The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - fs: init flags_valid before calling vfs_fileattr_get syzbot reported a uninit-value bug in [1]. Similar to     the *get context where the kernel's internal file_kattr structure is initialized before calling     vfs_fileattr_get(), we should use the same mechanism when using fa. [1] BUG: KMSAN: uninit-value in     fuse_fileattr_get+0xeb4/0x1450 fs/fuse/ioctl.c:517 fuse_fileattr_get+0xeb4/0x1450 fs/fuse/ioctl.c:517     vfs_fileattr_get fs/file_attr.c:94 [inline] __do_sys_file_getattr fs/file_attr.c:416 [inline] Local     variable fa.i created at: __do_sys_file_getattr fs/file_attr.c:380 [inline]
    __se_sys_file_getattr+0x8c/0xbd0 fs/file_attr.c:372 (CVE-2026-43474)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Published	Updated	Severity
313349	Linux Distros Unpatched Vulnerability : CVE-2026-43474	Nessus	Misc.	5/8/2026	7/25/2026	medium
311340	Amazon Linux 2023 : bpftool6.18, kernel6.18, kernel6.18-devel (ALAS2023-2026-1596)	Nessus	Amazon Linux Local Security Checks	4/30/2026	6/17/2026	high

Detections

Analytics

Plugins Search

medium

high