The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - smb/client: handle overlapping allocated ranges in fallocate smb3_simple_fallocate_range() can skip holes     when an allocated range returned by the server starts before the current fallocate offset. The skipped     hole is not zero-filled, but fallocate still returns success. A later write to that hole may therefore     fail with ENOSPC. The function queries allocated ranges so that it can preserve existing contents and     write zeroes only into holes. However, the server may return a range that starts before the current     fallocate offset. For example, assume the fallocate request is [100, 400) and the only allocated range     returned by the server is [0, 200): Request: [100, 400) Server range: [ 0, 200) allocated Correct: [100,     200) allocated data, skip [200, 400) hole, zero-fill Current: [100, 300) skipped [300, 400) zero-filled     afterwards The current code adds the full server range length, 200, to the current offset 100 and moves to     300. As a result, the hole in [200, 300) is skipped without being zero-filled. Fix this by advancing only     over the part of the allocated range that overlaps the current fallocate offset. Ignore ranges that end     before the current offset and reject ranges whose end offset overflows. This also prevents a malformed     range length from causing an out-of-bounds zero-buffer read. (CVE-2026-68388)

Note that Nessus relies on the presence of the package as reported by the vendor.

Detections

Analytics

Linux Distros Unpatched Vulnerability : CVE-2026-68388

critical Nessus Plugin ID 334273

Version 1.10