The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - ksmbd: add a WRITE_DAC/WRITE_OWNER check to SMB2 SET_INFO SECURITY commit cc57232cae23 (ksmbd: fix FSCTL     permission bypass by adding a permission check for FSCTL_SET_SPARSE) added a fp->daccess gate to     fsctl_set_sparse and noted that similar handle-level checks exist in other functions but are missing     here. The SMB2 SET_INFO SECURITY arm is one of the missing ones, and the most security-relevant:
    smb2_set_info_sec() calls set_info_sec() with no per-handle access check. set_info_sec()     (fs/smb/server/smbacl.c) re-permissions the file: it rewrites owner/group/mode via notify_change(),     rewrites the POSIX ACL via set_posix_acl(), and on KSMBD_SHARE_FLAG_ACL_XATTR shares removes and rewrites     the Windows security descriptor via ksmbd_vfs_set_sd_xattr(). Every other persistent-mutation arm of the     sibling handler smb2_set_info_file() checks fp->daccess first (FILE_WRITE_DATA / FILE_DELETE /     FILE_WRITE_EA / FILE_WRITE_ATTRIBUTES); the SECURITY arm  which mutates the access control itself  is     the only one with no gate. A client can therefore open a handle with FILE_WRITE_ATTRIBUTES only (no     FILE_WRITE_DAC / FILE_WRITE_OWNER) and use SMB2_SET_INFO with InfoType SMB2_O_INFO_SECURITY to rewrite the     file's DACL and owner, granting itself access the handle's daccess never carried. Unlike the FSCTL data     arms this is a metadata/xattr operation, so there is no FMODE_WRITE VFS backstop  the missing fp->daccess     check is the entire gate. Setting a security descriptor is the WRITE_DAC / WRITE_OWNER operation, so     require at least one of those on the handle before re-permissioning the file. -EACCES is mapped to     STATUS_ACCESS_DENIED by smb2_set_info(). (CVE-2026-64394)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	名稱	產品	系列	已發布	已更新	嚴重性
343532	Ubuntu 24.04 LTS / Pro Realtime 24.04 LTS : Linux kernel (GCP) vulnerabilities (USN-8728-1)	Nessus	Ubuntu Local Security Checks	2026/9/7	2026/11/14	high
365522	Ubuntu 24.04 LTS : Linux kernel vulnerabilities (USN-8917-1)	Nessus	Ubuntu Local Security Checks	2026/10/14	2026/10/14	medium
329774	Linux Distros Unpatched Vulnerability : CVE-2026-64394	Nessus	Misc.	2026/7/25	2026/11/13	high

偵測

搜尋 Plugin

high

medium

high