The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - nvmet-rdma: handle inline data with a nonzero offset nvmet_rdma_use_inline_sg() maps the host-controlled     inline data offset into the per-command inline scatterlist. The bounds check admits any offset with off +     len <= inline_data_size, but the mapping still assumes the data begins in the first inline page:
    sg->offset = off; sg->length = min_t(int, len, PAGE_SIZE - off); When a port is configured with     inline_data_size > PAGE_SIZE (settable up to max(SZ_16K, PAGE_SIZE)), an offset in (PAGE_SIZE,     inline_data_size] makes PAGE_SIZE - off underflow, so sg->length is set to ~4 GiB and the block backend     reads far past the first inline page. num_pages(len) also ignores the offset, so an in-bounds offset whose     [off, off+len) span crosses a page boundary under-counts the scatterlist. Map the offset properly: split     it into a page index and an in-page offset, start the scatterlist at that page, and size the page count     from page_off + len. Because the request scatterlist may now start at inline_sg[page_idx] rather than     inline_sg[0], generalize the inline-SGL identity test in nvmet_rdma_release_rsp() to a range test;
    otherwise the persistent inline scatterlist is mistaken for an allocated one and nvmet_req_free_sgls()     frees an inline page (and warns in free_large_kmalloc()). (CVE-2026-72129)

Note that Nessus relies on the presence of the package as reported by the vendor.

Detections

Analytics

Linux Distros Unpatched Vulnerability : CVE-2026-72129

critical Nessus Plugin ID 337171

Version 1.7