The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - libceph: fix two unsafe bare decodes in decode_lockers() decode_lockers() in cls_lock_client.c contains     two bare decode operations that allow a malicious or compromised OSD to trigger slab-out-of-bounds reads:
    1. ceph_decode_32(p) at the num_lockers field has no preceding bounds check. ceph_start_decoding() accepts     struct_len=0 as valid -- the internal ceph_decode_need(p, end, 0, bad) always passes -- so when an OSD     sends struct_len=0, ceph_start_decoding() returns success with p == end. The immediately following bare     ceph_decode_32(p) then reads 4 bytes past the validated buffer boundary. The garbage value is passed     directly to kzalloc_objs() as the locker count. The sibling function decode_watchers() in osd_client.c     already uses ceph_decode_32_safe() after its own ceph_start_decoding() call. decode_lockers() was the only     site using the bare variant. 2. ceph_decode_8(p) after the decode_locker() loop has no preceding bounds     check. If an OSD crafts num_lockers such that the loop advances p exactly to end, the subsequent bare     ceph_decode_8(p) reads one byte past the validated buffer boundary. The result is passed directly into
    *type, which is used as a lock type discriminator by callers, giving an OSD-controlled one-byte OOB read     with direct influence over the lock type field. Fix both by replacing bare operations with their safe     variants: ceph_decode_32(p) -> ceph_decode_32_safe(p, end, *num_lockers, err_inval) ceph_decode_8(p) ->     ceph_decode_8_safe(p, end, *type, err_free_lockers) The goto targets differ intentionally: err_inval: is a     new label returning -EINVAL directly. It is used for the pre-allocation failure path where *lockers is not     yet allocated and must not be passed to ceph_free_lockers(). err_free_lockers: is the existing label. It     is used for the post-allocation failure path where *lockers is allocated and must be freed. ret is set to
    -EINVAL before ceph_decode_8_safe() so that err_free_lockers returns the correct error code on bounds     violation. Without this, err_free_lockers would return a stale ret value (0 from the successful     decode_locker() loop), silently swallowing the error. -EINVAL is correct for both failure paths. The data     received from the OSD is structurally malformed. -ENOMEM would misrepresent the failure class to callers     and to stable@ backporters triaging error paths. Attacker model: a malicious or compromised OSD in a     multi-tenant Ceph deployment can trigger this against any kernel client that issues the lock.get_info     class method (e.g. during RBD exclusive lock acquisition). [ idryomov: trim changelog, formatting ]     (CVE-2026-68082)

Note that Nessus relies on the presence of the package as reported by the vendor.

Detections

Analytics

Linux Distros Unpatched Vulnerability : CVE-2026-68082

critical Nessus Plugin ID 333534

Version 1.10

Version 1.9

Version 1.8

Version 1.7

Version 1.6

Version 1.5

Version 1.4

Version 1.3

Version 1.2

Version 1.1

Version 1.10 Aug 28, 2026, 12:16 PM CVSS metrics ("CVSSv2 score" set to 10.0) CVSS metrics ("CVSSv2 vector" set to "CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C") CVSSv2 severity (based on CVE-2026-68082, severity increased from "Low" to "High") Plugin Feed: 202608281216
Version 1.9 Aug 28, 2026, 2:04 AM CVSS metrics ("CVSSv2 score" set to 3.6) CVSS metrics ("CVSSv2 vector" set to "CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:P") CVSSv2 severity (based on CVE-2026-68082, severity decreased from "High" to "Low") Detection (updated detection logic) Plugin metadata Plugin Feed: 202608280204
Version 1.8 Aug 27, 2026, 3:41 PM CVSS metrics ("CVSSv2 score" set to 10.0) CVSS metrics ("CVSSv2 vector" set to "CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C") CVSSv2 severity (based on CVE-2026-68082, severity increased from "Low" to "High") Plugin Feed: 202608271541
Version 1.7 Aug 26, 2026, 1:14 PM CVSS metrics ("CVSSv2 score" set to 3.6) CVSS metrics ("CVSSv2 vector" set to "CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:P") CVSSv2 severity (based on CVE-2026-68082, severity decreased from "High" to "Low") Detection (updated detection logic) Plugin metadata Plugin Feed: 202608261314
Version 1.6 Aug 21, 2026, 11:26 PM CVSS metrics ("CVSSv2 score" set to 10.0) CVSS metrics ("CVSSv2 vector" set to "CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C") CVSSv2 severity (based on CVE-2026-68082, severity increased from "Low" to "High") Plugin Feed: 202608212326
Version 1.5 Aug 21, 2026, 7:41 AM Detection (updated detection logic) Plugin metadata Plugin Feed: 202608210741
Version 1.4 Aug 14, 2026, 5:17 PM CVSS metrics ("CVSSv3 score" set to 9.8) CVSS metrics ("CVSSv3 vector" set to "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H") Detection (updated detection logic) Plugin metadata Plugin Feed: 202608141717
Version 1.3 Aug 13, 2026, 5:24 AM Detection (updated detection logic) Plugin metadata Plugin Feed: 202608130524
Version 1.2 Aug 12, 2026, 7:14 PM CVSS metrics ("CVSSv2 score" set to 3.6) CVSS metrics ("CVSSv2 vector" set to "CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:P") CVSS metrics ("CVSSv3 score" set to 8.2) CVSS metrics ("CVSSv3 vector" set to "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H") CVSSv2 severity (based on CVE-2026-68082, severity decreased from "High" to "Low") Detection (updated detection logic) Plugin metadata Plugin Feed: 202608121914
Version 1.1 Aug 8, 2026, 10:56 PM New Plugin Feed: 202608082256