In the Linux kernel, the following vulnerability has been resolved: net/rds: use wq_has_sleeper() in rds_cong_map_updated() rds_cong_map_updated() runs after a peer's congestion map has been rewritten (by rds_tcp_cong_recv() and rds_ib_cong_recv(), or the clear-all in the loopback and IB send-completion paths). It bumps rds_cong_generation and then checks waitqueue_active() on map->m_waitq and on rds_poll_waitq to decide whether anyone needs waking. atomic_inc() carries no ordering and waitqueue_active() is a plain load, so nothing orders the map and generation stores before the wait queue reads. The waiters do the mirror image: rds_cong_wait() adds itself to m_waitq and then tests the port bit, and rds_poll() registers on rds_poll_waitq and then reads the generation. That is the store-buffering pattern described above waitqueue_active() in include/linux/wait.h - the updater can observe an empty wait queue while the waiter still observes the port as congested, and no wake-up is issued. rds_cong_wait() is an interruptible sleep with no timeout, so a sender blocked on a congested port stays blocked until the next congestion update from that peer arrives or a signal is delivered. A poll() waiter misses the map-updated notification the same way. Use wq_has_sleeper(), which is waitqueue_active() preceded by the required full barrier, as rds_tcp_state_change() already does for the same pattern.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - net/rds: use wq_has_sleeper() in rds_cong_map_updated() rds_cong_map_updated() runs after a peer's     congestion map has been rewritten (by rds_tcp_cong_recv() and rds_ib_cong_recv(), or the clear-all in the     loopback and IB send-completion paths). It bumps rds_cong_generation and then checks waitqueue_active() on     map->m_waitq and on rds_poll_waitq to decide whether anyone needs waking. atomic_inc() carries no ordering     and waitqueue_active() is a plain load, so nothing orders the map and generation stores before the wait     queue reads. The waiters do the mirror image: rds_cong_wait() adds itself to m_waitq and then tests the     port bit, and rds_poll() registers on rds_poll_waitq and then reads the generation. That is the store-     buffering pattern described above waitqueue_active() in include/linux/wait.h - the updater can observe an     empty wait queue while the waiter still observes the port as congested, and no wake-up is issued.
    rds_cong_wait() is an interruptible sleep with no timeout, so a sender blocked on a congested port stays     blocked until the next congestion update from that peer arrives or a signal is delivered. A poll() waiter     misses the map-updated notification the same way. Use wq_has_sleeper(), which is waitqueue_active()     preceded by the required full barrier, as rds_tcp_state_change() already does for the same pattern.
    (CVE-2026-90081)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
365279	Amazon Linux 2023 : bpftool6.12, kernel6.12, kernel6.12-devel (ALAS2023-2026-3196)	Nessus	Amazon Linux Local Security Checks	Local	medium
365220	Amazon Linux 2023 : bpftool, kernel, kernel-devel (ALAS2023-2026-3197)	Nessus	Amazon Linux Local Security Checks	Local	medium
365194	Amazon Linux 2 : kernel (ALASKERNEL-5.15-2026-117)	Nessus	Amazon Linux Local Security Checks	Local	critical
362907	Debian dla-4817 : ata-modules-6.12.107+deb12-armmp-di - security update	Nessus	Debian Local Security Checks	Local	high
351155	Debian dsa-6528 : ata-modules-6.12.111+deb13-armmp-di - security update	Nessus	Debian Local Security Checks	Local	high
347425	Linux Distros Unpatched Vulnerability : CVE-2026-90081	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2026-90081

high

Tenable Plugins

medium

medium

critical

high

high

high