The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - net/packet: reset the MAC header on the packet-socket transmit path packet_parse_headers() resets the MAC     header only for a SOCK_RAW frame whose socket did not bind a protocol. A protocol-bound SOCK_RAW socket,     any SOCK_DGRAM frame, and the legacy SOCK_PACKET path therefore leave skb->mac_header unset here. For     frames sent via __dev_queue_xmit() this is harmless: it resets the MAC header unconditionally. But the     packet-socket PACKET_QDISC_BYPASS path uses dev_direct_xmit(), which does not, so the frame reaches     ndo_start_xmit() with the MAC header unset. A driver that reads eth_hdr(skb) on transmit then dereferences     skb->head + (u16)~0, an out-of-bounds access ~64 KiB past the head -- the same class fixed for one     consumer in commit f5089008f90c (macsec: do not read an unset MAC header in macsec_encrypt()).
    packet_parse_headers() runs only on the transmit path, where skb->data points at the start of the L2     header for every packet-socket type regardless of its length: SOCK_RAW and SOCK_PACKET carry a user-     supplied header and SOCK_DGRAM has one built by dev_hard_header(). Reset the MAC header unconditionally,     mirroring __dev_queue_xmit(), so the frame is anchored on the bypass path too. Found by 0sec     (https://0sec.ai) using automated source analysis; verified against source and matched to the macsec KASAN     report in f5089008f90c. Compile-tested. (CVE-2026-74667)

Note that Nessus relies on the presence of the package as reported by the vendor.

Detections

Analytics

Linux Distros Unpatched Vulnerability : CVE-2026-74667

high Nessus Plugin ID 338949

Version 1.2

Version 1.1

Version 1.2 Aug 25, 2026, 5:40 AM CVSS metrics ("CVSSv2 score" set to none) CVSS metrics ("CVSSv2 vector" set to none) CVSS metrics ("CVSSv3 score" set to none) CVSS metrics ("CVSSv3 vector" set to none) CVSS temporal metrics ("CVSSv2 temporal vector" set to none) CVSS temporal metrics ("CVSSv3 temporal vector" set to none) Detection (updated detection logic) Plugin metadata Plugin Feed: 202608250540
Version 1.1 Aug 23, 2026, 3:52 AM New Plugin Feed: 202608230352