The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - In the Linux kernel, the following vulnerability has been resolved: bpf: Fix race in cpumap on PREEMPT_RT     On PREEMPT_RT kernels, the per-CPU xdp_bulk_queue (bq) can be accessed concurrently by multiple     preemptible tasks on the same CPU. The original code assumes bq_enqueue() and __cpu_map_flush() run     atomically with respect to each other on the same CPU, relying on local_bh_disable() to prevent     preemption. However, on PREEMPT_RT, local_bh_disable() only calls migrate_disable() (when     PREEMPT_RT_NEEDS_BH_LOCK is not set) and does not disable preemption, which allows CFS scheduling to     preempt a task during bq_flush_to_queue(), enabling another task on the same CPU to enter bq_enqueue() and     operate on the same per-CPU bq concurrently. This leads to several races: 1. Double
    __list_del_clearprev(): after bq->count is reset in bq_flush_to_queue(), a preempting task can call     bq_enqueue() -> bq_flush_to_queue() on the same bq when bq->count reaches CPU_MAP_BULK_SIZE. Both tasks     then call __list_del_clearprev() on the same bq->flush_node, the second call dereferences the prev pointer     that was already set to NULL by the first. 2. bq->count and bq->q[] races: concurrent bq_enqueue() can     corrupt the packet queue while bq_flush_to_queue() is processing it. The race between task A     (__cpu_map_flush -> bq_flush_to_queue) and task B (bq_enqueue -> bq_flush_to_queue) on the same CPU: Task     A (xdp_do_flush) Task B (cpu_map_enqueue) ---------------------- ------------------------     bq_flush_to_queue(bq) spin_lock(&q->producer_lock) /* flush bq->q[] to ptr_ring */ bq->count = 0     spin_unlock(&q->producer_lock) bq_enqueue(rcpu, xdpf) <-- CFS preempts Task A --> bq->q[bq->count++] =     xdpf /* ... more enqueues until full ... */ bq_flush_to_queue(bq) spin_lock(&q->producer_lock) /* flush to     ptr_ring */ spin_unlock(&q->producer_lock) __list_del_clearprev(flush_node) /* sets flush_node.prev = NULL
    */ <-- Task A resumes --> __list_del_clearprev(flush_node) flush_node.prev->next = ... /* prev is NULL ->     kernel oops */ Fix this by adding a local_lock_t to xdp_bulk_queue and acquiring it in bq_enqueue() and
    __cpu_map_flush(). These paths already run under local_bh_disable(), so use local_lock_nested_bh() which     on non-RT is a pure annotation with no overhead, and on PREEMPT_RT provides a per-CPU sleeping lock that     serializes access to the bq. To reproduce, insert an mdelay(100) between bq->count = 0 and
    __list_del_clearprev() in bq_flush_to_queue(), then run reproducer provided by syzkaller. (CVE-2026-23342)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Published	Updated	Severity
304060	Linux Distros Unpatched Vulnerability : CVE-2026-23342	Nessus	Misc.	3/28/2026	7/18/2026	medium
311340	Amazon Linux 2023 : bpftool6.18, kernel6.18, kernel6.18-devel (ALAS2023-2026-1596)	Nessus	Amazon Linux Local Security Checks	4/30/2026	6/17/2026	high

Detections

Analytics

Plugins Search

medium

high