The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - scsi: qla2xxx: Bound VP index against VP_CTRL IOCB bitmap size The VP control IOCB selects its target     virtual port by setting one bit in vp_idx_map, a fixed 16-byte (128-bit) array in both vp_ctrl_entry_24xx     and vp_ctrl_entry_24xx_ext. qla25xx_ctrlvp_iocb() computes map = (vp_index - 1) / 8 and writes     vce->vp_idx_map[map] without checking that map stays within the array. max_npiv_vports is taken from     firmware and only sanitized to a MIN_MULTI_ID_FABRIC-aligned boundary, so it can legitimately be 191 or     255, and qla24xx_control_vp() only rejects vp_index >= max_npiv_vports. A vp_index above 128 therefore     yields map >= 16 and an out-of-bounds write of up to 16 bytes past vp_idx_map, corrupting the trailing     IOCB fields (or the adjacent request-ring slot on the 64-byte layout). Reject a vp_index that cannot be     represented in the IOCB bitmap in qla24xx_control_vp(), and add a defensive ARRAY_SIZE() guard in     qla25xx_ctrlvp_iocb() before the write. Adapters that report the usual 63 or 127 NPIV vports are     unaffected. (CVE-2026-97535)

Note that Nessus relies on the presence of the package as reported by the vendor.

Detections

Analytics

Linux Distros Unpatched Vulnerability : CVE-2026-97535

high Nessus Plugin ID 350502

Version 1.5

Version 1.4

Version 1.3

Version 1.1

Version 1.5 Oct 17, 2026, 4:43 AM Detection (updated detection logic) Plugin metadata Plugin Feed: 202610170443
Version 1.4 Oct 13, 2026, 2:52 AM Plugin metadata Detection (updated detection logic) Plugin Feed: 202610130252
Version 1.3 Oct 2, 2026, 6:07 PM Plugin metadata Detection (updated detection logic) Plugin Feed: 202610021807
Version 1.1 Sep 26, 2026, 2:30 AM New Plugin Feed: 202609260230