The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - usb: gadget: f_mass_storage: Fix potential integer overflow in check_command_size_in_blocks() The     `check_command_size_in_blocks()` function calculates the data size in bytes by left shifting     `common->data_size_from_cmnd` by the block size (`common->curlun->blkbits`). However, it does not validate     whether this shift operation will cause an integer overflow. Initially, the block size is set up in     `fsg_lun_open()` , and the `common->data_size_from_cmnd` is set up in `do_scsi_command()`. During     initialization, there is no integer overflow check for the interaction between two variables. So if a     malicious USB host sends a SCSI READ or WRITE command requesting a large amount of data     (`common->data_size_from_cmnd`), the left shift operation can wrap around. This results in a truncated     data size, which can bypass boundary checks and potentially lead to memory corruption or out-of-bounds     accesses. Fix this by using the check_shl_overflow() macro to safely perform the shift and catch any     overflows. (CVE-2026-31412)

Note that Nessus relies on the presence of the package as reported by the vendor.

Detections

Analytics

Linux Distros Unpatched Vulnerability : CVE-2026-31412

high Nessus Plugin ID 305977

Version 1.5

Version 1.4

Version 1.3

Version 1.2

Version 1.1

Version 1.5 May 3, 2026, 4:59 AM Detection (updated detection logic) Plugin metadata Plugin Feed: 202605030459
Version 1.4 May 2, 2026, 11:12 PM Detection (updated detection logic) Plugin metadata Plugin Feed: 202605022312
Version 1.3 Apr 17, 2026, 5:33 AM Detection (updated detection logic) Plugin metadata Plugin Feed: 202604170533
Version 1.2 Apr 14, 2026, 10:48 PM CVSS metrics ("CVSSv2 score" set to 6.1) CVSS metrics ("CVSSv2 vector" set to "CVSS2#AV:L/AC:L/Au:N/C:P/I:C/A:P") CVSS metrics ("CVSSv3 score" set to 7.8) CVSS metrics ("CVSSv3 vector" set to "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H") CVSSv2 severity (based on CVE-2026-31412, severity decreased from "High" to "Medium") Detection (updated detection logic) Plugin metadata Plugin Feed: 202604142248
Version 1.1 Apr 11, 2026, 1:43 AM New Plugin Feed: 202604110143