The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - smb: client: fix create context out-of-bounds reads smb2_parse_contexts() validates the complete create-     context area but does not limit each record to its Next field before dispatching it. A malformed chain can     therefore expose bytes beyond the current context to a handler. The QFid handler also used a full     response-structure cast although it only reads DiskFileId. The SMB2/SMB3 lease parsers made the same     layout assumption: they read LeaseState and LeaseFlags at canonical offsets rather than at DataOffset. A     valid non-canonical DataOffset could therefore yield unrelated in-bounds data, while a short DataLength     was still accepted. Limit each context to its Next value, reject offsets before the context header, and     reject malformed chains. Bound the name range by the current context and do not dispatch a known handler     when DataLength is zero. Read the QFid DiskFileId only when the context data covers that field. Parse the     lease context from DataOffset and require DataLength to match the v1 or v2 lease_context size used by     ksmbd. A size mismatch skips lease parsing without failing the open. (CVE-2026-98454)

Note that Nessus relies on the presence of the package as reported by the vendor.

Detections

Analytics

Linux Distros Unpatched Vulnerability : CVE-2026-98454

high Nessus Plugin ID 367133

Version 1.8

Version 1.7

Version 1.6

Version 1.5

Version 1.4

Version 1.3

Version 1.2

Version 1.1

Version 1.8 Nov 7, 2026, 4:01 AM Detection (updated detection logic) Plugin metadata Plugin Feed: 202611070401
Version 1.7 Nov 6, 2026, 2:22 PM Detection (updated detection logic) Plugin metadata Plugin Feed: 202611061422
Version 1.6 Nov 4, 2026, 12:13 PM Detection (updated detection logic) Plugin metadata Plugin Feed: 202611041213
Version 1.5 Oct 24, 2026, 11:07 PM CVSS metrics ("CVSSv3 score" set to 8.1) CVSS metrics ("CVSSv3 vector" set to "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H") Detection (updated detection logic) Plugin metadata Plugin Feed: 202610242307
Version 1.4 Oct 22, 2026, 12:02 AM Detection (updated detection logic) Plugin metadata Plugin Feed: 202610220002
Version 1.3 Oct 20, 2026, 8:26 AM Detection (updated detection logic) Plugin metadata Plugin Feed: 202610200826
Version 1.2 Oct 20, 2026, 4:30 AM CVSS metrics ("CVSSv2 score" set to 9.4) CVSS metrics ("CVSSv2 vector" set to "CVSS2#AV:N/AC:L/Au:N/C:C/I:N/A:C") CVSS metrics ("CVSSv3 score" set to 7.1) CVSS metrics ("CVSSv3 vector" set to "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H") Detection (updated detection logic) Plugin metadata Plugin Feed: 202610200430
Version 1.1 Oct 19, 2026, 1:51 AM New Plugin Feed: 202610190151