The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - In the Linux kernel, the following vulnerability has been resolved: btrfs: do not try compression for data     reloc inodes [BUG] There is a syzbot report that the check inside get_new_location() triggered: BTRFS info     (device loop0): found 31 extents, stage: move data extents BTRFS info (device loop0): leaf 8908800 gen 16     total ptrs 28 free space 1676 owner 18446744073709551607 item 0 key (256 INODE_ITEM 0) itemoff 3835     itemsize 160 inode generation 5 transid 0 size 0 nbytes 0 block group 0 mode 40755 links 1 uid 0 gid 0     rdev 0 sequence 0 flags 0x0 atime 1669132761.0 ctime 1669132761.0 mtime 1669132761.0 otime 0.0 item 1 key     (256 INODE_REF 256) itemoff 3823 itemsize 12 index 0 name_len 2 item 2 key (258 INODE_ITEM 0) itemoff 3663     itemsize 160 inode generation 1 transid 16 size 733184 nbytes 106496 block group 0 mode 100600 links 0 uid     0 gid 0 rdev 0 sequence 24 flags 0x18 item 3 key (258 EXTENT_DATA 0) itemoff 3595 itemsize 68 generation     16 type 0 inline extent data size 47 ram_bytes 4096 compression 1 [...] item 27 key (18446744073709551611     ORPHAN_ITEM 258) itemoff 2376 itemsize 0 BTRFS error (device loop0): unexpected non-zero offset in file     extent item for data reloc inode 258 key offset 0 offset 9277520992061368337 ------------[ cut here     ]------------ btrfs_abort_should_print_stack(__error) [CAUSE] The above dump tree shows the first file     extent item is inlined, which should make no sense for data reloc inodes, as such inodes just represent     where the data extents are in the relocation destination chunk. However the relocation path preallocates     space for each block, then dirties them, cluster by cluster. It's possible to have a single block at the     beginning of the block group, and no other block in the same cluster. So relocation will preallocate a     file extent for that block and dirty the first block. Then memory pressure forces the data reloc inode to     be written back, before any other blocks are dirtied/allocated. Finally commit 3eaf5f082c4c (btrfs:
    extract inlined creation into a dedicated delalloc helper) changed the sequence of delalloc. Before that     commit we always tried NOCOW first, so that dirtied block would be written back into the preallocated     space, and appear as a regular extent. But with that commit, we always try inline first, and since     compression is forced, we try compressing the first block, and then inline the compressed data, resulting     in the above inlined file extent in the data reloc tree. Then the check in get_new_location() will check     the file offset, without checking if the file extent is inlined or not, resulting in the above failure.
    [FIX] Do not allow compression for data reloc inodes. Since data reloc inode sizes are always block     aligned, as long as we do not compress, @data_len will always be at least one block, and that will cause     can_cow_file_range_inline() to return false, thus no inlined extent will be created. (CVE-2026-68167)

Note that Nessus relies on the presence of the package as reported by the vendor.

Detections

Analytics

Linux Distros Unpatched Vulnerability : CVE-2026-68167

medium Nessus Plugin ID 334804

Version 1.5

Version 1.4

Version 1.3

Version 1.2

Version 1.1

Version 1.5 Nov 13, 2026, 9:54 AM Detection (updated detection logic) Plugin metadata Plugin Feed: 202611130954
Version 1.4 Nov 12, 2026, 12:23 AM Detection (updated detection logic) Plugin metadata Plugin Feed: 202611120023
Version 1.3 Aug 15, 2026, 1:04 AM Detection (updated detection logic) Plugin metadata Plugin Feed: 202608150104
Version 1.2 Aug 13, 2026, 5:24 AM Detection (updated detection logic) Plugin metadata Plugin Feed: 202608130524
Version 1.1 Aug 12, 2026, 7:14 PM New Plugin Feed: 202608121914