The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - nvmet-auth: reject short AUTH_RECEIVE buffers nvmet_execute_auth_receive() trusts the AUTH_RECEIVE     allocation length after checking only that it is nonzero and matches the transfer length. In the SUCCESS1     and FAILURE1/default states, that lets a remote NVMe-oF initiator reach the fixed-size DH-HMAC-CHAP     response builders with a kmalloc() buffer shorter than the response, so nvmet_auth_success1() and     nvmet_auth_failure1() write past the allocation; both only WARN_ON the short length and then format the     message anyway. Impact: A remote NVMe-oF initiator with access to an auth-enabled target can trigger a     16-byte heap out-of-bounds write via a one-byte AUTH_RECEIVE allocation length. Compute the minimum     response length for the current DH-HMAC-CHAP step in nvmet_auth_receive_data_len() and report a zero data     length when the host-supplied allocation length is shorter, so the existing zero-length check in     nvmet_execute_auth_receive() rejects the command before any builder runs. The SUCCESS1 minimum is     sizeof(struct nvmf_auth_dhchap_success1_data) plus the HMAC hash length, because the response hash is     written into the rval[] flexible-array tail, so the minimum is state dependent rather than a flat sizeof.
    CHALLENGE keeps its existing variable-length guard in nvmet_auth_challenge(). This is reachable only when     in-band DH-HMAC-CHAP authentication is configured on the target. (CVE-2026-72130)

Note that Nessus relies on the presence of the package as reported by the vendor.

Detections

Analytics

Linux Distros Unpatched Vulnerability : CVE-2026-72130

critical Nessus Plugin ID 335679

Version 1.6

Version 1.5

Version 1.4

Version 1.3

Version 1.2

Version 1.1

Version 1.6 Sep 4, 2026, 7:38 PM Detection (updated detection logic) Plugin metadata Plugin Feed: 202609041938
Version 1.5 Sep 2, 2026, 12:19 AM Detection (updated detection logic) Plugin metadata Plugin Feed: 202609020019
Version 1.4 Aug 28, 2026, 2:04 AM Detection (updated detection logic) Plugin metadata Plugin Feed: 202608280204
Version 1.3 Aug 21, 2026, 7:41 AM Detection (updated detection logic) Plugin metadata Plugin Feed: 202608210741
Version 1.2 Aug 18, 2026, 3:38 PM CVSS metrics ("CVSSv2 score" set to 10.0) CVSS metrics ("CVSSv2 vector" set to "CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C") Detection (updated detection logic) Plugin metadata Plugin Feed: 202608181538
Version 1.1 Aug 15, 2026, 5:20 PM New Plugin Feed: 202608151720