Alibaba Cloud Linux 3 : 0209: kernel (ALINUX3-SA-2026:0209)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
#
# The package checks in this plugin were extracted from
# Alibaba Cloud Linux Security Advisory ALINUX3-SA-2026:0209.
##

include('compat.inc');

if (description)
{
  script_id(327664);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/07/20");

  script_cve_id("CVE-2026-43499", "CVE-2026-43503");

  script_name(english:"Alibaba Cloud Linux 3 : 0209: kernel (ALINUX3-SA-2026:0209)");

  script_set_attribute(attribute:"synopsis", value:
"The remote Alibaba Cloud Linux host is missing one or more security updates.");
  script_set_attribute(attribute:"description", value:
"The remote Alibaba Cloud Linux 3 host has packages installed that are affected by multiple vulnerabilities as referenced
in the ALINUX3-SA-2026:0209 advisory.

    Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities:

    CVE-2026-43499:
    In the Linux kernel, the following vulnerability has been resolved:
    rtmutex: Use waiter::task instead of current in remove_waiter()
    remove_waiter() is used by the slowlock paths, but it is also used for
    proxy-lock rollback in rt_mutex_start_proxy_lock() when invoked from
    futex_requeue().
    In the latter case waiter::task is not current, but remove_waiter()
    operates on current for the dequeue operation. That results in several
    problems:
    1) the rbtree dequeue happens without waiter::task::pi_lock being held
    2) the waiter task's pi_blocked_on state is not cleared, which leaves a
    dangling pointer primed for UAF around.
    3) rt_mutex_adjust_prio_chain() operates on the wrong top priority waiter
    task
    Use waiter::task instead of current in all related operations in
    remove_waiter() to cure those problems.
    [ tglx: Fixup rt_mutex_adjust_prio_chain(), add a comment and amend the
    changelog ]

    CVE-2026-43503:
    In the Linux kernel, the following vulnerability has been resolved:
    net: skbuff: propagate shared-frag marker through frag-transfer helpers
    Two frag-transfer helpers (__pskb_copy_fclone() and skb_shift()) fail
    to propagate the SKBFL_SHARED_FRAG bit in skb_shinfo()->flags when
    moving frags from source to destination.  __pskb_copy_fclone() defers
    the rest of the shinfo metadata to skb_copy_header() after copying
    frag descriptors, but that helper only carries over gso_{size,segs,
    type} and never touches skb_shinfo()->flags; skb_shift() moves frag
    descriptors directly and leaves flags untouched.  As a result, the
    destination skb keeps a reference to the same externally-owned or
    page-cache-backed pages while reporting skb_has_shared_frag() as
    false.
    The mismatch is harmful in any in-place writer that uses
    skb_has_shared_frag() to decide whether shared pages must be detoured
    through skb_cow_data().  ESP input is one such writer (esp4.c,
    esp6.c), and a single nft 'dup to <local>' rule -- or any other
    nf_dup_ipv4() / xt_TEE caller -- is enough to land a pskb_copy()'d
    skb in esp_input() with the marker stripped, letting an unprivileged
    user write into the page cache of a root-owned read-only file via
    authencesn-ESN stray writes.
    Set SKBFL_SHARED_FRAG on the destination whenever frag descriptors
    were actually moved from the source.  skb_copy() and skb_copy_expand()
    share skb_copy_header() too but linearize all paged data into freshly
    allocated head storage and emerge with nr_frags == 0, so
    skb_has_shared_frag() returns false on its own; they need no change.
    The same omission exists in skb_gro_receive() and skb_gro_receive_list().
    The former moves the incoming skb's frag descriptors into the
    accumulator's last sub-skb via two paths (a direct frag-move loop and
    the head_frag + memcpy path); the latter chains the incoming skb whole
    onto p's frag_list.  Downstream skb_segment() reads only
    skb_shinfo(p)->flags, and skb_segment_list() reuses each sub-skb's
    shinfo as the nskb -- both p and lp must carry the marker.
    The same omission also exists in tcp_clone_payload(), which builds an
    MTU probe skb by moving frag descriptors from skbs on sk_write_queue
    into a freshly allocated nskb.  The helper falls into the same family
    and warrants the same fix for consistency; no TCP TX-side in-place
    writer is currently known to reach a user page through this gap, but
    a future consumer depending on the marker would regress silently.
    The same omission exists in skb_segment(): the per-iteration flag
    merge takes only head_skb's flag, and the inner switch that rebinds
    frag_skb to list_skb on head_skb-frags exhaustion does not fold the
    new frag_skb's flag into nskb.  Fold frag_skb's flag at both sites
    so segments drawing frags from frag_list members carry the marker.

    CVE-2026-53166:
    In the Linux kernel, the following vulnerability has been resolved:
    futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock
    When FUTEX_CMP_REQUEUE_PI requeues a non-top waiter that already owns the
    target PI futex, task_blocks_on_rt_mutex() returns -EDEADLK before setting
    waiter->task.
    The subsequent remove_waiter() in rt_mutex_start_proxy_lock() dereferences
    the NULL waiter->task, causing a kernel crash.
    Add a self-deadlock check for non-top waiters before calling
    rt_mutex_start_proxy_lock(), analogous to the top-waiter check in
    futex_lock_pi_atomic().

Tenable has extracted the preceding description block directly from the Alibaba Cloud Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"http://mirrors.aliyun.com/alinux/3/cve/alinux3-sa-20260209.xml");
  script_set_attribute(attribute:"solution", value:
"Update the affected packages.");
  script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:S/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:F/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:F/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-43503");
  script_set_attribute(attribute:"cvss3_score_source", value:"CVE-2026-43499");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");
  script_set_attribute(attribute:"exploit_framework_core", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/05/15");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/07/17");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/07/17");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:alibabacloud:alibaba_cloud_linux_3:bpftool");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:alibabacloud:alibaba_cloud_linux_3:kernel");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:alibabacloud:alibaba_cloud_linux_3:kernel-core");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:alibabacloud:alibaba_cloud_linux_3:kernel-debug");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:alibabacloud:alibaba_cloud_linux_3:kernel-debug-core");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:alibabacloud:alibaba_cloud_linux_3:kernel-debug-devel");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:alibabacloud:alibaba_cloud_linux_3:kernel-debug-modules");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:alibabacloud:alibaba_cloud_linux_3:kernel-debug-modules-extra");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:alibabacloud:alibaba_cloud_linux_3:kernel-devel");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:alibabacloud:alibaba_cloud_linux_3:kernel-headers");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:alibabacloud:alibaba_cloud_linux_3:kernel-modules");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:alibabacloud:alibaba_cloud_linux_3:kernel-modules-extra");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:alibabacloud:alibaba_cloud_linux_3:kernel-tools");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:alibabacloud:alibaba_cloud_linux_3:kernel-tools-libs");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:alibabacloud:alibaba_cloud_linux_3:kernel-tools-libs-devel");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:alibabacloud:alibaba_cloud_linux_3:perf");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:alibabacloud:alibaba_cloud_linux_3:python3-perf");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:alibabacloud:alibaba_cloud_linux_3");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Alibaba Cloud Linux Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/Alibaba/release", "Host/Alibaba/rpm-list", "Host/cpu");

  exit(0);
}


include('rpm2.inc');

if (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
var os_product = get_kb_item('installed_os/local/SSH/0/product');
if (isnull(os_product) || 'Alibaba Cloud Linux' >!< os_product) audit(AUDIT_OS_NOT, 'Alibaba Cloud Linux');
var os_version = get_kb_item('installed_os/local/SSH/0/version');
if (isnull(os_version)) audit(AUDIT_UNKNOWN_APP_VER, 'Alibaba Cloud Linux');
if (! preg(pattern:"^3([^0-9]|$)", string:os_version)) audit(AUDIT_OS_NOT, 'Alibaba Cloud Linux 3.x', 'Alibaba Cloud Linux ' + os_version);

if (!get_kb_item('Host/Alibaba/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('aarch64' >!< cpu && 'x86_64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'Alibaba Cloud Linux', cpu);

var constraints = [
  {
    'release': '3',
    'pkgs': [
      {'reference':'bpftool-5.10.134-19.7.1.al8', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE, 'epoch':'0'},
      {'reference':'bpftool-5.10.134-19.7.1.al8', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE, 'epoch':'0'},
      {'reference':'kernel-5.10.134-19.7.1.al8', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE, 'epoch':'0'},
      {'reference':'kernel-5.10.134-19.7.1.al8', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE, 'epoch':'0'},
      {'reference':'kernel-core-5.10.134-19.7.1.al8', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE, 'epoch':'0'},
      {'reference':'kernel-core-5.10.134-19.7.1.al8', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE, 'epoch':'0'},
      {'reference':'kernel-debug-5.10.134-19.7.1.al8', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE, 'epoch':'0'},
      {'reference':'kernel-debug-5.10.134-19.7.1.al8', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE, 'epoch':'0'},
      {'reference':'kernel-debug-core-5.10.134-19.7.1.al8', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE, 'epoch':'0'},
      {'reference':'kernel-debug-core-5.10.134-19.7.1.al8', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE, 'epoch':'0'},
      {'reference':'kernel-debug-devel-5.10.134-19.7.1.al8', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE, 'epoch':'0'},
      {'reference':'kernel-debug-devel-5.10.134-19.7.1.al8', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE, 'epoch':'0'},
      {'reference':'kernel-debug-modules-5.10.134-19.7.1.al8', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE, 'epoch':'0'},
      {'reference':'kernel-debug-modules-5.10.134-19.7.1.al8', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE, 'epoch':'0'},
      {'reference':'kernel-debug-modules-extra-5.10.134-19.7.1.al8', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE, 'epoch':'0'},
      {'reference':'kernel-debug-modules-extra-5.10.134-19.7.1.al8', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE, 'epoch':'0'},
      {'reference':'kernel-devel-5.10.134-19.7.1.al8', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE, 'epoch':'0'},
      {'reference':'kernel-devel-5.10.134-19.7.1.al8', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE, 'epoch':'0'},
      {'reference':'kernel-headers-5.10.134-19.7.1.al8', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE, 'epoch':'0'},
      {'reference':'kernel-headers-5.10.134-19.7.1.al8', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE, 'epoch':'0'},
      {'reference':'kernel-modules-5.10.134-19.7.1.al8', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE, 'epoch':'0'},
      {'reference':'kernel-modules-5.10.134-19.7.1.al8', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE, 'epoch':'0'},
      {'reference':'kernel-modules-extra-5.10.134-19.7.1.al8', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE, 'epoch':'0'},
      {'reference':'kernel-modules-extra-5.10.134-19.7.1.al8', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE, 'epoch':'0'},
      {'reference':'kernel-tools-5.10.134-19.7.1.al8', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE, 'epoch':'0'},
      {'reference':'kernel-tools-5.10.134-19.7.1.al8', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE, 'epoch':'0'},
      {'reference':'kernel-tools-libs-5.10.134-19.7.1.al8', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE, 'epoch':'0'},
      {'reference':'kernel-tools-libs-5.10.134-19.7.1.al8', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE, 'epoch':'0'},
      {'reference':'kernel-tools-libs-devel-5.10.134-19.7.1.al8', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE, 'epoch':'0'},
      {'reference':'kernel-tools-libs-devel-5.10.134-19.7.1.al8', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE, 'epoch':'0'},
      {'reference':'perf-5.10.134-19.7.1.al8', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE, 'epoch':'0'},
      {'reference':'perf-5.10.134-19.7.1.al8', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE, 'epoch':'0'},
      {'reference':'python3-perf-5.10.134-19.7.1.al8', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE, 'epoch':'0'},
      {'reference':'python3-perf-5.10.134-19.7.1.al8', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE, 'epoch':'0'}
    ]
  }
];

var os_release = get_one_kb_item('installed_os/local/SSH/0/release');
var os_sp = get_one_kb_item('Host/*/minor_release');

var flag = 0;
var reference;
var sp;
var _cpu;
var el_string;
var rpm_spec_vers_cmp;
var epoch;
var allowmaj;
var exists_check;
var cves;
foreach var constraint ( constraints ) {
  # Check that the target release is equal to the affected release
  if (!empty_or_null(constraint['release'])){
    if (constraint['release'] != os_release) continue;
  }
  if (!empty_or_null(constraint['sp'])){
    if (constraint['sp'] != os_sp) continue;
  }
  foreach var pkg ( constraint['pkgs'] ) {
    reference = NULL;
    sp = NULL;
    _cpu = NULL;
    el_string = NULL;
    rpm_spec_vers_cmp = NULL;
    epoch = NULL;
    allowmaj = NULL;
    exists_check = NULL;
    cves = NULL;
    if (!empty_or_null(pkg['reference'])) reference = pkg['reference'];
    if (!empty_or_null(pkg['sp'])) sp = pkg['sp'];
    if (!empty_or_null(pkg['cpu'])) _cpu = pkg['cpu'];
    if (!empty_or_null(pkg['el_string'])) el_string = pkg['el_string'];
    if (!empty_or_null(pkg['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = pkg['rpm_spec_vers_cmp'];
    if (!empty_or_null(pkg['epoch'])) epoch = pkg['epoch'];
    if (!empty_or_null(pkg['allowmaj'])) allowmaj = pkg['allowmaj'];
    if (!empty_or_null(pkg['exists_check'])) exists_check = pkg['exists_check'];
    if (!empty_or_null(pkg['cves'])) cves = pkg['cves'];
    if (reference &&
        ## (no known rpm to check OR known rpm_exists)
        (!exists_check || rpm_exists(rpm:exists_check)) &&
        rpm_check(sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj, cves:cves)) flag++;
  }
}

if (flag)
{
  security_report_v4(
      port       : 0,
      severity   : SECURITY_WARNING,
      extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'bpftool / kernel / kernel-core / kernel-debug / kernel-debug-core / etc');
}