The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - nfsd: restore rq_status_counter to even on all nfsd_dispatch() exit paths nfsd_dispatch() sets     rq_status_counter to an odd value once a request has been decoded, and back to an even value once it has     been fully processed, forming a seq-lock like protocol with the lockless reader in     nfsd_nl_rpc_status_get_dumpit(). Only the fully successful path restored the counter to even. The cache-     hit (RC_REPLY), drop (RC_DROPIT / RQ_DROPME) and encode-error paths all return after the odd-valued store     without ever bringing the counter back to even. Once one of those paths is taken, rq_status_counter is     left odd: the next request's decode ORs in 1 (still odd) and only a subsequent successful encode restores     even. While stuck odd, the dumpit reader treats the rqstp fields as stable and its retry check compares     against the same unchanging odd value, so it never detects concurrent mutation. This exposes actively     mutating fields (e.g. args->ops / args->opcnt during compound decode and release) to the lockless reader,     which can read past the end of the 8-element inline ops array. Add a helper that advances the counter to     the next even value and call it on every return path that follows the odd-valued store. The decode-error     path is left untouched as it is reached before the counter is set odd. (CVE-2026-89705)

Note that Nessus relies on the presence of the package as reported by the vendor.

Detections

Analytics

Linux Distros Unpatched Vulnerability : CVE-2026-89705

high Nessus Plugin ID 345184

Version 1.10