The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - bpf: reject negative CO-RE accessor indices in bpf_core_parse_spec() CO-RE accessor strings are colon-     separated indices that describe a path from a root BTF type to a target field, e.g. 0:1:2 walks through     nested struct members. bpf_core_parse_spec() parses each component with sscanf(%d), so negative values     like -1 are silently accepted. The subsequent bounds checks (access_idx >= btf_vlen(t)) only guard the     upper bound and always pass for negative values because C integer promotion converts the __u16 btf_vlen     result to int, making the comparison (int)(-1) >= (int)(N) false for any positive N. When -1 reaches     btf_member_bit_offset() it gets cast to u32 0xffffffff, producing an out-of-bounds read far past the     members array. A crafted BPF program with a negative CO-RE accessor on any struct that exists in vmlinux     BTF (e.g. task_struct) crashes the kernel deterministically during BPF_PROG_LOAD on any system with     CONFIG_DEBUG_INFO_BTF=y (default on major distributions). The bug is reachable with CAP_BPF: BUG: unable     to handle page fault for address: ffffed11818b6626 #PF: supervisor read access in kernel mode #PF:
    error_code(0x0000) - not-present page Oops: Oops: 0000 [#1] SMP KASAN NOPTI CPU: 0 UID: 0 PID: 85 Comm:
    poc Not tainted 7.0.0-rc6 #18 PREEMPT(full) RIP: 0010:bpf_core_parse_spec (tools/lib/bpf/relo_core.c:354)     RAX: 00000000ffffffff Call Trace: <TASK> bpf_core_calc_relo_insn (tools/lib/bpf/relo_core.c:1321)     bpf_core_apply (kernel/bpf/btf.c:9507) check_core_relo (kernel/bpf/verifier.c:19475) bpf_check     (kernel/bpf/verifier.c:26031) bpf_prog_load (kernel/bpf/syscall.c:3089) __sys_bpf     (kernel/bpf/syscall.c:6228) </TASK> CO-RE accessor indices are inherently non-negative (struct member     index, array element index, or enumerator index), so reject them immediately after parsing.
    (CVE-2026-45839)

Note that Nessus relies on the presence of the package as reported by the vendor.

Detections

Analytics

Linux Distros Unpatched Vulnerability : CVE-2026-45839

medium Nessus Plugin ID 317077

Version 1.5

Version 1.4

Version 1.3

Version 1.1

Version 1.5 Jun 23, 2026, 12:13 AM Detection (updated detection logic) Plugin metadata Plugin Feed: 202606230013
Version 1.4 Jun 21, 2026, 6:24 PM Detection (updated detection logic) Plugin metadata Plugin Feed: 202606211824
Version 1.3 Jun 9, 2026, 4:51 AM CVSS metrics ("CVSSv2 score" set to 7.2. "CVSSv3 vector" set to "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H". "CVSSv2 vector" set to "CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C") CVSSv2 severity (based on CVE-2026-45839, severity decreased from "High" to "Medium". based on CVE-2026-45839, severity increased from "Medium" to "High") CVSSv3 severity (based on None, severity decreased from "High" to "Medium") Detection (updated detection logic) Plugin metadata Plugin Feed: 202606090451
Version 1.1 May 29, 2026, 5:27 PM New Plugin Feed: 202605291727