The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - ipv4: icmp: reject RTN_UNREACHABLE input routes in icmp_route_lookup When the forward output route cannot     be used in icmp_route_lookup(), it enters the reverse path and calls ip_route_input() on fl4_dec.daddr,     the original packet's source address. ip_route_input() only returns an error for truly invalid packets.
    For unreachable addresses it will succeed and return an input route whose dst.output is set to     ip_rt_bug(). The existing check only rejects RTN_LOCAL routes, so the RTN_UNREACHABLE route types can     still be returned and later used for output, syzkaller triggering a WARN_ON_ONCE() in ip_rt_bug() as     bellow: ------------[ cut here ]------------ WARNING: net/ipv4/route.c:1273 at ip_rt_bug+0x14/0x20 RIP:
    0010:ip_rt_bug+0x14/0x20 Call Trace: ip_push_pending_frames+0xfa/0x100 __icmp_send+0x905/0xf10     ip_options_compile+0xc0/0xd0 ip_rcv_finish_core+0x321/0xae0 ip_rcv+0x1de/0x260
    __netif_receive_skb_one_core+0x11a/0x130 netif_receive_skb+0x7b/0x260 tun_get_user+0x11bf/0x1c10
    ------------[ cut here ]------------ Reject input route that is RTN_UNREACHABLE to fix it. The net warning     is only printed for RTN_LOCAL, as RTN_UNREACHABLE is not the result of a race condition. (CVE-2026-98303)

Note that Nessus relies on the presence of the package as reported by the vendor.

Detections

Analytics

Linux Distros Unpatched Vulnerability : CVE-2026-98303

medium Nessus Plugin ID 363318

Version 1.5

Version 1.3

Version 1.2

Version 1.1

Version 1.5 Oct 22, 2026, 12:02 AM CVSS metrics ("CVSSv2 vector" set to "CVSS2#AV:L/AC:M/Au:N/C:N/I:N/A:C") Detection (updated detection logic) Plugin metadata Plugin Feed: 202610220002
Version 1.3 Oct 9, 2026, 6:12 PM CVSS metrics ("CVSSv2 score" set to 6.3) CVSS metrics ("CVSSv2 vector" set to "CVSS2#AV:L/AC:M/Au:N/C:N/I:C/A:C") Detection (updated detection logic) Plugin metadata Plugin Feed: 202610091812
Version 1.2 Oct 9, 2026, 2:01 PM CVSS metrics ("CVSSv2 score" set to 4.7) CVSS metrics ("CVSSv2 vector" set to "CVSS2#AV:L/AC:M/Au:N/C:N/I:N/A:C") CVSS metrics ("CVSSv3 score" set to none) CVSS metrics ("CVSSv3 vector" set to none) CVSS temporal metrics ("CVSSv3 temporal vector" set to none) CVSSv2 severity (based on CVE-2026-98303, severity decreased from "High" to "Medium") Detection (updated detection logic) Plugin metadata Plugin Feed: 202610091401
Version 1.1 Oct 6, 2026, 7:18 PM New Plugin Feed: 202610061918