The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - batman-adv: mcast: fix use-after-free in orig_node RCU release batadv_mcast_purge_orig() removes entries     from RCU-protected hlists but does not wait for an RCU grace period before returning. Concurrent RCU     readers may still accesses references to those entries at the point of removal. RCU-protected readers     trying to operate on entries like orig->mcast_want_all_ipv6_node will then access already freed memory.
    Fix this by moving batadv_mcast_purge_orig() to batadv_orig_node_release(), just before the call_rcu()     invocation. This ensures RCU readers that were active at purge time have drained before the orig_node     memory is reclaimed. (CVE-2026-64096)

Note that Nessus relies on the presence of the package as reported by the vendor.

Detections

Analytics

Linux Distros Unpatched Vulnerability : CVE-2026-64096

high Nessus Plugin ID 328247

Version 1.19