The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - net: bridge: mcast: don't truncate the port group walk on teardown __br_multicast_disable_port_ctx() and     br_multicast_del_port() walk port->mglist with hlist_for_each_entry_safe(). However,     br_multicast_find_del_pg() can also delete other entries from the same list through     br_multicast_fwd_src_remove() or __fwd_del_star_excl(). If such an entry is the iterator's saved next     node, hlist_del_init() clears its ->next and terminates the walk early. The reproducer triggers this in     both teardown walks, leaving port groups in the bridge mdb with a dangling ->key.port after del_nbp()     frees the port: BUG: KASAN: slab-use-after-free in __mdb_fill_info+0x1191/0x1320
    __mdb_fill_info+0x1191/0x1320 br_mdb_dump+0x594/0xe40 rtnl_mdb_dump+0x1cf/0x5d0 Use hlist_del_init_rcu()     to unlink the group while preserving ->next. br_multicast_del_pg() and the teardown walks run under     br->multicast_lock. The GC worker must acquire the same lock before detaching the group for destruction,     so the node remains alive while the walk uses the preserved pointer. Preserving ->next means a walk can     now reach a group that an earlier iteration already deleted as a side effect. That group is off mp->ports,     so br_multicast_find_del_pg() would fall through its port scan and hit the trailing WARN_ON(1). Skip such     groups at the top of that helper: a port group is put on port->mglist when it is created and only unlinked     when it is deleted, so hlist_unhashed() identifies exactly this case. (CVE-2026-99117)

Note that Nessus relies on the presence of the package as reported by the vendor.

Detections

Analytics

Linux Distros Unpatched Vulnerability : CVE-2026-99117

high Nessus Plugin ID 373310

Version 1.3

Version 1.2

Version 1.1

Version 1.3 Oct 30, 2026, 8:32 AM Detection (updated detection logic) Plugin metadata Plugin Feed: 202610300832
Version 1.2 Oct 29, 2026, 3:00 PM CVSS metrics ("CVSSv2 score" set to 7.2) CVSS metrics ("CVSSv2 vector" set to "CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C") CVSS metrics ("CVSSv3 score" set to 7.1) CVSS metrics ("CVSSv3 vector" set to "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H") Detection (updated detection logic) Plugin metadata Plugin Feed: 202610291500
Version 1.1 Oct 29, 2026, 7:21 AM New Plugin Feed: 202610290721