The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - macvlan: observe an RCU grace period in macvlan_common_newlink() error path valis reported that a race     condition still happens after my prior patch. macvlan_common_newlink() might have made @dev visible before     detecting an error, and its caller will directly call free_netdev(dev). We must respect an RCU period,     either in macvlan or the core networking stack. After adding a temporary mdelay(1000) in     macvlan_forward_source_one() to open the race window, valis repro was: ip link add p1 type veth peer p2 ip     link set address 00:00:00:00:00:20 dev p1 ip link set up dev p1 ip link set up dev p2 ip link add mv0 link     p2 type macvlan mode source (ip link add invalid% link p2 type macvlan mode source macaddr add     00:00:00:00:00:20 &) ; sleep 0.5 ; ping -c1 -I p1 1.2.3.4 PING 1.2.3.4 (1.2.3.4): 56 data bytes RTNETLINK     answers: Invalid argument BUG: KASAN: slab-use-after-free in macvlan_forward_source     (drivers/net/macvlan.c:408 drivers/net/macvlan.c:444) Read of size 8 at addr ffff888016bb89c0 by task     e/175 CPU: 1 UID: 1000 PID: 175 Comm: e Not tainted 6.19.0-rc8+ #33 NONE Hardware name: QEMU Standard PC     (i440FX + PIIX, 1996), BIOS 1.14.0-2 04/01/2014 Call Trace: <IRQ> dump_stack_lvl (lib/dump_stack.c:123)     print_report (mm/kasan/report.c:379 mm/kasan/report.c:482) ? macvlan_forward_source     (drivers/net/macvlan.c:408 drivers/net/macvlan.c:444) kasan_report (mm/kasan/report.c:597) ?     macvlan_forward_source (drivers/net/macvlan.c:408 drivers/net/macvlan.c:444) macvlan_forward_source     (drivers/net/macvlan.c:408 drivers/net/macvlan.c:444) ? tasklet_init (kernel/softirq.c:983)     macvlan_handle_frame (drivers/net/macvlan.c:501) Allocated by task 169: kasan_save_stack     (mm/kasan/common.c:58) kasan_save_track (./arch/x86/include/asm/current.h:25 mm/kasan/common.c:70     mm/kasan/common.c:79) __kasan_kmalloc (mm/kasan/common.c:419) __kvmalloc_node_noprof     (./include/linux/kasan.h:263 mm/slub.c:5657 mm/slub.c:7140) alloc_netdev_mqs (net/core/dev.c:12012)     rtnl_create_link (net/core/rtnetlink.c:3648) rtnl_newlink (net/core/rtnetlink.c:3830     net/core/rtnetlink.c:3957 net/core/rtnetlink.c:4072) rtnetlink_rcv_msg (net/core/rtnetlink.c:6958)     netlink_rcv_skb (net/netlink/af_netlink.c:2550) netlink_unicast (net/netlink/af_netlink.c:1319     net/netlink/af_netlink.c:1344) netlink_sendmsg (net/netlink/af_netlink.c:1894) __sys_sendto     (net/socket.c:727 net/socket.c:742 net/socket.c:2206) __x64_sys_sendto (net/socket.c:2209) do_syscall_64     (arch/x86/entry/syscall_64.c:63 arch/x86/entry/syscall_64.c:94) entry_SYSCALL_64_after_hwframe     (arch/x86/entry/entry_64.S:131) Freed by task 169: kasan_save_stack (mm/kasan/common.c:58)     kasan_save_track (./arch/x86/include/asm/current.h:25 mm/kasan/common.c:70 mm/kasan/common.c:79)     kasan_save_free_info (mm/kasan/generic.c:587) __kasan_slab_free (mm/kasan/common.c:287) kfree     (mm/slub.c:6674 mm/slub.c:6882) rtnl_newlink (net/core/rtnetlink.c:3845 net/core/rtnetlink.c:3957     net/core/rtnetlink.c:4072) rtnetlink_rcv_msg (net/core/rtnetlink.c:6958) netlink_rcv_skb     (net/netlink/af_netlink.c:2550) netlink_unicast (net/netlink/af_netlink.c:1319     net/netlink/af_netlink.c:1344) netlink_sendmsg (net/netlink/af_netlink.c:1894) __sys_sendto     (net/socket.c:727 net/socket.c:742 net/socket.c:2206) __x64_sys_sendto (net/socket.c:2209) do_syscall_64     (arch/x86/entry/syscall_64.c:63 arch/x86/entry/syscall_64.c:94) entry_SYSCALL_64_after_hwframe     (arch/x86/entry/entry_64.S:131) (CVE-2026-23273)

Note that Nessus relies on the presence of the package as reported by the vendor.

Detections

Analytics

Linux Distros Unpatched Vulnerability : CVE-2026-23273

high Nessus Plugin ID 303222

Version 1.8

Version 1.7

Version 1.6

Version 1.5

Version 1.4

Version 1.3

Version 1.2

Version 1.1

Version 1.8 Apr 29, 2026, 12:50 PM Detection (updated detection logic) Plugin metadata Plugin Feed: 202604291250
Version 1.7 Apr 28, 2026, 8:33 AM Detection (updated detection logic) Plugin metadata Plugin Feed: 202604280833
Version 1.6 Apr 17, 2026, 10:08 PM Detection (updated detection logic) Plugin metadata Plugin Feed: 202604172208
Version 1.5 Apr 17, 2026, 5:33 AM Detection (updated detection logic) Plugin metadata Plugin Feed: 202604170533
Version 1.4 Apr 6, 2026, 3:39 PM CVSS metrics ("CVSSv3 score" set to 7.8) CVSS metrics ("CVSSv3 vector" set to "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H") CVSSv3 severity (based on None, severity increased from "Medium" to "High") Plugin Feed: 202604061539
Version 1.3 Mar 26, 2026, 1:29 AM Detection (updated detection logic) Plugin metadata Plugin Feed: 202603260129
Version 1.2 Mar 24, 2026, 8:21 PM CVSS metrics ("CVSSv2 score" set to 4.9) CVSS metrics ("CVSSv2 vector" set to "CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C") CVSS metrics ("CVSSv3 score" set to 6.3) CVSS metrics ("CVSSv3 vector" set to "CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:H") CVSSv2 severity (based on CVE-2026-23273, severity decreased from "High" to "Medium") CVSSv3 severity (based on None, severity decreased from "High" to "Medium") Detection (updated detection logic) Plugin metadata Plugin Feed: 202603242021
Version 1.1 Mar 21, 2026, 9:15 AM New Plugin Feed: 202603210915