The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - vduse: hold vduse_lock across IDR lookup in open path vduse_dev_open() looks up struct vduse_dev through     the IDR and then acquires dev->lock only after vduse_lock has been dropped. This leaves a window where a     concurrent VDUSE_DESTROY_DEV can remove the same object from the IDR and free it before the open path     locks the device, leading to a use-after-free. Close this race by keeping vduse_lock held until dev->lock     has been acquired in the open path, matching the lock ordering already used by the destroy path.
    (CVE-2026-74313)

Note that Nessus relies on the presence of the package as reported by the vendor.

Detections

Analytics

Linux Distros Unpatched Vulnerability : CVE-2026-74313

high Nessus Plugin ID 337426

Version 1.4