There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - A flaw was found in crun. When crun is built with libkrun and a container is started rootful with passt
    networking (krun.use_passt), crun can execute attacker-controlled payload from the container image with
    host root privileges. The issue is a regression in crun 1.29. It affects crun >= 1.29 (CVE-2026-84042)

  - A flaw was found in crun. When the container configuration does not give /dev a dedicated mount, terminal
    setup can redirect /dev/console onto an attacker-controlled path, including via the read-only-rootfs bind-
    mount fallback. Affected versions are crun 1.29.1 and earlier. Default configurations that mount a fresh
    /dev are not exposed. No fixed release is available yet. (CVE-2026-88264)

  - A flaw was found in crun. After pivot_root, reopening /dev/null for stdio can follow a symlink and attach
    a host file to container stdio, then change that file's ownership. Affected versions are crun 1.29.1 and
    earlier. Default configurations that mount a fresh /dev are not exposed. No fixed release is available
    yet. (CVE-2026-88265)

Linux/Unix 主機上安裝了一個或多個受到弱點影響的套件，且廠商未提供可用的修補程式。

  - 在 crun 中發現缺陷。當使用 libkrun 構建 crun 並且容器使用 passt 網絡 （krun.use_passt） 啟動 rootful 時，crun 可以使用主機 root 權限從容器映像執行攻擊者控制的負載。問題是 crun 1.29的回歸。它會影響 crun >= 1.29 （CVE-2026-84042）

請注意，Nessus 的判定取決於廠商所報告的套件是否存在。

Linux/Unix 主机中安装的一个或多个程序包受到一个漏洞影响，而供应商没有提供补丁程序。

  - 在 crun 中发现一个缺陷。当 crun 是以 libkrun 构建，并且容器是通过 passt networking （krun.use_passt） 来 rootful 启动时，crun 可能会使用主机 root 权限，从容器映像执行受攻击者控制的负载。此问题是 crun 1.29中的回归。这会影响 crun >= 1.29 （CVE-2026-84042）

请注意，Nessus 依赖供应商报告的程序包是否存在进行判断。

Linux/Unix ホストには、ベンダーが提供するパッチが利用できない脆弱性の影響を受ける複数のパッケージがインストールされています。

  - crun に欠陥が見つかりました。crun が libkrun で構築され、コンテナが passt networking(krun.use_passt)で rootful に起動される場合、crun はホスト root 権限でコンテナイメージから攻撃者が制御するペイロードを実行できます。問題は crun 1.29 の回帰です。crun >= 1.29 に影響します(CVE-2026-84042)

Nessus は、ベンダーから報告されたパッケージの存在に依存していることに注意してください。

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:97561 advisory.

    crun is a OCI runtime

    Security Fix(es):

    * crun: crun: rootful krun with passt executes container payload as host root (CVE-2026-84042)

    Bug Fix(es) and Enhancement(s):

    * crun should require container-selinux (JIRA:RHEL-169227)

    * update to the latest upstream release (JIRA:RHEL-185741)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 9 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A flaw was found in crun. When crun is built with libkrun and a container is started rootful with passt     networking (krun.use_passt), crun can execute attacker-controlled payload from the container image with     host root privileges. The issue is a regression in crun 1.29. It affects crun >= 1.29 (CVE-2026-84042)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote Redhat Enterprise Linux 10 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:98561 advisory.

    crun is a OCI runtime

    Security Fix(es):

    * crun: crun: rootful krun with passt executes container payload as host root (CVE-2026-84042)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote RockyLinux 9 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:97561 advisory.

    * crun: crun: rootful krun with passt executes container payload as host root (CVE-2026-84042)

    Bug Fix(es) and Enhancement(s):

    * crun should require container-selinux (JIRA:Rocky Linux-169227)

    * update to the latest upstream release (JIRA:Rocky Linux-185741)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-2026_97561 advisory.

    * crun: crun: rootful krun with passt executes container payload as host root (CVE-2026-84042)

    Bug Fix(es) and Enhancement(s):

    * crun should require container-selinux (JIRA:Rocky Linux-169227)

    * update to the latest upstream release (JIRA:Rocky Linux-185741)

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
448442	Alpine: multiple crun packages: security update to 1.30.1-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	9/29/2026	9/29/2026	high
448442	Alpine: multiple crun packages: security update to 1.30.1-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	9/29/2026	9/29/2026	high
344726	Linux Distros 未修補弱點：CVE-2026-84042	Nessus	Misc.	9/11/2026	11/11/2026	high
344726	Linux Distros 未修补的漏洞：CVE-2026-84042	Nessus	Misc.	9/11/2026	11/11/2026	high
344726	Linux Distros のパッチ未適用の脆弱性: CVE-2026-84042	Nessus	Misc.	9/11/2026	11/11/2026	high
378213	RHEL 9 : crun (RHSA-2026:97561)	Nessus	Red Hat Local Security Checks	11/10/2026	11/10/2026	high
344726	Linux Distros Unpatched Vulnerability : CVE-2026-84042	Nessus	Misc.	9/11/2026	11/11/2026	high
379025	RHEL 10 : crun (RHSA-2026:98561)	Nessus	Red Hat Local Security Checks	11/11/2026	11/11/2026	high
380054	RockyLinux 9 : crun (RLSA-2026:97561)	Nessus	Rocky Linux Local Security Checks	11/13/2026	11/13/2026	high
381108	Rocky Linux 9 [CIQ] Security Update: crun / crun-debuginfo / crun-debugsource (crlsa-2026_97561)	Nessus	Rocky Linux Local Security Checks	11/14/2026	11/14/2026	high

Detections

Analytics

Plugins Search

high

high

high

high

high

high

high

high

high

high