The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - HID: wacom: fix OOB read in wacom_wac_pen_serial_enforce() The 'wacom_wac_pen_serial_enforce()' function     may calculate and pass an invalid offset to hid_field_extract(), resulting in memory reads at incorrect     addresses -- possibly beyond the end of the report. If a field in the HID descriptor lists more usages     than its Report Count actually reserves space for, the function's inner 'j' will walk past the end of the     field: for (i = 0; i < report->maxfield; i++) { for (j = 0; j < report->field[i]->maxusage; j++) { ...
    value = hid_field_extract(hdev, raw_data + 1, offset + j * size, size); A descriptor listing 12288 usages     against Report Count 1 has the loop extract the usage at index 12287 from bit offset 98296 -- about 12 KB     past a 2-byte received report. The value is stored in wacom_wac->serial[0] and can reach userspace as an     MSC_SERIAL event, making this an information disclosure. Clamp the loop to field->report_count, the number     of value slots the report holds. Value slots past the last declared usage are still scanned; they reuse     that usage (HID 1.11, 6.2.2.8). Verified on v6.12.105 with a UHID reproducer: a 2-byte report from such a     descriptor trips KASAN before the patch and not after it. (CVE-2026-98499)

Note that Nessus relies on the presence of the package as reported by the vendor.

Detections

Analytics

Linux Distros Unpatched Vulnerability : CVE-2026-98499

high Nessus Plugin ID 367470

Version 1.10

Version 1.9

Version 1.8

Version 1.7

Version 1.6

Version 1.6

Version 1.5

Version 1.4

Version 1.3

Version 1.2

Version 1.1

Version 1.10 Nov 12, 2026, 7:08 AM CVSS metrics ("CVSSv2 score" set to 1.7. "CVSSv2 vector" set to "CVSS2#AV:L/AC:L/Au:S/C:P/I:N/A:N") CVSSv2 severity (based on CVE-2026-98499, severity decreased from "High" to "Low") Detection (updated detection logic) Plugin metadata Plugin Feed: 202611120708
Version 1.9 Nov 9, 2026, 3:50 PM CVSS metrics ("CVSSv2 score" set to 7.8. "CVSSv2 vector" set to "CVSS2#AV:A/AC:L/Au:N/C:C/I:N/A:C") CVSSv2 severity (based on CVE-2026-98499, severity increased from "Low" to "High") Plugin Feed: 202611091550
Version 1.8 Nov 7, 2026, 4:01 AM Detection (updated detection logic) Plugin metadata Plugin Feed: 202611070401
Version 1.7 Nov 6, 2026, 2:22 PM CVSS metrics ("CVSSv2 score" set to 1.7. "CVSSv2 vector" set to "CVSS2#AV:L/AC:L/Au:S/C:P/I:N/A:N") CVSSv2 severity (based on CVE-2026-98499, severity decreased from "High" to "Low") Detection (updated detection logic) Plugin metadata Plugin Feed: 202611061422
Version 1.6 Nov 5, 2026, 10:52 AM Detection (updated detection logic) Plugin Feed: 202611051052
Version 1.6 Nov 5, 2026, 5:43 PM CVSS metrics ("CVSSv2 score" set to 7.8. "CVSSv2 vector" set to "CVSS2#AV:A/AC:L/Au:N/C:C/I:N/A:C") CVSSv2 severity (based on CVE-2026-98499, severity increased from "Low" to "High") Plugin Feed: 202611051743
Version 1.5 Nov 4, 2026, 12:13 PM CVSS metrics ("CVSSv2 score" set to 1.7. "CVSSv2 vector" set to "CVSS2#AV:L/AC:L/Au:S/C:P/I:N/A:N") CVSSv2 severity (based on CVE-2026-98499, severity decreased from "High" to "Low") Detection (updated detection logic) Plugin metadata Plugin Feed: 202611041213
Version 1.4 Oct 26, 2026, 8:43 AM CVSS metrics ("CVSSv2 score" set to 7.8) CVSS metrics ("CVSSv2 vector" set to "CVSS2#AV:A/AC:L/Au:N/C:C/I:N/A:C") CVSSv2 severity (based on CVE-2026-98499, severity increased from "Low" to "High") Plugin Feed: 202610260843
Version 1.3 Oct 24, 2026, 11:07 PM CVSS metrics ("CVSSv3 score" set to 8.1) CVSS metrics ("CVSSv3 vector" set to "CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H") Detection (updated detection logic) Plugin metadata Plugin Feed: 202610242307
Version 1.2 Oct 22, 2026, 12:02 AM Detection (updated detection logic) Plugin metadata Plugin Feed: 202610220002
Version 1.1 Oct 20, 2026, 8:26 AM New Plugin Feed: 202610200826