The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - wifi: ath11k: cleanup arsta in ath11k_mac_peer_cleanup_all() When mac80211 removes a sta, it calls     .sta_state() which in turn calls ath11k_mac_station_remove(). In that function we clean up both peers &     arsta related resources. But when the firmware crashes, ath11k calls ieee80211_restart_hw(), which assumes     that all driver related resources are cleaned up beforehand. This cleanup is supposedly done by     ath11k_mac_peer_cleanup_all() but does not in fact free arsta->rx_stats / tx_stats. Extract the arsta     cleanup from ath11k_mac_station_remove() into a new ath11k_mac_station_cleanup() and call it from both     there and ath11k_mac_peer_cleanup_all(). This should handle kmemleaks reports like: unreferenced object     0xffffff801ae66400 (size 1024): comm hostapd, pid 1306, jiffies 4295011565 hex dump (first 32 bytes): 00     00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00     00 ................ backtrace (crc d61c08ec): kmemleak_alloc+0x3c/0x50 __kmalloc_cache_noprof+0x2b0/0x3e0     ath11k_mac_op_sta_state+0x1dc/0xb10 drv_sta_state+0xac/0x6f8 sta_info_insert_rcu+0x314/0x5e0     sta_info_insert+0x14/0x38 ieee80211_add_station+0x10c/0x1a0 nl80211_new_station+0x3e8/0x680     genl_family_rcv_msg_doit+0xc0/0x120 genl_rcv_msg+0x1b4/0x258 netlink_rcv_skb+0x4c/0x108 genl_rcv+0x38/0x60     netlink_unicast+0x190/0x278 netlink_sendmsg+0x15c/0x370 ____sys_sendmsg+0x120/0x290
    ___sys_sendmsg+0x70/0xa0 Tested-on: QCN9074 hw1.0 PCI WLAN.HK.2.9.0.1-01977-QCAHKSWPL_SILICONZ-1     (CVE-2026-98307)

Note that Nessus relies on the presence of the package as reported by the vendor.

Detections

Analytics

Linux Distros Unpatched Vulnerability : CVE-2026-98307

medium Nessus Plugin ID 363272

Version 1.5

Version 1.3

Version 1.2

Version 1.1

Version 1.5 Oct 22, 2026, 12:02 AM Detection (updated detection logic) Plugin metadata Plugin Feed: 202610220002
Version 1.3 Oct 11, 2026, 12:37 PM Detection (updated detection logic) Plugin metadata Plugin Feed: 202610111237
Version 1.2 Oct 9, 2026, 2:01 PM CVSS metrics ("CVSSv2 score" set to 6.6) CVSS metrics ("CVSSv2 vector" set to "CVSS2#AV:L/AC:L/Au:N/C:C/I:N/A:C") CVSS metrics ("CVSSv3 score" set to 5.5) CVSS metrics ("CVSSv3 vector" set to "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H") CVSSv2 severity (based on CVE-2026-98307, severity decreased from "High" to "Medium") CVSSv3 severity (based on None, severity decreased from "High" to "Medium") Detection (updated detection logic) Plugin metadata Plugin Feed: 202610091401
Version 1.1 Oct 6, 2026, 7:18 PM New Plugin Feed: 202610061918