The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - lockd: fix swapped arguments in nlmsvc_match_ip() When releasing locks by server IP address via     /proc/fs/nfsd/unlock_ip, nlmsvc_unlock_all_by_ip() calls nlm_traverse_files() with the server sockaddr as     the opaque @data argument: nlm_traverse_files(server_addr, nlmsvc_match_ip, NULL); The match callback is     later invoked from nlm_traverse_locks() as: match(lockhost, host); where the first argument is the     nlm_host that owns the lock, and the second argument is the @data that was originally passed down (here     the server sockaddr). This is the convention every other match callback relies on (nlmsvc_mark_host(),     nlmsvc_same_host(), nlmsvc_is_client()): arg1 is the real nlm_host, arg2 is the caller-supplied reference     value. nlmsvc_match_ip() has had these two arguments reversed ever since the unlock-by-IP feature was     introduced in commit 4373ea84c84d (lockd: unlock lockd locks associated with a given server ip): return     rpc_cmp_addr(nlm_srcaddr(host), datap); Here @host is actually the server sockaddr, so nlm_srcaddr(host)     dereferences a struct sockaddr as a struct nlm_host and reads garbage at the offset of h_srcaddr;
    meanwhile @datap is actually the lock owner's nlm_host but is compared as a sockaddr. As a result the     comparison practically never matches and locks are not released for the requested IP. Swap the arguments     so the lock owner's source address is compared against the requested server address: return     rpc_cmp_addr(nlm_srcaddr(datap), (struct sockaddr *)host); [ cel: fix the misleading typedef parameter     names too ] (CVE-2026-93231)

Note that Nessus relies on the presence of the package as reported by the vendor.

Detections

Analytics

Linux Distros Unpatched Vulnerability : CVE-2026-93231

medium Nessus Plugin ID 350117

Version 1.4

Version 1.3

Version 1.2

Version 1.1

Version 1.4 Oct 17, 2026, 4:43 AM Detection (updated detection logic) Plugin metadata Plugin Feed: 202610170443
Version 1.3 Oct 13, 2026, 2:52 AM Detection (updated detection logic) Plugin metadata Plugin Feed: 202610130252
Version 1.2 Sep 25, 2026, 6:49 PM Plugin metadata Detection (updated detection logic) CVSSv2 severity (based on CVE-2026-93231, severity increased from "Low" to "Medium") CVSS metrics ("CVSSv2 vector" set to "CVSS2#AV:L/AC:L/Au:N/C:C/I:N/A:C") CVSS metrics ("CVSSv2 score" set to 6.6) Plugin Feed: 202609251849
Version 1.1 Sep 25, 2026, 12:17 PM New Plugin Feed: 202609251217