Detections
Analytics

Linux Distros Unpatched Vulnerability : CVE-2026-65928

medium Nessus Plugin ID 341602

Language:

Synopsis

The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.

Description

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

 - NOTE: Fixed by: https://gitlab.com/qemu-project/qemu/-/commit/1f24066fc88d33455ee54a20f29994d9e69997ba (v11.1.0-rc3)NOTE: Fixed by: https://gitlab.com/qemu- project/qemu/-/commit/5fbd2fe1cc54259d045d00d4966aa2db1ba990d6 (v11.0.4) (CVE-2026-18054) NOTE:
 https://gitlab.com/qemu-project/qemu/-/work_items/3917NOTE: Fixed by: https://gitlab.com/qemu- project/qemu/-/commit/0be94d8d9c28e6b7235b34133d057090fe93be6c (v11.1.0-rc2)NOTE: Fixed by:
 https://gitlab.com/qemu-project/qemu/-/commit/88a0e5e45b41d407cf9adf1f2cf6f20f394a578d (v11.0.4) (CVE-2026-50624) NOTE: https://gitlab.com/qemu-project/qemu/-/work_items/3875NOTE: Fixed by:
 https://gitlab.com/qemu-project/qemu/-/commit/f404bf0e6504e0412a00ea64708f17d2a5e3f869 (v11.1.0-rc2)NOTE:
 Fixed by: https://gitlab.com/qemu-project/qemu/-/commit/a4abe1f1fa6f465b64fb400bea14c72bd5e32ac9 (v11.0.4) (CVE-2026-61476) QEMU's 9pfs readonly check at line 2108-2109 tests mode & O_TRUNC and mode & O_APPEND against the raw 9P open mode byte. For the 9P2000.u protocol, mode uses 9P flag values (Otrunc=0x10, Oappend=0x80), but the check compares against Linux constants (O_TRUNC=0x200, O_APPEND=0x400). Since 0x10 & 0x200 = 0 and 0x80 & 0x400 = 0, both flags bypass the readonly guard. The mode is then correctly converted to host flags via omode_to_uflags(), so open() is called with O_TRUNC -- truncating host files on readonly shares.9P2000.L is NOT affected (guest passes Linux flags directly, so the bit values match).
 (CVE-2026-63318) Host-side AddressSanitizer heap-buffer-overflow READ in current QEMU master through the virtio-net-pci receive filtering path on q35. The crash is in receive_filter(). (CVE-2026-63320) NOTE:
 https://gitlab.com/qemu-project/qemu/-/work_items/3607NOTE: Fixed by: https://gitlab.com/qemu- project/qemu/-/commit/4727cc883b7e81d2c30b9801af54482d65b84292 (v11.1.0-rc2)NOTE: Fixed by:
 https://gitlab.com/qemu-project/qemu/-/commit/95b9a1bf26fef7c44f4925f78ade7fa824ed5e76 (v11.0.4) (CVE-2026-63322) NOTE: https://gitlab.com/qemu-project/qemu/-/work_items/3846NOTE: Fixed by:
 https://gitlab.com/qemu-project/qemu/-/commit/370882d0869567e5f21b95229a763171e319d0db (v11.1.0-rc3)NOTE:
 Fixed by: https://gitlab.com/qemu-project/qemu/-/commit/e00b9c9193de00f5782cb919d91eb80d255017fe (v11.0.4) (CVE-2026-65928) A flaw was found in QEMU. The VAPIC setup hypercall in hw/i386/vapic.c does not validate that the writable RAM alias remains within the option ROM window. A privileged guest user on a Q35/KVM machine can position this alias over locked SMRAM, bypassing chipset D_LCK protection and injecting code into System Management Mode memory. (CVE-2026-81627) (CVE-2026-65928)

Note that Nessus relies on the presence of the package as reported by the vendor.

Solution

There is no known solution at this time.

See Also

https://security-tracker.debian.org/tracker/CVE-2026-65928

https://ubuntu.com/security/CVE-2026-65928

Plugin Details

Severity: Medium

ID: 341602

File Name: unpatched_CVE_2026_65928.nasl

Version: 1.6

Type: Local

Agent: unix

Family: Misc.

Published: 8/30/2026

Updated: 10/29/2026

Supported Sensors: Frictionless Assessment AWS, Frictionless Assessment Azure, Frictionless Assessment Agent, Nessus Agent, Agentless Assessment, Tenable Cloud Security, Tenable Self-Hosted Container Security, Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 4.3

Percentile: 53.48

Vulnerability Information

CPE: cpe:/o:canonical:ubuntu_linux:14.04:-:lts, cpe:/o:canonical:ubuntu_linux:16.04:-:lts, cpe:/o:canonical:ubuntu_linux:18.04:-:lts, cpe:/o:canonical:ubuntu_linux:20.04:-:lts, cpe:/o:canonical:ubuntu_linux:22.04:-:lts, cpe:/o:canonical:ubuntu_linux:24.04:-:lts, cpe:/o:canonical:ubuntu_linux:26.04:-:lts, cpe:/o:canonical:ubuntu_linux:26.10, cpe:/o:debian:debian_linux:12.0, p-cpe:/a:canonical:ubuntu_linux:qemu-hwe, p-cpe:/a:canonical:ubuntu_linux:qemu, p-cpe:/a:debian:debian_linux:qemu

Required KB Items: Host/local_checks_enabled, Host/cpu, global_settings/vendor_unpatched, Host/OS/identifier

Exploit Ease: No known exploits are available

Reference Information

CVE: CVE-2026-65928