The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - vlan: require the MAC header to be present in __vlan_insert_inner_tag() __vlan_insert_inner_tag() only     guarantees head room via skb_cow_head(), never that mac_len bytes of MAC header are present. Its ETH_HLEN     wrappers - __vlan_insert_tag() under skb_vlan_push(), and vlan_insert_tag() under validate_xmit_vlan() on     the generic transmit path - therefore rewrite the first 16 bytes at skb->data: a 12-byte memmove plus two     2-byte stores at +12 and +14. No caller supplies the bound, while the pop helpers use     skb_ensure_writable()/pskb_may_pull(). An IFF_TUN device has hard_header_len == 0, so packet_snd() accepts     a one-byte AF_PACKET/SOCK_RAW frame. The first vlan push only sets a hwaccel tag; the next - clsact     action vlan push or bpf_skb_vlan_push() - enters the helper with skb->len still 1. The head comes from     skbuff_small_head without __GFP_ZERO, so each push drags bytes from beyond skb->tail into the frame. After     three the one-byte send leaves as 13 bytes carrying 11 bytes of uninitialised slab: 0000: 5a b3 62 12 80     88 ff ff 00 b3 62 12 81 `------------------------------' only 0x5a was sent; the rest is slab, here the     top 56 bits of a linear-map address Require the MAC header the helper rewrites to be present, so such a     frame is dropped rather than transmitted. (CVE-2026-98377)

Note that Nessus relies on the presence of the package as reported by the vendor.

Detections

Analytics

Linux Distros Unpatched Vulnerability : CVE-2026-98377

medium Nessus Plugin ID 364530

Version 1.6

Version 1.4

Version 1.3

Version 1.2

Version 1.1

Version 1.6 Oct 22, 2026, 12:02 AM Detection (updated detection logic) Plugin metadata Plugin Feed: 202610220002
Version 1.4 Oct 17, 2026, 4:43 AM Detection (updated detection logic) Plugin metadata Plugin Feed: 202610170443
Version 1.3 Oct 14, 2026, 10:44 PM CVSS metrics ("CVSSv2 score" set to 5.4) CVSS metrics ("CVSSv2 vector" set to "CVSS2#AV:L/AC:M/Au:N/C:N/I:P/A:C") Detection (updated detection logic) Plugin metadata Plugin Feed: 202610142244
Version 1.2 Oct 11, 2026, 2:49 AM CVSS metrics ("CVSSv2 score" set to 5.6) CVSS metrics ("CVSSv2 vector" set to "CVSS2#AV:L/AC:L/Au:N/C:N/I:P/A:C") CVSS metrics ("CVSSv3 score" set to none) CVSS metrics ("CVSSv3 vector" set to none) CVSS temporal metrics ("CVSSv3 temporal vector" set to none) CVSSv2 severity (based on CVE-2026-98377, severity decreased from "High" to "Medium") Detection (updated detection logic) Plugin metadata Plugin Feed: 202610110249
Version 1.1 Oct 10, 2026, 5:24 AM New Plugin Feed: 202610100524