The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - ALSA: usb-audio: fix stack info leak in RME Digiface status snd_rme_digiface_read_status() reads a four-     word status block from the device into an uninitialised on-stack __le32 buf[4] and, whenever the vendor     control-IN transfer does not return a negative error, copies all four words into the caller's status[].
    snd_usb_ctl_msg() copies the full requested size back into the caller's buffer regardless of how many     bytes the data stage actually delivered: buf = kmemdup(data, size, GFP_KERNEL); err = usb_control_msg(dev,     pipe, request, requesttype, value, index, buf, size, timeout); memcpy(data, buf, size); usb_control_msg()     returns the transferred length on a short control-IN, which is a non-negative value, and writes only that     many bytes. The remainder of the copy back is the kmemdup()ed image of the caller's buffer, so a device     answering with a short data stage leaves the trailing words of buf[] holding leftover kernel stack. The     only guard in the caller is err < 0, so those words are stored into status[]. They then reach user space:
    snd_rme_digiface_get_status_val() selects a 16-bit halfword of status[] per the control's reg/mask, and     the eight Digiface status controls together expose the whole 16-byte frame to an unprivileged reader of     /dev/snd/controlC*. Zero-initialise the buffer so a short read yields zeros instead of stack residue. This     mirrors snd_rme_get_status1(), which already clears its output word before the same kind of vendor read.
    Discovered by XBOW, triaged by Baul Lee <baul.lee@xbow.com> (CVE-2026-74500)

Note that Nessus relies on the presence of the package as reported by the vendor.

Detections

Analytics

Linux Distros Unpatched Vulnerability : CVE-2026-74500

high Nessus Plugin ID 335851

Version 1.6

Version 1.5

Version 1.4

Version 1.3

Version 1.2

Version 1.1

Version 1.6 Aug 28, 2026, 2:04 AM Detection (updated detection logic) Plugin metadata Plugin Feed: 202608280204
Version 1.5 Aug 26, 2026, 1:14 PM CVSS metrics ("CVSSv2 score" set to 2.1) CVSS metrics ("CVSSv2 vector" set to "CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:N") CVSSv2 severity (based on CVE-2026-74500, severity decreased from "Medium" to "Low") Detection (updated detection logic) Plugin metadata Plugin Feed: 202608261314
Version 1.4 Aug 21, 2026, 7:41 AM Detection (updated detection logic) Plugin metadata Plugin Feed: 202608210741
Version 1.3 Aug 19, 2026, 6:09 AM CVSS metrics ("CVSSv2 score" set to 5.6) CVSS metrics ("CVSSv2 vector" set to "CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:C") CVSSv2 severity (based on CVE-2026-74500, severity increased from "Low" to "Medium") Detection (updated detection logic) Plugin metadata Plugin Feed: 202608190609
Version 1.2 Aug 16, 2026, 2:04 PM CVSS metrics ("CVSSv2 score" set to 2.1) CVSS metrics ("CVSSv2 vector" set to "CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:N") CVSS metrics ("CVSSv3 score" set to 7.1) CVSS metrics ("CVSSv3 vector" set to "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H") CVSSv2 severity (based on CVE-2026-74500, severity decreased from "High" to "Low") Detection (updated detection logic) Plugin metadata Plugin Feed: 202608161404
Version 1.1 Aug 15, 2026, 10:21 PM New Plugin Feed: 202608152221