The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - mptcp: close TOCTOU race while computing rcv_wnd The MPTCP output path access locklessly the MPTCP-level     ack_seq in multiple times, using possibly different values for the data_ack in the DSS option and to     compute the announced rcv wnd for the same packet. Refactor the cote to avoid inconsistencies which may     confuse the peer. Also ensure that the MPTCP level rcv wnd is updated only when the egress packet actually     contains a DSS ack. (CVE-2026-63867)

Note that Nessus relies on the presence of the package as reported by the vendor.

Detections

Analytics

Linux Distros Unpatched Vulnerability : CVE-2026-63867

high Nessus Plugin ID 328067

Version 1.3

Version 1.2

Version 1.1

Version 1.3 Aug 6, 2026, 3:43 PM CVSS metrics ("CVSSv2 score" set to 6.9) CVSS metrics ("CVSSv2 vector" set to "CVSS2#AV:L/AC:M/Au:N/C:C/I:C/A:C") CVSSv2 severity (based on CVE-2026-63867, severity increased from "Low" to "Medium") Detection (updated detection logic) Plugin metadata Plugin Feed: 202608061543
Version 1.2 Jul 25, 2026, 1:06 PM Detection (updated detection logic) Plugin metadata Plugin Feed: 202607251306
Version 1.1 Jul 21, 2026, 12:41 AM New Plugin Feed: 202607210041