The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - In the Linux kernel, the following vulnerability has been resolved: net/smc: fix NULL dereference and UAF     in smc_tcp_syn_recv_sock() Syzkaller reported a panic in smc_tcp_syn_recv_sock() [1].
    smc_tcp_syn_recv_sock() is called in the TCP receive path (softirq) via icsk_af_ops->syn_recv_sock on the     clcsock (TCP listening socket). It reads sk_user_data to get the smc_sock pointer. However, when the SMC     listen socket is being closed concurrently, smc_close_active() sets clcsock->sk_user_data to NULL under     sk_callback_lock, and then the smc_sock itself can be freed via sock_put() in smc_release(). This leads to     two issues: 1) NULL pointer dereference: sk_user_data is NULL when accessed. 2) Use-after-free:
    sk_user_data is read as non-NULL, but the smc_sock is freed before its fields (e.g., queued_smc_hs,     ori_af_ops) are accessed. The race window looks like this (the syzkaller crash [1] triggers via the SYN     cookie path: tcp_get_cookie_sock() -> smc_tcp_syn_recv_sock(), but the normal tcp_check_req() path has the     same race): CPU A (softirq) CPU B (process ctx) tcp_v4_rcv() TCP_NEW_SYN_RECV: sk = req->rsk_listener     sock_hold(sk) /* No lock on listener */ smc_close_active(): write_lock_bh(cb_lock) sk_user_data = NULL     write_unlock_bh(cb_lock) ... smc_clcsock_release() sock_put(smc->sk) x2 -> smc_sock freed! tcp_check_req()     smc_tcp_syn_recv_sock(): smc = user_data(sk) -> NULL or dangling smc->queued_smc_hs -> crash! Note that     the clcsock and smc_sock are two independent objects with separate refcounts. TCP stack holds a reference     on the clcsock, which keeps it alive, but this does NOT prevent the smc_sock from being freed. Fix this by     using RCU and refcount_inc_not_zero() to safely access smc_sock. Since smc_tcp_syn_recv_sock() is called     in the TCP three-way handshake path, taking read_lock_bh on sk_callback_lock is too heavy and would not     survive a SYN flood attack. Using rcu_read_lock() is much more lightweight. - Set SOCK_RCU_FREE on the SMC     listen socket so that smc_sock freeing is deferred until after the RCU grace period. This guarantees the     memory is still valid when accessed inside rcu_read_lock(). - Use rcu_read_lock() to protect reading     sk_user_data. - Use refcount_inc_not_zero(&smc->sk.sk_refcnt) to pin the smc_sock. If the refcount has     already reached zero (close path completed), it returns false and we bail out safely. Note:
    smc_hs_congested() has a similar lockless read of sk_user_data without rcu_read_lock(), but it only checks     for NULL and accesses the global smc_hs_wq, never dereferencing any smc_sock field, so it is not affected.
    Reproducer was verified with mdelay injection and smc_run, the issue no longer occurs with this patch     applied. [1] https://syzkaller.appspot.com/bug?extid=827ae2bfb3a3529333e9 (CVE-2026-23450)

Note that Nessus relies on the presence of the package as reported by the vendor.

Detections

Analytics

Linux Distros Unpatched Vulnerability : CVE-2026-23450

critical Nessus Plugin ID 304974

Version 1.18

Version 1.17

Version 1.16

Version 1.15

Version 1.14

Version 1.12

Version 1.11

Version 1.10

Version 1.9

Version 1.8

Version 1.6

Version 1.5

Version 1.4

Version 1.3

Version 1.2

Version 1.1

Version 1.18 Jul 11, 2026, 6:31 AM Detection (updated detection logic) Plugin metadata Plugin Feed: 202607110631
Version 1.17 Jul 10, 2026, 10:18 AM Detection (updated detection logic) Plugin Feed: 202607101018
Version 1.16 Jul 7, 2026, 11:10 AM Detection (updated detection logic) Plugin metadata Plugin Feed: 202607071110
Version 1.15 Jul 7, 2026, 5:47 AM Detection (updated detection logic) Plugin metadata Plugin Feed: 202607070547
Version 1.14 Jul 4, 2026, 4:43 PM Detection (updated detection logic) Plugin metadata Plugin Feed: 202607041643
Version 1.12 Jul 2, 2026, 3:38 PM Detection (updated detection logic) Plugin metadata Plugin Feed: 202607021538
Version 1.11 Jun 30, 2026, 11:58 AM Detection (updated detection logic) Plugin metadata Plugin Feed: 202606301158
Version 1.10 Jun 28, 2026, 8:12 PM Detection (updated detection logic) Plugin metadata Plugin Feed: 202606282012
Version 1.9 Jun 25, 2026, 4:10 AM Detection (updated detection logic) Plugin metadata Plugin Feed: 202606250410
Version 1.8 May 25, 2026, 10:30 PM Detection (updated detection logic) Plugin metadata Plugin Feed: 202605252230
Version 1.6 May 20, 2026, 10:33 PM Detection (updated detection logic) Plugin metadata Plugin Feed: 202605202233
Version 1.5 May 3, 2026, 4:59 AM Detection (updated detection logic) Plugin metadata Plugin Feed: 202605030459
Version 1.4 May 2, 2026, 11:12 PM CVSS metrics ("CVSSv3 score" set to 9.8) CVSS metrics ("CVSSv3 vector" set to "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H") CVSSv3 severity (based on None, severity increased from "Medium" to "High") Detection (updated detection logic) Plugin metadata Plugin Feed: 202605022312
Version 1.3 Apr 9, 2026, 4:06 AM Plugin metadata Detection (updated detection logic) Plugin Feed: 202604090406
Version 1.2 Apr 7, 2026, 7:26 PM Detection (updated detection logic) Plugin metadata Plugin Feed: 202604071926
Version 1.1 Apr 5, 2026, 3:14 PM New Plugin Feed: 202604051514