The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read In qla2x00_status_entry(), the FWI2 status     path advances sense_data and shrinks par_sense_len by rsp_info_len: if (IS_FWI2_CAPABLE(ha)) { sense_data     += rsp_info_len; par_sense_len -= rsp_info_len; } rsp_info_len is a 32-bit value taken directly from the     target's FCP response (sf.rsp_data_len), while par_sense_len is the IOCB data area size (28 bytes for     24xx, 60 bytes for 29xx). A hostile or buggy target reporting an rsp_info_len larger than par_sense_len     makes the unsigned subtraction underflow to a huge value and advances sense_data out of bounds. The     underflowed par_sense_len then defeats the cap in qla2x00_handle_sense(): if (sense_len > par_sense_len)     sense_len = par_sense_len; memcpy(cp->sense_buffer, sense_data, sense_len); so the memcpy reads up to     SCSI_SENSE_BUFFERSIZE bytes from the out-of-bounds sense_data pointer, leaking adjacent response-ring/heap     memory into the command's sense buffer. Clamp rsp_info_len to par_sense_len before the subtraction so     par_sense_len can never underflow and sense_data stays within the IOCB data area. The fix sits before the     comp_status switch, covering both qla2x00_handle_sense() call sites. (CVE-2026-89846)

Note that Nessus relies on the presence of the package as reported by the vendor.

Detections

Analytics

Linux Distros Unpatched Vulnerability : CVE-2026-89846

critical Nessus Plugin ID 346630

Version 1.11

Version 1.10

Version 1.9

Version 1.4

Version 1.3

Version 1.2

Version 1.1

Version 1.11 Sep 30, 2026, 4:36 PM Detection (updated detection logic) Plugin metadata Plugin Feed: 202609301636
Version 1.10 Sep 30, 2026, 6:31 AM CVSS metrics ("CVSSv2 score" set to 5.6) CVSS metrics ("CVSSv2 vector" set to "CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:C") CVSSv2 severity (based on CVE-2026-89846, severity decreased from "High" to "Medium") Detection (updated detection logic) Plugin metadata Plugin Feed: 202609300631
Version 1.9 Sep 25, 2026, 12:17 PM CVSS metrics ("CVSSv2 score" set to 9.4) CVSS metrics ("CVSSv2 vector" set to "CVSS2#AV:N/AC:L/Au:N/C:C/I:N/A:C") CVSSv2 severity (based on CVE-2026-89846, severity increased from "Medium" to "High") Plugin Feed: 202609251217
Version 1.4 Sep 23, 2026, 1:21 PM CVSS metrics ("CVSSv2 score" set to 5.6) CVSS metrics ("CVSSv2 vector" set to "CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:C") CVSSv2 severity (based on CVE-2026-89846, severity decreased from "High" to "Medium") Detection (updated detection logic) Plugin Feed: 202609231321
Version 1.3 Sep 18, 2026, 2:17 PM CVSS metrics ("CVSSv2 score" set to 9.4) CVSS metrics ("CVSSv2 vector" set to "CVSS2#AV:N/AC:L/Au:N/C:C/I:N/A:C") CVSSv2 severity (based on CVE-2026-89846, severity increased from "Medium" to "High") Plugin Feed: 202609181417
Version 1.2 Sep 18, 2026, 12:24 AM CVSS metrics ("CVSSv2 score" set to 5.6) CVSS metrics ("CVSSv2 vector" set to "CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:C") CVSSv2 severity (based on CVE-2026-89846, severity decreased from "High" to "Medium") Detection (updated detection logic) Plugin metadata Plugin Feed: 202609180024
Version 1.1 Sep 17, 2026, 12:32 PM New Plugin Feed: 202609171232