Linux/Unix 主机中安装的一个或多个程序包受到一个漏洞影响，而供应商没有提供补丁程序。

  - bpf：保持借用的 RCU kptrs 的 refcount_acquire 为空 bpf_refcount_acquire（） 对于借用的引用，可能会造成错误，因为对象可能已经达到零引用计数。因此，校验器会保持对返回值的KF_RET_NULL，除非参数是拥有的引用。本地 kptr 的受 RCU 保护的负载被标记为 MEM_ALLOC，但它仅在指针包含图形节点时才会接收NON_OWN_REF。因此，没有图形节点的 refcounted 对象看起来像是拥有的引用，即使加载的寄存器没有被获取的引用状态也是如此。如果程序丢弃了保留在 RCU 关键部分的最后一个真正引用，refcount_inc_not_zero（） 会在校验器将结果视为非 NULL 时返回 NULL。仅当参数有验证器跟踪的引用支持时，才将该参数分类为拥有。这会保留来自 bpf_obj_new（）、bpf_kptr_xchg（） 或较早成功采集的指针的非空返回，同时要求对借用的 RCU kptr 进行空检查。[ kkd： 已重写提交日志 ]（CVE-2026-98038）

请注意，Nessus 依赖供应商报告的程序包是否存在进行判断。

Linux/Unix 主機上安裝了一個或多個受到弱點影響的套件，且廠商未提供可用的修補程式。

  - bpf：對於借用的 RCU kptrs，保持 refcount_acquire 為空 bpf_refcount_acquire（） 對於借用的參照是可能出錯的，因為物件可能已達到零參照計數。因此，除非引數是擁有參考，否則驗證程式會保留傳回值的KF_RET_NULL。本機 kptr 的 RCU 保護負載被標記為MEM_ALLOC，但只有在被指包含圖形節點時才會收到NON_OWN_REF。因此，即使載入的暫存器沒有取得的參照狀態，沒有圖形節點的參照計數物件看起來也像擁有參照。如果程式在保留在 RCU 關鍵區段時刪除最後一個實際參照，則 refcount_inc_not_zero（） 會傳回 NULL，而驗證程式會將結果視為非 NULL。只有在引數受到驗證者追蹤的參考支援時，才將引數分類為擁有。這會保留來自 bpf_obj_new（）、bpf_kptr_xchg（） 或先前成功取得的指標的非 NULL 傳回，同時需要對借用的 RCU kptr 進行 NULL 檢查。[ kkd：重寫提交日誌 ]（CVE-2026-98038）

請注意，Nessus 的判定取決於廠商所報告的套件是否存在。

Linux/Unix ホストには、ベンダーが提供するパッチが利用できない脆弱性の影響を受ける複数のパッケージがインストールされています。

  - bpf:借用した RCU kptrs に対して Keep refcount_acquire null を許します。オブジェクトがゼロの refcount に達した可能性があるためbpf_refcount_acquire() は借用した参照に対してエラーが発生する可能性があります。そのため、検証機能は、引数が所有参照でない限り、戻り値にKF_RET_NULLし続けます。ローカル kptr の RCU 保護ロードは MEM_ALLOC とマークされますが、NON_OWN_REFを受け取るのは、ポインティにグラフノードが含まれている場合のみです。グラフノードのないrefcountオブジェクトは、ロードされたレジスタに取得参照状態がない場合でも、結果として所有参照のように見えます。プログラムが RCU クリティカルセクションに残っている状態で最後の実際の参照をドロップすると、refcount_inc_not_zero() は NULL を返しますが、検証機能は結果を非 NULL として処理します。検証者が追跡する参照に裏打ちされている場合にのみ、引数を所有するものとして分類します。これにより、借用した RCU kptrs に対して NULL チェックが必要になる一方で、bpf_obj_new()、bpf_kptr_xchg()、あるいは以前の成功した取得からのポインターの NULL 以外の戻り値が保持されます。[ kkd:コミットログを書き直しました ](CVE-2026-98038)

Nessus は、ベンダーから報告されたパッケージの存在に依存していることに注意してください。

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - bpf: Keep refcount_acquire nullable for borrowed RCU kptrs bpf_refcount_acquire() is fallible for a     borrowed reference because the object may have reached a zero refcount. The verifier therefore keeps     KF_RET_NULL on the return value unless the argument is an owning reference. An RCU-protected load of a     local kptr is marked MEM_ALLOC, but it only receives NON_OWN_REF when the pointee contains a graph node. A     refcounted object without a graph node consequently looks like an owning reference even though the loaded     register has no acquired reference state. If the program drops the last real reference while remaining in     the RCU critical section, refcount_inc_not_zero() returns NULL while the verifier treats the result as     non-NULL. Only classify the argument as owning when it is backed by a verifier-tracked reference. This     retains the non-NULL return for pointers from bpf_obj_new(), bpf_kptr_xchg(), or an earlier successful     acquisition, while requiring a NULL check for borrowed RCU kptrs. [ kkd: Rewrote commit log ]     (CVE-2026-98038)

Note that Nessus relies on the presence of the package as reported by the vendor.

The AlmaLinux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1793100968 advisory.

  - In the Linux kernel, the following vulnerability has been resolved: udf: Avoid double brelse() in     udf_rename() syzbot reported a warning like below [1]: VFS: brelse: Trying to free free buffer WARNING:
    CPU: 2 PID: 7301 at fs/buffer.c:1145 __brelse+0x67/0xa0 ... Call Trace: <TASK>     invalidate_bh_lru+0x99/0x150 smp_call_function_many_cond+0xe2a/0x10c0 ?     generic_remap_file_range_prep+0x50/0x50 ? __brelse+0xa0/0xa0 ? __mutex_lock+0x21c/0x12d0 ?     smp_call_on_cpu+0x250/0x250 ? rcu_read_lock_sched_held+0xb/0x60 ? lock_release+0x587/0x810 ?
    __brelse+0xa0/0xa0 ? generic_remap_file_range_prep+0x50/0x50 on_each_cpu_cond_mask+0x3c/0x80     blkdev_flush_mapping+0x13a/0x2f0 blkdev_put_whole+0xd3/0xf0 blkdev_put+0x222/0x760     deactivate_locked_super+0x96/0x160 deactivate_super+0xda/0x100 cleanup_mnt+0x222/0x3d0     task_work_run+0x149/0x240 ? task_work_cancel+0x30/0x30 do_exit+0xb29/0x2a40 ?     reacquire_held_locks+0x4a0/0x4a0 ? do_raw_spin_lock+0x12a/0x2b0 ? mm_update_next_owner+0x7c0/0x7c0 ?     rwlock_bug.part.0+0x90/0x90 ? zap_other_threads+0x234/0x2d0 do_group_exit+0xd0/0x2a0
    __x64_sys_exit_group+0x3a/0x50 do_syscall_64+0x34/0xb0 entry_SYSCALL_64_after_hwframe+0x63/0xcd The cause     of the issue is that brelse() is called on both ofibh.sbh and ofibh.ebh by udf_find_entry() when it     returns NULL. However, brelse() is called by udf_rename(), too. So, b_count on buffer_head becomes     unbalanced. This patch fixes the issue by not calling brelse() by udf_rename() when udf_find_entry()     returns NULL. (CVE-2022-50755)

  - In the Linux kernel, the following vulnerability has been resolved: soc: qcom: qmi_encdec: Restrict string     length in decode The QMI TLV value for strings in a lot of qmi element info structures account for null     terminated strings with MAX_LEN + 1. If a string is actually MAX_LEN + 1 length, this will cause an out of     bounds access when the NULL character is appended in decoding. (CVE-2023-53729)

  - In the Linux kernel, the following vulnerability has been resolved: can: isotp: check CAN address family     in isotp_bind() Add missing check to block non-AF_CAN binds. Syzbot created some code which matched the     right sockaddr struct size but used AF_XDP (0x2C) instead of AF_CAN (0x1D) in the address family field:
    bind$xdp(r2, &(0x7f0000000540)={0x2c, 0x0, r4, 0x0, r2}, 0x10) ^^^^ This has no funtional impact but the     userspace should be notified about the wrong address family field content. (CVE-2023-54105)

  - In the Linux kernel, the following vulnerability has been resolved: usb: rndis_host: Secure rndis_query     check against int overflow Variables off and len typed as uint32 in rndis_query function are controlled by     incoming RNDIS response message thus their value may be manipulated. Setting off to a unexpectetly large     value will cause the sum with len and 8 to overflow and pass the implemented validation step. Consequently     the response pointer will be referring to a location past the expected buffer boundaries allowing     information leakage e.g. via RNDIS_OID_802_3_PERMANENT_ADDRESS OID. (CVE-2023-54110)

  - In the Linux kernel, the following vulnerability has been resolved: mtd: spi-nor: Fix shift-out-of-bounds     in spi_nor_set_erase_type spi_nor_set_erase_type() was used either to set or to mask out an erase type.
    When we used it to mask out an erase type a shift-out-of-bounds was hit: UBSAN: shift-out-of-bounds in     drivers/mtd/spi-nor/core.c:2237:24 shift exponent 4294967295 is too large for 32-bit type 'int' The     setting of the size_{shift, mask} and of the opcode are unnecessary when the erase size is zero, as     throughout the code just the erase size is considered to determine whether an erase type is supported or     not. Setting the opcode to 0xFF was wrong too as nobody guarantees that 0xFF is an unused opcode. Thus     when masking out an erase type, just set the erase size to zero. This will fix the shift-out-of-bounds.
    [ta: refine changes, new commit message, fix compilation error] (CVE-2023-54295)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1793100968 advisory.

  - In the Linux kernel, the following vulnerability has been resolved: udf: Avoid double brelse() in     udf_rename() syzbot reported a warning like below [1]: VFS: brelse: Trying to free free buffer WARNING:
    CPU: 2 PID: 7301 at fs/buffer.c:1145 __brelse+0x67/0xa0 ... Call Trace: <TASK>     invalidate_bh_lru+0x99/0x150 smp_call_function_many_cond+0xe2a/0x10c0 ?     generic_remap_file_range_prep+0x50/0x50 ? __brelse+0xa0/0xa0 ? __mutex_lock+0x21c/0x12d0 ?     smp_call_on_cpu+0x250/0x250 ? rcu_read_lock_sched_held+0xb/0x60 ? lock_release+0x587/0x810 ?
    __brelse+0xa0/0xa0 ? generic_remap_file_range_prep+0x50/0x50 on_each_cpu_cond_mask+0x3c/0x80     blkdev_flush_mapping+0x13a/0x2f0 blkdev_put_whole+0xd3/0xf0 blkdev_put+0x222/0x760     deactivate_locked_super+0x96/0x160 deactivate_super+0xda/0x100 cleanup_mnt+0x222/0x3d0     task_work_run+0x149/0x240 ? task_work_cancel+0x30/0x30 do_exit+0xb29/0x2a40 ?     reacquire_held_locks+0x4a0/0x4a0 ? do_raw_spin_lock+0x12a/0x2b0 ? mm_update_next_owner+0x7c0/0x7c0 ?     rwlock_bug.part.0+0x90/0x90 ? zap_other_threads+0x234/0x2d0 do_group_exit+0xd0/0x2a0
    __x64_sys_exit_group+0x3a/0x50 do_syscall_64+0x34/0xb0 entry_SYSCALL_64_after_hwframe+0x63/0xcd The cause     of the issue is that brelse() is called on both ofibh.sbh and ofibh.ebh by udf_find_entry() when it     returns NULL. However, brelse() is called by udf_rename(), too. So, b_count on buffer_head becomes     unbalanced. This patch fixes the issue by not calling brelse() by udf_rename() when udf_find_entry()     returns NULL. (CVE-2022-50755)

  - In the Linux kernel, the following vulnerability has been resolved: soc: qcom: qmi_encdec: Restrict string     length in decode The QMI TLV value for strings in a lot of qmi element info structures account for null     terminated strings with MAX_LEN + 1. If a string is actually MAX_LEN + 1 length, this will cause an out of     bounds access when the NULL character is appended in decoding. (CVE-2023-53729)

  - In the Linux kernel, the following vulnerability has been resolved: can: isotp: check CAN address family     in isotp_bind() Add missing check to block non-AF_CAN binds. Syzbot created some code which matched the     right sockaddr struct size but used AF_XDP (0x2C) instead of AF_CAN (0x1D) in the address family field:
    bind$xdp(r2, &(0x7f0000000540)={0x2c, 0x0, r4, 0x0, r2}, 0x10) ^^^^ This has no funtional impact but the     userspace should be notified about the wrong address family field content. (CVE-2023-54105)

  - In the Linux kernel, the following vulnerability has been resolved: usb: rndis_host: Secure rndis_query     check against int overflow Variables off and len typed as uint32 in rndis_query function are controlled by     incoming RNDIS response message thus their value may be manipulated. Setting off to a unexpectetly large     value will cause the sum with len and 8 to overflow and pass the implemented validation step. Consequently     the response pointer will be referring to a location past the expected buffer boundaries allowing     information leakage e.g. via RNDIS_OID_802_3_PERMANENT_ADDRESS OID. (CVE-2023-54110)

  - In the Linux kernel, the following vulnerability has been resolved: mtd: spi-nor: Fix shift-out-of-bounds     in spi_nor_set_erase_type spi_nor_set_erase_type() was used either to set or to mask out an erase type.
    When we used it to mask out an erase type a shift-out-of-bounds was hit: UBSAN: shift-out-of-bounds in     drivers/mtd/spi-nor/core.c:2237:24 shift exponent 4294967295 is too large for 32-bit type 'int' The     setting of the size_{shift, mask} and of the opcode are unnecessary when the erase size is zero, as     throughout the code just the erase size is considered to determine whether an erase type is supported or     not. Setting the opcode to 0xFF was wrong too as nobody guarantees that 0xFF is an unused opcode. Thus     when masking out an erase type, just set the erase size to zero. This will fix the shift-out-of-bounds.
    [ta: refine changes, new commit message, fix compilation error] (CVE-2023-54295)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名前	製品	ファミリー	公開日	更新日	深刻度
350331	Linux Distros 未修补的漏洞：CVE-2026-98038	Nessus	Misc.	2026/9/25	2026/10/21	medium
350331	Linux Distros 未修補弱點：CVE-2026-98038	Nessus	Misc.	2026/9/25	2026/10/21	medium
350331	Linux Distros のパッチ未適用の脆弱性: CVE-2026-98038	Nessus	Misc.	2026/9/25	2026/10/21	medium
350331	Linux Distros Unpatched Vulnerability : CVE-2026-98038	Nessus	Misc.	2026/9/25	2026/10/21	medium
373062	AlmaLinux 9.6 [TuxCare] Security Update: kernel / kernel-64k / kernel-64k-core / kernel-64k-debug / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1793100968)	Nessus	Alma Linux Local Security Checks	2026/10/28	2026/10/28	high
373068	Rocky Linux 9.6 [TuxCare] Security Update: kernel / kernel-64k / kernel-64k-core / kernel-64k-debug / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1793100968)	Nessus	Rocky Linux Local Security Checks	2026/10/28	2026/10/28	high

検出

プラグインの検索

medium

medium

medium

medium

high

high