The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - rds: filter RDS_INFO_* getsockopt by caller's netns The RDS_INFO_* family of getsockopt(2) options reads     several file-scope global lists that are not per-netns: rds_sock_info / rds6_sock_info, rds_sock_inc_info     / rds6_sock_inc_info -> rds_sock_list rds_tcp_tc_info / rds6_tcp_tc_info -> rds_tcp_tc_list rds_conn_info     / rds6_conn_info, rds_conn_message_info_cmn (for the *_SEND_MESSAGES and *_RETRANS_MESSAGES variants),     rds_for_each_conn_info (for RDS_INFO_IB_CONNECTIONS) -> rds_conn_hash[] The handlers do not filter by the     caller's network namespace. rds_info_getsockopt() has no netns or capable() check, and rds_create() has no     capable() check, so AF_RDS is reachable from an unprivileged user namespace. As a result, an unprivileged     caller in a fresh user_ns plus netns can read the bound address and sock inode of every RDS socket on the     host, the peer address of incoming messages on every RDS socket on the host, the peer address and TCP     sequence numbers of every rds-tcp connection on the host, and the peer address and RDS sequence numbers of     every RDS connection on the host. The rds-tcp transport is reachable from a non-initial netns (see     rds_set_transport()), so a one-shot init_net gate at rds_info_getsockopt() would deny legitimate per-netns     visibility to rds-tcp callers. Instead, filter at each handler by comparing the netns of the caller's     socket to the netns of the list entry, or to rds_conn_net(conn) for connection paths. Only copy entries     whose netns matches the caller. Counters (RDS_INFO_COUNTERS) are aggregate statistics and remain global.
    Reproducer (KASAN VM, rds and rds_tcp loaded): an AF_RDS socket binds 127.0.0.1:4242 in init_net as root.
    A child process enters a fresh user_ns plus netns and opens AF_RDS there, then calls getsockopt(SOL_RDS,     RDS_INFO_SOCKETS). Before this change, the child sees the init_net socket. After this change, the child     sees zero entries. Drop the rds_sock_count, rds_tcp_tc_count, and rds6_tcp_tc_count globals. v2 used them     for the size precheck and lens->nr; v3 replaced the precheck with a per-ns count from a first pass over     the list, so the globals have no remaining readers. The matching increments and decrements in     rds_create()/rds_destroy_sock() and rds_tcp_set_callbacks()/rds_tcp_restore_callbacks() go away with them.
    Reported by the kernel test robot under clang W=1. (CVE-2026-97476)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Published	Updated	Severity
351155	Debian dsa-6528 : ata-modules-6.12.111+deb13-armmp-di - security update	Nessus	Debian Local Security Checks	9/29/2026	9/29/2026	high
362907	Debian dla-4817 : ata-modules-6.12.107+deb12-armmp-di - security update	Nessus	Debian Local Security Checks	10/4/2026	10/4/2026	high
365209	Amazon Linux 2023 : bpftool6.12, kernel6.12, kernel6.12-devel (ALAS2023-2026-3193)	Nessus	Amazon Linux Local Security Checks	10/12/2026	10/12/2026	medium
349964	Linux Distros Unpatched Vulnerability : CVE-2026-97476	Nessus	Misc.	9/24/2026	9/30/2026	medium

Detections

Analytics

Plugins Search

high

high

medium

medium