The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - ata: libata-core: Reject an invalid concurrent positioning ranges count ata_dev_config_cpr() takes the     number of range descriptors from buf[0] of the concurrent positioning ranges log (up to 255), which the     device reports independently of the log size in the GPL directory. The count is then walked at a fixed     32-byte stride in two places with no bound: the log read here, and the INQUIRY VPD page B9h emitter, which     writes one descriptor per range into the fixed 2048-byte ata_scsi_rbuf. A device reporting a count larger     than its own log overflows the read buffer (up to 7704 bytes past a 512-byte slab), and a count above 62     overflows the response buffer on the emit side. Bound the count once, on probe, against both the log the     device returned and the number of descriptors the VPD B9h response buffer can hold (ATA_DEV_MAX_CPR,     derived from the rbuf size). Reject an out-of-range count with a warning; this keeps the emitter in bounds     with no separate change there. (CVE-2026-72030)

Note that Nessus relies on the presence of the package as reported by the vendor.

Detections

Analytics

Linux Distros Unpatched Vulnerability : CVE-2026-72030

high Nessus Plugin ID 335648

Version 1.5

Version 1.4

Version 1.3

Version 1.1

Version 1.5 Aug 28, 2026, 2:04 AM Detection (updated detection logic) Plugin metadata Plugin Feed: 202608280204
Version 1.4 Aug 21, 2026, 7:41 AM Detection (updated detection logic) Plugin metadata Plugin Feed: 202608210741
Version 1.3 Aug 19, 2026, 6:09 AM CVSS metrics ("CVSSv3 vector" set to "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H") CVSSv2 severity (based on CVE-2026-72030, severity decreased from "High" to "Medium") Detection (updated detection logic) Plugin metadata Plugin Feed: 202608190609
Version 1.1 Aug 15, 2026, 5:20 PM New Plugin Feed: 202608151720