The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - In the Linux kernel, the following vulnerability has been resolved: NFSD: Prevent client use-after-free     during export state revocation nfsd4_revoke_export_states() has the same use-after-free as     nfsd4_revoke_states(): it drops nn->client_lock across revoke_one_stid() and the following read of     clp->cl_minorversion, but the stateid reference it holds does not pin the client. A teardown racing the     dropped lock can free the client while revoke_one_stid() still dereferences it. exportfs -u drives this     path through NFSD_CMD_UNLOCK_EXPORT, so an administrator removing an export can race a client expiry. Skip     a client that is already expiring and otherwise pin it with cl_rpc_users under client_lock before dropping     the lock, matching nfsd4_revoke_states(). (CVE-2026-90038)

Note that Nessus relies on the presence of the package as reported by the vendor.

Detections

Analytics

Linux Distros Unpatched Vulnerability : CVE-2026-90038

critical Nessus Plugin ID 346934

Version 1.3

Version 1.2

Version 1.1

Version 1.3 Sep 18, 2026, 11:05 PM CVSS metrics ("CVSSv2 score" set to 2.1) CVSS metrics ("CVSSv2 vector" set to "CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:N") CVSSv2 severity (based on CVE-2026-90038, severity decreased from "High" to "Low") Detection (updated detection logic) Plugin metadata Plugin Feed: 202609182305
Version 1.2 Sep 18, 2026, 2:17 PM CVSS metrics ("CVSSv2 score" set to 10.0. "CVSSv2 vector" set to "CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C") CVSSv2 severity (based on CVE-2026-90038, severity increased from "Low" to "High") Detection (updated detection logic) Plugin metadata Plugin Feed: 202609181417
Version 1.1 Sep 18, 2026, 12:24 AM New Plugin Feed: 202609180024