The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - usb: gadget: f_subset: Fix net_device lifecycle with device_move The net_device is allocated during     function instance creation and registered during the bind phase with the gadget device as its sysfs     parent. When the function unbinds, the parent device is destroyed, but the net_device survives, resulting     in dangling sysfs symlinks: console:/ # ls -l /sys/class/net/usb0 lrwxrwxrwx ... /sys/class/net/usb0 ->     /sys/devices/platform/.../gadget.0/net/usb0 console:/ # ls -l /sys/devices/platform/.../gadget.0/net/usb0     ls: .../gadget.0/net/usb0: No such file or directory Use device_move() to reparent the net_device between     the gadget device tree and /sys/devices/virtual across bind and unbind cycles. During the final unbind,     calling device_move(NULL) moves the net_device to the virtual device tree before the gadget device is     destroyed. On rebinding, device_move() reparents the device back under the new gadget, ensuring proper     sysfs topology and power management ordering. To maintain compatibility with legacy composite drivers     (e.g., multi.c), the bound flag is used to indicate whether the network device is shared and pre-     registered during the legacy driver's bind phase. (CVE-2026-31723)

Note that Nessus relies on the presence of the package as reported by the vendor.

An update of the linux package has been released.

ID	Name	Product	Family	Published	Updated	Severity
311588	Linux Distros Unpatched Vulnerability : CVE-2026-31723	Nessus	Misc.	5/2/2026	8/1/2026	medium
318365	Photon OS 5.0: Linux PHSA-2026-5.0-0849	Nessus	PhotonOS Local Security Checks	6/3/2026	7/31/2026	high

Detections

Analytics

Plugins Search

medium

high