The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - inetpeer: randomize RB-tree node comparison using SipHash The inetpeer rate limiting system stores peer     entries in a Red-Black tree keyed deterministically on the remote IP address. Because tree lookups walk     the RB-tree using standard lexicographical comparisons (inetpeer_addr_cmp), an off-path adversary can     predict the exact topology of the tree and the sequence of nodes traversed during lookups (the gc_stack     candidate list). By combining deterministic tree traversal with aggressive garbage collection (triggered     when tree size exceeds inet_peer_threshold), an attacker can selectively force the eviction of targeted     inet_peer nodes. When an evicted node is subsequently re-created upon receiving a new packet, its rate-     limiting token bucket (rate_tokens, rate_last) is reset to full capacity. This creates a side-channel     primitive allowing off-path attackers to bypass IP-keyed ICMP rate limits and infer open UDP ports     (similar to SAD DNS style attacks). Mitigate this by randomizing the RB-tree node comparison logic using     SipHash with a secret key (inetpeer_hash_key) initialized via net_get_random_once(). Nodes are ordered in     the tree by SipHash(addr, key) rather than raw IP addresses. Because the secret key is unknown to external     entities, the tree layout and lookup traversal paths are unpredictable to off-path adversaries, breaking     the deterministic eviction gadget. Cache the computed 64-bit SipHash (hash) in struct inet_peer and     compute the target hash (dhash) once at the beginning of inet_getpeer() to avoid recomputing SipHash at     every step of the RB-tree walk. (CVE-2026-90110)

Note that Nessus relies on the presence of the package as reported by the vendor.

Detections

Analytics

Linux Distros Unpatched Vulnerability : CVE-2026-90110

critical Nessus Plugin ID 347515

Version 1.5