The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - xen/privcmd: fix double free via VMA splitting privcmd_vm_ops defines .close (privcmd_close), but neither     .may_split nor .open. When userspace does a partial munmap() on a privcmd mapping, the kernel splits the     VMA via __split_vma(). Since may_split is NULL, the split is allowed. vm_area_dup() copies vm_private_data     (a pages array allocated in alloc_empty_pages()) into the new VMA without any fixup, because there is no     .open callback. Both VMAs now point to the same pages array. When the unmapped portion is closed,     privcmd_close() calls: - xen_unmap_domain_gfn_range() - xen_free_unpopulated_pages() - kvfree(pages) The     surviving VMA still holds the dangling pointer. When it is later destroyed, the same sequence runs again,     which leads to a double free. Fix this issue by adding a .may_split callback denying the VMA split. This     is XSA-487 / CVE-2026-31787 (CVE-2026-31787)

Note that Nessus relies on the presence of the package as reported by the vendor.

Detections

Analytics

Linux Distros Unpatched Vulnerability : CVE-2026-31787

high Nessus Plugin ID 310803

Version 1.7