The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - nvme-tcp: fix host memory disclosure on R2T for a read command nvme_tcp_handle_r2t() does not check the     direction of the request the R2T refers to. A malicious controller can send an R2T for a READ and the host     will answer it: nvme_tcp_setup_h2c_data_pdu() builds the H2CData header and nvme_tcp_try_send_data() sends     the request's data buffer. That buffer is the READ destination, so its contents go to the controller. The     command then completes normally and nothing is logged. Against a test controller that answers every READ     with an R2T, a 4096 byte buffered read returned all 4096 bytes, split over two R2Ts. The pages contained     stale kernel data, including an array of struct page pointers. Reject an R2T for a request that is not a     write. (CVE-2026-89481)

Note that Nessus relies on the presence of the package as reported by the vendor.

Detections

Analytics

Linux Distros Unpatched Vulnerability : CVE-2026-89481

high Nessus Plugin ID 345433

Version 1.11

Version 1.10

Version 1.9

Version 1.8

Version 1.4

Version 1.3

Version 1.2

Version 1.1

Version 1.11 Sep 30, 2026, 4:36 PM CVSS metrics ("CVSSv2 score" set to 7.8) CVSS metrics ("CVSSv2 vector" set to "CVSS2#AV:N/AC:L/Au:N/C:C/I:N/A:N") CVSSv2 severity (based on CVE-2026-89481, severity increased from "Low" to "High") Plugin Feed: 202609301636
Version 1.10 Sep 30, 2026, 1:44 AM CVSS metrics ("CVSSv2 score" set to 2.1) CVSS metrics ("CVSSv2 vector" set to "CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:N") CVSSv2 severity (based on CVE-2026-89481, severity decreased from "High" to "Low") Detection (updated detection logic) Plugin metadata Plugin Feed: 202609300144
Version 1.9 Sep 28, 2026, 8:04 AM CVSS metrics ("CVSSv2 score" set to 7.8) CVSS metrics ("CVSSv2 vector" set to "CVSS2#AV:N/AC:L/Au:N/C:C/I:N/A:N") CVSSv2 severity (based on CVE-2026-89481, severity increased from "Low" to "High") Plugin Feed: 202609280804
Version 1.8 Sep 25, 2026, 5:53 AM CVSS metrics ("CVSSv2 score" set to 2.1) CVSS metrics ("CVSSv2 vector" set to "CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:N") CVSSv2 severity (based on CVE-2026-89481, severity decreased from "High" to "Low") Detection (updated detection logic) Plugin metadata Plugin Feed: 202609250553
Version 1.4 Sep 16, 2026, 6:23 PM CVSS metrics ("CVSSv2 score" set to 7.8) CVSS metrics ("CVSSv2 vector" set to "CVSS2#AV:N/AC:L/Au:N/C:C/I:N/A:N") CVSSv2 severity (based on CVE-2026-89481, severity increased from "Low" to "High") Plugin Feed: 202609161823
Version 1.3 Sep 14, 2026, 6:39 PM CVSS metrics ("CVSSv2 score" set to 2.1) CVSS metrics ("CVSSv2 vector" set to "CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:N") CVSSv2 severity (based on CVE-2026-89481, severity decreased from "High" to "Low") Detection (updated detection logic) Plugin metadata Plugin Feed: 202609141839
Version 1.2 Sep 14, 2026, 1:09 PM CVSS metrics ("CVSSv2 score" set to 7.8) CVSS metrics ("CVSSv2 vector" set to "CVSS2#AV:N/AC:L/Au:N/C:C/I:N/A:N") CVSS metrics ("CVSSv3 score" set to 7.5) CVSS metrics ("CVSSv3 vector" set to "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N") CVSSv2 severity (based on CVE-2026-89481, severity increased from "Low" to "High") CVSSv3 severity (based on None, severity increased from "Medium" to "High") Plugin Feed: 202609141309
Version 1.1 Sep 12, 2026, 9:05 PM New Plugin Feed: 202609122105