The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() Two latent bugs in the     Text-phase handler, both present since the original LIO integration in commit e48354ce078c (iscsi-target:
    Add iSCSI fabric support for target v4.1): 1) DataDigest CRC buffer overread (4 bytes past text_in).
    text_in is kzalloc()'d at ALIGN(payload_length, 4). rx_size is then incremented by ISCSI_CRC_LEN to make     room for the received DataDigest in the iovec, but the same (now-bumped) rx_size is passed as the buffer     length to iscsit_crc_buf(): if (conn->conn_ops->DataDigest) { ... rx_size += ISCSI_CRC_LEN; } ... if     (conn->conn_ops->DataDigest) { data_crc = iscsit_crc_buf(text_in, rx_size, 0, NULL); iscsit_crc_buf()     walks rx_size bytes of text_in with crc32c(), so when DataDigest is negotiated it reads 4 bytes past the     end of the text_in allocation. KASAN reproduces this directly on the unpatched mainline tree as slab-out-     of-bounds in crc32c() called from the Text PDU path. The OOB bytes feed crc32c() and are then compared     against the initiator-supplied checksum, so the value does not flow back to the attacker, but the kernel     does read past the buffer on every Text PDU with DataDigest=CRC32C. Fix by passing the actual padded     payload length (ALIGN(payload_length, 4)) that was used for the kzalloc(). 2) Stale cmd->text_in_ptr re-     free (double-free) on ERL>0 bad DataDigest drop. On DataDigest mismatch with ErrorRecoveryLevel > 0 the     handler silently drops the PDU and lets the initiator plug the CmdSN gap: kfree(text_in); return 0;
    cmd->text_in_ptr still points at the freed buffer. The next Text Request on the same ITT re-enters     iscsit_setup_text_cmd(), which unconditionally does kfree(cmd->text_in_ptr); cmd->text_in_ptr = NULL;
    freeing the same pointer a second time. Session teardown via iscsit_release_cmd() has the same shape and     hits the same double-free if the connection is dropped before a second Text Request arrives. On an     unmodified mainline tree the bug-1 CRC overread fires first on the initial valid Text Request and perturbs     the subsequent state, so #4 was isolated by building a kernel with only the bug-1 hunk of this patch     applied plus temporary printk() observability around the three relevant kfree() sites. The observability     prints are not part of this patch. On that build, a three-PDU Text Request sequence after login produces     two back-to-back splats: BUG: KASAN: double-free in iscsit_setup_text_cmd+0x?? BUG: KASAN: double-free in     iscsit_release_cmd+0x?? showing the same pointer freed in the ERL>0 drop path and again in     iscsit_setup_text_cmd() (next Text Request on the same ITT) and once more in iscsit_release_cmd() (session     teardown). On distro kernels with CONFIG_SLAB_FREELIST_HARDENED=y (default) the double-free becomes a     remote kernel BUG(); on non-hardened kernels it corrupts the slab freelist. Fix by clearing     cmd->text_in_ptr after the kfree() in the ERL>0 drop path. With both hunks applied #4 is directly     observable on the stock tree without observability printks; fixing bug-1 alone would mask #4 less, not     more, so the hunks are submitted together. Both fixes are one-liners. The Text PDU state machine is     unchanged and the wire protocol is unaffected. (CVE-2026-63888)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Published	Updated	Severity
364820	EulerOS 2.0 SP11 : kernel (EulerOS-SA-2026-4332)	Nessus	Huawei Local Security Checks	10/12/2026	10/13/2026	high
328493	Amazon Linux 2023 : bpftool6.12, kernel6.12, kernel6.12-devel (ALAS2023-2026-1968)	Nessus	Amazon Linux Local Security Checks	7/20/2026	9/23/2026	high
340045	Ubuntu 26.04 LTS : Linux kernel (NVIDIA BaseOS) vulnerabilities (USN-8664-1)	Nessus	Ubuntu Local Security Checks	8/26/2026	9/23/2026	high
328130	Linux Distros Unpatched Vulnerability : CVE-2026-63888	Nessus	Misc.	7/20/2026	10/13/2026	critical
343617	EulerOS 2.0 SP12 : kernel (EulerOS-SA-2026-3270)	Nessus	Huawei Local Security Checks	9/8/2026	9/23/2026	high

Detections

Analytics

Plugins Search

high

high

high

critical

high