The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - vxlan: reject dynamic fdb entries that reference a nexthop id The commit cited in the Fixes tag allowed     VXLAN FDB entries to point to FDB nexthops so that overlay traffic could be load balanced across multiple     VTEPs. Such entries can only be configured from user space, cannot be learned and cannot roam. They only     make sense with a user space control plane such as E-VPN where data plane learning is disabled. Despite     that, the VXLAN driver does not currently prevent such entries from being configured with the dynamic     flag. The per-nexthop FDB list is only protected by the per-device hash lock, which is not sufficient when     two VXLAN devices point to the same FDB nexthop and therefore share the list. Aging runs in softirq     context without RTNL, so an entry deleted by one device can race with an addition or deletion from the     other, leading to list corruption: list_del corruption. next->prev should be ffff8881069d9548, but was     dead000000000122. (next=ffff8881069d9448) WARNING: CPU: 0 PID: 90 at lib/list_debug.c:65
    __list_del_entry_valid_or_report+0x1aa/0x210 ... vxlan_fdb_destroy+0x5b8/0xad0 vxlan_cleanup+0x328/0x450     call_timer_fn+0x2a/0x1c0 run_timer_softirq+0x18c/0x210 BUG: KASAN: slab-use-after-free in     vxlan_fdb_destroy Fix this by rejecting the bogus configuration of dynamic FDB entries that point to FDB     nexthops, both when created and when an existing entry is updated. As such, the per-nexthop FDB list is     only ever mutated under the RTNL lock. Add test cases to make sure that this does not regress in the     future. (CVE-2026-98023)

Note that Nessus relies on the presence of the package as reported by the vendor.

Detections

Analytics

Linux Distros Unpatched Vulnerability : CVE-2026-98023

high Nessus Plugin ID 350425

Version 1.16

Version 1.15

Version 1.14

Version 1.13

Version 1.12

Version 1.11

Version 1.10

Version 1.7

Version 1.4

Version 1.3

Version 1.2

Version 1.1

Version 1.16 Nov 6, 2026, 2:22 PM CVSS metrics ("CVSSv2 score" set to 5.4. "CVSSv2 vector" set to "CVSS2#AV:L/AC:M/Au:N/C:N/I:P/A:C") Detection (updated detection logic) Plugin metadata Plugin Feed: 202611061422
Version 1.15 Nov 5, 2026, 5:43 PM CVSS metrics ("CVSSv2 score" set to 6.8. "CVSSv2 vector" set to "CVSS2#AV:L/AC:L/Au:S/C:C/I:C/A:C") Plugin Feed: 202611051743
Version 1.14 Nov 4, 2026, 12:13 PM CVSS metrics ("CVSSv2 score" set to 5.4. "CVSSv2 vector" set to "CVSS2#AV:L/AC:M/Au:N/C:N/I:P/A:C") Detection (updated detection logic) Plugin metadata Plugin Feed: 202611041213
Version 1.13 Oct 26, 2026, 2:57 PM CVSS metrics ("CVSSv2 score" set to 6.8) CVSS metrics ("CVSSv2 vector" set to "CVSS2#AV:L/AC:L/Au:S/C:C/I:C/A:C") Plugin Feed: 202610261457
Version 1.12 Oct 23, 2026, 11:36 AM CVSS metrics ("CVSSv2 score" set to 5.4) CVSS metrics ("CVSSv2 vector" set to "CVSS2#AV:L/AC:M/Au:N/C:N/I:P/A:C") Detection (updated detection logic) Plugin metadata Plugin Feed: 202610231136
Version 1.11 Oct 22, 2026, 10:08 AM CVSS metrics ("CVSSv2 score" set to 6.8) CVSS metrics ("CVSSv2 vector" set to "CVSS2#AV:L/AC:L/Au:S/C:C/I:C/A:C") Plugin Feed: 202610221008
Version 1.10 Oct 22, 2026, 12:02 AM CVSS metrics ("CVSSv2 vector" set to "CVSS2#AV:L/AC:M/Au:N/C:N/I:P/A:C") Detection (updated detection logic) Plugin metadata Plugin Feed: 202610220002
Version 1.7 Oct 2, 2026, 6:07 PM CVSS metrics ("CVSSv2 score" set to 6.3) CVSS metrics ("CVSSv2 vector" set to "CVSS2#AV:L/AC:M/Au:N/C:N/I:C/A:C") Detection (updated detection logic) Plugin metadata Plugin Feed: 202610021807
Version 1.4 Sep 30, 2026, 6:31 AM Detection (updated detection logic) Plugin metadata Plugin Feed: 202609300631
Version 1.3 Sep 29, 2026, 4:08 PM CVSS metrics ("CVSSv2 score" set to 6.3) CVSS metrics ("CVSSv2 vector" set to "CVSS2#AV:L/AC:M/Au:N/C:N/I:C/A:C") Detection (updated detection logic) Plugin metadata Plugin Feed: 202609291608
Version 1.2 Sep 28, 2026, 8:04 AM CVSS metrics ("CVSSv2 score" set to 6.8) CVSS metrics ("CVSSv2 vector" set to "CVSS2#AV:L/AC:L/Au:S/C:C/I:C/A:C") Plugin Feed: 202609280804
Version 1.1 Sep 26, 2026, 2:30 AM New Plugin Feed: 202609260230