The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - nfsd: restore rq_status_counter to even on all nfsd_dispatch() exit paths nfsd_dispatch() sets     rq_status_counter to an odd value once a request has been decoded, and back to an even value once it has     been fully processed, forming a seq-lock like protocol with the lockless reader in     nfsd_nl_rpc_status_get_dumpit(). Only the fully successful path restored the counter to even. The cache-     hit (RC_REPLY), drop (RC_DROPIT / RQ_DROPME) and encode-error paths all return after the odd-valued store     without ever bringing the counter back to even. Once one of those paths is taken, rq_status_counter is     left odd: the next request's decode ORs in 1 (still odd) and only a subsequent successful encode restores     even. While stuck odd, the dumpit reader treats the rqstp fields as stable and its retry check compares     against the same unchanging odd value, so it never detects concurrent mutation. This exposes actively     mutating fields (e.g. args->ops / args->opcnt during compound decode and release) to the lockless reader,     which can read past the end of the 8-element inline ops array. Add a helper that advances the counter to     the next even value and call it on every return path that follows the odd-valued store. The decode-error     path is left untouched as it is reached before the counter is set odd. (CVE-2026-89705)

Note that Nessus relies on the presence of the package as reported by the vendor.

Detections

Analytics

Linux Distros Unpatched Vulnerability : CVE-2026-89705

high Nessus Plugin ID 345184

Version 1.5

Version 1.4

Version 1.3

Version 1.2

Version 1.1

Version 1.5 Sep 17, 2026, 12:32 PM CVSS metrics ("CVSSv2 score" set to 6.2) CVSS metrics ("CVSSv2 vector" set to "CVSS2#AV:L/AC:L/Au:S/C:C/I:N/A:C") CVSS temporal metrics ("CVSSv2 temporal vector" set to "CVSS2#E:U/RL:U/RC:C") CVSSv2 severity (based on CVE-2026-89705, severity decreased from "High" to "Medium") CVSSv3 score source (changed from "CVE-2026-89705" to none) Plugin Feed: 202609171232
Version 1.4 Sep 16, 2026, 5:33 AM Detection (updated detection logic) Plugin metadata Plugin Feed: 202609160533
Version 1.3 Sep 14, 2026, 6:39 PM CVSS metrics ("CVSSv2 score" set to none) CVSS metrics ("CVSSv2 vector" set to none) CVSS temporal metrics ("CVSSv2 temporal vector" set to none) CVSSv2 severity (based on CVE-2026-89705, severity increased from "Medium" to "High") CVSSv3 score source (set to "CVE-2026-89705") Detection (updated detection logic) Plugin metadata Plugin Feed: 202609141839
Version 1.2 Sep 14, 2026, 1:09 PM CVSS metrics ("CVSSv2 score" set to 6.2) CVSS metrics ("CVSSv2 vector" set to "CVSS2#AV:L/AC:L/Au:S/C:C/I:N/A:C") CVSS metrics ("CVSSv3 score" set to 7.1) CVSS metrics ("CVSSv3 vector" set to "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H") CVSS temporal metrics ("CVSSv2 temporal vector" set to "CVSS2#E:U/RL:U/RC:C") CVSS temporal metrics ("CVSSv3 temporal vector" set to "CVSS:3.0/E:U/RL:U/RC:C") CVSSv2 score source (set to "CVE-2026-89705") CVSSv2 severity (based on CVE-2026-89705, severity decreased from "High" to "Medium") Plugin Feed: 202609141309
Version 1.1 Sep 12, 2026, 9:05 PM New Plugin Feed: 202609122105