The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - landlock: Fix handling of disconnected directories Disconnected files or directories can appear when they     are visible and opened from a bind mount, but have been renamed or moved from the source of the bind mount     in a way that makes them inaccessible from the mount point (i.e. out of scope). Previously, access rights     tied to files or directories opened through a disconnected directory were collected by walking the related     hierarchy down to the root of the filesystem, without taking into account the mount point because it     couldn't be found. This could lead to inconsistent access results, potential access right widening, and     hard-to-debug renames, especially since such paths cannot be printed. For a sandboxed task to create a     disconnected directory, it needs to have write access (i.e. FS_MAKE_REG, FS_REMOVE_FILE, and FS_REFER) to     the underlying source of the bind mount, and read access to the related mount point. Because a sandboxed     task cannot acquire more access rights than those defined by its Landlock domain, this could lead to     inconsistent access rights due to missing permissions that should be inherited from the mount point     hierarchy, while inheriting permissions from the filesystem hierarchy hidden by this mount point instead.
    Landlock now handles files and directories opened from disconnected directories by taking into account the     filesystem hierarchy when the mount point is not found in the hierarchy walk, and also always taking into     account the mount point from which these disconnected directories were opened. This ensures that a rename     is not allowed if it would widen access rights [1]. The rationale is that, even if disconnected     hierarchies might not be visible or accessible to a sandboxed task, relying on the collected access rights     from them improves the guarantee that access rights will not be widened during a rename because of the     access right comparison between the source and the destination (see LANDLOCK_ACCESS_FS_REFER). It may look     like this would grant more access on disconnected files and directories, but the security policies are     always enforced for all the evaluated hierarchies. This new behavior should be less surprising to users     and safer from an access control perspective. Remove a wrong WARN_ON_ONCE() canary in     collect_domain_accesses() and fix the related comment. Because opened files have their access rights     stored in the related file security properties, there is no impact for disconnected or unlinked files.
    (CVE-2025-68736)

Note that Nessus relies on the presence of the package as reported by the vendor.

Detections

Analytics

Linux Distros Unpatched Vulnerability : CVE-2025-68736

medium Nessus Plugin ID 279801

Version 1.16

Version 1.15

Version 1.14

Version 1.13

Version 1.12

Version 1.11

Version 1.10

Version 1.9

Version 1.8

Version 1.7

Version 1.6

Version 1.5

Version 1.4

Version 1.3

Version 1.2

Version 1.1

Version 1.16 May 9, 2026, 2:20 AM Detection (updated detection logic) Plugin Feed: 202605090220
Version 1.15 May 8, 2026, 1:55 AM Detection (updated detection logic) Plugin metadata Plugin Feed: 202605080155
Version 1.14 May 2, 2026, 11:12 PM Detection (updated detection logic) Plugin metadata Plugin Feed: 202605022312
Version 1.13 Apr 28, 2026, 8:33 AM Detection (updated detection logic) Plugin metadata Plugin Feed: 202604280833
Version 1.12 Apr 20, 2026, 10:26 PM Detection (updated detection logic) Plugin metadata Plugin Feed: 202604202226
Version 1.11 Apr 17, 2026, 10:08 PM Detection (updated detection logic) Plugin Feed: 202604172208
Version 1.10 Mar 17, 2026, 4:16 PM Detection (updated detection logic) Plugin Feed: 202603171616
Version 1.9 Mar 10, 2026, 10:49 PM Detection (updated detection logic) New Plugin metadata Plugin Feed: 202603102249
Version 1.8 Feb 23, 2026, 1:38 PM Detection (updated detection logic) Plugin metadata Plugin Feed: 202602231338
Version 1.7 Feb 7, 2026, 9:06 AM Detection (updated detection logic) Plugin metadata Plugin Feed: 202602070906
Version 1.6 Feb 4, 2026, 6:31 AM Detection (updated detection logic) Plugin metadata Plugin Feed: 202602040631
Version 1.5 Jan 10, 2026, 7:58 PM Detection (updated detection logic) Plugin Feed: 202601101958
Version 1.4 Jan 6, 2026, 6:10 PM Detection (updated detection logic) Plugin metadata Plugin Feed: 202601061810
Version 1.3 Dec 26, 2025, 4:55 PM Detection (updated detection logic) Plugin metadata Plugin Feed: 202512261655
Version 1.2 Dec 26, 2025, 12:07 AM CVSS metrics ("CVSSv2 score" set to 6.8) CVSS metrics ("CVSSv2 vector" set to "CVSS2#AV:L/AC:L/Au:S/C:C/I:C/A:C") CVSS metrics ("CVSSv3 score" set to 5.5) CVSS metrics ("CVSSv3 vector" set to "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N") CVSSv2 severity (based on CVE-2025-68736, severity decreased from "High" to "Medium") CVSSv3 severity (based on None, severity decreased from "High" to "Medium") Detection (updated detection logic) Plugin metadata Plugin Feed: 202512260007
Version 1.1 Dec 25, 2025, 7:38 AM New Plugin Feed: 202512250738