CVE-2026-80887)

    * kernel: KVM: s390: vsie: zero stale crypto bits (CVE-2026-80921)

    * kernel: smb: client: reject a tree connect response whose byte count is too small (CVE-2026-89631)

    * kernel: nfsd: defer vfree of compound ops to fix rpc_status UAF (CVE-2026-89690)

    * kernel: nfsd: initialize copy-notify stateid before publishing it (CVE-2026-89669)

    * kernel: net: tun: bound receive headroom (CVE-2026-81000)

    * kernel: svcrdma: Reject inline replies that overflow the pull-up buffer (CVE-2026-89530)

    * kernel: nfsd: fix stale s2s_cp_stateids IDR entry for async COPY (CVE-2026-89676)

    * kernel: nfsd: revoke copy-notify stateids before dropping their reference (CVE-2026-89663)

    * kernel: nfsd: fix UAF in async copy cancel and shutdown (CVE-2026-89675)

    * kernel: svcrdma: Validate Read chunk positions before reconstruction (CVE-2026-89526)

    * kernel: entry: Fix seccomp bypass after ptrace with TSYNC (CVE-2026-89603)

    * kernel: nfsd: don't free session slots that are still in use (CVE-2026-89689)

    * kernel: net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CVE-2026-81003)

    * kernel: KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation (CVE-2026-89775)

    * kernel: vfio/pci: clear vdev->msi_perm after freeing it on init failure (CVE-2026-89777)

    * kernel: perf: Fix use-after-free when perf mmap() revival races with the last munmap() (CVE-2026-89791)

    * kernel: nvme: add missing SRCU grace period in error path (CVE-2026-89972)

    * kernel: NFSD: Prevent client use-after-free during blocked-lock reaping (CVE-2026-90036)

    * kernel: scsi: target: iscsi: Reserve a terminator byte for the login payload (CVE-2026-90011)

    * kernel: nvmet-auth: Synchronize timeout work during SQ teardown (CVE-2026-89970)

    * kernel: scsi: megaraid_sas: Limit NVMe request size to the PRP chain frame (CVE-2026-90008)

    * kernel: drm/amdkfd: Add TLB flush after MES queue eviction/suspension (CVE-2026-89811)

    * kernel: media: cx231xx: reject geometry changes while the VBI queue is busy (CVE-2026-89894)

    * kernel: nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CVE-2026-90227)

    * kernel: SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (CVE-2026-93207)

    * kernel: svcrdma: Reject Write/Reply chunks with segcount 0 (CVE-2026-93228)

    * kernel: md/raid5-ppl: fix use-after-free in ppl_do_flush() (CVE-2026-93262)

    * kernel: perf: Fix addr_filter_ranges lifetime (CVE-2026-93817)

    * kernel: virtio-fs: avoid double-free on failed queue setup (CVE-2026-93827)

    * kernel: netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CVE-2026-93288)

    * kernel: kernel: strparser: use-after-free via msg_timer_work rearm after strp_done() cancellation ()

    * kernel: KEYS: encrypted: fix integer overflow of datablob_len (CVE-2026-98222)

    * kernel: signal: Prevent exec() race (CVE-2026-98256)

    * kernel: xfrm: hold net_device reference under RCU in bundle creation (CVE-2026-98364)

    * kernel: exec: Cleanup POSIX timers right after de_thread() (CVE-2026-98260)

    * kernel: netfilter: flowtable: hold reference on ct until flow is released (CVE-2026-98320)

    * kernel: ipv4: free inet_opt and ireq_opt after an RCU grace period (CVE-2026-98432)

    * kernel: nvmet-auth: fix out-of-bounds write in nvmet_auth_challenge() (CVE-2026-98725)

    * kernel: kernel: xfs: Unauthorized data modification via improper file size exchange handling     (CVE-2026-98974)

    * kernel: ZDI-CAN-33367: Linux Kernel skbuff skb_zerocopy Improper Ownership Management Local Privilege     Escalation Vulnerability ()

    Bug Fix(es) and Enhancement(s):

    * [HPEMC RHEL 10.3 BUG] bnxt_en: Fix NULL pointer dereference (JIRA:RHEL-185083)

    * netfilter: rebase to 7.2 (JIRA:RHEL-242582)

    * [Intel 10.3 FEAT] idpf: Driver Update [rhel-10.3.z] (JIRA:RHEL-248077)

    * RHEL 9.8: Multiuser Kerberized DFS shares fail to mount with UID mount option [rhel-10.3.z]     (JIRA:RHEL-254106)

    * cannot use VFs of i40e/ice NIC in bond device (JIRA:RHEL-276751)

    * [EC2][CVM]AMD SEV-SNP guest hangs during early boot on RHEL 10.3 and 10.4 (regression from 10.2)     [rhel-10.3.z] (JIRA:RHEL-283382)

    * backport fixes for lockdep issues reported with rt-debug [rhel-10.3.z] (JIRA:RHEL-259938)

    * [RHEL 10] fwctl: Fix class init ordering to avoid NULL pointer dereference on device removal     [rhel-10.3.z] (JIRA:RHEL-284384)

    * RHEL is missing support for conntrack zone filtering in dump/delete requests (10.4) [rhel-10.3.z]     (JIRA:RHEL-291349)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名前	製品	ファミリー	公開日	更新日	深刻度
362238	CentOS Linux 7 [TuxCare] Security Update: bpftool / kernel / kernel-debug / kernel-debug-devel / kernel-devel / etc Multiple Vulnerabilities (CENTOS7:CLSA-2026:1768110920)	Nessus	CentOS Local Security Checks	2026/10/1	2026/10/1	high
252244	Oracle Linux 10 / 9 : Unbreakable Enterprise kernel (ELSA-2025-20530)	Nessus	Oracle Linux Local Security Checks	2025/8/19	2026/2/9	medium
378846	RHEL 10 : kernel (RHSA-2026:98608)	Nessus	Red Hat Local Security Checks	2026/11/11	2026/11/11	high

検出

プラグインの検索

high

medium

high