The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - IB/isert: reject login PDUs declaring more data than was received isert_login_recv_done() records how many     bytes the HCA actually placed in the login buffer, but nothing compares that against the length the login     PDU's BHS declares. isert_rx_login_req() copies min(login_req_len, MAX_KEY_VALUE_PAIRS) bytes into     login->req_buf, and the login code then reads the declared length back out of that buffer - for the first     PDU in iscsi_target_locate_portal(), payload_length = ntoh24(login_req->dlength); tmpbuf =     kmemdup_nul(login->req_buf, payload_length, GFP_KERNEL); and for the ones after it in     iscsi_decode_text_input(), reached from iscsi_target_do_login(). login->req_buf is a fixed     MAX_KEY_VALUE_PAIRS (8192) byte allocation, so an initiator that declares more than it sends reads off the     end of it, before authentication and with the length under its control: BUG: KASAN: slab-out-of-bounds in     kmemdup_nul+0x43/0x80 Read of size 8193 at addr ffff8881056a8000 by task iscsi_np/167
    __asan_memcpy+0x23/0x60 kmemdup_nul+0x43/0x80 iscsi_target_locate_portal+0x48d/0x1180     iscsi_target_login_thread+0x19a9/0x3350 Allocated by task 167: __kmalloc_cache_noprof+0x158/0x370     iscsi_target_login_thread+0x971/0x3350 which belongs to the cache kmalloc-8k of size 8192 allocated     8192-byte region Falsifying the second login PDU instead reaches the other reader, on the same buffer:
    BUG: KASAN: slab-out-of-bounds in kmemdup_nul+0x43/0x80 Read of size 8193 at addr ffff888104d10000 by task     kworker/1:1/50 Workqueue: isert_login_wq iscsi_target_do_login_rx __asan_memcpy+0x23/0x60     kmemdup_nul+0x43/0x80 iscsi_decode_text_input+0xc6/0x11c0 iscsi_target_do_login+0x261/0x1470     iscsi_target_do_login_rx+0x51d/0x7d0 iscsit over TCP is not exposed: iscsit_get_login_rx() validates the     declared length with iscsi_target_check_login_request() and then reads exactly that many bytes off the     socket, so the declared length governs how much arrives rather than how much is copied out of an already-     filled buffer. isert does not call iscsi_target_check_login_request() at all. Reject a login PDU whose     declared DataSegmentLength exceeds what was received, in both paths that reach isert_rx_login_req():
    isert_get_login_rx() for the first login PDU and isert_login_recv_done() for the ones after it. dlength <=     login_req_len is allowed because the received count can include up to three bytes of iSCSI padding. Once     the check is in place the copy out can no longer exceed the copy in: the posted login SGE is     ISER_RX_PAYLOAD_SIZE, so login_req_len cannot exceed MAX_KEY_VALUE_PAIRS and the min() in     isert_rx_login_req() is login_req_len. Like the existing short-PDU check added by 29e7b925ae6d, the reject     in isert_login_recv_done() returns without completing login_req_comp, so a malformed subsequent PDU leaves     the login to be torn down by the login timer rather than failing immediately. The first-PDU path returns     an error and fails straight away. Reproduced on 7.2.0-rc4 with soft-RoCE (rdma_rxe) under KASAN, using an     initiator that sends the real key=value payload while declaring 8193 in the BHS, on the first login PDU     and on the second in separate runs. The reported read size tracks the declared value exactly; 16384 and     61440 behave the same. Unpatched 3 of 3 runs report on each of the two paths, patched 0 of 3 on both, run     alternately in a single session, and a normal login still completes on the patched build. (CVE-2026-90413)

Note that Nessus relies on the presence of the package as reported by the vendor.

Detections

Analytics

Linux Distros Unpatched Vulnerability : CVE-2026-90413

critical Nessus Plugin ID 347556

Version 1.10

Version 1.9

Version 1.7

Version 1.6

Version 1.3

Version 1.2

Version 1.1

Version 1.10 Oct 22, 2026, 10:08 AM CVSS metrics ("CVSSv2 score" set to 9.4) CVSS metrics ("CVSSv2 vector" set to "CVSS2#AV:N/AC:L/Au:N/C:C/I:N/A:C") Plugin Feed: 202610221008
Version 1.9 Oct 22, 2026, 12:02 AM CVSS metrics ("CVSSv2 vector" set to "CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:C") Detection (updated detection logic) Plugin metadata Plugin Feed: 202610220002
Version 1.7 Oct 6, 2026, 8:42 AM CVSS metrics ("CVSSv2 score" set to 9.4) CVSS metrics ("CVSSv2 vector" set to "CVSS2#AV:N/AC:L/Au:N/C:C/I:N/A:C") Plugin Feed: 202610060842
Version 1.6 Sep 30, 2026, 6:31 AM CVSS metrics ("CVSSv2 score" set to 8.5) CVSS metrics ("CVSSv2 vector" set to "CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:C") Detection (updated detection logic) Plugin metadata Plugin Feed: 202609300631
Version 1.3 Sep 21, 2026, 3:50 PM CVSS metrics ("CVSSv2 score" set to 9.4) CVSS metrics ("CVSSv2 vector" set to "CVSS2#AV:N/AC:L/Au:N/C:C/I:N/A:C") CVSSv2 severity (based on CVE-2026-90413, severity increased from "Medium" to "High") Plugin Feed: 202609211550
Version 1.2 Sep 18, 2026, 11:05 PM CVSS metrics ("CVSSv2 score" set to 5.6) CVSS metrics ("CVSSv2 vector" set to "CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:C") CVSS metrics ("CVSSv3 score" set to 9.1) CVSS metrics ("CVSSv3 vector" set to "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H") CVSSv2 severity (based on CVE-2026-90413, severity decreased from "High" to "Medium") Detection (updated detection logic) Plugin metadata Plugin Feed: 202609182305
Version 1.1 Sep 18, 2026, 2:17 PM New Plugin Feed: 202609181417