The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - svcrdma: Reject Write/Reply chunks with segcount 0 A peer can send a Write or Reply chunk whose segcount     field is zero. xdr_check_write_chunk() only rejects segcount > rc_maxpages, so zero passes the range     check, and xdr_inline_decode(stream, 0) returns the current (non-NULL) cursor without advancing. The     function returns true and pcl_alloc_write() then links a struct svc_rdma_chunk with ch_segcount == 0 onto     rc_write_pcl or rc_reply_pcl. An earlier patch in this series made pcl_for_each_segment() safe for     ch_segcount == 0, so this no longer drives the memory walk it used to. Rejecting the malformed frame at     the decode boundary is still worthwhile as defense in depth: it keeps degenerate zero-segment chunks off     the parsed chunk lists entirely, so any future consumer that walks ch_segments directly cannot observe     one, and it makes the zero-floor easy to backport to trees where the macro change is more intrusive. RFC     8166 has no meaning for a Write/Reply chunk that describes no remote buffer, so no legitimate client is     affected. xdr_check_reply_chunk() funnels Reply chunks through xdr_check_write_chunk() and inherits the     same rejection. pcl_alloc_write() also links each chunk onto the parsed chunk list before filling its     segment array. If a future change weakens the segcount-0 rejection, an incomplete chunk is visible to     consumers during the fill loop. Reorder so that list_add_tail() follows the segment fill loop, ensuring     only fully-populated chunks appear on the list. (CVE-2026-93228)

Note that Nessus relies on the presence of the package as reported by the vendor.

Detections

Analytics

Linux Distros Unpatched Vulnerability : CVE-2026-93228

critical Nessus Plugin ID 350108

Version 1.12