TrueNAS | CVE False Positives

Automated vulnerability scanners compare package version strings against CVE databases and report matches. For TrueNAS CE/Enterprise, that process generates a significant number of findings that do not represent real exposure. This page explains the most common sources of false positives and describes how the TrueNAS PSIRT triages each CVE before publishing an impact statement.

Before publishing or acting on a CVE, TrueNAS PSIRT works through the following questions in order:

1. Is the affected subsystem compiled into the TrueNAS kernel? Many kernel CVEs affect subsystems TrueNAS does not build. If the subsystem is absent from the TrueNAS kernel configuration, the CVE does not apply regardless of CVSS score.

2. Is the vulnerable code path reachable in a default deployment? Some subsystems are compiled as loadable modules but are never activated by any default TrueNAS service. Reachability is evaluated against the stock configuration, not a theoretical worst case.

3. Is the fix already backported? Debian-based releases backport security fixes without incrementing the upstream version number. Scanners that compare version strings miss these backports. PSIRT verifies patch presence at the commit level, not from the version string.

4. Does the published CVSS score reflect TrueNAS’s actual attack surface? NVD scores assume a worst-case environment. PSIRT re-assesses attack vector, privilege required, and scope against TrueNAS’s architecture and reports the effective severity alongside the NVD score.

5. Is a fix available and scheduled? If the finding is confirmed as applicable, PSIRT tracks the upstream fix commit and targets it for inclusion in the next appropriate release.

TrueNAS CE/Enterprise is a headless x86-64 storage appliance. The kernel configuration excludes subsystems with no applicable hardware or use case, including: audio (ALSA/ASoC), WiFi (cfg80211/mac80211), Bluetooth, NFC, CAN bus, media/V4L2, ksmbd (the in-kernel SMB server), the kernel SMB client (TrueNAS uses Samba), Xen virtualization, ARM and SoC-specific drivers, and framebuffer devices. CVEs affecting any of these areas do not apply to TrueNAS regardless of CVSS score.

Example: CVE-2026-43083 is an out-of-bounds read in net/ipv6/ioam6.c with a published CVSS of 9.1 CRITICAL. CONFIG_IPV6_IOAM6 is absent from the TrueNAS kernel configuration — the code is not present and the finding does not apply.

Some kernel features are built as loadable modules but only become active when an application explicitly opts in via a specific system call sequence. No default TrueNAS service triggers these paths. A network-facing CVSS score assigned under the assumption that the service is running does not reflect actual TrueNAS exposure.

Example: CVE-2026-64046 is a scatterlist corruption bug in net/tls with a published CVSS of 9.8 CRITICAL. CONFIG_TLS=m is present in the TrueNAS kernel. However, no default TrueNAS service calls setsockopt(TCP_ULP, "tls", ...) to activate kernel TLS. The effective attack vector is local and requires deliberate opt-in — the finding does not apply to default deployments.

TrueNAS CE/Enterprise packages Debian Trixie, which backports security fixes to stable package versions without incrementing the upstream version number. A scanner that reports a package as vulnerable based on version comparison may be wrong if the fix was already included in the Debian-patched build.

The same applies to the Linux kernel: TrueNAS stable branches track a specific 6.12.x stable series and incorporate fixes independently of version string progression. PSIRT checks commit presence directly rather than relying on version strings.

NVD scores represent a worst-case scenario. Scores are sometimes assigned AV:N/PR:N/UI:N for vulnerabilities that, in practice, require a specific precondition that the scoring did not model — a service TrueNAS does not run by default, hardware the platform does not have, or a network topology that does not apply to typical deployments. PSIRT reports the NVD score alongside a TrueNAS-specific severity assessment.

Example: CVE-2026-43198 is a race condition in tcp_v6_syn_recv_sock(). NVD assigned CVSS 9.8; Red Hat’s ADP assessed 7.0 with AV:L. PSIRT confirmed the network-reachable attack vector applies to TrueNAS and published the finding as CRITICAL — but for many similar CVEs the NVD score overstates exposure.

CVEs with a local attack vector (AV:L) are often scored 7.0–7.8 HIGH, which sounds significant. TrueNAS CE/Enterprise does not provide shell access to non-administrative users by default. A local-unprivileged CVE requires an attacker who already holds operator-level credentials on the appliance. PSIRT notes this distinction in published impact statements even when classifying a finding as affected.

TrueNAS Apps run in Docker containers that do not receive /dev/zfs, raw block device access, or host-level capabilities by default. CVEs that require CAP_SYS_ADMIN in the host namespace, direct ZFS ioctl access, or specific device access from within a container do not apply to the default TrueNAS app model unless an administrator has explicitly granted elevated privileges to a specific app. PSIRT assesses first-party apps that require elevated container privileges separately.

Before treating a scanner finding as confirmed:

1. Check whether TrueNAS has published an Impact Statement for this CVE. Absence of a statement for an older finding may indicate it was triaged and found not applicable.

2. Check whether the CVE affects a subsystem TrueNAS compiles. Many kernel CVEs can be ruled out immediately at this step.

3. Check whether the scanner is comparing version strings without accounting for Debian security backports. Package changelogs (apt changelog <package>) list the fixes included in the installed build.

4. Check whether the attack scenario the CVE describes applies to your deployment configuration — particularly for CVEs involving optional features, non-default services, or container privilege escalation.

If you have found a vulnerability in TrueNAS not covered by a published Impact Statement, report it to the PSIRT team directly. TrueNAS reviews all reports and coordinates fixes under responsible disclosure. TrueNAS is not a CVE Numbering Authority — confirmed findings are referred to the appropriate CNA after investigation.

Contact: psirt@truenas.com

Back