The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - net: skmsg: preserve sg.copy across SG transforms The sk_msg sg.copy bitmap is part of the scatterlist     entry ownership state. A set bit tells sk_msg_compute_data_pointers() not to expose the entry through     writable BPF ctx->data. This protects entries backed by pages that are not private to the sk_msg, such as     splice-backed file page-cache pages. Several sk_msg transform paths move, copy, split, or compact     msg->sg.data[] entries without moving the matching sg.copy bit. This can make an externally backed entry     arrive at a new slot with a clear copy bit. A later SK_MSG verdict can then expose sg_virt(sge) as     writable ctx->data and BPF stores can modify the original page cache. Keep sg.copy synchronized with     sg.data[] whenever entries are transferred, shifted, split, or copied into a new sk_msg. Clear the bit     when an entry is replaced by a newly allocated private page or freed. This covers the BPF pull/push/pop     helpers, sk_msg_shift_left/right(), sk_msg_xfer(), and tls_split_open_record(), including the partial tail     entry created during TLS open-record splitting. (CVE-2026-63830)

Note that Nessus relies on the presence of the package as reported by the vendor.

Detections

Analytics

Linux Distros Unpatched Vulnerability : CVE-2026-63830

critical Nessus Plugin ID 327839

Version 1.28