The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - lib/crypto: mpi: Fix integer underflow in mpi_read_raw_from_sgl() Yiming reports an integer underflow in     mpi_read_raw_from_sgl() when subtracting lzeros from the unsigned nbytes. For this to happen, the     scatterlist sgl needs to occupy more bytes than the nbytes parameter and the first nbytes + 1 bytes     of the scatterlist must be zero. Under these conditions, the while loop iterating over the scatterlist     will count more zeroes than nbytes, subtract the number of zeroes from nbytes and cause the underflow.
    When commit 2d4d1eea540b (lib/mpi: Add mpi sgl helpers) originally introduced the bug, it couldn't be     triggered because all callers of mpi_read_raw_from_sgl() passed a scatterlist whose length was equal to     nbytes. However since commit 63ba4d67594a (KEYS: asymmetric: Use new crypto interface without     scatterlists), the underflow can now actually be triggered. When invoking a KEYCTL_PKEY_ENCRYPT system     call with a larger out_len than in_len and filling the in buffer with zeroes,     crypto_akcipher_sync_prep() will create an all-zero scatterlist used for both the src and dst member     of struct akcipher_request and thereby fulfil the conditions to trigger the bug: sys_keyctl()     keyctl_pkey_e_d_s() asymmetric_key_eds_op() software_key_eds_op() crypto_akcipher_sync_encrypt()     crypto_akcipher_sync_prep() crypto_akcipher_encrypt() rsa_enc() mpi_read_raw_from_sgl() To the user this     will be visible as a DoS as the kernel spins forever, causing soft lockup splats as a side effect. Fix it.
    (CVE-2026-43492)

Note that Nessus relies on the presence of the package as reported by the vendor.

Detections

Analytics

Linux Distros Unpatched Vulnerability : CVE-2026-43492

medium Nessus Plugin ID 315315

Version 1.15

Version 1.14

Version 1.13

Version 1.12

Version 1.11

Version 1.10

Version 1.8

Version 1.7

Version 1.6

Version 1.5

Version 1.4

Version 1.2

Version 1.15 Aug 1, 2026, 6:58 AM Detection (updated detection logic) Plugin metadata Plugin Feed: 202608010658
Version 1.14 Aug 1, 2026, 2:26 AM Detection (updated detection logic) Plugin metadata Plugin Feed: 202608010226
Version 1.13 Jul 29, 2026, 6:41 AM Detection (updated detection logic) Plugin metadata Plugin Feed: 202607290641
Version 1.12 Jul 25, 2026, 1:06 PM Detection (updated detection logic) Plugin metadata Plugin Feed: 202607251306
Version 1.11 Jul 21, 2026, 12:41 AM Detection (updated detection logic) Plugin Feed: 202607210041
Version 1.10 Jul 4, 2026, 4:43 PM Detection (updated detection logic) Plugin metadata Plugin Feed: 202607041643
Version 1.8 Jul 2, 2026, 3:38 PM Detection (updated detection logic) Plugin metadata Plugin Feed: 202607021538
Version 1.7 Jun 28, 2026, 7:50 AM Detection (updated detection logic) Plugin metadata Plugin Feed: 202606280750
Version 1.6 Jun 23, 2026, 12:13 AM Detection (updated detection logic) Plugin metadata Plugin Feed: 202606230013
Version 1.5 May 29, 2026, 5:27 PM Detection (updated detection logic) Plugin metadata Plugin Feed: 202605291727
Version 1.4 May 25, 2026, 10:30 PM Detection (updated detection logic) Plugin metadata Plugin Feed: 202605252230
Version 1.2 May 20, 2026, 3:58 PM CVSS metrics ("CVSSv2 score" set to 5.6. "CVSSv2 vector" set to "CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:C". "CVSSv3 score" set to 7.8. "CVSSv3 vector" set to "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H") CVSSv2 severity (based on CVE-2026-43492, severity decreased from "High" to "Medium") Detection (updated detection logic) New Plugin metadata Plugin Feed: 202605201558