The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Bluetooth: eir: Fix stack OOB write when prepending the Flags AD eir_create_adv_data() builds the     advertising data into a fixed-size buffer (size, 31 for the legacy path). It may prepend a 3-byte     Flags AD structure (LE_AD_NO_BREDR on an LE-only controller) and then copies the per-instance data     without checking that it still fits: memcpy(ptr, adv->adv_data, adv->adv_data_len); tlv_data_max_len()     only reserves those 3 bytes when the user-supplied flags carry a managed-flags bit, so an instance added     with flags == 0 is accepted with adv_data_len up to the full buffer. At advertise time the flags are still     prepended, and the memcpy() writes 3 + adv_data_len bytes into the size-byte buffer: BUG: KASAN: stack-     out-of-bounds in eir_create_adv_data (net/bluetooth/eir.c:301) Write of size 31 at addr ffff88800a547bdc     by task kworker/u9:0/65 Workqueue: hci0 hci_cmd_sync_work __asan_memcpy (mm/kasan/shadow.c:106)     eir_create_adv_data (net/bluetooth/eir.c:301) hci_update_adv_data_sync (net/bluetooth/hci_sync.c:1310)     hci_schedule_adv_instance_sync (net/bluetooth/hci_sync.c:1817) hci_cmd_sync_work     (net/bluetooth/hci_sync.c:332) This frame has 1 object: [32, 64) 'cp' The Flags structure is added by     the kernel, not requested by userspace, so only prepend it when it fits together with the instance     advertising data; when there is no room for both, drop the flags rather than the user-provided data.
    Reachable by a local user with CAP_NET_ADMIN owning an LE-only controller on the legacy advertising path.
    (CVE-2026-64539)

Note that Nessus relies on the presence of the package as reported by the vendor.

Detections

Analytics

Linux Distros Unpatched Vulnerability : CVE-2026-64539

high Nessus Plugin ID 330247

Version 1.10

Version 1.9

Version 1.8

Version 1.7

Version 1.6

Version 1.5

Version 1.4

Version 1.3

Version 1.2

Version 1.1

Version 1.10 Aug 14, 2026, 5:17 PM CVSS metrics ("CVSSv2 score" set to 5.8) CVSS metrics ("CVSSv2 vector" set to "CVSS2#AV:A/AC:L/Au:N/C:P/I:P/A:P") Detection (updated detection logic) Plugin metadata Plugin Feed: 202608141717
Version 1.9 Aug 12, 2026, 9:10 AM CVSS metrics ("CVSSv2 score" set to 6.8) CVSS metrics ("CVSSv2 vector" set to "CVSS2#AV:L/AC:L/Au:S/C:C/I:C/A:C") Plugin Feed: 202608120910
Version 1.8 Aug 7, 2026, 9:55 PM Detection (updated detection logic) Plugin metadata Plugin Feed: 202608072155
Version 1.7 Aug 6, 2026, 3:43 PM Detection (updated detection logic) Plugin metadata Plugin Feed: 202608061543
Version 1.6 Aug 1, 2026, 2:26 AM Detection (updated detection logic) Plugin metadata Plugin Feed: 202608010226
Version 1.5 Jul 31, 2026, 1:14 PM CVSS metrics ("CVSSv3 score" set to 7.8) CVSS metrics ("CVSSv3 vector" set to "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H") Plugin Feed: 202607311314
Version 1.4 Jul 29, 2026, 9:32 PM Detection (updated detection logic) Plugin Feed: 202607292132
Version 1.3 Jul 29, 2026, 3:16 PM Detection (updated detection logic) Plugin metadata Plugin Feed: 202607291516
Version 1.2 Jul 29, 2026, 12:29 AM CVSS metrics ("CVSSv2 score" set to 5.8) CVSS metrics ("CVSSv2 vector" set to "CVSS2#AV:A/AC:L/Au:N/C:P/I:P/A:P") CVSS metrics ("CVSSv3 score" set to 8.0) CVSS metrics ("CVSSv3 vector" set to "CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H") CVSSv2 severity (based on CVE-2026-64539, severity decreased from "High" to "Medium") Detection (updated detection logic) Plugin metadata Plugin Feed: 202607290029
Version 1.1 Jul 28, 2026, 1:30 PM New Plugin Feed: 202607281330