The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - exfat: fix potential use-after-free in exfat_find_dir_entry() In exfat_find_dir_entry(), the buffer_head     obtained from exfat_get_dentry() is released with brelse(bh) before the fall-through TYPE_EXTEND branch     reads the directory entry through ep (which points into bh->b_data): brelse(bh); if (entry_type ==     TYPE_EXTEND) { ... len = exfat_extract_uni_name(ep, entry_uniname); ... } After brelse() drops our     reference, nothing guarantees that the underlying page backing bh->b_data remains valid for the subsequent     exfat_extract_uni_name() read. This is the same pattern fixed in commit fc961522ddbd (exfat: Fix     potential use after free in exfat_load_upcase_table()). Move brelse(bh) so it runs after ep is no longer     dereferenced on each branch. Confirmed on QEMU x86_64 with CONFIG_KASAN=y + CONFIG_DEBUG_PAGEALLOC=y +     CONFIG_PAGE_POISONING=y on linux-next, using a crafted exFAT image (long filename with same-hash     collisions forcing the TYPE_EXTEND path). With a debug-only invalidate_bdev() inserted between brelse(bh)     and the ep read to make the stale-deref window deterministic, the unpatched kernel faults: BUG: KASAN:
    use-after-free in exfat_find_dir_entry+0x133b/0x15a0 BUG: unable to handle page fault for address:
    ffff88801a5fa0c2 Oops: 0000 [#1] SMP DEBUG_PAGEALLOC KASAN NOPTI RIP:
    0010:exfat_find_dir_entry+0x1188/0x15a0 With this patch applied, the same instrumented harness completes     cleanly under the same sanitizer stack. I have not reproduced a crash on an uninstrumented kernel under     ordinary reclaim; the instrumented A/B establishes the lifetime violation and that the patch closes it,     not an unaided triggerability claim. (CVE-2026-63808)

Note that Nessus relies on the presence of the package as reported by the vendor.

Detections

Analytics

Linux Distros Unpatched Vulnerability : CVE-2026-63808

critical Nessus Plugin ID 327889

Version 1.8

Version 1.7

Version 1.6

Version 1.5

Version 1.4

Version 1.3

Version 1.2

Version 1.1

Version 1.8 Aug 28, 2026, 2:04 AM CVSS metrics ("CVSSv2 score" set to 6.6) CVSS metrics ("CVSSv2 vector" set to "CVSS2#AV:L/AC:L/Au:N/C:C/I:N/A:C") CVSSv2 severity (based on CVE-2026-63808, severity decreased from "High" to "Medium") Detection (updated detection logic) Plugin metadata Plugin Feed: 202608280204
Version 1.7 Aug 25, 2026, 5:40 AM CVSS metrics ("CVSSv2 score" set to 10.0) CVSS metrics ("CVSSv2 vector" set to "CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C") CVSSv2 severity (based on CVE-2026-63808, severity increased from "Medium" to "High") Plugin Feed: 202608250540
Version 1.6 Aug 21, 2026, 7:41 AM Detection (updated detection logic) Plugin metadata Plugin Feed: 202608210741
Version 1.5 Aug 14, 2026, 5:17 PM Detection (updated detection logic) Plugin metadata Plugin Feed: 202608141717
Version 1.4 Aug 6, 2026, 3:43 PM Detection (updated detection logic) Plugin metadata Plugin Feed: 202608061543
Version 1.3 Jul 25, 2026, 1:06 PM Detection (updated detection logic) Plugin metadata Plugin Feed: 202607251306
Version 1.2 Jul 21, 2026, 12:41 AM CVSS metrics ("CVSSv2 score" set to 6.6) CVSS metrics ("CVSSv2 vector" set to "CVSS2#AV:L/AC:L/Au:N/C:C/I:N/A:C") CVSSv2 severity (based on CVE-2026-63808, severity decreased from "High" to "Medium") Detection (updated detection logic) Plugin metadata Plugin Feed: 202607210041
Version 1.1 Jul 20, 2026, 12:56 AM New Plugin Feed: 202607200056