The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - ipv4: fib: free fib_alias with kfree_rcu() on insert error path fib_table_insert() publishes new_fa into     the leaf's fa_list with fib_insert_alias() before calling the fib entry notifiers. When a notifier fails,     the error path removes new_fa with fib_remove_alias() (hlist_del_rcu) and frees it right away with     kmem_cache_free(). fib_table_lookup() walks that list under rcu_read_lock() only, so a concurrent lookup     that already reached new_fa keeps reading it after the free: BUG: KASAN: slab-use-after-free in     fib_table_lookup (net/ipv4/fib_trie.c:1601) Read of size 1 at addr ffff88810676d4eb by task exploit/297     Call Trace: fib_table_lookup (net/ipv4/fib_trie.c:1601) ip_route_output_key_hash_rcu     (net/ipv4/route.c:2814) ip_route_output_key_hash (net/ipv4/route.c:2705) __ip4_datagram_connect     (net/ipv4/datagram.c:49) udp_connect (net/ipv4/udp.c:2144) __sys_connect (net/socket.c:2167)
    __x64_sys_connect (net/socket.c:2173) do_syscall_64 entry_SYSCALL_64_after_hwframe which belongs to the     cache ip_fib_alias of size 56 Triggering the error path needs CAP_NET_ADMIN and a registered fib notifier     that can reject a route; a netdevsim device whose IPv4 FIB resource is exhausted is enough. Free new_fa     with alias_free_mem_rcu(), as fib_table_delete() already does for a fib_alias removed from the trie.
    (CVE-2026-64572)

Note that Nessus relies on the presence of the package as reported by the vendor.

Detections

Analytics

Linux Distros Unpatched Vulnerability : CVE-2026-64572

medium Nessus Plugin ID 332766

Version 1.8

Version 1.7

Version 1.6

Version 1.5

Version 1.4

Version 1.3

Version 1.8 Aug 28, 2026, 2:04 AM Detection (updated detection logic) Plugin metadata Plugin Feed: 202608280204
Version 1.7 Aug 21, 2026, 7:41 AM Detection (updated detection logic) Plugin metadata Plugin Feed: 202608210741
Version 1.6 Aug 14, 2026, 5:17 PM CVSS metrics ("CVSSv3 score" set to 4.7) CVSS metrics ("CVSSv3 vector" set to "CVSS:3.0/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:H") Detection (updated detection logic) Plugin metadata Plugin Feed: 202608141717
Version 1.5 Aug 7, 2026, 5:10 PM Detection (updated detection logic) Plugin metadata Plugin Feed: 202608071710
Version 1.4 Aug 7, 2026, 7:32 AM Detection (updated detection logic) Plugin metadata Plugin Feed: 202608070732
Version 1.3 Aug 6, 2026, 3:43 PM CVSS metrics ("CVSSv2 score" set to 5.6. "CVSSv2 vector" set to "CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:C". "CVSSv3 score" set to 6.1. "CVSSv3 vector" set to "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H") CVSSv2 severity (based on CVE-2026-64572, severity decreased from "High" to "Medium") CVSSv3 severity (based on None, severity decreased from "High" to "Medium") Detection (updated detection logic) New Plugin metadata Plugin Feed: 202608061543