The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - vfio/pci: Latch disable_idle_d3 per device When disable_idle_d3 was introduced in vfio-pci, it directly     manipulated the device power state with pci_set_power_state(). There were no refcounts to maintain or     balanced operations, we could unconditionally bring the device to D0 and conditionally move it to D3hot.
    Therefore the module parameter was made writable. Later, in commit c61302aa48f7 (vfio/pci: Move module     parameters to vfio_pci.c), as part of the vfio-pci-core split, the writable aspect of the module     parameter was nullified. The parameter value could still be changed through sysfs, but the vfio-pci driver     latched the values into vfio-pci-core globals at module init. Loading the vfio-pci module, or unloading     and reloading, with non-default or different values could change the globals relative to existing devices     bound to vfio-pci variant drivers. Runtime PM was introduced in commit 7ab5e10eda02 (vfio/pci: Move the     unused device into low power state with runtime PM), which marks the point where power states became     refcounted. PM get and put operations need to be balanced, but the same module operations noted above can     change the global variables relative to those devices already bound to vfio-pci variant drivers. This     introduces a window where PM operations can now become unbalanced. To resolve this with a narrow footprint     for stable backports, the disable_idle_d3 flag is latched into the vfio_pci_core_device at the time of     initialization, such that the device always operates with a consistent value. NB.
    vfio_pci_dev_set_try_reset() now unconditionally raises the runtime PM usage count around bus reset to     account for disable_idle_d3 becoming a per-device rather than global flag. When this flag is set, the     additional get/put pair is harmless and allows continued use of the shared     vfio_pci_dev_set_pm_runtime_get() helper. (CVE-2026-64476)

Note that Nessus relies on the presence of the package as reported by the vendor.

Detections

Analytics

Linux Distros Unpatched Vulnerability : CVE-2026-64476

high Nessus Plugin ID 329962

Version 1.7

Version 1.6

Version 1.5

Version 1.4

Version 1.3

Version 1.2

Version 1.1

Version 1.7 Aug 14, 2026, 5:17 PM Detection (updated detection logic) Plugin metadata Plugin Feed: 202608141717
Version 1.6 Aug 7, 2026, 5:10 PM CVSS metrics ("CVSSv3 score" set to 7.1) CVSS metrics ("CVSSv3 vector" set to "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H") CVSSv3 severity (based on None, severity increased from "Medium" to "High") Detection (updated detection logic) Plugin metadata Plugin Feed: 202608071710
Version 1.5 Aug 6, 2026, 3:43 PM Detection (updated detection logic) Plugin metadata Plugin Feed: 202608061543
Version 1.4 Jul 30, 2026, 10:03 PM Detection (updated detection logic) Plugin metadata Plugin Feed: 202607302203
Version 1.3 Jul 29, 2026, 12:29 AM Detection (updated detection logic) Plugin metadata Plugin Feed: 202607290029
Version 1.2 Jul 28, 2026, 3:13 AM CVSS metrics ("CVSSv2 score" set to 5.6) CVSS metrics ("CVSSv2 vector" set to "CVSS2#AV:L/AC:L/Au:N/C:N/I:P/A:C") CVSS metrics ("CVSSv3 score" set to 6.3) CVSS metrics ("CVSSv3 vector" set to "CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H") CVSSv2 severity (based on CVE-2026-64476, severity decreased from "High" to "Medium") CVSSv3 severity (based on None, severity decreased from "High" to "Medium") Detection (updated detection logic) Plugin metadata Plugin Feed: 202607280313
Version 1.1 Jul 26, 2026, 12:11 AM New Plugin Feed: 202607260011