Linux/Unix 主机中安装的一个或多个程序包受到一个漏洞影响，而供应商没有提供补丁程序。

  - scsi：megaraid_sas：将 NVMe 请求大小限制为 PRP 链帧 megasas_make_prp_nvme（） 在 cmd->sg_frame（实例>max_chain_frame_sz字节的 DMA 池缓冲区）中构建命令的 PRP 列表，在传输的每个 NVMe 页面花费一个条目，另外每页缓冲区花费一个链指针。循环一直运行到描述传输为止，并且从不检查缓冲区边界。max_hw_sectors直接来自驱动器的固件报告的 MDTS。在具有大型 MDTS 的驱动器上，唯一将列表保留在缓冲区内的是块层默认值 1280 KiB，它需要 320 个条目，这些条目适合 4 KiB 帧，因为它可容纳 512。但是由于提交了 9b8b84879d4a（区块：增加 BLK_DEF_MAX_SECTORS_CAP），该默认值为 4 MiB，此类传输需要 1025 个条目，因此列表会运行一整页超过框架末尾： sd 1：0：1：0：[sdb] tag#630 页面边界 ptr_sgl： 0x00000000ba62d13f 缺陷：无法处理地址的页面错误：ff663bcb81e7c000 #PF：内核模式下的监督人写入权限 #PF： error_code（0x0002） - 不存在的页面 RIP：0010：megasas_build_and_issue_cmd_fusion+0xeaa/0x1870 [megaraid_sas] 如果帧之后的页面恰好被映射，则溢出不会发生错误，而是静默地损坏邻近的池条目，即另一个正在传输的命令的 PRP 列表。上限max_hw_sectors链框架可以描述的内容，减去一页用于不从页面边界开始的传输，因此需要多一个条目。
    这是提交 04631f55afc5 的megaraid_sas对应项（scsi：mpt3sas：将 NVMe 请求大小限制为 2 MiB），但该限制来源于 max_chain_frame_sz，而非对其进行硬编码。（CVE-2026-90008）

请注意，Nessus 依赖供应商报告的程序包是否存在进行判断。

Linux/Unix 主機上安裝了一個或多個受到弱點影響的套件，且廠商未提供可用的修補程式。

  - scsi：megaraid_sas：將 NVMe 要求大小限制為 PRP 鏈框架 megasas_make_prp_nvme（） 會在 cmd->sg_frame 中建立命令的 PRP 清單，這是實例>max_chain_frame_sz位元組的 DMA 集區緩衝區，傳輸的每個 NVMe 頁面花費一個項目，鏈指標的緩衝區每頁花費一個項目。迴圈會一直執行，直到描述傳輸為止，並且永遠不會檢查緩衝區繫結。max_hw_sectors直接來自驅動器固件報告的 MDTS。在具有大型 MDTS 的驅動器上，唯一將列表保留在緩衝區內的是塊層默認值 1280 KiB，它需要 320 個項目，這些項目適合 4 KiB 框架，因為它可容納 512 個。但由於提交 9b8b84879d4a （block： 增加 BLK_DEF_MAX_SECTORS_CAP），因此預設值為 4 MiB，而此類傳輸需要 1025 個項目，因此清單會在框架結尾後運行一整頁： sd 1：0：1：0： [sdb] tag#630 頁面邊界 ptr_sgl： 0x00000000ba62d13f 錯誤：無法處理位址的頁面錯誤：ff663bcb81e7c000 #PF：核心模式下的主管寫入存取權限 #PF： error_code（0x0002） - 不存在頁面 RIP：0010：megasas_build_and_issue_cmd_fusion+0xeaa/0x1870 [megaraid_sas] 如果框架之後的頁面恰好被映射，則溢位不會出錯，而是會無訊息地損毀相鄰的集區項目，這是另一個正在進行的命令的 PRP 清單。上限max_hw_sectors鏈框架可以描述的內容，減去一頁，用於不從頁面邊界開始的傳輸，因此需要多一個條目。
    這是提交 04631f55afc5 的megaraid_sas對應部分 （scsi：mpt3sas：將 NVMe 請求大小限制為 2 MiB），但從 max_chain_frame_sz 派生限制，而不是硬式編碼。（CVE-2026-90008）

請注意，Nessus 的判定取決於廠商所報告的套件是否存在。

Linux/Unix ホストには、ベンダーが提供するパッチが利用できない脆弱性の影響を受ける複数のパッケージがインストールされています。

  - scsi:megaraid_sas:NVMe リクエストサイズを PRP チェーンフレームに制限します megasas_make_prp_nvme() は、cmd->sg_frame でコマンドの PRP リストを構築し、インスタンス>max_chain_frame_szバイトの DMA プールバッファで、転送の NVMe ページごとに 1 つのエントリを費やし、さらにチェーンポインターのバッファのページごとに 1 つのエントリを費やします。このループは、転送が記述されるまで実行され、バッファ境界がチェックされることはありません。max_hw_sectors、ドライブのファームウェア レポートである MDTS から直接取得されます。大きなMDTSを搭載したドライブで、リストをバッファ内に保持していたのは、ブロック層のデフォルトの1280 KiBだけでした。これには320のエントリが必要で、512を保持する4 KiBフレームに収まります。ただし、コミット 9b8b84879d4a(ブロック: 増加 BLK_DEF_MAX_SECTORS_CAP)以降、そのデフォルトは 4 MiB であり、このような転送には 1025 エントリが必要なため、リストはフレームの終わりを超えてページ全体を実行します: sd 1:0:1:0: [sdb] tag#630 ページ境界ptr_sgl: 0x00000000ba62d13f バグ: アドレスのページ障害を処理できません:ff663bcb81e7c000 #PF: カーネルモードにおけるスーパーバイザーの書き込みアクセス #PF: error_code(0x0002) - 存在しないページ RIP:0010:megasas_build_and_issue_cmd_fusion+0xeaa/0x1870 [megaraid_sas] フレームの後のページがたまたまマッピングされている場合、オーバーランは障害発生しませんが、別のインフライトコマンドの PRP リストである隣接するプールエントリを警告なしで破損します。チェーンフレームが記述できる範囲でmax_hw_sectors上限を設け、ページ境界で開始されず、さらに1つのエントリが必要な転送の場合は1ページを差し引きます。
    これは、コミット 04631f55afc5(scsi:mpt3sas:NVMe リクエストサイズを 2 MiB に制限)のmegaraid_sasに相当しますが、ハードコードするのではなく、max_chain_frame_szから制限を導き出します。(CVE-2026-90008)

Nessus は、ベンダーから報告されたパッケージの存在に依存していることに注意してください。

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:98608 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: virt: tdx-guest: Just leak decrypted memory on unrecoverable errors (CVE-2024-57793)

    * kernel: OPP: add index check to assert to avoid buffer overflow in _read_freq() (CVE-2024-57998)

    * kernel: can: bcm: add locking for bcm_op runtime updates (CVE-2025-38004)

    * kernel: calipso: Don't call calipso functions for AF_INET sk. (CVE-2025-38147)

    * kernel: openvswitch: defer tunnel netdev_put to RCU release (CVE-2026-31678)

    * kernel: vhost: move vdpa group bound check to vhost_vdpa (CVE-2026-43248)

    * kernel: KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (CVE-2026-46076)

    * kernel: RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CVE-2026-46176)

    * kernel: net/sched: act_ct: Only release RCU read lock after ct_ft (CVE-2026-46319)

    * kernel: net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CVE-2026-53011)

    * kernel: net/sched: act_api: use RCU with deferred freeing for action lifecycle (CVE-2026-53264)

    * kernel: af_unix: Set gc_in_progress to true in unix_gc() (CVE-2026-53361)

    * kernel: vsock/virtio: fix zerocopy completion for multi-skb sends (CVE-2026-53365)

    * kernel: NFSD: Fix SECINFO_NO_NAME decode error cleanup (CVE-2026-53398)

    * kernel: KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CVE-2026-63794)

    * kernel: fuse: re-lock request before replacing page cache folio (CVE-2026-53388)

    * kernel: USB: serial: mxuport: fix memory corruption with small endpoint (CVE-2026-63899)

    * kernel: usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (CVE-2026-63962)

    * kernel: vsock/virtio: bind uarg before filling zerocopy skb (CVE-2026-63970)

    * kernel: idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (CVE-2026-64162)

    * kernel: vfio/pci: Check BAR resources before exporting a DMABUF (CVE-2026-64042)

    * kernel: vsock/vmci: fix UAF when peer resets connection during handshake (CVE-2026-64115)

    * kernel: i2c: stub: Reject I2C block transfers with invalid length (CVE-2026-64191)

    * kernel: ALSA: hda/cs35l41: Fix firmware load work teardown (CVE-2026-64481)

    * kernel: fuse: re-lock request before returning from fuse_ref_folio() (CVE-2026-64266)

    * kernel: bpf: Support for hardening against JIT spraying (CVE-2026-64508)

    * kernel: x86/bugs: Enable IBPB flush on BPF JIT allocation (CVE-2026-64507)

    * kernel: spi: fsl-lpspi: terminate the RX channel on TX prepare failure path (CVE-2026-64303)

    * kernel: drm/amd/display: set new_stream to NULL after release (CVE-2026-68236)

    * kernel: Linux kernel SLIP: Out-of-bounds write due to race condition during MTU change (CVE-2026-68143)

    * kernel: ALSA: seq: close a re-opened queue timer in the destructor (CVE-2026-68202)

    * kernel: Linux kernel: Denial of Service due to use-after-free in act_tunnel_key (CVE-2026-68377)

    * kernel: drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CVE-2026-68278)

    * kernel: drm/amdgpu/vce: fix integer overflow in image size (CVE-2026-68108)

    * kernel: drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CVE-2026-68245)

    * kernel: openvswitch: fix GSO userspace truncation underflow (CVE-2026-68123)

    * kernel: ovl: check access to copy_file_range source with src mounter creds (CVE-2026-68448)

    * kernel: scsi: target: core: Fix iSCSI ISID use-after-free in REGISTER AND MOVE (CVE-2026-72083)

    * kernel: KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CVE-2026-72289)

    * kernel: SUNRPC: pin upper rpc_clnt across the TLS connect_worker (CVE-2026-72317)

    * kernel: tipc: require net admin for TIPCv2 netlink mutators (CVE-2026-74283)

    * kernel: Bluetooth: hci_sync: Fix advertising data UAFs (CVE-2026-74509)

    * kernel: Bluetooth: mgmt: fix UAF in pair command cancellation (CVE-2026-74510)

    * kernel: dmaengine: idxd: fix fdev setup failure cleanup in idxd_cdev_open() (CVE-2026-74574)

    * kernel: KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (CVE-2026-74516)

    * kernel: ALSA: usx2y: bound the hwdep mmap fault offset (CVE-2026-74641)

    * kernel: udp: fix potential use-after-free in tunnel segmentation (CVE-2026-74705)

    * kernel: af_unix: Unlink scc_entry in unix_del_edge() (CVE-2026-80521)

    * kernel: netfilter: flowtable: publish GC-visible tuple last (CVE-2026-74746)

    * kernel: xfs: bounds-check buffer log item's dirty bitmap (CVE-2026-80536)

    * kernel: usb: usbfs: fix use-after-free of usb_device in usbdev_release() (CVE-2026-80824)

    * kernel: drm/vmwgfx: use check_add_overflow for shader size+offset bound (CVE-2026-80887)

    * kernel: KVM: s390: vsie: zero stale crypto bits (CVE-2026-80921)

    * kernel: smb: client: reject a tree connect response whose byte count is too small (CVE-2026-89631)

    * kernel: nfsd: defer vfree of compound ops to fix rpc_status UAF (CVE-2026-89690)

    * kernel: nfsd: initialize copy-notify stateid before publishing it (CVE-2026-89669)

    * kernel: net: tun: bound receive headroom (CVE-2026-81000)

    * kernel: svcrdma: Reject inline replies that overflow the pull-up buffer (CVE-2026-89530)

    * kernel: nfsd: fix stale s2s_cp_stateids IDR entry for async COPY (CVE-2026-89676)

    * kernel: nfsd: revoke copy-notify stateids before dropping their reference (CVE-2026-89663)

    * kernel: nfsd: fix UAF in async copy cancel and shutdown (CVE-2026-89675)

    * kernel: svcrdma: Validate Read chunk positions before reconstruction (CVE-2026-89526)

    * kernel: entry: Fix seccomp bypass after ptrace with TSYNC (CVE-2026-89603)

    * kernel: nfsd: don't free session slots that are still in use (CVE-2026-89689)

    * kernel: net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CVE-2026-81003)

    * kernel: KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation (CVE-2026-89775)

    * kernel: vfio/pci: clear vdev->msi_perm after freeing it on init failure (CVE-2026-89777)

    * kernel: perf: Fix use-after-free when perf mmap() revival races with the last munmap() (CVE-2026-89791)

    * kernel: nvme: add missing SRCU grace period in error path (CVE-2026-89972)

    * kernel: NFSD: Prevent client use-after-free during blocked-lock reaping (CVE-2026-90036)

    * kernel: scsi: target: iscsi: Reserve a terminator byte for the login payload (CVE-2026-90011)

    * kernel: nvmet-auth: Synchronize timeout work during SQ teardown (CVE-2026-89970)

    * kernel: scsi: megaraid_sas: Limit NVMe request size to the PRP chain frame (CVE-2026-90008)

    * kernel: drm/amdkfd: Add TLB flush after MES queue eviction/suspension (CVE-2026-89811)

    * kernel: media: cx231xx: reject geometry changes while the VBI queue is busy (CVE-2026-89894)

    * kernel: nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CVE-2026-90227)

    * kernel: SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (CVE-2026-93207)

    * kernel: svcrdma: Reject Write/Reply chunks with segcount 0 (CVE-2026-93228)

    * kernel: md/raid5-ppl: fix use-after-free in ppl_do_flush() (CVE-2026-93262)

    * kernel: perf: Fix addr_filter_ranges lifetime (CVE-2026-93817)

    * kernel: virtio-fs: avoid double-free on failed queue setup (CVE-2026-93827)

    * kernel: netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CVE-2026-93288)

    * kernel: kernel: strparser: use-after-free via msg_timer_work rearm after strp_done() cancellation ()

    * kernel: KEYS: encrypted: fix integer overflow of datablob_len (CVE-2026-98222)

    * kernel: signal: Prevent exec() race (CVE-2026-98256)

    * kernel: xfrm: hold net_device reference under RCU in bundle creation (CVE-2026-98364)

    * kernel: exec: Cleanup POSIX timers right after de_thread() (CVE-2026-98260)

    * kernel: netfilter: flowtable: hold reference on ct until flow is released (CVE-2026-98320)

    * kernel: ipv4: free inet_opt and ireq_opt after an RCU grace period (CVE-2026-98432)

    * kernel: nvmet-auth: fix out-of-bounds write in nvmet_auth_challenge() (CVE-2026-98725)

    * kernel: kernel: xfs: Unauthorized data modification via improper file size exchange handling     (CVE-2026-98974)

    * kernel: ZDI-CAN-33367: Linux Kernel skbuff skb_zerocopy Improper Ownership Management Local Privilege     Escalation Vulnerability ()

    Bug Fix(es) and Enhancement(s):

    * [HPEMC RHEL 10.3 BUG] bnxt_en: Fix NULL pointer dereference (JIRA:RHEL-185083)

    * netfilter: rebase to 7.2 (JIRA:RHEL-242582)

    * [Intel 10.3 FEAT] idpf: Driver Update [rhel-10.3.z] (JIRA:RHEL-248077)

    * RHEL 9.8: Multiuser Kerberized DFS shares fail to mount with UID mount option [rhel-10.3.z]     (JIRA:RHEL-254106)

    * cannot use VFs of i40e/ice NIC in bond device (JIRA:RHEL-276751)

    * [EC2][CVM]AMD SEV-SNP guest hangs during early boot on RHEL 10.3 and 10.4 (regression from 10.2)     [rhel-10.3.z] (JIRA:RHEL-283382)

    * backport fixes for lockdep issues reported with rt-debug [rhel-10.3.z] (JIRA:RHEL-259938)

    * [RHEL 10] fwctl: Fix class init ordering to avoid NULL pointer dereference on device removal     [rhel-10.3.z] (JIRA:RHEL-284384)

    * RHEL is missing support for conntrack zone filtering in dump/delete requests (10.4) [rhel-10.3.z]     (JIRA:RHEL-291349)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - In the Linux kernel, the following vulnerability has been resolved: scsi: megaraid_sas: Limit NVMe request     size to the PRP chain frame megasas_make_prp_nvme() builds a command's PRP list in cmd->sg_frame, a DMA     pool buffer of instance->max_chain_frame_sz bytes, spending one entry per NVMe page of the transfer plus     one per page of the buffer for the chain pointer. The loop runs until the transfer is described and never     checks the buffer bound. max_hw_sectors comes straight from the MDTS the firmware reports for the drive.
    On drives with a large MDTS the only thing keeping the list inside the buffer was the block layer default     of 1280 KiB, which needs 320 entries, which fit into a 4 KiB frame as that holds 512. But since commit     9b8b84879d4a (block: Increase BLK_DEF_MAX_SECTORS_CAP) that default is 4 MiB, and such a transfer needs     1025 entries, so the list runs a full page past the end of the frame: sd 1:0:1:0: [sdb] tag#630 page     boundary ptr_sgl: 0x00000000ba62d13f BUG: unable to handle page fault for address: ff663bcb81e7c000 #PF:
    supervisor write access in kernel mode #PF: error_code(0x0002) - not-present page RIP:
    0010:megasas_build_and_issue_cmd_fusion+0xeaa/0x1870 [megaraid_sas] If the page after the frame happens to     be mapped, the overrun does not fault but silently corrupts the neighbouring pool entry, which is another     in-flight command's PRP list. Cap max_hw_sectors at what the chain frame can describe, less one page for     transfers that do not start on a page boundary and so need one entry more. This is the megaraid_sas     counterpart of commit 04631f55afc5 (scsi: mpt3sas: Limit NVMe request size to 2 MiB), but derives the     limit from max_chain_frame_sz rather than hardcoding it. (CVE-2026-90008)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	名前	製品	ファミリー	公開日	更新日	深刻度
346696	Linux Distros 未修补的漏洞：CVE-2026-90008	Nessus	Misc.	2026/9/16	2026/11/11	high
346696	Linux Distros 未修補弱點：CVE-2026-90008	Nessus	Misc.	2026/9/16	2026/11/11	high
346696	Linux Distros のパッチ未適用の脆弱性: CVE-2026-90008	Nessus	Misc.	2026/9/16	2026/11/11	high
378846	RHEL 10 : kernel (RHSA-2026:98608)	Nessus	Red Hat Local Security Checks	2026/11/11	2026/11/12	high
376443	Ubuntu 24.04 LTS / 26.04 LTS : Linux kernel vulnerabilities (USN-8959-1)	Nessus	Ubuntu Local Security Checks	2026/11/5	2026/11/5	high
346696	Linux Distros Unpatched Vulnerability : CVE-2026-90008	Nessus	Misc.	2026/9/16	2026/11/11	high

検出

プラグインの検索

high

high

high

high

high

high