The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 raw_send_hdrinc() validates that the caller-supplied     IPv4 header fits within the message length: iphlen = iph->ihl * 4; err = -EINVAL; if (iphlen > length)     goto error_free; if (iphlen >= sizeof(*iph)) { /* fix up saddr, tot_len, id, csum, transport_header */ }     It does not, however, reject ihl < 5. For such a packet the if (iphlen >= sizeof(*iph)) branch is     skipped, leaving the crafted iphdr untouched, but the packet is still handed to __ip_local_out() and     onward. Downstream consumers that read iph->ihl assume a sane value: net/ipv4/ah4.c:ah_output() in     particular subtracts sizeof(struct iphdr) from top_iph->ihl * 4 and passes the (signed-int-negative, then     cast to size_t) result to memcpy(), producing an OOB access of length close to SIZE_MAX and a host kernel     panic. An IPv4 header with ihl < 5 is malformed by definition (RFC 791: Internet Header Length is the     length of the internet header in 32 bit words ... Note that the minimum value for a correct header is     5.). The kernel should not be willing to inject such a packet into its own output path. Reject iphlen <     sizeof(*iph) alongside the existing iphlen > length check. This matches the principle that locally     constructed packets that re-enter the IP stack must pass the same basic sanity tests that a foreign packet     would be subjected to. Once this lands, the if (iphlen >= sizeof(*iph)) wrapper around the fixup branch     becomes redundant; left in place to keep the patch minimal and backport-friendly. A follow-up can unwrap     it. Note that commit 86f4c90a1c5c (ipv4, ipv6: ensure raw socket message is big enough to hold an IP     header) ensures the message buffer is large enough to hold an iphdr, but does not constrain the self-     reported iph->ihl. Reachability: the malformed packet source is any caller with CAP_NET_RAW, including an     unprivileged process in a user+net namespace on a kernel with CONFIG_USER_NS=y. The reproduced AH crash     also requires a matching xfrm AH policy on the outgoing route; a container granted CAP_NET_ADMIN can     install that state and policy in its netns. Loopback bypasses xfrm_output, so the trigger uses a real     netdev. Reproduced on UML + KASAN: kernel-mode fault at addr 0x0 with memcpy_orig at the crash site. Same     shape reproduces inside a rootless Docker container with --cap-add NET_ADMIN on a stock distro kernel.
    (CVE-2026-64114)

Note that Nessus relies on the presence of the package as reported by the vendor.

Detections

Analytics

Linux Distros Unpatched Vulnerability : CVE-2026-64114

high Nessus Plugin ID 328322

Version 1.6

Version 1.5

Version 1.4

Version 1.3

Version 1.2

Version 1.1

Version 1.6 Aug 1, 2026, 6:58 AM Detection (updated detection logic) Plugin metadata Plugin Feed: 202608010658
Version 1.5 Aug 1, 2026, 2:26 AM CVSS metrics ("CVSSv2 score" set to 6.1) CVSS metrics ("CVSSv2 vector" set to "CVSS2#AV:A/AC:L/Au:N/C:N/I:N/A:C") Detection (updated detection logic) Plugin metadata Plugin Feed: 202608010226
Version 1.4 Jul 29, 2026, 6:41 AM Detection (updated detection logic) Plugin metadata Plugin Feed: 202607290641
Version 1.3 Jul 25, 2026, 1:06 PM Detection (updated detection logic) Plugin metadata Plugin Feed: 202607251306
Version 1.2 Jul 21, 2026, 8:31 PM CVSS metrics ("CVSSv2 score" set to 4.9) CVSS metrics ("CVSSv2 vector" set to "CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C") CVSSv2 severity (based on CVE-2026-64114, severity increased from "Low" to "Medium") Detection (updated detection logic) Plugin metadata Plugin Feed: 202607212031
Version 1.1 Jul 21, 2026, 12:41 AM New Plugin Feed: 202607210041