The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - ipmi: Fix user refcount underflow in event delivery ipmi_alloc_recv_msg(user) takes the temporary user     reference owned by the receive message, and ipmi_free_recv_msg() drops it again. If event delivery fails     after allocating receive messages for earlier users, handle_read_event_rsp() rolls those messages back     with ipmi_free_recv_msg(). That rollback path still drops user->refcount explicitly after freeing each     message. The extra put can free a user that remains linked on intf->users, so later event delivery may     dereference a freed user or trip refcount_t's addition-on-zero warning when ipmi_alloc_recv_msg() tries to     acquire another reference. Remove the stale explicit put and the now-dead user assignment. Keep the     list_del() and ipmi_free_recv_msg() calls; they are the required rollback operations. (CVE-2026-72042)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Published	Updated	Severity
335591	Linux Distros Unpatched Vulnerability : CVE-2026-72042	Nessus	Misc.	8/15/2026	8/28/2026	high
341880	Amazon Linux 2023 : bpftool6.18, kernel6.18, kernel6.18-devel (ALAS2023-2026-2071)	Nessus	Amazon Linux Local Security Checks	8/31/2026	9/9/2026	high

Detections

Analytics

Plugins Search

high

high