The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - ext4: fix out-of-bounds read in ext4_read_inline_dir() ext4_read_inline_dir() can read a dirent header     past the end of its inline buffer, triggering a slab-out-of-bounds read during getdents64(): BUG: KASAN:
    slab-out-of-bounds in __ext4_check_dir_entry Read of size 2 at addr ffff88800f3dd23c by task exploit/148     ... __ext4_check_dir_entry ext4_read_inline_dir iterate_dir The dirent payload lives in a buffer of     exactly inline_size bytes: dir_buf = kmalloc(inline_size, GFP_NOFS); but iteration runs in a position     space extra_offset bytes larger (extra_size = extra_offset + inline_size) so the synthetic . and ..
    land at their block-dir offsets. A dirent is formed at dir_buf + pos - extra_offset, yet the     ext4_check_dir_entry() length argument uses the larger extra_size. A position whose dirent header would     extend past extra_size is therefore accepted, and the rescan loop's rec_len probe and     ext4_check_dir_entry() dereference de->rec_len before the entry is rejected. Reject a position whose     minimum-size dirent header would not fit within extra_size before forming de, in both the rescan and main     loops, and pass inline_size rather than extra_size to ext4_check_dir_entry() so the length check matches     the physical buffer. (CVE-2026-89786)

Note that Nessus relies on the presence of the package as reported by the vendor.

Detections

Analytics

Linux Distros Unpatched Vulnerability : CVE-2026-89786

critical Nessus Plugin ID 349303

Version 1.10

Version 1.9

Version 1.8

Version 1.7

Version 1.6

Version 1.4

Version 1.10 Oct 19, 2026, 10:23 AM CVSS metrics ("CVSSv2 score" set to 9.4) CVSS metrics ("CVSSv2 vector" set to "CVSS2#AV:N/AC:L/Au:N/C:C/I:N/A:C") CVSSv2 severity (based on CVE-2026-89786, severity increased from "Medium" to "High") Plugin Feed: 202610191023
Version 1.9 Oct 18, 2026, 5:28 AM CVSS metrics ("CVSSv2 score" set to 5.6) CVSS metrics ("CVSSv2 vector" set to "CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:C") Detection (updated detection logic) Plugin metadata Plugin Feed: 202610180528
Version 1.8 Oct 17, 2026, 4:43 AM CVSS metrics ("CVSSv2 score" set to 6.6) CVSS metrics ("CVSSv2 vector" set to "CVSS2#AV:L/AC:L/Au:N/C:C/I:N/A:C") CVSSv2 severity (based on CVE-2026-89786, severity decreased from "High" to "Medium") Detection (updated detection logic) Plugin metadata Plugin Feed: 202610170443
Version 1.7 Oct 14, 2026, 9:52 AM CVSS metrics ("CVSSv2 score" set to 9.4) CVSS metrics ("CVSSv2 vector" set to "CVSS2#AV:N/AC:L/Au:N/C:C/I:N/A:C") CVSSv2 severity (based on CVE-2026-89786, severity increased from "Medium" to "High") Plugin Feed: 202610140952
Version 1.6 Oct 13, 2026, 2:52 AM CVSS metrics ("CVSSv2 score" set to 6.6) CVSS metrics ("CVSSv2 vector" set to "CVSS2#AV:L/AC:L/Au:N/C:C/I:N/A:C") CVSSv2 severity (based on CVE-2026-89786, severity decreased from "High" to "Medium") Detection (updated detection logic) Plugin metadata Plugin Feed: 202610130252
Version 1.4 Sep 30, 2026, 6:31 AM CVSS metrics ("CVSSv2 score" set to 6.6) CVSS metrics ("CVSSv2 vector" set to "CVSS2#AV:L/AC:L/Au:N/C:C/I:N/A:C") CVSSv2 severity (based on CVE-2026-89786, severity decreased from "High" to "Medium") Detection (updated detection logic) Plugin metadata Plugin Feed: 202609300631