The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - LoongArch: Add DIRECT_MAP_PHYSMEM_END definition get_free_mem_region() and mhp_get_pluggable_range() bound     their search to DIRECT_MAP_PHYSMEM_END. LoongArch does not define it, so the fallback in     include/linux/mm.h applies: under CONFIG_SPARSEMEM_VMEMMAP it is (1ULL << MAX_PHYSMEM_BITS) - 1, a     compile-time constant that does not adapt to the CPU's physical address space bits (cpu_pabits, probed     from CPUCFG1). The vmemmap window only covers physical space below 2^(cpu_pabits+1) (i.e. VMEMMAP_SIZE),     so on CPUs with fewer physical address bits than MAX_PHYSMEM_BITS the fallback allows     get_free_mem_region() to return a ZONE_DEVICE region outside the vmemmap window; vmemmap_populate() then     wraps the memmap range around and maps it into low memory, silently corrupting the page tables. The same     search also picked the top-of- address-space region that crashed memmap_init_zone_device() with amdkfd on     Loongson-3C6000 in 6.16 [1]; the commit 2969b42c8f99 (LoongArch/mm: align vmemmap to maximal folio size)     keeps that region in bounds on current Loongson-3C6000 configs, but CPUs with smaller cpu_pabits (e.g. the     Loongson-2K series) are still affected. Define DIRECT_MAP_PHYSMEM_END as the vmemmap-covered physical     range, (1ULL << (cpu_pabits + 1)) - 1, capped at (1ULL << MAX_PHYSMEM_BITS) - 1 under CONFIG_SPARSEMEM,     similar to the commit f3336b48cf9d (riscv: mm: Define DIRECT_MAP_PHYSMEM_END). [1]     https://lore.kernel.org/amd-gfx/20250814032153.227285-1-jeffbai@aosc.io/ (CVE-2026-93237)

Note that Nessus relies on the presence of the package as reported by the vendor.

Detections

Analytics

Linux Distros Unpatched Vulnerability : CVE-2026-93237

high Nessus Plugin ID 350107

Version 1.4

Version 1.3

Version 1.2

Version 1.1

Version 1.4 Sep 28, 2026, 8:04 AM CVSS metrics ("CVSSv2 score" set to 6.8) CVSS metrics ("CVSSv2 vector" set to "CVSS2#AV:L/AC:L/Au:S/C:C/I:C/A:C") CVSSv2 severity (based on CVE-2026-93237, severity decreased from "High" to "Medium") Plugin Feed: 202609280804
Version 1.3 Sep 26, 2026, 8:25 AM Detection (updated detection logic) Plugin metadata Plugin Feed: 202609260825
Version 1.2 Sep 25, 2026, 6:49 PM Detection (updated detection logic) Plugin metadata Plugin Feed: 202609251849
Version 1.1 Sep 25, 2026, 12:17 PM New Plugin Feed: 202609251217