The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - io_uring/rsrc: reject zero-length fixed buffer import validate_fixed_range() admits buf_addr at the exact     end of the registered region when len is zero, because the check uses strict greater-than (buf_end >     imu->ubuf + imu->len). io_import_fixed() then computes offset == imu->len, which causes the bvec skip     logic to advance past the last bio_vec entry and read bv_offset from out-of-bounds slab memory. Return     early from io_import_fixed() when len is zero. A zero-length import has no data to transfer and should not     walk the bvec array at all. BUG: KASAN: slab-out-of-bounds in io_import_reg_buf+0x697/0x7f0 Read of size 4     at addr ffff888002bcc254 by task poc/103 Call Trace: io_import_reg_buf+0x697/0x7f0     io_write_fixed+0xd9/0x250 __io_issue_sqe+0xad/0x710 io_issue_sqe+0x7d/0x1100 io_submit_sqes+0x86a/0x23c0
    __do_sys_io_uring_enter+0xa98/0x1590 Allocated by task 103: The buggy address is located 12 bytes to the     right of allocated 584-byte region [ffff888002bcc000, ffff888002bcc248) (CVE-2026-43006)

Note that Nessus relies on the presence of the package as reported by the vendor.

Detections

Analytics

Linux Distros Unpatched Vulnerability : CVE-2026-43006

high Nessus Plugin ID 311560

Version 1.6

Version 1.5

Version 1.4

Version 1.3

Version 1.2

Version 1.1

Version 1.6 May 20, 2026, 10:33 PM CVSS metrics ("CVSSv2 score" set to 6.6) CVSS metrics ("CVSSv2 vector" set to "CVSS2#AV:L/AC:L/Au:N/C:C/I:N/A:C") CVSSv2 severity (based on CVE-2026-43006, severity decreased from "High" to "Medium") Detection (updated detection logic) Plugin metadata Plugin Feed: 202605202233
Version 1.5 May 8, 2026, 1:55 AM Detection (updated detection logic) Plugin metadata Plugin Feed: 202605080155
Version 1.4 May 6, 2026, 9:10 AM CVSSv3 score source (changed from "CVE-2026-43006" to none) Plugin Feed: 202605060910
Version 1.3 May 5, 2026, 10:13 PM CVSS metrics ("CVSSv2 score" set to 7.2) CVSS metrics ("CVSSv2 vector" set to "CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C") CVSS temporal metrics ("CVSSv2 temporal vector" set to "CVSS2#E:U/RL:U/RC:C") CVSSv2 score source (set to "CVE-2026-43006") Detection (updated detection logic) Plugin metadata Plugin Feed: 202605052213
Version 1.2 May 4, 2026, 9:33 AM CVSS metrics ("CVSSv3 score" set to 7.1) CVSS metrics ("CVSSv3 vector" set to "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H") CVSS temporal metrics ("CVSSv3 temporal vector" set to "CVSS:3.0/E:U/RL:U/RC:C") CVSSv3 score source (set to "CVE-2026-43006") Plugin Feed: 202605040933
Version 1.1 May 2, 2026, 11:12 PM New Plugin Feed: 202605022312