The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - KVM: arm64: nv: Fix life cycle of the nested_mmus array The nested_mmus array holds the shadow page tables     that are used when a guest is running a nested context. These structures are allocated on VCPU_INIT for     whole guest, which implies that they may have to be relocated as the array grows. Should a VCPU_INIT occur     whilst a vcpu is actively running an L2 and that the allocation requires relocation, that vcpu will still     be running with a pointer to the previous structure, which will have been freed. Fix this by turning the     array of structures to an array of pointers, which is now allocated at VM creation, sized to the absolute     maximum that KVM can handle. In turn, each VCPU_INIT contributes S2_MMU_PER_VCPU to the pool. No     reallocation is ever performed, and the life cycle of each object is much clearer: - the nested_mmus array     is allocated in kvm_init_nested(), and freed in kvm_arch_destroy_vm() - s2_mmu structures are allocated in     kvm_vcpu_init_nested(), and freed on kvm_arch_flush_shadow_all() Finally, the freeing of     vcpu->arch.vncr_array is made consistent rather than being done on some failure paths, but not others.
    (CVE-2026-98927)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Published	Updated	Severity
371850	Amazon Linux 2023 : bpftool6.18, kernel6.18, kernel6.18-devel (ALAS2023-2026-3251)	Nessus	Amazon Linux Local Security Checks	10/25/2026	10/27/2026	critical
372309	Linux Distros Unpatched Vulnerability : CVE-2026-98927	Nessus	Misc.	10/27/2026	10/28/2026	high

Detections

Analytics

Plugins Search

critical

high