The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - inet: frags: fix use-after-free caused by the fqdir_pre_exit() flush On netns teardown, fqdir_pre_exit()     walks the fqdir rhashtable and flushes every fragment queue that is not yet complete using     inet_frag_queue_flush(). That helper frees all the skbs queued on the fragment queue but does not set     INET_FRAG_COMPLETE, and leaves q->fragments_tail and q->last_run_head pointing at the freed skbs. The     queue itself stays in the rhashtable. fqdir_pre_exit() first lowers high_thresh to 0 to stop new queue     lookups, but it cannot stop a fragment that already obtained the queue through inet_frag_find() earlier     and stalled just before taking the queue lock. Once that fragment resumes after the flush and takes the     queue lock, it passes the INET_FRAG_COMPLETE check and then dereferences the freed fragments_tail.
    inet_frag_queue_insert() reads FRAG_CB() and ->len of that pointer and, on the append path, writes
    ->next_frag, causing a slab use-after-free. IPv6, nf_conntrack_reasm6 and 6lowpan reassembly share the     same flush path and are affected as well. Reset rb_fragments, fragments_tail and last_run_head in     inet_frag_queue_flush() so a flushed queue no longer points at the freed skbs. A fragment that resumes     after the flush and takes the queue lock then finds an empty queue and starts a new run instead of     dereferencing the freed fragments_tail. ip_frag_reinit() already performed this reset after its own flush,     so drop the now duplicate code there. (CVE-2026-53175)

Note that Nessus relies on the presence of the package as reported by the vendor.

Detections

Analytics

Linux Distros Unpatched Vulnerability : CVE-2026-53175

high Nessus Plugin ID 323386

Version 1.5

Version 1.4

Version 1.2

Version 1.1

Version 1.5 Jul 6, 2026, 3:53 PM Detection (updated detection logic) Plugin metadata Plugin Feed: 202607061553
Version 1.4 Jul 2, 2026, 3:38 PM CVSS metrics ("CVSSv3 vector" set to "CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H") Detection (updated detection logic) Plugin Feed: 202607021538
Version 1.2 Jun 30, 2026, 11:58 AM Detection (updated detection logic) Plugin metadata Plugin Feed: 202606301158
Version 1.1 Jun 28, 2026, 2:21 PM New Plugin Feed: 202606281421