There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - In the Linux kernel, the following vulnerability has been resolved: usb: gadget: f_eem: Fix net_device
    lifecycle with device_move The net_device is allocated during function instance creation and registered
    during the bind phase with the gadget device as its sysfs parent. When the function unbinds, the parent
    device is destroyed, but the net_device survives, resulting in dangling sysfs symlinks: console:/ # ls -l
    /sys/class/net/usb0 lrwxrwxrwx ... /sys/class/net/usb0 -> /sys/devices/platform/.../gadget.0/net/usb0
    console:/ # ls -l /sys/devices/platform/.../gadget.0/net/usb0 ls: .../gadget.0/net/usb0: No such file or
    directory Use device_move() to reparent the net_device between the gadget device tree and
    /sys/devices/virtual across bind and unbind cycles. During the final unbind, calling device_move(NULL)
    moves the net_device to the virtual device tree before the gadget device is destroyed. On rebinding,
    device_move() reparents the device back under the new gadget, ensuring proper sysfs topology and power
    management ordering. To maintain compatibility with legacy composite drivers (e.g., multi.c), the bound
    flag is used to indicate whether the network device is shared and pre-registered during the legacy
    driver's bind phase. (CVE-2026-31724)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - usb: gadget: f_eem: Fix net_device lifecycle with device_move The net_device is allocated during function     instance creation and registered during the bind phase with the gadget device as its sysfs parent. When     the function unbinds, the parent device is destroyed, but the net_device survives, resulting in dangling     sysfs symlinks: console:/ # ls -l /sys/class/net/usb0 lrwxrwxrwx ... /sys/class/net/usb0 ->     /sys/devices/platform/.../gadget.0/net/usb0 console:/ # ls -l /sys/devices/platform/.../gadget.0/net/usb0     ls: .../gadget.0/net/usb0: No such file or directory Use device_move() to reparent the net_device between     the gadget device tree and /sys/devices/virtual across bind and unbind cycles. During the final unbind,     calling device_move(NULL) moves the net_device to the virtual device tree before the gadget device is     destroyed. On rebinding, device_move() reparents the device back under the new gadget, ensuring proper     sysfs topology and power management ordering. To maintain compatibility with legacy composite drivers     (e.g., multi.c), the bound flag is used to indicate whether the network device is shared and pre-     registered during the legacy driver's bind phase. (CVE-2026-31724)

Note that Nessus relies on the presence of the package as reported by the vendor.

An update of the linux package has been released.

ID	Name	Product	Family	Published	Updated	Severity
465380	Echo: linux: security update to 6.12.85-1	Tenable Self-Hosted Container Security	Echo Local Security Checks	10/2/2026	10/2/2026	medium
465380	Echo: linux: security update to 6.12.85-1	Tenable Cloud Security	Echo Local Security Checks	10/2/2026	10/2/2026	medium
311596	Linux Distros Unpatched Vulnerability : CVE-2026-31724	Nessus	Misc.	5/2/2026	9/30/2026	medium
318365	Photon OS 5.0: Linux PHSA-2026-5.0-0849	Nessus	PhotonOS Local Security Checks	6/3/2026	10/14/2026	high
333798	Photon OS 5.0: Linux PHSA-2026-5.0-92-0849	Nessus	PhotonOS Local Security Checks	8/10/2026	8/22/2026	high
340680	Ubuntu 24.04 LTS / Pro Realtime 24.04 LTS : Linux kernel (Raspberry Pi) vulnerabilities (USN-8665-1)	Nessus	Ubuntu Local Security Checks	8/26/2026	8/27/2026	high

Detections

Analytics

Plugins Search

medium

medium

medium

high

high

high