The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free of a     deferred file_lock on SMB2_CLOSE then SMB2_CANCEL Commit f580d27e8928 (ksmbd: fix use-after-free of a     deferred file_lock on double SMB2_CANCEL) made smb2_cancel() skip a work whose state is     KSMBD_WORK_CANCELLED, so its cancel_fn cannot be fired a second time. But KSMBD_WORK has three states     (ACTIVE, CANCELLED, CLOSED), and the same freeing producer path is reached for CLOSED too: SMB2_CLOSE on     the locking handle -> set_close_state_blocked_works() sets the deferred work's state to KSMBD_WORK_CLOSED     and wakes the smb2_lock() worker. The worker takes the non-ACTIVE early-exit, locks_free_lock()s the     file_lock and, because the state is not KSMBD_WORK_CANCELLED, takes the STATUS_RANGE_NOT_LOCKED branch     with goto out2 -- which, like the cancelled branch, skips release_async_work(). The work stays on     conn->async_requests with a live cancel_fn = smb2_remove_blocked_lock pointing at the freed file_lock. A     subsequent SMB2_CANCEL for the same AsyncId then passes the KSMBD_WORK_CANCELLED-only guard (its state is     KSMBD_WORK_CLOSED), so smb2_cancel() fires cancel_fn again over the freed file_lock -- the same use-after-     free fixed, via SMB2_CLOSE instead of a first SMB2_CANCEL: BUG: KASAN: slab-use-after-free in
    __locks_delete_block __locks_delete_block locks_delete_block ksmbd_vfs_posix_lock_unblock     smb2_remove_blocked_lock smb2_cancel <- 2nd SMB2_CANCEL fires cancel_fn handle_ksmbd_work Allocated by     ...: locks_alloc_lock <- smb2_lock Freed by ...: locks_free_lock <- smb2_lock (non-ACTIVE early-exit) ...
    cache file_lock_cache of size 192 Reproduced on mainline 7.1-rc7 (which already contains f580d27e8928)     with KASAN by an authenticated SMB client; the double-SMB2_CANCEL control is silent on that kernel, so the     splat is attributable to the CLOSE trigger. Only an ACTIVE deferred work may have its cancel_fn fired:
    both terminal states (CANCELLED and CLOSED) reach the smb2_lock() early-exit that frees the file_lock and     skips release_async_work(). Guard on KSMBD_WORK_ACTIVE so any non-active work is skipped. (CVE-2026-64437)

Note that Nessus relies on the presence of the package as reported by the vendor.

Detections

Analytics

Linux Distros Unpatched Vulnerability : CVE-2026-64437

high Nessus Plugin ID 329950

Version 1.7

Version 1.6

Version 1.5

Version 1.4

Version 1.3

Version 1.2

Version 1.1

Version 1.7 Aug 7, 2026, 5:10 PM CVSS metrics ("CVSSv2 score" set to 6.1) CVSS metrics ("CVSSv2 vector" set to "CVSS2#AV:L/AC:L/Au:N/C:C/I:P/A:P") CVSSv2 severity (based on CVE-2026-64437, severity decreased from "High" to "Medium") Detection (updated detection logic) Plugin metadata Plugin Feed: 202608071710
Version 1.6 Aug 6, 2026, 3:43 PM Detection (updated detection logic) Plugin metadata Plugin Feed: 202608061543
Version 1.5 Aug 1, 2026, 2:26 AM Detection (updated detection logic) Plugin metadata Plugin Feed: 202608010226
Version 1.4 Jul 29, 2026, 9:32 PM Detection (updated detection logic) Plugin metadata Plugin Feed: 202607292132
Version 1.3 Jul 29, 2026, 12:29 AM Detection (updated detection logic) Plugin metadata Plugin Feed: 202607290029
Version 1.2 Jul 28, 2026, 3:13 AM CVSS metrics ("CVSSv2 score" set to 7.2) CVSS metrics ("CVSSv2 vector" set to "CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C") CVSS metrics ("CVSSv3 score" set to 8.8) CVSS metrics ("CVSSv3 vector" set to "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H") Detection (updated detection logic) Plugin metadata Plugin Feed: 202607280313
Version 1.1 Jul 26, 2026, 12:11 AM New Plugin Feed: 202607260011