The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - In the Linux kernel, the following vulnerability has been resolved: ext4: clear stale xarray tags on     folios skipped during writeback In data=journal mode, the writeback thread can hit the     WARN_ON_ONCE(sb_rdonly(sb)) in ext4_journal_check_start() while the superblock is being remounted read-     only during reboot: Workqueue: writeback wb_workfn (flush-253:0) RIP:
    0010:ext4_journal_check_start+0x8b/0xd0 Call Trace: __ext4_journal_start_sb+0x3c/0x1e0     mpage_prepare_extent_to_map+0x4af/0x580 ext4_do_writepages+0x3c0/0x1080 ext4_writepages+0xc8/0x1a0     do_writepages+0xc4/0x180 __writeback_single_inode+0x45/0x2f0 writeback_sb_inodes+0x26b/0x5d0
    __writeback_inodes_wb+0x54/0x100 wb_writeback+0x1ac/0x320 wb_workfn+0x394/0x470 And followed by the     warning: EXT4-fs warning (device vda1): ext4_evict_inode:195: inode #6263: comm (sd-umount): data will be     lost This issue is not reproduced every time, but frequently. The reproduction step is to create a VM with     8 CPUs, 16G memory and setup data=journal: sudo tune2fs -o journal_data /dev/vda1 Run fio: rm -f fiotest     fio --name=fiotest --rw=randwrite --bs=4k --runtime=6 --ioengine=libaio --iodepth=256 --numjobs=8
    --filename=fiotest --filesize=30G --group_reporting Reboot the VM, and check the console output from:
    virsh console testvm But there is no dirty inode, folio_clear_dirty_for_io clears PG_dirty but leaves tags     PAGECACHE_TAG_DIRTY and PAGECACHE_TAG_TOWRITE set which are only cleared by __folio_start_writeback. In     data=journal mode, jbd2 checkpoints the journalled data to its final location and clears its own dirty     flag without touching folio PG_dirty or xarray dirty flags. The commit f4a2b42e7891 (ext4: fix stale     xarray tags after writeback) fixes when PG_dirty is still set but there is no dirty page. Another case is     PG_dirty is cleared, but PAGECACHE_TAG_DIRTY and PAGECACHE_TAG_TOWRITE is still set. In this case,     writeback thread checks clean folio and skips it in mpage_prepare_extent_to_map: if     (!folio_test_dirty(folio) || ... folio_unlcok(folio); continue And never reaches ext4_bio_write_folio     where the commit f4a2b42e7891 clears the stale xarray tags. Print debug logs after the filesystem is     remounted read-only: writepages RDONLY nrpages=2048 dirtytag=1 wbtag=0 towrite=1 sync=0 And all folios are     actually clean: folio idx=3 dirty=0 wb=0 checked=0 dirtybuf=0 jbddirty=0 mapped=1 ... We need to clear the     xarray stale tags for such clean folios by cycling them through writeback in the skip path, the same way     f4a2b42e7891 does in ext4_bio_write_folio. (CVE-2026-92502)

Note that Nessus relies on the presence of the package as reported by the vendor.

Detections

Analytics

Linux Distros Unpatched Vulnerability : CVE-2026-92502

medium Nessus Plugin ID 347842

Version 1.12

Version 1.11

Version 1.10

Version 1.9

Version 1.7

Version 1.6

Version 1.4

Version 1.3

Version 1.2

Version 1.1

Version 1.12 Oct 20, 2026, 5:14 PM CVSS metrics ("CVSSv2 score" set to 4.7) CVSS metrics ("CVSSv2 vector" set to "CVSS2#AV:L/AC:M/Au:N/C:N/I:N/A:C") Detection (updated detection logic) Plugin metadata Plugin Feed: 202610201714
Version 1.11 Oct 16, 2026, 2:12 AM Plugin metadata Detection (updated detection logic) Plugin Feed: 202610160212
Version 1.10 Oct 15, 2026, 9:10 PM Detection (updated detection logic) Plugin metadata Plugin Feed: 202610152110
Version 1.9 Oct 9, 2026, 2:01 PM Detection (updated detection logic) Plugin metadata Plugin Feed: 202610091401
Version 1.7 Oct 7, 2026, 6:12 AM Detection (updated detection logic) Plugin metadata Plugin Feed: 202610070612
Version 1.6 Sep 30, 2026, 4:36 PM CVSS metrics ("CVSSv2 score" set to 5.4) CVSS metrics ("CVSSv2 vector" set to "CVSS2#AV:L/AC:M/Au:N/C:P/I:N/A:C") CVSS metrics ("CVSSv3 score" set to none) CVSS metrics ("CVSSv3 vector" set to none) CVSS temporal metrics ("CVSSv3 temporal vector" set to none) CVSSv3 severity (based on None, severity increased from "Medium" to "High") Detection (updated detection logic) Plugin metadata Plugin Feed: 202609301636
Version 1.4 Sep 23, 2026, 1:21 PM Detection (updated detection logic) Plugin Feed: 202609231321
Version 1.3 Sep 22, 2026, 8:27 AM Detection (updated detection logic) Plugin metadata Plugin Feed: 202609220827
Version 1.2 Sep 18, 2026, 11:05 PM CVSS metrics ("CVSSv2 score" set to 4.7) CVSS metrics ("CVSSv2 vector" set to "CVSS2#AV:L/AC:M/Au:N/C:N/I:N/A:C") CVSS metrics ("CVSSv3 score" set to 5.5) CVSS metrics ("CVSSv3 vector" set to "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H") CVSSv2 severity (based on CVE-2026-92502, severity decreased from "High" to "Medium") CVSSv3 severity (based on None, severity decreased from "High" to "Medium") Detection (updated detection logic) Plugin metadata Plugin Feed: 202609182305
Version 1.1 Sep 18, 2026, 2:17 PM New Plugin Feed: 202609181417