The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - debugobjects: Plug race against a concurrent OOM disable syzbot reported a puzzling splat: WARNING:
    kernel/time/hrtimer.c:443 at stub_timer+0xa/0x20 stub_timer() is installed as timer callback function in     hrtimer_fixup_assert_init(), which is invoked when debug_object_assert_init() can't find a shadow object.
    In that case debug objects emits a warning about it before invoking the fixup. Though the provided console     log lacks this warning and instead has the following a few seconds before the splat: ODEBUG: Out of     memory. ODEBUG disabled So the object was looked up in debug_object_assert_init() and the lookup failed     due a concurrent out of memory situation which disabled debug objects and freed the shadow objects:
    debug_object_assert_init() if (!debug_objects_enabled) return; obj = alloc(); if (!obj) { // Out of memory     debug_objects_enabled = false; free_objects(); obj = lookup_or_alloc(); // The lookup failed because the     other side // removed the objects, so this returns // an error code as the object in question // is not     statically initialized if (!IS_ERR_OR_NULL(obj)) return; if (!obj) { debug_oom(); return; } print(...) if     (!debug_objects_enabled) return; fixup(...) The debug object splat is skipped because     debug_objects_enabled is false, but the fixup callback is invoked unconditionally, which makes the timer     disfunctional. This is only a problem in debug_object_assert_init() and debug_object_activate() as both     have to handle statically initialized objects and therefore must handle the error pointer return case     gracefully. All other places only handle the found/not found case and the NULL pointer return is a signal     for OOM. Otherwise they get a valid shadow object. Plug the hole by checking whether debug objects are     still enabled before invoking the print and fixup function in those two places. (CVE-2026-68090)

Note that Nessus relies on the presence of the package as reported by the vendor.

Detections

Analytics

Linux Distros Unpatched Vulnerability : CVE-2026-68090

medium Nessus Plugin ID 334510

Version 1.9

Version 1.8

Version 1.7

Version 1.6

Version 1.5

Version 1.4

Version 1.3

Version 1.2

Version 1.1

Version 1.9 Sep 22, 2026, 8:27 AM Detection (updated detection logic) Plugin Feed: 202609220827
Version 1.8 Sep 21, 2026, 8:44 PM Detection (updated detection logic) Plugin Feed: 202609212044
Version 1.7 Sep 16, 2026, 5:33 AM Detection (updated detection logic) Plugin metadata Plugin Feed: 202609160533
Version 1.6 Sep 8, 2026, 12:57 AM Detection (updated detection logic) Plugin metadata Plugin Feed: 202609080057
Version 1.5 Aug 28, 2026, 2:04 AM Detection (updated detection logic) Plugin metadata Plugin Feed: 202608280204
Version 1.4 Aug 21, 2026, 7:41 AM Detection (updated detection logic) Plugin metadata Plugin Feed: 202608210741
Version 1.3 Aug 14, 2026, 5:17 PM Detection (updated detection logic) Plugin metadata Plugin Feed: 202608141717
Version 1.2 Aug 12, 2026, 7:14 PM CVSS metrics ("CVSSv2 score" set to 4.7) CVSS metrics ("CVSSv2 vector" set to "CVSS2#AV:L/AC:M/Au:N/C:N/I:N/A:C") CVSS metrics ("CVSSv3 score" set to 5.5) CVSS metrics ("CVSSv3 vector" set to "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H") CVSS temporal metrics ("CVSSv2 temporal vector" set to "CVSS2#E:U/RL:U/RC:C") CVSS temporal metrics ("CVSSv3 temporal vector" set to "CVSS:3.0/E:U/RL:U/RC:C") CVSSv2 score source (set to "CVE-2026-68090") CVSSv2 severity (based on CVE-2026-68090, severity decreased from "High" to "Medium") CVSSv3 severity (based on None, severity decreased from "High" to "Medium") Detection (updated detection logic) Plugin metadata Plugin Feed: 202608121914
Version 1.1 Aug 11, 2026, 3:40 PM New Plugin Feed: 202608111540