The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - KVM: arm64: Check the untrusted offset in FF-A memory share Verify the offset to prevent OOB access in the     hypervisor FF-A buffer in case an untrusted large enough value [U32_MAX - sizeof(struct     ffa_composite_mem_region) + 1, U32_MAX] is set from the host kernel. (CVE-2025-40266)

Note that Nessus relies on the presence of the package as reported by the vendor.

Detections

Analytics

Linux Distros Unpatched Vulnerability : CVE-2025-40266

high Nessus Plugin ID 277509

Version 1.2

Version 1.1

Version 1.2 Dec 9, 2025, 2:31 AM CVSS metrics ("CVSSv2 score" set to 7.2) CVSS metrics ("CVSSv2 vector" set to "CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C") CVSS metrics ("CVSSv3 score" set to 7.1) CVSS metrics ("CVSSv3 vector" set to "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H") Detection (updated detection logic) Plugin metadata Plugin Feed: 202512090231
Version 1.1 Dec 5, 2025, 5:34 AM New Plugin Feed: 202512050534