The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - bridge: mcast: Fix a possible use-after-free when removing a bridge port When per-VLAN multicast snooping     is enabled, the bridge iterates over all the bridge ports, disables the per-port multicast context on each     port and enables the per-{port, VLAN} multicast contexts instead. The reverse happens when per-VLAN     multicast snooping is disabled. When global multicast snooping is enabled, the bridge iterates over all     the bridge ports and enables the per-port multicast context on each port. The reverse happens when     multicast snooping is disabled. The above scheme can result in a situation where both types of contexts     (per-port and per-{port, VLAN}) are enabled on a single bridge port: # ip link add name br1 up type bridge     mcast_snooping 1 mcast_querier 1 vlan_filtering 1 # ip link add name dummy1 up master br1 type dummy # ip     link set dev br1 type bridge mcast_vlan_snooping 1 # ip link set dev br1 type bridge mcast_snooping 0 # ip     link set dev br1 type bridge mcast_snooping 1 This is not intended and it is a problem since the commit     cited below. Prior to this commit, when removing a bridge port, br_multicast_disable_port() would disable     the per-port multicast context and the per-{port, VLAN} multicast contexts would get disabled when     flushing VLANs. After this commit, br_multicast_disable_port() only disables the per-port multicast     context if per-VLAN multicast snooping is disabled. If both types of contexts were enabled on the port     when it was removed, the per-port multicast context would remain enabled when freeing the bridge port,     leading to a use-after-free [1]. Fix by preventing the bridge from enabling / disabling the per-port     multicast contexts when toggling global multicast snooping if per-VLAN multicast snooping is enabled. [1]     ODEBUG: free active (active state 0) object: ffff88810f8bda78 object type: timer_list hint:
    br_ip6_multicast_port_query_expired (net/bridge/br_multicast.c:1927) WARNING: lib/debugobjects.c:629 at     debug_print_object+0x1b1/0x3e0, CPU#5: swapper/5/0 [...] Call Trace: <IRQ> __debug_check_no_obj_freed     (lib/debugobjects.c:1116) kfree (mm/slub.c:2620 mm/slub.c:6250 mm/slub.c:6565) kobject_cleanup     (lib/kobject.c:689) rcu_do_batch (kernel/rcu/tree.c:2617) rcu_core (kernel/rcu/tree.c:2869)     handle_softirqs (kernel/softirq.c:622) __irq_exit_rcu (kernel/softirq.c:656 kernel/softirq.c:496     kernel/softirq.c:735) irq_exit_rcu (kernel/softirq.c:752) sysvec_apic_timer_interrupt     (arch/x86/kernel/apic/apic.c:1061 (discriminator 47) arch/x86/kernel/apic/apic.c:1061 (discriminator 47))     </IRQ> (CVE-2026-64032)

Note that Nessus relies on the presence of the package as reported by the vendor.

Detections

Analytics

Linux Distros Unpatched Vulnerability : CVE-2026-64032

high Nessus Plugin ID 328282

Version 1.12

Version 1.11

Version 1.9

Version 1.8

Version 1.7

Version 1.6

Version 1.5

Version 1.4

Version 1.3

Version 1.2

Version 1.1

Version 1.12 Aug 31, 2026, 4:25 PM CVSS metrics ("CVSSv2 score" set to 6.8) CVSS metrics ("CVSSv2 vector" set to "CVSS2#AV:L/AC:L/Au:S/C:C/I:C/A:C") Plugin Feed: 202608311625
Version 1.11 Aug 29, 2026, 12:30 AM CVSS metrics ("CVSSv2 vector" set to "CVSS2#AV:L/AC:M/Au:N/C:C/I:C/A:C") Detection (updated detection logic) Plugin metadata Plugin Feed: 202608290030
Version 1.9 Aug 24, 2026, 3:52 PM CVSS metrics ("CVSSv2 score" set to 6.8) CVSS metrics ("CVSSv2 vector" set to "CVSS2#AV:L/AC:L/Au:S/C:C/I:C/A:C") Plugin Feed: 202608241552
Version 1.8 Aug 22, 2026, 11:30 AM Detection (updated detection logic) Plugin metadata Plugin Feed: 202608221130
Version 1.7 Aug 21, 2026, 12:45 PM Detection (updated detection logic) Plugin metadata Plugin Feed: 202608211245
Version 1.6 Aug 6, 2026, 3:43 PM Detection (updated detection logic) Plugin metadata Plugin Feed: 202608061543
Version 1.5 Aug 1, 2026, 6:58 AM Detection (updated detection logic) Plugin metadata Plugin Feed: 202608010658
Version 1.4 Aug 1, 2026, 2:26 AM CVSS metrics ("CVSSv2 score" set to 6.9) CVSS metrics ("CVSSv2 vector" set to "CVSS2#AV:L/AC:M/Au:N/C:C/I:C/A:C") CVSSv2 severity (based on CVE-2026-64032, severity increased from "Low" to "Medium") Detection (updated detection logic) Plugin metadata Plugin Feed: 202608010226
Version 1.3 Jul 29, 2026, 6:41 AM Detection (updated detection logic) Plugin metadata Plugin Feed: 202607290641
Version 1.2 Jul 25, 2026, 1:06 PM Detection (updated detection logic) Plugin metadata Plugin Feed: 202607251306
Version 1.1 Jul 21, 2026, 12:41 AM New Plugin Feed: 202607210041