The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - nvmet-tcp: reject unsolicited H2CData PDUs nvmet_tcp_handle_h2c_data_pdu() accepts an H2CData PDU after     only checking that its TTAG is a valid in-range command index and that the command's data buffers are     mapped. It never checks that the target has actually solicited that data by sending an R2T for the     command. A remote host can abuse this. It submits a write command that takes the R2T path and, before the     target transmits the R2T, sends an H2CData PDU for that command's tag. The data completes the command     early, and when the command then fails synchronously (e.g. a length mismatch caught by     nvmet_check_transfer_len()), it is completed a second time. Each completion calls     nvmet_tcp_queue_response(), so the same command is added to queue->resp_list twice while it is still     linked; the second llist_add() makes the node point to itself (lentry->next == lentry).
    nvmet_tcp_process_resp_list() then walks that self-referential node and adds the command to resp_send_list     twice. With CONFIG_DEBUG_LIST this trips the list_add double add check (kernel BUG); without it the loop     never terminates and the nvmet_tcp workqueue wedges (soft-lockup). It is remotely triggerable and needs no     authentication on an allow_any_host subsystem. Track whether an R2T has been transmitted for a command and     reject an H2CData PDU that arrives before it. The flag is cleared on command reuse (nvmet_tcp_get_cmd()     zeroes cmd->flags) and stays set across the multiple H2CData PDUs of a single solicited transfer.
    (CVE-2026-89968)

Note that Nessus relies on the presence of the package as reported by the vendor.

Detections

Analytics

Linux Distros Unpatched Vulnerability : CVE-2026-89968

high Nessus Plugin ID 346542

Version 1.9

Version 1.6

Version 1.5

Version 1.4

Version 1.3

Version 1.2

Version 1.1

Version 1.9 Sep 30, 2026, 6:31 AM CVSS metrics ("CVSSv2 score" set to 7.2) CVSS metrics ("CVSSv2 vector" set to "CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C") Detection (updated detection logic) Plugin metadata Plugin Feed: 202609300631
Version 1.6 Sep 23, 2026, 1:21 PM CVSS metrics ("CVSSv2 score" set to 7.2) CVSS metrics ("CVSSv2 vector" set to "CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C") Detection (updated detection logic) Plugin Feed: 202609231321
Version 1.5 Sep 21, 2026, 3:50 PM CVSS metrics ("CVSSv2 score" set to 7.8) CVSS metrics ("CVSSv2 vector" set to "CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C") Plugin Feed: 202609211550
Version 1.4 Sep 18, 2026, 11:05 PM CVSS metrics ("CVSSv2 score" set to 7.2) CVSS metrics ("CVSSv2 vector" set to "CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C") Detection (updated detection logic) Plugin metadata Plugin Feed: 202609182305
Version 1.3 Sep 18, 2026, 2:17 PM CVSS metrics ("CVSSv2 score" set to 7.8. "CVSSv2 vector" set to "CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C") Detection (updated detection logic) Plugin metadata Plugin Feed: 202609181417
Version 1.2 Sep 18, 2026, 12:24 AM CVSS metrics ("CVSSv2 score" set to 7.2) CVSS metrics ("CVSSv2 vector" set to "CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C") Detection (updated detection logic) Plugin metadata Plugin Feed: 202609180024
Version 1.1 Sep 17, 2026, 12:32 PM New Plugin Feed: 202609171232