Linux/Unix 主机中安装的一个或多个程序包受到一个漏洞影响，而供应商没有提供补丁程序。

  - 已修复 Linux 内核中的下列漏洞：HID: winwing: fix use-after-free in force feedback teardown winwing_init_ff() passes the driver's private data, allocated with devm_kzalloc() in winwing_probe(), as the effect context to input_ff_create_memless(). The memoryless force-feedback core takes ownership of that pointer and frees it with kfree() from input_ff_destroy() (ml_ff_destroy()) when the input device is destroyed. Freeing a devm-managed allocation with kfree() is an invalid free, and the same object is then released again by devres when the HID device is torn down, a double free. As the allocation also embeds the LED class devices, their timers and work item live on freed memory and the slab gets corrupted. This triggers on unbind, rmmod, hot-unplug and on system suspend, where the firmware cache walks the now-corrupt devres list. KASAN reports: BUG: KASAN: invalid-free in input_ff_destroy Allocated by task N: winwing_probe Pass NULL as the memless context instead and fetch the driver data from the input device in winwing_play_effect(): the HID core already stores the hid_device as the input device's drvdata.
    The force-feedback core then owns nothing that it must not free. (CVE-2026-98645)

请注意，Nessus 依赖供应商报告的程序包是否存在进行判断。

Linux/Unix 主機上安裝了一個或多個受到弱點影響的套件，且供應商未提供可用的修補程式。

  - 已解決 Linux 核心中的下列弱點：HID: winwing: fix use-after-free in force feedback teardown winwing_init_ff() passes the driver's private data, allocated with devm_kzalloc() in winwing_probe(), as the effect context to input_ff_create_memless(). The memoryless force-feedback core takes ownership of that pointer and frees it with kfree() from input_ff_destroy() (ml_ff_destroy()) when the input device is destroyed. Freeing a devm-managed allocation with kfree() is an invalid free, and the same object is then released again by devres when the HID device is torn down, a double free. As the allocation also embeds the LED class devices, their timers and work item live on freed memory and the slab gets corrupted. This triggers on unbind, rmmod, hot-unplug and on system suspend, where the firmware cache walks the now-corrupt devres list. KASAN reports: BUG: KASAN: invalid-free in input_ff_destroy Allocated by task N: winwing_probe Pass NULL as the memless context instead and fetch the driver data from the input device in winwing_play_effect(): the HID core already stores the hid_device as the input device's drvdata.
    The force-feedback core then owns nothing that it must not free. (CVE-2026-98645)

請注意，Nessus 依賴供應商報告的套件存在。

Linux/Unix ホストには、ベンダーが提供するパッチが利用できない脆弱性の影響を受ける複数のパッケージがインストールされています。

  - Linux カーネルでは、以下の脆弱性が解決されています: HID: winwing: fix use-after-free in force feedback teardown winwing_init_ff() passes the driver's private data, allocated with devm_kzalloc() in winwing_probe(), as the effect context to input_ff_create_memless(). The memoryless force-feedback core takes ownership of that pointer and frees it with kfree() from input_ff_destroy() (ml_ff_destroy()) when the input device is destroyed. Freeing a devm-managed allocation with kfree() is an invalid free, and the same object is then released again by devres when the HID device is torn down, a double free. As the allocation also embeds the LED class devices, their timers and work item live on freed memory and the slab gets corrupted. This triggers on unbind, rmmod, hot-unplug and on system suspend, where the firmware cache walks the now-corrupt devres list. KASAN reports: BUG: KASAN: invalid-free in input_ff_destroy Allocated by task N: winwing_probe Pass NULL as the memless context instead and fetch the driver data from the input device in winwing_play_effect(): the HID core already stores the hid_device as the input device's drvdata.
    The force-feedback core then owns nothing that it must not free. (CVE-2026-98645)

Nessus は、ベンダーによって報告されたパッケージの存在に依存していることに注意してください。

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - In the Linux kernel, the following vulnerability has been resolved: HID: winwing: fix use-after-free in     force feedback teardown winwing_init_ff() passes the driver's private data, allocated with devm_kzalloc()     in winwing_probe(), as the effect context to input_ff_create_memless(). The memoryless force-feedback core     takes ownership of that pointer and frees it with kfree() from input_ff_destroy() (ml_ff_destroy()) when     the input device is destroyed. Freeing a devm-managed allocation with kfree() is an invalid free, and the     same object is then released again by devres when the HID device is torn down, a double free. As the     allocation also embeds the LED class devices, their timers and work item live on freed memory and the slab     gets corrupted. This triggers on unbind, rmmod, hot-unplug and on system suspend, where the firmware cache     walks the now-corrupt devres list. KASAN reports: BUG: KASAN: invalid-free in input_ff_destroy Allocated     by task N: winwing_probe Pass NULL as the memless context instead and fetch the driver data from the input     device in winwing_play_effect(): the HID core already stores the hid_device as the input device's drvdata.
    The force-feedback core then owns nothing that it must not free. (CVE-2026-98645)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	名稱	產品	系列	已發布	已更新	嚴重性
367465	Linux Distros 未修补的漏洞：CVE-2026-98645	Nessus	Misc.	2026/10/20	2026/10/21	high
367465	Linux Distros 未修補弱點：CVE-2026-98645	Nessus	Misc.	2026/10/20	2026/10/21	high
367465	Linux Distros のパッチ未適用の脆弱性: CVE-2026-98645	Nessus	Misc.	2026/10/20	2026/10/21	high
367465	Linux Distros Unpatched Vulnerability : CVE-2026-98645	Nessus	Misc.	2026/10/20	2026/10/21	high

偵測

搜尋 Plugin

high

high

high

high