The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - net/sched: cls_flow: fix NULL pointer dereference on shared blocks flow_change() calls tcf_block_q() and     dereferences q->handle to derive a default baseclass. Shared blocks leave block->q NULL, causing a NULL     deref when a flow filter without a fully qualified baseclass is created on a shared block. Check     tcf_block_shared() before accessing block->q and return -EINVAL for shared blocks. This avoids the null-     deref shown below: ======================================================================= KASAN: null-     ptr-deref in range [0x0000000000000038-0x000000000000003f] RIP: 0010:flow_change     (net/sched/cls_flow.c:508) Call Trace: tc_new_tfilter (net/sched/cls_api.c:2432) rtnetlink_rcv_msg     (net/core/rtnetlink.c:6980) [...] =======================================================================     (CVE-2026-31422)

Note that Nessus relies on the presence of the package as reported by the vendor.

An update of the linux package has been released.

ID	Name	Product	Family	Published	Updated	Severity
306189	Linux Distros Unpatched Vulnerability : CVE-2026-31422	Nessus	Misc.	4/13/2026	4/25/2026	medium
310098	Photon OS 4.0: Linux PHSA-2026-4.0-1002	Nessus	PhotonOS Local Security Checks	4/24/2026	4/27/2026	high
310100	Photon OS 5.0: Linux PHSA-2026-5.0-0830	Nessus	PhotonOS Local Security Checks	4/24/2026	4/28/2026	medium

Detections

Analytics

Plugins Search

medium

high

medium