Amazon Linux 2023 : bpftool6.12, kernel6.12, kernel6.12-devel (ALAS2023-2026-2014)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
#
# The descriptive text and package checks in this plugin were
# extracted from Amazon Linux 2023 Security Advisory ALAS2023-2026-2014.
##

include('compat.inc');

if (description)
{
  script_id(332042);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/08/04");

  script_cve_id(
    "CVE-2025-40158",
    "CVE-2026-31732",
    "CVE-2026-43010",
    "CVE-2026-43216",
    "CVE-2026-45932",
    "CVE-2026-52909",
    "CVE-2026-52975",
    "CVE-2026-52991",
    "CVE-2026-53070",
    "CVE-2026-53167",
    "CVE-2026-53341",
    "CVE-2026-53361",
    "CVE-2026-53381",
    "CVE-2026-53385",
    "CVE-2026-53388",
    "CVE-2026-53391",
    "CVE-2026-53393",
    "CVE-2026-53394",
    "CVE-2026-53397",
    "CVE-2026-53400",
    "CVE-2026-53403",
    "CVE-2026-63800",
    "CVE-2026-63802",
    "CVE-2026-63806",
    "CVE-2026-63807",
    "CVE-2026-63809",
    "CVE-2026-63810",
    "CVE-2026-63823",
    "CVE-2026-63824",
    "CVE-2026-63826",
    "CVE-2026-63829",
    "CVE-2026-64244",
    "CVE-2026-64245",
    "CVE-2026-64253"
  );

  script_name(english:"Amazon Linux 2023 : bpftool6.12, kernel6.12, kernel6.12-devel (ALAS2023-2026-2014)");

  script_set_attribute(attribute:"synopsis", value:
"The remote Amazon Linux 2023 host is missing a security update.");
  script_set_attribute(attribute:"description", value:
"It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2014 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    ipv6: use RCU in ip6_output() (CVE-2025-40158)

    In the Linux kernel, the following vulnerability has been resolved:

    gpio: Fix resource leaks on errors in gpiochip_add_data_with_key() (CVE-2026-31732)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf: Reject sleepable kprobe_multi programs at attach time (CVE-2026-43010)

    In the Linux kernel, the following vulnerability has been resolved:

    net: Drop the lock in skb_may_tx_timestamp() (CVE-2026-43216)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf: Fix tcx/netkit detach permissions when prog fd isn't given (CVE-2026-45932)

    In the Linux kernel, the following vulnerability has been resolved:

    ip6_vti: set netns_immutable on the fallback device. (CVE-2026-52909)

    In the Linux kernel, the following vulnerability has been resolved:

    bonding: 3ad: implement proper RCU rules for port->aggregator (CVE-2026-52975)

    In the Linux kernel, the following vulnerability has been resolved:

    sched/psi: fix race between file release and pressure write (CVE-2026-52991)

    In the Linux kernel, the following vulnerability has been resolved:

    sctp: disable BH before calling udp_tunnel_xmit_skb() (CVE-2026-53070)

    In the Linux kernel, the following vulnerability has been resolved:

    fuse: limit FUSE_NOTIFY_RETRIEVE to uptodate folios (CVE-2026-53167)

    In the Linux kernel, the following vulnerability has been resolved:

    fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (CVE-2026-53341)

    In the Linux kernel, the following vulnerability has been resolved:

    af_unix: Set gc_in_progress to true in unix_gc(). (CVE-2026-53361)

    In the Linux kernel, the following vulnerability has been resolved:

    virtiofs: fix UAF on submount umount

    iput() called from fuse_release_end() can Oops if the super block hasalready been destroyed.  Normally
    this is prevented by waiting fornum_waiting to go down to zero before commencing with super block
    shutdown.

    This only works, however, for the last submount instance, as the waitcounter is per connection, not per
    superblock.

    Revert to using synchronous release requests for the auto_submounts case,which is virtiofs only at this
    time. (CVE-2026-53381)

    In the Linux kernel, the following vulnerability has been resolved:

    vc_screen: fix null-ptr-deref in vcs_notifier() during concurrent vcs_write

    A KASAN null-ptr-deref was observed in vcs_notifier():

    BUG: KASAN: null-ptr-deref in vcs_notifier+0x98/0x130Read of size 2 at addr qmp_cmd_name:
    qmp_capabilities, arguments: {}

    The issue is a race condition in vcs_write(). When the console_lock istemporarily dropped (to copy data
    from userspace), the vc_data pointerobtained from vcs_vc() may become stale. After re-acquiring the
    lock,vcs_vc() is called again to re-validate the pointer. If the vc has beendeallocated in the meantime,
    vcs_vc() returns NULL, and the while loopbreaks (with written > 0). However, after the loop,
    vcs_scr_updated(vc)is still called with the now-NULL vc pointer, leading to a null pointerdereference in
    the notifier chain (vcs_notifier dereferences param->vc).

    Fix this by adding a NULL check for vc before calling vcs_scr_updated(). (CVE-2026-53385)

    In the Linux kernel, the following vulnerability has been resolved:

    fuse: re-lock request before replacing page cache folio

    fuse_try_move_folio() unlocks the request on entry but does notre-lock it on the success path. This means
    fuse_chan_abort() can end therequest and free the fuse_io_args (eg fuse_readpages_end()) while
    thesubsequent copy chain logic after fuse_try_move_folio() accesses thefuse_io_args, leading to use-after-
    free issues.

    Fix this by calling lock_request() before replace_page_cache_folio().This ensures the request is locked on
    the success path which willprevent the fuse_io_args from being freed while the later copying logicruns,
    and also ensures that the ap->folios[i]->mapping is never nullsince ap->folios[i] will always point to the
    newfolio afterreplace_page_cache_folio(). (CVE-2026-53388)

    In the Linux kernel, the following vulnerability has been resolved:

    NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CVE-2026-53391)

    In the Linux kernel, the following vulnerability has been resolved:

    nfsd: reset write verifier on deferred writeback errors (CVE-2026-53393)

    In the Linux kernel, the following vulnerability has been resolved:

    nfsd: avoid leaking pre-allocated openowner on unconfirmed retry race (CVE-2026-53394)

    In the Linux kernel, the following vulnerability has been resolved:

    nfsd: fix posix_acl leak on SETACL decode failure (CVE-2026-53397)

    In the Linux kernel, the following vulnerability has been resolved:

    i2c: core: fix adapter registration race

    Adapters can be looked up based on their id using i2c_get_adapter()which takes a reference to the embedded
    struct device.

    Make sure that the adapter (including its struct device) has beeninitialised before adding it to the IDR
    to avoid accessing uninitialiseddata which could, for example, lead to NULL-pointer dereferences oruse-
    after-free.

    Note that the i2c-dev chardev, which is registered from a bus notifier,currently uses i2c_get_adapter() so
    the adapter needs to be added to theIDR before registration. (CVE-2026-53400)

    In the Linux kernel, the following vulnerability has been resolved:

    fbdev: Fix fb_new_modelist to prevent null-ptr-deref in fb_videomode_to_var

    info->var, a framebuffer's current mode, is expected to have a matchingentry in info->modelist.
    var_to_display() relies on this and treats afailed fb_match_mode() as This should not happen.
    fb_set_var() keeps ittrue by adding the mode to the list on every change, anddo_register_framebuffer()
    does the same at registration.

    store_modes() replaces the modelist from userspace. fb_new_modelist()validates the new modes but does not
    check that info->var still has amatch. It relies on fbcon_new_modelist() to re-point consoles, but
    thatonly handles consoles mapped to the framebuffer. With fbcon unbound thereare none, so info->var is
    left describing a mode that is no longer in thelist.

    A later console takeover runs var_to_display(), where fb_match_mode()returns NULL and leaves
    fb_display[i].mode NULL. fbcon_switch() passes itto display_to_var(), and fb_videomode_to_var()
    dereferences the NULL mode.

    Keep the current mode in the list in fb_new_modelist(), the same wayfb_set_var() does. (CVE-2026-53403)

    In the Linux kernel, the following vulnerability has been resolved:

    pNFS: Fix use-after-free in pnfs_update_layout() (CVE-2026-63800)

    In the Linux kernel, the following vulnerability has been resolved:

    blk-cgroup: fix UAF in __blkcg_rstat_flush() (CVE-2026-63802)

    In the Linux kernel, the following vulnerability has been resolved:

    KVM: Replace guest-triggerable BUG_ON() in ioeventfd datamatch with get_unaligned() (CVE-2026-63806)

    In the Linux kernel, the following vulnerability has been resolved:

    KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (CVE-2026-63807)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf: use kvfree() for replaced sysctl write buffer (CVE-2026-63809)

    In the Linux kernel, the following vulnerability has been resolved:

    block: Avoid mounting the bdev pseudo-filesystem in userspace (CVE-2026-63810)

    In the Linux kernel, the following vulnerability has been resolved:

    keys: Pin request_key_auth payload in instantiate paths (CVE-2026-63823)

    In the Linux kernel, the following vulnerability has been resolved:

    KEYS: fix overflow in keyctl_pkey_params_get_2() (CVE-2026-63824)

    In the Linux kernel, the following vulnerability has been resolved:

    fbdev: fix use-after-free in store_modes() (CVE-2026-63826)

    In the Linux kernel, the following vulnerability has been resolved:

    net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (CVE-2026-63829)

    In the Linux kernel, the following vulnerability has been resolved:

    drivers/base/memory: set mem->altmap after successful device registration (CVE-2026-64244)

    In the Linux kernel, the following vulnerability has been resolved:

    fbdev: modedb: fix a possible UAF in fb_find_mode() (CVE-2026-64245)

    In the Linux kernel, the following vulnerability has been resolved:

    kernel/fork: clear PF_BLOCK_TS in copy_process() (CVE-2026-64253)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://alas.aws.amazon.com//AL2023/ALAS2023-2026-2014.html");
  script_set_attribute(attribute:"see_also", value:"https://alas.aws.amazon.com/faqs.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2025-40158.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-31732.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-43010.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-43216.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-45932.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-52909.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-52975.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-52991.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-53070.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-53167.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-53341.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-53361.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-53381.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-53385.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-53388.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-53391.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-53393.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-53394.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-53397.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-53400.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-53403.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-63800.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-63802.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-63806.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-63807.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-63809.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-63810.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-63823.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-63824.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-63826.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-63829.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-64244.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-64245.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-64253.html");
  script_set_attribute(attribute:"solution", value:
"Run 'dnf update kernel6.12 --releasever 2023.12.20260803' or
  or 'dnf update --advisory ALAS2023-2026-2014 --releasever 2023.12.20260803' to update your system.");
  script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:S/C:N/I:N/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-53403");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2025/11/12");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/08/04");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/08/04");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:bpftool6.12");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:bpftool6.12-debuginfo");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:kernel-livepatch-6.12.95-124.187");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:kernel6.12");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:kernel6.12-debuginfo");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:kernel6.12-debuginfo-common-aarch64");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:kernel6.12-debuginfo-common-x86_64");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:kernel6.12-devel");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:kernel6.12-headers");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:kernel6.12-modules-extra");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:kernel6.12-modules-extra-common");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:kernel6.12-tools");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:kernel6.12-tools-debuginfo");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:kernel6.12-tools-devel");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:perf6.12");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:perf6.12-debuginfo");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:python3-perf6.12");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:python3-perf6.12-debuginfo");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:amazon:linux:2023");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Amazon Linux Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/AmazonLinux/release", "Host/AmazonLinux/rpm-list");

  exit(0);
}

include("rpm2.inc");

if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);

var alas_release = get_kb_item("Host/AmazonLinux/release");
if (isnull(alas_release) || !strlen(alas_release)) audit(AUDIT_OS_NOT, "Amazon Linux");
var os_ver = pregmatch(pattern: "^AL(A|\d+|-\d+)", string:alas_release);
if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "Amazon Linux");
os_ver = os_ver[1];
if (os_ver != "-2023")
{
  if (os_ver == 'A') os_ver = 'AMI';
  audit(AUDIT_OS_NOT, "Amazon Linux 2023", "Amazon Linux " + os_ver);
}

if (!get_kb_item("Host/AmazonLinux/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);

var pkgs = [
    {'reference':'bpftool6.12-6.12.95-124.187.amzn2023', 'cpu':'aarch64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'bpftool6.12-6.12.'},
    {'reference':'bpftool6.12-6.12.95-124.187.amzn2023', 'cpu':'x86_64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'bpftool6.12-6.12.'},
    {'reference':'bpftool6.12-debuginfo-6.12.95-124.187.amzn2023', 'cpu':'aarch64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'bpftool6.12-debuginfo-6.12.'},
    {'reference':'bpftool6.12-debuginfo-6.12.95-124.187.amzn2023', 'cpu':'x86_64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'bpftool6.12-debuginfo-6.12.'},
    {'reference':'kernel-livepatch-6.12.95-124.187-1.0-0.amzn2023', 'cpu':'aarch64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'kernel-livepatch-6.12.95-124.187-1.0-0.amzn2023', 'cpu':'x86_64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'kernel6.12-6.12.95-124.187.amzn2023', 'cpu':'aarch64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'kernel6.12-6.12.'},
    {'reference':'kernel6.12-6.12.95-124.187.amzn2023', 'cpu':'x86_64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'kernel6.12-6.12.'},
    {'reference':'kernel6.12-debuginfo-6.12.95-124.187.amzn2023', 'cpu':'aarch64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'kernel6.12-debuginfo-6.12.'},
    {'reference':'kernel6.12-debuginfo-6.12.95-124.187.amzn2023', 'cpu':'x86_64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'kernel6.12-debuginfo-6.12.'},
    {'reference':'kernel6.12-debuginfo-common-aarch64-6.12.95-124.187.amzn2023', 'cpu':'aarch64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'kernel6.12-debuginfo-common-aarch64-6.12.'},
    {'reference':'kernel6.12-debuginfo-common-x86_64-6.12.95-124.187.amzn2023', 'cpu':'x86_64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'kernel6.12-debuginfo-common-x86_64-6.12.'},
    {'reference':'kernel6.12-devel-6.12.95-124.187.amzn2023', 'cpu':'aarch64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'kernel6.12-devel-6.12.'},
    {'reference':'kernel6.12-devel-6.12.95-124.187.amzn2023', 'cpu':'x86_64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'kernel6.12-devel-6.12.'},
    {'reference':'kernel6.12-headers-6.12.95-124.187.amzn2023', 'cpu':'aarch64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'kernel6.12-headers-6.12.'},
    {'reference':'kernel6.12-headers-6.12.95-124.187.amzn2023', 'cpu':'x86_64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'kernel6.12-headers-6.12.'},
    {'reference':'kernel6.12-modules-extra-6.12.95-124.187.amzn2023', 'cpu':'aarch64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'kernel6.12-modules-extra-6.12.'},
    {'reference':'kernel6.12-modules-extra-6.12.95-124.187.amzn2023', 'cpu':'x86_64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'kernel6.12-modules-extra-6.12.'},
    {'reference':'kernel6.12-modules-extra-common-6.12.95-124.187.amzn2023', 'cpu':'aarch64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'kernel6.12-modules-extra-common-6.12.'},
    {'reference':'kernel6.12-modules-extra-common-6.12.95-124.187.amzn2023', 'cpu':'x86_64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'kernel6.12-modules-extra-common-6.12.'},
    {'reference':'kernel6.12-tools-6.12.95-124.187.amzn2023', 'cpu':'aarch64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'kernel6.12-tools-6.12.'},
    {'reference':'kernel6.12-tools-6.12.95-124.187.amzn2023', 'cpu':'x86_64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'kernel6.12-tools-6.12.'},
    {'reference':'kernel6.12-tools-debuginfo-6.12.95-124.187.amzn2023', 'cpu':'aarch64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'kernel6.12-tools-debuginfo-6.12.'},
    {'reference':'kernel6.12-tools-debuginfo-6.12.95-124.187.amzn2023', 'cpu':'x86_64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'kernel6.12-tools-debuginfo-6.12.'},
    {'reference':'kernel6.12-tools-devel-6.12.95-124.187.amzn2023', 'cpu':'aarch64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'kernel6.12-tools-devel-6.12.'},
    {'reference':'kernel6.12-tools-devel-6.12.95-124.187.amzn2023', 'cpu':'x86_64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'kernel6.12-tools-devel-6.12.'},
    {'reference':'perf6.12-6.12.95-124.187.amzn2023', 'cpu':'aarch64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'perf6.12-6.12.'},
    {'reference':'perf6.12-6.12.95-124.187.amzn2023', 'cpu':'x86_64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'perf6.12-6.12.'},
    {'reference':'perf6.12-debuginfo-6.12.95-124.187.amzn2023', 'cpu':'aarch64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'perf6.12-debuginfo-6.12.'},
    {'reference':'perf6.12-debuginfo-6.12.95-124.187.amzn2023', 'cpu':'x86_64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'perf6.12-debuginfo-6.12.'},
    {'reference':'python3-perf6.12-6.12.95-124.187.amzn2023', 'cpu':'aarch64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'python3-perf6.12-6.12.'},
    {'reference':'python3-perf6.12-6.12.95-124.187.amzn2023', 'cpu':'x86_64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'python3-perf6.12-6.12.'},
    {'reference':'python3-perf6.12-debuginfo-6.12.95-124.187.amzn2023', 'cpu':'aarch64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'python3-perf6.12-debuginfo-6.12.'},
    {'reference':'python3-perf6.12-debuginfo-6.12.95-124.187.amzn2023', 'cpu':'x86_64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'python3-perf6.12-debuginfo-6.12.'}
];

var flag = 0;
foreach var package_array ( pkgs ) {
  var reference = NULL;
  var _release = NULL;
  var sp = NULL;
  var _cpu = NULL;
  var el_string = NULL;
  var rpm_spec_vers_cmp = NULL;
  var epoch = NULL;
  var allowmaj = NULL;
  var exists_check = NULL;
  var cves = NULL;
  if (!empty_or_null(package_array['reference'])) reference = package_array['reference'];
  if (!empty_or_null(package_array['release'])) _release = package_array['release'];
  if (!empty_or_null(package_array['sp'])) sp = package_array['sp'];
  if (!empty_or_null(package_array['cpu'])) _cpu = package_array['cpu'];
  if (!empty_or_null(package_array['el_string'])) el_string = package_array['el_string'];
  if (!empty_or_null(package_array['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = package_array['rpm_spec_vers_cmp'];
  if (!empty_or_null(package_array['epoch'])) epoch = package_array['epoch'];
  if (!empty_or_null(package_array['allowmaj'])) allowmaj = package_array['allowmaj'];
  if (!empty_or_null(package_array['exists_check'])) exists_check = package_array['exists_check'];
  if (!empty_or_null(package_array['cves'])) cves = package_array['cves'];
  if (reference && _release && (!exists_check || rpm_exists(release:_release, rpm:exists_check))) {
    if (rpm_check(release:_release, sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj, cves:cves)) flag++;
  }
}

if (flag)
{
  security_report_v4(
      port       : 0,
      severity   : SECURITY_WARNING,
      extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, "bpftool6.12 / bpftool6.12-debuginfo / kernel-livepatch-6.12.95-124.187 / etc");
}