The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - smack: /smack/doi: accept previously used values Writing to /smack/doi a value that has ever been written     there in the past disables networking for non-ambient labels. E.g. # cat /smack/doi 3 # netlabelctl -p     cipso list Configured CIPSO mappings (1) DOI value : 3 mapping type : PASS_THROUGH # netlabelctl -p map     list Configured NetLabel domain mappings (3) domain: _ (IPv4) protocol: UNLABELED domain: DEFAULT (IPv4)     protocol: CIPSO, DOI = 3 domain: DEFAULT (IPv6) protocol: UNLABELED # cat /smack/ambient _ # cat     /proc/$$/attr/smack/current _ # ping -c1 10.1.95.12 64 bytes from 10.1.95.12: icmp_seq=1 ttl=64 time=0.964     ms # echo foo >/proc/$$/attr/smack/current # ping -c1 10.1.95.12 64 bytes from 10.1.95.12: icmp_seq=1     ttl=64 time=0.956 ms unknown option 86 # echo 4 >/smack/doi # echo 3 >/smack/doi !> [ 214.050395]     smk_cipso_doi:691 cipso add rc = -17 # echo 3 >/smack/doi !> [ 249.402261] smk_cipso_doi:678 remove rc =
    -2 !> [ 249.402261] smk_cipso_doi:691 cipso add rc = -17 # ping -c1 10.1.95.12 !!> ping: 10.1.95.12:
    Address family for hostname not supported # echo _ >/proc/$$/attr/smack/current # ping -c1 10.1.95.12 64     bytes from 10.1.95.12: icmp_seq=1 ttl=64 time=0.617 ms This happens because Smack keeps decommissioned     DOIs, fails to re-add them, and consequently refuses to add the default domain map: # netlabelctl -p     cipso list Configured CIPSO mappings (2) DOI value : 3 mapping type : PASS_THROUGH DOI value : 4 mapping     type : PASS_THROUGH # netlabelctl -p map list Configured NetLabel domain mappings (2) domain: _ (IPv4)     protocol: UNLABELED !> (no ipv4 map for default domain here) domain: DEFAULT (IPv6) protocol: UNLABELED     Fix by clearing decommissioned DOI definitions and serializing concurrent DOI updates with a new lock.
    Also: - allow /smack/doi to live unconfigured, since adding a map (netlbl_cfg_cipsov4_map_add) may fail.
    CIPSO_V4_DOI_UNKNOWN(0) indicates the unconfigured DOI - add new DOI before removing the old default map,     so the old map remains if the add fails (2008-02-04, Casey Schaufler) (CVE-2025-71304)

Note that Nessus relies on the presence of the package as reported by the vendor.

Detections

Analytics

Linux Distros Unpatched Vulnerability : CVE-2025-71304

medium Nessus Plugin ID 317213

Version 1.4

Version 1.3

Version 1.2

Version 1.1

Version 1.4 Jun 26, 2026, 4:08 PM CVSS metrics ("CVSSv2 score" set to 4.6) CVSS metrics ("CVSSv2 vector" set to "CVSS2#AV:L/AC:L/Au:S/C:N/I:N/A:C") CVSS metrics ("CVSSv3 score" set to 5.5) CVSS metrics ("CVSSv3 vector" set to "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H") CVSSv2 severity (based on CVE-2025-71304, severity decreased from "High" to "Medium") CVSSv3 severity (based on None, severity decreased from "High" to "Medium") Plugin Feed: 202606261608
Version 1.3 Jun 4, 2026, 12:07 AM CVSS metrics ("CVSSv2 score" set to 8.3) CVSS metrics ("CVSSv2 vector" set to "CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:C") CVSS metrics ("CVSSv3 score" set to 8.8) CVSS metrics ("CVSSv3 vector" set to "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H") CVSS temporal metrics ("CVSSv2 temporal vector" set to "CVSS2#E:U/RL:U/RC:C") CVSS temporal metrics ("CVSSv3 temporal vector" set to "CVSS:3.0/E:U/RL:U/RC:C") Detection (updated detection logic) Plugin metadata Plugin Feed: 202606040007
Version 1.2 May 30, 2026, 6:41 AM Detection (Plugin has been deprecated) Plugin Feed: 202605300641
Version 1.1 May 29, 2026, 5:27 PM New Plugin Feed: 202605291727