The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - inet: frags: invalidate queues before flushing them fqdir_pre_exit() flushes the skbs from incomplete     queues without changing their completion state. A fragment which found a queue before high_thresh was     cleared can then acquire the queue lock and reuse stale reassembly metadata. A queue concurrently killed     after fqdir->dead is set can instead become INET_FRAG_COMPLETE|INET_FRAG_HASH_DEAD while still holding its     old skbs; skipping it because it is complete leaves those references behind until asynchronous fqdir     teardown. For IPv6, stale metadata can make ip6_frag_reasm() use the old nhoffset with a new skb and     access memory out of bounds. The resulting heap corruption can be leveraged for local privilege escalation     when unprivileged network namespaces are available. Unflushed fragments can also keep conntrack references     alive after the conntrack per-net cleanup point. Kill each incomplete queue, then flush every queue still     owned by the dying rhashtable. HASH_DEAD identifies that ownership, while complete queues without it are     already owned by another destroy path and must be left alone. Releasing a timer reference removed by     inet_frag_kill() is deferred to inet_frag_putn(), after the queue lock is dropped. KASAN report: BUG:
    KASAN: slab-out-of-bounds in ipv6_frag_rcv (net/ipv6/reassembly.c:289 (discriminator 2)     net/ipv6/reassembly.c:229 (discriminator 2) net/ipv6/reassembly.c:391 (discriminator 2)) Write of size 1     at addr ff110001039c6e00 by task poc/771 Call Trace: ? ipv6_frag_rcv (net/ipv6/reassembly.c:289     (discriminator 2) net/ipv6/reassembly.c:229 (discriminator 2) net/ipv6/reassembly.c:391 (discriminator 2))     ipv6_frag_rcv (net/ipv6/reassembly.c:289 (discriminator 2) net/ipv6/reassembly.c:229 (discriminator 2)     net/ipv6/reassembly.c:391 (discriminator 2)) ip6_protocol_deliver_rcu (net/ipv6/ip6_input.c:479     (discriminator 5)) ip6_input_finish (net/ipv6/ip6_input.c:534) ipv6_rcv (include/net/dst.h:480     (discriminator 3) net/ipv6/ip6_input.c:119 (discriminator 3) net/ipv6/ip6_input.c:109 (discriminator 3)     include/linux/netfilter.h:325 (discriminator 3) include/linux/netfilter.h:319 (discriminator 3)     net/ipv6/ip6_input.c:351 (discriminator 3)) packet_sendmsg (net/packet/af_packet.c:3110     net/packet/af_packet.c:3142) __x64_sys_sendmmsg (net/socket.c:2883 net/socket.c:2880 net/socket.c:2880)     The buggy address belongs to the object at ff110001039c6b40 which belongs to the cache skbuff_small_head     of size 704 The buggy address is located 0 bytes to the right of allocated 704-byte region     [ff110001039c6b40, ff110001039c6e00) BUG: KASAN: slab-out-of-bounds in ip6_protocol_deliver_rcu     (net/ipv6/ip6_input.c:423 (discriminator 1)) Read of size 1 at addr ff110001039c6e08 by task poc/771 Call     Trace: ? ip6_protocol_deliver_rcu (net/ipv6/ip6_input.c:423 (discriminator 1)) ip6_protocol_deliver_rcu     (net/ipv6/ip6_input.c:423 (discriminator 1)) ip6_input_finish (net/ipv6/ip6_input.c:534) ipv6_rcv     (include/net/dst.h:480 (discriminator 3) net/ipv6/ip6_input.c:119 (discriminator 3)     net/ipv6/ip6_input.c:109 (discriminator 3) include/linux/netfilter.h:325 (discriminator 3)     include/linux/netfilter.h:319 (discriminator 3) net/ipv6/ip6_input.c:351 (discriminator 3)) packet_sendmsg     (net/packet/af_packet.c:3110 net/packet/af_packet.c:3142) __x64_sys_sendmmsg (net/socket.c:2883     net/socket.c:2880 net/socket.c:2880) packet_sendmsg (net/packet/af_packet.c:2959     net/packet/af_packet.c:3053 net/packet/af_packet.c:3142) __x64_sys_sendmmsg (net/socket.c:2883     net/socket.c:2880 net/socket.c:2880) The buggy address belongs to the object at ff110001039c6b40 which     belongs to the cache skbuff_small_head of size 704 The buggy address is located 8 bytes to the right of     allocated 704-byte region [ff110001039c6b40, ff110001039c6e00) (CVE-2026-97602)

Note that Nessus relies on the presence of the package as reported by the vendor.

Detections

Analytics

Linux Distros Unpatched Vulnerability : CVE-2026-97602

high Nessus Plugin ID 350492

Version 1.8

Version 1.7

Version 1.5

Version 1.3

Version 1.2

Version 1.1

Version 1.8 Oct 12, 2026, 12:19 PM CVSS metrics ("CVSSv2 vector" set to "CVSS2#AV:L/AC:L/Au:S/C:C/I:C/A:C") Plugin Feed: 202610121219
Version 1.7 Oct 9, 2026, 2:01 PM CVSS metrics ("CVSSv2 vector" set to "CVSS2#AV:A/AC:L/Au:N/C:P/I:N/A:C") Detection (updated detection logic) Plugin metadata Plugin Feed: 202610091401
Version 1.5 Oct 2, 2026, 6:07 PM Detection (updated detection logic) Plugin metadata Plugin Feed: 202610021807
Version 1.3 Sep 30, 2026, 1:44 AM CVSS metrics ("CVSSv2 vector" set to "CVSS2#AV:A/AC:L/Au:N/C:P/I:N/A:C") Detection (updated detection logic) Plugin metadata Plugin Feed: 202609300144
Version 1.2 Sep 28, 2026, 8:04 AM CVSS metrics ("CVSSv2 score" set to 6.8) CVSS metrics ("CVSSv2 vector" set to "CVSS2#AV:L/AC:L/Au:S/C:C/I:C/A:C") CVSSv2 severity (based on CVE-2026-97602, severity decreased from "High" to "Medium") Plugin Feed: 202609280804
Version 1.1 Sep 26, 2026, 2:30 AM New Plugin Feed: 202609260230