The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - gtp: add synchronize_net() in gtp_newlink() error path to prevent use-after-free gtp_newlink()'s error     path frees tid_hash and addr_hash without waiting for an RCU grace period after clearing sk_user_data. A     concurrent gtp_encap_recv() in softirq may still hold the gtp_dev pointer obtained via     rcu_dereference_sk_user_data() and access the freed memory. BUG: KASAN: slab-use-after-free in     gtp0_pdp_find+0x1f6/0x200 (gtp.c:152) Call Trace: <IRQ> gtp0_pdp_find+0x1f6/0x200     gtp_encap_recv+0x527/0x24b0 udp_queue_rcv_one_skb+0x75f/0xc10 Add synchronize_net() before the kfree calls     in out_hashtable, which covers all error paths from both gtp_encap_enable() and gtp_create_sockets().
    (CVE-2026-89789)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Published	Updated	Severity
364137	Oracle Linux 10 / 9 : Unbreakable Enterprise kernel (ELSA-2026-500374)	Nessus	Oracle Linux Local Security Checks	10/8/2026	10/8/2026	high
362907	Debian dla-4817 : ata-modules-6.12.107+deb12-armmp-di - security update	Nessus	Debian Local Security Checks	10/4/2026	10/4/2026	high
351155	Debian dsa-6528 : ata-modules-6.12.111+deb13-armmp-di - security update	Nessus	Debian Local Security Checks	9/29/2026	9/29/2026	high
349289	Linux Distros Unpatched Vulnerability : CVE-2026-89789	Nessus	Misc.	9/23/2026	10/5/2026	high

Detections

Analytics

Plugins Search

high

high

high

high