The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - nvmet-auth: fix out-of-bounds write in nvmet_auth_challenge() nvmet_auth_challenge() receives its output     buffer as a void pointer. sizeof(*d) therefore evaluates to one with GCC and undercounts the fixed     challenge header by 15 bytes. A short AUTH_RECEIVE buffer can pass the check before the challenge is     copied past the end of its allocation. Use the typed challenge pointer when calculating the response size.
    BUG: KASAN: slab-out-of-bounds in nvmet_execute_auth_receive (drivers/nvme/target/fabrics-cmd-auth.c:442     drivers/nvme/target/fabrics-cmd-auth.c:569) Write of size 32 by task kworker/1:1H/64 Workqueue:
    nvmet_tcp_wq nvmet_tcp_io_work Call Trace: nvmet_execute_auth_receive (drivers/nvme/target/fabrics-cmd-     auth.c:442 drivers/nvme/target/fabrics-cmd-auth.c:569) nvmet_tcp_try_recv_pdu     (drivers/nvme/target/tcp.c:1119 drivers/nvme/target/tcp.c:1243) nvmet_tcp_io_work     (drivers/nvme/target/tcp.c:1350 drivers/nvme/target/tcp.c:1382 drivers/nvme/target/tcp.c:1445)     process_one_work (kernel/workqueue.c:3322) worker_thread (kernel/workqueue.c:3405 kernel/workqueue.c:3486)     kthread (kernel/kthread.c:436) ret_from_fork (arch/x86/kernel/process.c:158) ret_from_fork_asm     (arch/x86/entry/entry_64.S:245) The buggy address is located 16 bytes inside of allocated 33-byte region     [ffff888000554e80, ffff888000554ea1) Kernel panic - not syncing: KASAN: panic_on_warn set ...
    (CVE-2026-98725)

Note that Nessus relies on the presence of the package as reported by the vendor.

Detections

Analytics

Linux Distros Unpatched Vulnerability : CVE-2026-98725

high Nessus Plugin ID 366999

Version 1.8

Version 1.7

Version 1.6

Version 1.5

Version 1.4

Version 1.3

Version 1.2

Version 1.1

Version 1.8 Nov 7, 2026, 4:01 AM Detection (updated detection logic) Plugin metadata Plugin Feed: 202611070401
Version 1.7 Nov 5, 2026, 10:52 AM Plugin metadata Plugin Feed: 202611051052
Version 1.6 Nov 2, 2026, 8:29 AM CVSS metrics ("CVSSv3 score" set to 7.5) CVSS metrics ("CVSSv3 vector" set to "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H") Detection (updated detection logic) Plugin metadata Plugin Feed: 202611020829
Version 1.5 Oct 31, 2026, 12:23 PM Detection (updated detection logic) Plugin metadata Plugin Feed: 202610311223
Version 1.4 Oct 23, 2026, 5:20 AM Detection (updated detection logic) Plugin metadata Plugin Feed: 202610230520
Version 1.3 Oct 22, 2026, 12:02 AM Detection (updated detection logic) Plugin metadata Plugin Feed: 202610220002
Version 1.2 Oct 20, 2026, 8:26 AM CVSS metrics ("CVSSv2 score" set to 7.2) CVSS metrics ("CVSSv2 vector" set to "CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C") CVSS metrics ("CVSSv3 score" set to 7.8) CVSS metrics ("CVSSv3 vector" set to "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H") Detection (updated detection logic) Plugin metadata Plugin Feed: 202610200826
Version 1.1 Oct 19, 2026, 1:51 AM New Plugin Feed: 202610190151