The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - staging: nvec: fix use-after-free in nvec_rx_completed() In nvec_rx_completed(), when an incomplete RX     transfer is detected, nvec_msg_free() is called to return the message back to the pool by clearing its     'used' atomic flag. Immediately after this, the code accesses nvec->rx->data[0] to check the message type.
    Since nvec_msg_free() marks the pool slot as available via atomic_set(), any concurrent or subsequent call     to nvec_msg_alloc() could claim that same slot and overwrite its data[] array. Reading nvec->rx->data[0]     after freeing the message is therefore a use-after-free. Fix this by saving the message type byte before     calling nvec_msg_free(), then using the saved value for the battery quirk check. (CVE-2026-72489)

Note that Nessus relies on the presence of the package as reported by the vendor.

Detections

Analytics

Linux Distros Unpatched Vulnerability : CVE-2026-72489

high Nessus Plugin ID 337505

Version 1.2

Version 1.1

Version 1.2 Aug 19, 2026, 11:27 AM CVSS metrics ("CVSSv2 score" set to 7.2) CVSS metrics ("CVSSv2 vector" set to "CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C") CVSSv2 severity (based on CVE-2026-72489, severity increased from "Medium" to "High") Plugin Feed: 202608191127
Version 1.1 Aug 19, 2026, 6:09 AM New Plugin Feed: 202608190609