The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - ksmbd: fix mechToken leak when SPNEGO decode fails after token alloc The kernel ASN.1 BER decoder calls     action callbacks incrementally as it walks the input. When ksmbd_decode_negTokenInit() reaches the     mechToken [2] OCTET STRING element, ksmbd_neg_token_alloc() allocates conn->mechToken immediately via     kmemdup_nul(). If a later element in the same blob is malformed, then the decoder will return nonzero     after the allocation is already live. This could happen if mechListMIC [3] overrunse the enclosing     SEQUENCE. decode_negotiation_token() then sets conn->use_spnego = false because both the negTokenInit and     negTokenTarg grammars failed. The cleanup at the bottom of smb2_sess_setup() is gated on use_spnego: if     (conn->use_spnego && conn->mechToken) { kfree(conn->mechToken); conn->mechToken = NULL; } so the kfree is     skipped, causing the mechToken to never be freed. This codepath is reachable pre-authentication, so     untrusted clients can cause slow memory leaks on a server without even being properly authenticated. Fix     this up by not checking check for use_spnego, as it's not required, so the memory will always be properly     freed. At the same time, always free the memory in ksmbd_conn_free() incase some other failure path forgot     to free it. (CVE-2026-31610)

Note that Nessus relies on the presence of the package as reported by the vendor.

Detections

Analytics

Linux Distros Unpatched Vulnerability : CVE-2026-31610

medium Nessus Plugin ID 310302

Version 1.7

Version 1.6

Version 1.5

Version 1.4

Version 1.3

Version 1.2

Version 1.1

Version 1.7 May 15, 2026, 12:01 PM CVSS metrics ("CVSSv2 score" set to 4.6) CVSS metrics ("CVSSv2 vector" set to "CVSS2#AV:L/AC:L/Au:S/C:N/I:N/A:C") Plugin Feed: 202605151201
Version 1.6 May 14, 2026, 3:47 AM CVSS metrics ("CVSSv2 score" set to 4.9) CVSS metrics ("CVSSv2 vector" set to "CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C") Detection (updated detection logic) Plugin Feed: 202605140347
Version 1.5 May 5, 2026, 11:15 AM CVSS metrics ("CVSSv2 score" set to 4.6) CVSS metrics ("CVSSv2 vector" set to "CVSS2#AV:L/AC:L/Au:S/C:N/I:N/A:C") Plugin Feed: 202605051115
Version 1.4 May 2, 2026, 11:12 PM CVSS metrics ("CVSSv2 score" set to 4.9) CVSS metrics ("CVSSv2 vector" set to "CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C") Detection (updated detection logic) Plugin metadata Plugin Feed: 202605022312
Version 1.3 Apr 30, 2026, 4:16 PM CVSS metrics ("CVSSv2 score" set to 4.6) CVSS metrics ("CVSSv2 vector" set to "CVSS2#AV:L/AC:L/Au:S/C:N/I:N/A:C") Plugin Feed: 202604301616
Version 1.2 Apr 30, 2026, 3:55 AM Detection (updated detection logic) Plugin metadata Plugin Feed: 202604300355
Version 1.1 Apr 25, 2026, 4:14 PM New Plugin Feed: 202604251614