The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - net/sched: Handle TC_ACT_REDIRECT from qdisc filter chains When a TC filter attached to a qdisc filter     chain returns TC_ACT_REDIRECT (ex: via an eBPF program calling bpf_redirect() or an act_bpf action), the     redirect was silently lost i.e no qdisc classify function handled TC_ACT_REDIRECT, so the packet fell     through the switch and was enqueued normally instead of being redirected. This has been broken since     bpf_redirect() was introduced for TC in commit 27b29f63058d (bpf: add bpf_redirect() helper). We got     lucky for a long time because bpf_net_context was a per-CPU variable that was always available. commit     401cb7dae813 (net: Reference bpf_redirect_info via task_struct on PREEMPT_RT.) turned bpf_net_context     into a task_struct member that is only set up by explicit callers. Without a caller setting it up,     bpf_redirect() itself crashes with a NULL pointer dereference in bpf_net_ctx_get_ri(). However, even with     bpf_net_context available, TC_ACT_REDIRECT from qdisc filter chains cannot be honored without adding     skb_do_redirect() calls to every qdisc classify function, which would require changes across net/sched/.
    Isolate it to ebpf core where it belongs. Instead, add a tcf_classify_qdisc() inline helper in pkt_cls.h,     as a wrapper around tcf_classify() for use by qdisc classify functions and tcf_qevent_handle(). When the     classify verdict is TC_ACT_REDIRECT, the wrapper converts it to TC_ACT_SHOT, dropping the packet rather     than letting it continue silently. Dropping is preferred over letting the packet through because the user     immediately sees packet loss. Silently passing the packet through would hide the problem and leave the     user wondering why their redirect is not working. The clsact fast path, tc_run() continues to call     tcf_classify() directly and is unaffected: TC_ACT_REDIRECT is returned as-is and handled by     sch_handle_egress/ingress() calling skb_do_redirect() as before. (CVE-2026-68441)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Published	Updated	Severity
365768	Ubuntu 26.04 LTS : Linux kernel (Azure) vulnerabilities (USN-8888-1)	Nessus	Ubuntu Local Security Checks	10/14/2026	10/14/2026	medium
365767	Ubuntu 26.04 LTS : Linux kernel vulnerabilities (USN-8887-1)	Nessus	Ubuntu Local Security Checks	10/14/2026	10/14/2026	medium
365463	Ubuntu 26.04 LTS : Linux kernel (OEM) vulnerabilities (USN-8889-1)	Nessus	Ubuntu Local Security Checks	10/13/2026	10/13/2026	medium
334906	Linux Distros Unpatched Vulnerability : CVE-2026-68441	Nessus	Misc.	8/12/2026	11/2/2026	medium
366742	SUSE SLED15: cluster-md-kmp-default / dlm-kmp-default / gfs2-kmp-default / etc (SUSE-SU-2026:4706-1)	Nessus	SuSE Local Security Checks	10/17/2026	10/17/2026	high

Detections

Analytics

Plugins Search

medium

medium

medium

medium

high