In the Linux kernel, the following vulnerability has been resolved: net/iucv: fix locking in .getsockopt Mirror iucv_sock_setsockopt() and wrap the whole switch in lock_sock()/release_sock(). The pre-existing SO_MSGLIMIT-only lock becomes redundant and is removed. Any AF_IUCV HIPER user can potentially crash the kernel by racing recvmsg() with getsockopt(SO_MSGSIZE): the SO_MSGSIZE arm dereferences iucv->hs_dev->mtu after iucv_sock_close() (called from the racing recvmsg()) has set hs_dev to NULL, producing a NULL pointer dereference oops.

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-100590 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    net/iucv: fix locking in .getsockopt

    Mirror iucv_sock_setsockopt() and wrap the whole switch in     lock_sock()/release_sock(). The pre-existing SO_MSGLIMIT-only lock     becomes redundant and is removed.

    Any AF_IUCV HIPER user can potentially crash the kernel by racing     recvmsg() with getsockopt(SO_MSGSIZE): the SO_MSGSIZE arm dereferences     iucv->hs_dev->mtu after iucv_sock_close() (called from the racing     recvmsg()) has set hs_dev to NULL, producing a NULL pointer dereference     oops.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

An update of the linux package has been released.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - net/iucv: fix locking in .getsockopt Mirror iucv_sock_setsockopt() and wrap the whole switch in     lock_sock()/release_sock(). The pre-existing SO_MSGLIMIT-only lock becomes redundant and is removed. Any     AF_IUCV HIPER user can potentially crash the kernel by racing recvmsg() with getsockopt(SO_MSGSIZE): the     SO_MSGSIZE arm dereferences iucv->hs_dev->mtu after iucv_sock_close() (called from the racing recvmsg())     has set hs_dev to NULL, producing a NULL pointer dereference oops. (CVE-2026-64004)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
340681	Ubuntu 24.04 LTS / 26.04 LTS / Pro Realtime 24.04 LTS : Linux kernel (NVIDIA) vulnerabilities (USN-8663-1)	Nessus	Ubuntu Local Security Checks	Local	high
340045	Ubuntu 26.04 LTS : Linux kernel (NVIDIA BaseOS) vulnerabilities (USN-8664-1)	Nessus	Ubuntu Local Security Checks	Local	high
337054	Unity Linux 20.1050a Security Update: kernel (UTSA-2026-100590)	Nessus	Unity Linux Local Security Checks	Local	high
333941	Photon OS 5.0: Linux PHSA-2026-5.0-92-0926	Nessus	PhotonOS Local Security Checks	Local	high
333762	Photon OS 5.0: Linux PHSA-2026-5.0-92-0895	Nessus	PhotonOS Local Security Checks	Local	high
329326	Photon OS 5.0: Linux PHSA-2026-5.0-0926	Nessus	PhotonOS Local Security Checks	Local	high
328154	Linux Distros Unpatched Vulnerability : CVE-2026-64004	Nessus	Misc.	Local	high
322944	Photon OS 5.0: Linux PHSA-2026-5.0-0895	Nessus	PhotonOS Local Security Checks	Local	high

Detections

Analytics

CVE-2026-64004

high

Tenable Plugins

high

high

high

high

high

high

high

high