The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - nexthop: take nh->lock for f6i_list walks in replace check and notify fib6_check_nh_list() and
    __nexthop_replace_notify() walk nh->f6i_list during an RTNL-serialized nexthop replace without holding     nh->lock. IPv6 RTM_NEWROUTE/RTM_DELROUTE run without RTNL and mutate that list under nh->lock     (fib6_add_rt2node_nh(), fib6_purge_rt()), so both walks race a concurrent route delete that unlinks and     frees a fib6_info: BUG: KASAN: slab-use-after-free in rt6_fill_node.isra.0 (net/ipv6/route.c:5799) Read of     size 4 at addr ffff888014607e64 by task exploit/143 rt6_fill_node.isra.0 (net/ipv6/route.c:5799)     fib6_rt_update (net/ipv6/route.c:6412) __nexthop_replace_notify (net/ipv4/nexthop.c:2542) rtm_new_nexthop     (net/ipv4/nexthop.c:2554) rtnetlink_rcv_msg (net/core/rtnetlink.c:7076) BUG: KASAN: slab-use-after-free in     fib6_check_nh_list (net/ipv4/nexthop.c:1605) Read of size 8 at addr ffff888014a7d068 by task exploit/142     fib6_check_nh_list (net/ipv4/nexthop.c:1605) rtm_new_nexthop (net/ipv4/nexthop.c:2575) rtnetlink_rcv_msg     (net/core/rtnetlink.c:7076) Both walks only read the entries and take no tb6_lock, so protect them with     nh->lock; fib6_rt_update() uses gfp_any(), which returns GFP_ATOMIC under the lock. (CVE-2026-74562)

Note that Nessus relies on the presence of the package as reported by the vendor.

Detections

Analytics

Linux Distros Unpatched Vulnerability : CVE-2026-74562

high Nessus Plugin ID 335857

Version 1.8

Version 1.7

Version 1.6

Version 1.5

Version 1.4

Version 1.2

Version 1.1

Version 1.8 Aug 28, 2026, 12:16 PM CVSS metrics ("CVSSv2 score" set to 6.8) CVSS metrics ("CVSSv2 vector" set to "CVSS2#AV:L/AC:L/Au:S/C:C/I:C/A:C") Plugin Feed: 202608281216
Version 1.7 Aug 28, 2026, 2:04 AM CVSS metrics ("CVSSv2 score" set to 4.9) CVSS metrics ("CVSSv2 vector" set to "CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C") Detection (updated detection logic) Plugin metadata Plugin Feed: 202608280204
Version 1.6 Aug 21, 2026, 11:26 PM CVSS metrics ("CVSSv2 score" set to 6.8) CVSS metrics ("CVSSv2 vector" set to "CVSS2#AV:L/AC:L/Au:S/C:C/I:C/A:C") Plugin Feed: 202608212326
Version 1.5 Aug 21, 2026, 7:41 AM Detection (updated detection logic) Plugin metadata Plugin Feed: 202608210741
Version 1.4 Aug 19, 2026, 6:09 AM CVSS metrics ("CVSSv3 vector" set to "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H") CVSS temporal metrics ("CVSSv3 temporal vector" set to "CVSS:3.0/E:U/RL:U/RC:C") CVSSv2 severity (based on CVE-2026-74562, severity decreased from "High" to "Medium") Detection (updated detection logic) Plugin metadata Plugin Feed: 202608190609
Version 1.2 Aug 16, 2026, 7:07 PM Detection (Plugin has been deprecated) Plugin Feed: 202608161907
Version 1.1 Aug 15, 2026, 10:21 PM New Plugin Feed: 202608152221