The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - configfs: unhash the dentry before dropping the item in rmdir configfs_get_config_item() treats a hashed     dentry as proof that sd->s_element is a live config_item. configfs_rmdir() breaks that: simple_rmdir()     leaves the dentry hashed, the last reference to the item is dropped right after, and the dentry is only     unhashed by d_delete() once ->rmdir() has returned. configfs_symlink() resolves its target holding no lock     on it, so get_target() can land in that window: BUG: KASAN: slab-use-after-free in     config_item_get+0x26/0x90 get_target fs/configfs/symlink.c:128 [inline] configfs_symlink+0x4ab/0x1030     fs/configfs/symlink.c:185 Unhash in configfs_remove_dir(), while the item is still guaranteed to be there.
    A reference obtained just before that stays harmless, as create_link() rechecks CONFIGFS_USET_DROPPING,     already set by configfs_detach_prep(). Both configfs_unregister_subsystem() paths d_drop() after     detaching, so this only makes rmdir match them. (CVE-2026-97949)

Note that Nessus relies on the presence of the package as reported by the vendor.

Detections

Analytics

Linux Distros Unpatched Vulnerability : CVE-2026-97949

high Nessus Plugin ID 350368

Version 1.5

Version 1.4

Version 1.3

Version 1.2

Version 1.1

Version 1.5 Oct 17, 2026, 9:36 AM Detection (updated detection logic) Plugin metadata Plugin Feed: 202610170936
Version 1.4 Oct 13, 2026, 2:52 AM Detection (updated detection logic) Plugin metadata Plugin Feed: 202610130252
Version 1.3 Oct 2, 2026, 6:07 PM Detection (updated detection logic) Plugin metadata Plugin Feed: 202610021807
Version 1.2 Sep 30, 2026, 4:36 PM CVSS metrics ("CVSSv2 score" set to 4.9) CVSS metrics ("CVSSv2 vector" set to "CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C") Detection (updated detection logic) Plugin metadata Plugin Feed: 202609301636
Version 1.1 Sep 26, 2026, 2:30 AM New Plugin Feed: 202609260230