The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Bluetooth: MGMT: cancel mesh send timer when hdev removed mesh_send_done timer is not canceled when hdev     is removed, which causes crash if the timer triggers after hdev is gone. Cancel the timer when MGMT     removes the hdev, like other MGMT timers. Should fix the BUG: sporadically seen by BlueZ test bot (in     Mesh - Send cancel - 1 test). Log: ------ BUG: KASAN: slab-use-after-free in     run_timer_softirq+0x76b/0x7d0 ... Freed by task 36: kasan_save_stack+0x24/0x50 kasan_save_track+0x14/0x30
    __kasan_save_free_info+0x3a/0x60 __kasan_slab_free+0x43/0x70 kfree+0x103/0x500 device_release+0x9a/0x210     kobject_put+0x100/0x1e0 vhci_release+0x18b/0x240 ------ (CVE-2025-40284)

Note that Nessus relies on the presence of the package as reported by the vendor.

Detections

Analytics

Linux Distros Unpatched Vulnerability : CVE-2025-40284

medium Nessus Plugin ID 277720

Version 1.5

Version 1.4

Version 1.3

Version 1.2

Version 1.1

Version 1.5 Jan 21, 2026, 5:00 PM Detection (updated detection logic) Plugin metadata Plugin Feed: 202601211700
Version 1.4 Jan 13, 2026, 2:35 AM CVSS metrics ("CVSSv2 score" set to 4.9) CVSS metrics ("CVSSv2 vector" set to "CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C") Detection (updated detection logic) Plugin metadata Plugin Feed: 202601130235
Version 1.3 Jan 10, 2026, 7:58 PM Detection (updated detection logic) Plugin Feed: 202601101958
Version 1.2 Dec 15, 2025, 9:39 PM CVSS metrics ("CVSSv2 score" set to 6.6) CVSS metrics ("CVSSv2 vector" set to "CVSS2#AV:L/AC:L/Au:N/C:N/I:C/A:C") Detection (updated detection logic) Plugin metadata Plugin Feed: 202512152139
Version 1.1 Dec 9, 2025, 2:31 AM New Plugin Feed: 202512090231