The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - net: fix memory leak in skb_segment_list for GRO packets When skb_segment_list() is called during packet     forwarding, it handles packets that were aggregated by the GRO engine. Historically, the segmentation     logic in skb_segment_list assumes that individual segments are split from a parent SKB and may need to     carry their own socket memory accounting. Accordingly, the code transfers truesize from the parent to the     newly created segments. Prior to commit ed4cccef64c1 (gro: fix ownership transfer), this truesize     subtraction in skb_segment_list() was valid because fragments still carry a reference to the original     socket. However, commit ed4cccef64c1 (gro: fix ownership transfer) changed this behavior by ensuring     that fraglist entries are explicitly orphaned (skb->sk = NULL) to prevent illegal orphaning later in the     stack. This change meant that the entire socket memory charge remained with the head SKB, but the     corresponding accounting logic in skb_segment_list() was never updated. As a result, the current code     unconditionally adds each fragment's truesize to delta_truesize and subtracts it from the parent SKB.
    Since the fragments are no longer charged to the socket, this subtraction results in an effective under-     count of memory when the head is freed. This causes sk_wmem_alloc to remain non-zero, preventing socket     destruction and leading to a persistent memory leak. The leak can be observed via KMEMLEAK when tearing     down the networking environment: unreferenced object 0xffff8881e6eb9100 (size 2048): comm ping, pid     6720, jiffies 4295492526 backtrace: kmem_cache_alloc_noprof+0x5c6/0x800 sk_prot_alloc+0x5b/0x220     sk_alloc+0x35/0xa00 inet6_create.part.0+0x303/0x10d0 __sock_create+0x248/0x640 __sys_socket+0x11b/0x1d0     Since skb_segment_list() is exclusively used for SKB_GSO_FRAGLIST packets constructed by GRO, the truesize     adjustment is removed. The call to skb_release_head_state() must be preserved. As documented in commit     cf673ed0e057 (net: fix fraglist segmentation reference count leak), it is still required to correctly     drop references to SKB extensions that may be overwritten during __copy_skb_header(). (CVE-2026-22979)

Note that Nessus relies on the presence of the package as reported by the vendor.

Detections

Analytics

Linux Distros Unpatched Vulnerability : CVE-2026-22979

medium Nessus Plugin ID 296404

Version 1.9

Version 1.8

Version 1.6

Version 1.5

Version 1.4

Version 1.3

Version 1.2

Version 1.1

Version 1.9 Feb 14, 2026, 1:12 AM Detection (updated detection logic) Plugin metadata Plugin Feed: 202602140112
Version 1.8 Feb 12, 2026, 7:05 AM Detection (updated detection logic) Plugin metadata Plugin Feed: 202602120705
Version 1.6 Feb 10, 2026, 11:15 AM Detection (updated detection logic) Plugin metadata Plugin Feed: 202602101115
Version 1.5 Feb 7, 2026, 9:06 AM Detection (updated detection logic) Plugin metadata Plugin Feed: 202602070906
Version 1.4 Feb 5, 2026, 4:41 PM Detection (updated detection logic) Plugin Feed: 202602051641
Version 1.3 Jan 31, 2026, 11:07 AM Detection (updated detection logic) Plugin metadata Plugin Feed: 202601311107
Version 1.2 Jan 24, 2026, 9:30 PM CVSS metrics ("CVSSv2 score" set to 4.9) CVSS metrics ("CVSSv2 vector" set to "CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C") CVSS metrics ("CVSSv3 score" set to 5.5) CVSS metrics ("CVSSv3 vector" set to "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H") CVSSv2 severity (based on CVE-2026-22979, severity decreased from "High" to "Medium") CVSSv3 severity (based on None, severity decreased from "High" to "Medium") Detection (updated detection logic) Plugin metadata Plugin Feed: 202601242130
Version 1.1 Jan 23, 2026, 11:44 PM New Plugin Feed: 202601232344