The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - landlock: Fix LANDLOCK_SCOPE_SIGNAL bypass on the SIGIO path LANDLOCK_SCOPE_SIGNAL must prevent a     sandboxed process from signaling processes outside its Landlock domain. It can be bypassed through the     asynchronous SIGIO delivery path. A sandboxed process that owns any file or socket can arm it with     fcntl(fd, F_SETOWN, -pgid), fcntl(fd, F_SETSIG, SIGKILL) and O_ASYNC, so that an I/O event makes the     kernel deliver the chosen signal to the whole process group. As the head of its process group's task list     (the default position right after fork()) that group can also hold the non-sandboxed process that launched     it, e.g. a supervisor or a security monitor. The sandbox can thus kill or signal the processes     LANDLOCK_SCOPE_SIGNAL is meant to protect from it. The scope is enforced in hook_file_send_sigiotask()     against the Landlock domain recorded at F_SETOWN time, not the live domain of the sender.
    control_current_fowner() decides whether to record that domain and skips recording it when the fowner     target is in the caller's thread group, which is safe only for a single-task target (PIDTYPE_PID,     PIDTYPE_TGID). For a process group (PIDTYPE_PGID) pid_task() returns only one member; recording is skipped     whenever that member shares the caller's thread group, and hook_file_send_sigiotask() then lets the signal     fan out to the whole group unchecked. Record the domain for every non single-process target so the scope     is enforced against each group member at delivery time. That recording is necessary but not sufficient on     its own: the kernel signals a process group through its members' thread-group leaders, and the leader of     the registrant's own process can carry a different Landlock domain than the sibling thread that armed the     owner. domain_is_scoped() would then deny that leader, even though commit 18eb75f3af40 (landlock: Always     allow signals between threads of the same process) requires same-process delivery to be allowed.
    hook_task_kill() avoids this by evaluating same_thread_group() live, per recipient; the SIGIO path instead     delegates the whole decision to a single registration-time check, which a process-group fan-out cannot     honor. So also record the registrant's thread group next to its domain and exempt it at delivery:
    hook_file_send_sigiotask() allows the signal whenever the recipient belongs to the registrant's own     process, restoring the same-process guarantee while keeping out-of-domain group members blocked. The     direct kill() path (hook_task_kill) already evaluates the live domain and is unaffected. [mic: Check     pid_type earlier and improve comment, fix commit message, fix comment formatting] (CVE-2026-72183)

Note that Nessus relies on the presence of the package as reported by the vendor.

Detections

Analytics

Linux Distros Unpatched Vulnerability : CVE-2026-72183

high Nessus Plugin ID 337561

Version 1.2

Version 1.2

Version 1.2 Aug 19, 2026, 6:09 AM Detection (updated detection logic) New Plugin metadata Plugin Feed: 202608190609
Version 1.2 Aug 19, 2026, 11:27 AM CVSS metrics ("CVSSv2 score" set to 6.2) CVSS metrics ("CVSSv2 vector" set to "CVSS2#AV:L/AC:L/Au:S/C:N/I:C/A:C") CVSS temporal metrics ("CVSSv2 temporal vector" set to "CVSS2#E:U/RL:U/RC:C") CVSSv2 score source (set to "CVE-2026-72183") CVSSv2 severity (based on CVE-2026-72183, severity decreased from "High" to "Medium") CVSSv3 score source (changed from "CVE-2026-72183" to none) Plugin Feed: 202608191127