The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - ALSA: seq: oss: Serialize readq reset state with q->lock snd_seq_oss_readq_clear() resets qlen, head, and     tail without q->lock even though the normal reader and producer paths serialize the same ring state under     that spinlock. A reset can therefore race snd_seq_oss_readq_free() or snd_seq_oss_readq_put_event() and     leave stale records in the queue, drop freshly queued ones, or report the wrong readiness after wakeup.
    KCSAN reports a data race between snd_seq_oss_readq_clear() and snd_seq_oss_readq_free(). Take q->lock     while clearing the ring and resetting input_time. Factor the enqueue logic into a caller-locked helper so     snd_seq_oss_readq_put_timestamp() updates its suppression state under the same lock instead of racing the     reset path. The buggy scenario involves two paths, with each column showing the order within that path:
    reset path: locked readq updater: 1. snd_seq_oss_reset() or 1. A reader or callback producer release     reaches takes q->lock on the same queue. snd_seq_oss_readq_clear(). 2. snd_seq_oss_readq_clear() 2. The     updater tests or modifies resets qlen, head, tail, qlen, head, and tail. and input_time. 3.
    snd_seq_oss_readq_clear() 3. The updater completes its wakes sleepers on read-modify-write sequence.
    q->midi_sleep. 4. Without q->lock, the reset 4. The resulting ring state drives can overlap the locked     later reads and readiness. update. KCSAN reports: BUG: KCSAN: data-race in snd_seq_oss_readq_clear /     snd_seq_oss_readq_free write to 0xffff8881069fe608 of 4 bytes by task 120516 on cpu 0:
    snd_seq_oss_readq_free+0x6c/0x80 snd_seq_oss_read+0xcb/0x250 odev_read+0x38/0x60 vfs_read+0xff/0x600     ksys_read+0xb4/0x140 __x64_sys_read+0x46/0x60 do_syscall_64+0xbb/0x2f0     entry_SYSCALL_64_after_hwframe+0x77/0x7f read to 0xffff8881069fe608 of 4 bytes by task 120517 on cpu 1:
    snd_seq_oss_readq_clear+0x1f/0x90 snd_seq_oss_reset+0xa7/0xf0 snd_seq_oss_ioctl+0x6f6/0x7e0     odev_ioctl+0x56/0xc0 __x64_sys_ioctl+0xd1/0x120 do_syscall_64+0xbb/0x2f0     entry_SYSCALL_64_after_hwframe+0x77/0x7f value changed: 0x00000001 -> 0x00000000 (CVE-2026-80628)

Note that Nessus relies on the presence of the package as reported by the vendor.

Detections

Analytics

Linux Distros Unpatched Vulnerability : CVE-2026-80628

high Nessus Plugin ID 341332

Version 1.16

Version 1.15

Version 1.14

Version 1.13

Version 1.11

Version 1.9

Version 1.8

Version 1.6

Version 1.5

Version 1.4

Version 1.3

Version 1.2

Version 1.1

Version 1.16 Oct 14, 2026, 9:52 AM CVSS metrics ("CVSSv2 score" set to 6.8) CVSS metrics ("CVSSv2 vector" set to "CVSS2#AV:L/AC:L/Au:S/C:C/I:C/A:C") Plugin Feed: 202610140952
Version 1.15 Oct 13, 2026, 2:52 AM CVSS metrics ("CVSSv2 score" set to 5.6) CVSS metrics ("CVSSv2 vector" set to "CVSS2#AV:L/AC:H/Au:N/C:N/I:C/A:C") Detection (updated detection logic) Plugin metadata Plugin Feed: 202610130252
Version 1.14 Oct 12, 2026, 12:19 PM CVSS metrics ("CVSSv2 score" set to 6.8) CVSS metrics ("CVSSv2 vector" set to "CVSS2#AV:L/AC:L/Au:S/C:C/I:C/A:C") Plugin Feed: 202610121219
Version 1.13 Oct 10, 2026, 5:24 AM Detection (updated detection logic) Plugin metadata Plugin Feed: 202610100524
Version 1.11 Oct 9, 2026, 2:01 PM CVSS metrics ("CVSSv2 vector" set to "CVSS2#AV:L/AC:H/Au:N/C:N/I:C/A:C") Detection (updated detection logic) Plugin metadata Plugin Feed: 202610091401
Version 1.9 Oct 8, 2026, 7:54 AM CVSS metrics ("CVSSv2 score" set to 6.8) CVSS metrics ("CVSSv2 vector" set to "CVSS2#AV:L/AC:L/Au:S/C:C/I:C/A:C") Plugin Feed: 202610080754
Version 1.8 Oct 7, 2026, 6:12 AM CVSS metrics ("CVSSv2 score" set to 5.6) CVSS metrics ("CVSSv2 vector" set to "CVSS2#AV:L/AC:H/Au:N/C:N/I:C/A:C") Detection (updated detection logic) Plugin metadata Plugin Feed: 202610070612
Version 1.6 Sep 23, 2026, 1:21 PM CVSS metrics ("CVSSv2 score" set to 5.6) CVSS metrics ("CVSSv2 vector" set to "CVSS2#AV:L/AC:H/Au:N/C:N/I:C/A:C") Detection (updated detection logic) Plugin Feed: 202609231321
Version 1.5 Sep 16, 2026, 6:23 PM CVSS metrics ("CVSSv2 score" set to 6.8) CVSS metrics ("CVSSv2 vector" set to "CVSS2#AV:L/AC:L/Au:S/C:C/I:C/A:C") Plugin Feed: 202609161823
Version 1.4 Sep 2, 2026, 6:07 PM Detection (updated detection logic) Plugin metadata Plugin Feed: 202609021807
Version 1.3 Sep 1, 2026, 5:14 AM Detection (updated detection logic) Plugin metadata Plugin Feed: 202609010514
Version 1.2 Aug 31, 2026, 4:25 PM CVSS metrics ("CVSSv2 score" set to 5.6) CVSS metrics ("CVSSv2 vector" set to "CVSS2#AV:L/AC:H/Au:N/C:N/I:C/A:C") CVSS metrics ("CVSSv3 score" set to 7.8) CVSS metrics ("CVSSv3 vector" set to "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H") CVSSv2 severity (based on CVE-2026-80628, severity decreased from "High" to "Medium") Detection (updated detection logic) Plugin metadata Plugin Feed: 202608311625
Version 1.1 Aug 29, 2026, 12:30 AM New Plugin Feed: 202608290030