The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - tcp: fix use-after-free of retransmit_skb_hint in tcp_send_synack() When tcp_send_synack() replaces the     cloned SYN skb at the head of the retransmit queue with a copy, it frees the original with     tcp_rtx_queue_unlink_and_free() and only repairs tp->highest_sack. tp->retransmit_skb_hint keeps pointing     at the freed skbuff_fclone_cache object. The dangling hint is read in tcp_verify_retransmit_hint() and     used as the root of the rbtree walk in tcp_xmit_retransmit_queue(). An unprivileged TFO client     (sendmsg(MSG_FASTOPEN)) can arm the hint with an attacker-supplied ICMP fragmentation-needed message,     after which a simultaneous open frees the armed SYN skb: BUG: KASAN: slab-use-after-free in     tcp_mark_skb_lost (net/ipv4/tcp_input.c:1316) Read of size 4 at addr ffff88800604d928 by task swapper/1/0     Call Trace: tcp_mark_skb_lost (net/ipv4/tcp_input.c:1316) tcp_simple_retransmit     (net/ipv4/tcp_input.c:3158) tcp_v4_err (net/ipv4/tcp_ipv4.c:587) Sync the hint to the copy.
    (CVE-2026-98374)

Note that Nessus relies on the presence of the package as reported by the vendor.

Detections

Analytics

Linux Distros Unpatched Vulnerability : CVE-2026-98374

high Nessus Plugin ID 363907

Version 1.10

Version 1.9

Version 1.8

Version 1.7

Version 1.6

Version 1.5

Version 1.4

Version 1.3

Version 1.2

Version 1.1

Version 1.10 Oct 26, 2026, 8:43 AM CVSS metrics ("CVSSv2 score" set to 10.0) CVSS metrics ("CVSSv2 vector" set to "CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C") Plugin Feed: 202610260843
Version 1.9 Oct 24, 2026, 11:07 PM CVSS metrics ("CVSSv3 score" set to 8.8) CVSS metrics ("CVSSv3 vector" set to "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H") Detection (updated detection logic) Plugin metadata Plugin Feed: 202610242307
Version 1.8 Oct 22, 2026, 12:02 AM Detection (updated detection logic) Plugin metadata Plugin Feed: 202610220002
Version 1.7 Oct 18, 2026, 5:28 AM CVSS metrics ("CVSSv3 score" set to 7.8) CVSS metrics ("CVSSv3 vector" set to "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H") Detection (updated detection logic) Plugin metadata Plugin Feed: 202610180528
Version 1.6 Oct 17, 2026, 4:43 AM Plugin metadata Detection (updated detection logic) Plugin Feed: 202610170443
Version 1.5 Oct 16, 2026, 2:12 AM Detection (updated detection logic) Plugin metadata Plugin Feed: 202610160212
Version 1.4 Oct 15, 2026, 9:10 PM Detection (updated detection logic) Plugin metadata Plugin Feed: 202610152110
Version 1.3 Oct 9, 2026, 6:12 PM Detection (updated detection logic) Plugin metadata Plugin Feed: 202610091812
Version 1.2 Oct 9, 2026, 2:01 PM CVSS metrics ("CVSSv3 vector" set to "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H") Detection (updated detection logic) Plugin metadata CVSS metrics ("CVSSv2 score" set to 7.2) CVSS metrics ("CVSSv2 vector" set to "CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C") CVSS metrics ("CVSSv3 score" set to 7.1) Plugin Feed: 202610091401
Version 1.1 Oct 8, 2026, 2:26 AM New Plugin Feed: 202610080226