The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - sunrpc: xprtsock: annotate shared socket callbacks with READ_ONCE/WRITE_ONCE xprtsock replaces and     restores sk->sk_data_ready and sk->sk_write_space on live sockets with plain stores, and     xs_udp_do_set_buffer_size() invokes sk->sk_write_space via a plain load. These callback pointers are     shared with generic socket and protocol paths that may read or invoke them concurrently, so xprtsock needs     the same READ_ONCE()/WRITE_ONCE() callback visibility contract that the validated 4022 family applied     elsewhere. When SUNRPC takes over an AF_LOCAL, UDP, or TCP socket and later restores the lower-socket     callbacks during teardown, another CPU may still hold an earlier callback snapshot. The plain     replace/restore pattern leaves the same visibility hole as the validated 4022 family, so a stale snapshot     can still invoke xs_data_ready() or xs_udp_write_space() after the live callback fields have already been     restored to the lower-socket handlers. Use WRITE_ONCE() for the shared sk_data_ready and sk_write_space     stores in xs_local_finish_connecting(), xs_udp_finish_connecting(), xs_tcp_finish_connecting(), and     xs_restore_old_callbacks(). Use READ_ONCE() for the direct sk_write_space invocation in     xs_udp_do_set_buffer_size(). This matches the required callback visibility contract while leaving adjacent     sk_state_change and sk_error_report handling unchanged. (CVE-2026-90235)

Note that Nessus relies on the presence of the package as reported by the vendor.

Detections

Analytics

Linux Distros Unpatched Vulnerability : CVE-2026-90235

critical Nessus Plugin ID 347504

Version 1.8

Version 1.7

Version 1.4

Version 1.3

Version 1.2

Version 1.1

Version 1.8 Oct 6, 2026, 8:42 AM CVSS metrics ("CVSSv2 score" set to 10.0) CVSS metrics ("CVSSv2 vector" set to "CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C") CVSSv2 severity (based on CVE-2026-90235, severity increased from "Low" to "High") Plugin Feed: 202610060842
Version 1.7 Sep 30, 2026, 6:31 AM CVSS metrics ("CVSSv2 score" set to 2.1) CVSS metrics ("CVSSv2 vector" set to "CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:N") CVSSv2 severity (based on CVE-2026-90235, severity decreased from "High" to "Low") Detection (updated detection logic) Plugin metadata Plugin Feed: 202609300631
Version 1.4 Sep 23, 2026, 1:21 PM CVSS metrics ("CVSSv2 score" set to 2.1) CVSS metrics ("CVSSv2 vector" set to "CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:N") CVSSv2 severity (based on CVE-2026-90235, severity decreased from "High" to "Low") Detection (updated detection logic) Plugin Feed: 202609231321
Version 1.3 Sep 21, 2026, 3:50 PM CVSS metrics ("CVSSv2 score" set to 10.0) CVSS metrics ("CVSSv2 vector" set to "CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C") CVSSv2 severity (based on CVE-2026-90235, severity increased from "Low" to "High") Plugin Feed: 202609211550
Version 1.2 Sep 18, 2026, 11:05 PM CVSS metrics ("CVSSv2 score" set to 2.1) CVSS metrics ("CVSSv2 vector" set to "CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:N") CVSSv2 severity (based on CVE-2026-90235, severity decreased from "High" to "Low") Detection (updated detection logic) Plugin metadata Plugin Feed: 202609182305
Version 1.1 Sep 18, 2026, 2:17 PM New Plugin Feed: 202609181417