The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling Hyunwoo Kim reports some     really bad races should the following situation occur: - LPI-I is pending in vcpu-B's AP list - vcpu-A     writes to vcpu-B's RD to disable its LPIs - vcpu-C moves I from B to C If the last two race nicely enough,     vgic_prune_ap_list() can drop the irq and AP list locks, reacquire them, and in the interval the irq has     been freed. UAF follows. The fix is two-fold: - Before dropping the irq and ap_list locks, take a     reference on the irq - Do not try to handle migration of the pending bit: there is no expectation that     this state is retained, as per the architecture With that, we're sure that the interrupt is still around,     and we safely remove it from the AP list as it has no target at this stage (unless another interrupt     fires, but that's another story). (CVE-2026-72288)

Note that Nessus relies on the presence of the package as reported by the vendor.

Detections

Analytics

Linux Distros Unpatched Vulnerability : CVE-2026-72288

critical Nessus Plugin ID 335686

Version 1.26