The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Bluetooth: MGMT: free the mesh send cancel command when it is cancelled mesh_send_cancel() queues the     pending command with a NULL destroy callback, so it is only freed if send_cancel() runs. A cancelled entry     is leaked, as _hci_cmd_sync_cancel_entry() does not release entry->data when there is no destroy callback,     and hci_cmd_sync_clear() cancels every pending entry when the controller is unregistered. Nothing else     reclaims it either: mgmt_pending_new() does not put the command on hdev->mgmt_pending. The leak also pins     the socket reference taken by mgmt_pending_new(), so the mgmt socket is never released. Free the command     from a destroy callback. (CVE-2026-90253)

Note that Nessus relies on the presence of the package as reported by the vendor.

Detections

Analytics

Linux Distros Unpatched Vulnerability : CVE-2026-90253

high Nessus Plugin ID 347442

Version 1.8

Version 1.6

Version 1.5

Version 1.3

Version 1.2

Version 1.1

Version 1.8 Oct 22, 2026, 12:02 AM Detection (updated detection logic) Plugin metadata Plugin Feed: 202610220002
Version 1.6 Oct 6, 2026, 8:42 AM Detection (updated detection logic) Plugin metadata Plugin Feed: 202610060842
Version 1.5 Sep 30, 2026, 4:36 PM Detection (updated detection logic) Plugin metadata Plugin Feed: 202609301636
Version 1.3 Sep 22, 2026, 8:27 AM Detection (updated detection logic) Plugin metadata Plugin Feed: 202609220827
Version 1.2 Sep 18, 2026, 11:05 PM CVSS metrics ("CVSSv2 score" set to 7.2) CVSS metrics ("CVSSv2 vector" set to "CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C") CVSS metrics ("CVSSv3 score" set to 7.8) CVSS metrics ("CVSSv3 vector" set to "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H") Detection (updated detection logic) Plugin metadata Plugin Feed: 202609182305
Version 1.1 Sep 18, 2026, 2:17 PM New Plugin Feed: 202609181417