Fedora 43 : linux-firmware (2026-bd021461a8)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##
# The descriptive text and package checks in this plugin were
# extracted from Fedora Security Advisory FEDORA-2026-bd021461a8
#

include('compat.inc');

if (description)
{
  script_id(370296);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/10/22");
  script_xref(name:"FEDORA", value:"2026-bd021461a8");

  script_name(english:"Fedora 43 : linux-firmware (2026-bd021461a8)");

  script_set_attribute(attribute:"synopsis", value:
"The remote Fedora host is missing one or more security updates.");
  script_set_attribute(attribute:"description", value:
"The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the
FEDORA-2026-bd021461a8 advisory.

    Update to 20261019:

    * rockchip: add PCIe3 PHY firmware for snps-pcie3
    * Update ADSP firmware for Qualcomm qcs615 platform.
    * Revert amdgpu: update GC 11.0.0 firmware
    * amdgpu: a LOT of updates for various ASICs
    * amdgpu: DMCUB updates for various ASICs
    * rtw89: init board_elm.bin with stuffs for board ID 1
    * rtw89: 8922d: update fw 0.35.119.3 with format suffix -1
    * rtw89: 8922d: update fw 0.35.115.2
    * wfx: update to firmware 3.18
    * nvidia: Update and add missing firmware files for Tegra SoCs
    * qcom:Update qdsp6sw firmware for shikra platform
    * aic: Add AIC8800D80 Bluetooth and Wi-Fi firmware
    * qcom: update HPASS firmware for nord platform
    * amdgpu: DMCUB updates for various ASICs
    * amdgpu: update gc 11.0.1 and 11.0.4 firmware
    * qcom: update LPAICP firmware for shikra platform
    * ath12k: WCN7850 hw2.0: update board-2.bin
    * panthor: Add initial firmware for Architecture 14.8 Arm Mali GPU
    * qcom: update ADSP firmware for glymur platform
    * cirrus: cs35l41: Add firmware and tuning for Lenovo Thinkbook laptops
    * cirrus: cs35l63: Add firmware for Cirrus CS35L63 for various Dell laptops
    * cirrus: cs42l45: Add CS42L49 SDCA codec firmware for Dell laptops
    * qcom: fix qcs8300 gpdspr.jsn symlink target
    * qcom: update ADSP firmware for x1e80100 platform
    * Update firmware for Intel Solar/Magnetar/Blazar*/Scorpius/ScorpiusGfp core
    * cirrus: cs35l57 cs35l63: Add firmware for some Dell laptops
    * WHENCE: add SPDX license references for non-standard license texts
    * WHENCE: add initial SPDX identifiers
    * cirrus: cs42l45: Add CS42L45 SDCA codec firmware for a Dell laptop
    * cirrus: cs35l41: Add support for Lenovo Yoga Slim 7 Carbon 14ACN6
    * Add ISH firmware files for Intel Nova Lake-H/S platforms
    * qcom: add ADSP firmware for eliza platform
    * qcom: update ADSP firmware for hawi platform
    * QCA: Add QCA2066 Bluetooth firmware hpnv21g.30c
    * QCA: Update Bluetooth QCA2066 firmware to 2.1.0-00653
    * Revert qcom: update ADSP firmware for qcs615 platform
    * qcom: Add gpu firmwares for Hawi and Maili chipsets
    * qcom: update Rubik Pi 3 ADSP firmware
    * cirrus: cs35l56: Correct firmware instances for 103c8c52 and 103c8c53
    * contrib: post the MR comment to the project of the merge request
    * qcom: vpu: add Gen2 firmware binary for Hawi/Maili
    * Update AMD cpu microcode
    * iwlwifi: add Bz/Sc FW for core24.80-41 release
    * iwlwifi: Update Bz/Fm firmware for core24.80-41 release
    * iwlwifi: Add Hr/Gf firmware for core24.80-41 release
    * iwlwifi: update ty/So/Ma firmwares for core24.80-41 release
    * iwlwifi: Add cc/Qu/QuZ firmwares for core24.80-41 release
    * mwifiex: add IW416 firmware
    * ath12k: WCN7850 hw2.0: update board-2.bin
    * ath12k: QCC2072 hw1.0: update board-2.bin
    * ci: add Qualcomm firmware version diff MR comment job
    * qcom: sdx61: add missing firmware version
    * qcom: sdx35: add missing firmware version
    * qcom: aic100: add missing firmware versions
    * qcom: qdu100: add missing firmware versions
    * qcom: sdm845: add missing modem firmware version
    * qcom: x1e80100: add missing Dell XPS 13 9345 DSP versions
    * qcom: add missing Adreno ZAP shader versions
    * qca: separate the WCN685x uart firmware revisions
    * qca: group the QCA61x4 USB firmware files
    * qca: drop duplicate version lines
    * qca: fix the version of the QCA6698 Bluetooth firmware
    * qca: fix the version of the WCN785x USB firmware
    * qcom: fix the version of the a660 GMU firmware
    * qcom: fix the version of the Eliza SQE microcode
    * qcom: fix the version of the QCS615 ZAP shader
    * qcom/shikra: link WiFi firmware from the ath10k subdir
    * Revert amdgpu: update GC 11.0.0 firmware
    * Revert amdgpu: update GC 11.0.0 firmware
    * amdgpu: DMCUB updates for various ASICs
    * intel: Update ibt-00a0-01a1-pci.ddc for BE211 - Whale Peak2 (WhP2)
    * ath11k: WCN6855 hw2.0: update board-2.bin
    * cirrus: cs42l45: Add CS42L45 SDCA codec firmware for Dell laptops
    * qcom: add CDSP firmware for hawi platform
    * cirrus: cs42l45: Add CS42L45 SDCA codec firmware for Dell laptops
    * cirrus: cs35l63: Add Cirrus CS35L63 firmware mappings for some Dell laptops
    * QCA: Update Bluetooth firmware for QCC2072 UART interface: 1.1.0-00340 to 1.1.0-00355

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://bodhi.fedoraproject.org/updates/FEDORA-2026-bd021461a8");
  script_set_attribute(attribute:"solution", value:
"Update the affected linux-firmware package.");
  script_set_attribute(attribute:"risk_factor", value:"High");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/10/19");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/10/19");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/10/22");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:fedoraproject:fedora:43");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fedoraproject:fedora:linux-firmware");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Fedora Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info2.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/RedHat/release", "Host/RedHat/rpm-list");

  exit(0);
}


include('rpm2.inc');

if (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
var os_product = get_kb_item('installed_os/local/SSH/0/product');
if (isnull(os_product) || 'Fedora' >!< os_product) audit(AUDIT_OS_NOT, 'Fedora');
var os_version = get_kb_item('installed_os/local/SSH/0/version');
if (isnull(os_version)) audit(AUDIT_UNKNOWN_APP_VER, 'Fedora');
if (! preg(pattern:"^43([^0-9]|$)", string:os_version)) audit(AUDIT_OS_NOT, 'Fedora 43', 'Fedora ' + os_version);

if (!get_kb_item('Host/RedHat/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('x86_64' >!< cpu && cpu !~ "^i[3-6]86$" && 's390' >!< cpu && 'aarch64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'Fedora', cpu);

var constraints = [
  {
    'release': '43',
    'pkgs': [
      {'reference':'linux-firmware-20261019-1.fc43', 'rpm_spec_vers_cmp':TRUE}
    ]
  }
];

var os_release = get_one_kb_item('installed_os/local/SSH/0/release');
var os_sp = get_one_kb_item('Host/*/minor_release');

var flag = 0;
var reference;
var sp;
var _cpu;
var el_string;
var rpm_spec_vers_cmp;
var epoch;
var allowmaj;
var exists_check;
var cves;
foreach var constraint ( constraints ) {
  # Check that the target release is equal to the affected release
  if (!empty_or_null(constraint['release'])){
    if (constraint['release'] != os_release) continue;
  }
  if (!empty_or_null(constraint['sp'])){
    if (constraint['sp'] != os_sp) continue;
  }
  foreach var pkg ( constraint['pkgs'] ) {
    reference = NULL;
    sp = NULL;
    _cpu = NULL;
    el_string = NULL;
    rpm_spec_vers_cmp = NULL;
    epoch = NULL;
    allowmaj = NULL;
    exists_check = NULL;
    cves = NULL;
    if (!empty_or_null(pkg['reference'])) reference = pkg['reference'];
    if (!empty_or_null(pkg['sp'])) sp = pkg['sp'];
    if (!empty_or_null(pkg['cpu'])) _cpu = pkg['cpu'];
    if (!empty_or_null(pkg['el_string'])) el_string = pkg['el_string'];
    if (!empty_or_null(pkg['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = pkg['rpm_spec_vers_cmp'];
    if (!empty_or_null(pkg['epoch'])) epoch = pkg['epoch'];
    if (!empty_or_null(pkg['allowmaj'])) allowmaj = pkg['allowmaj'];
    if (!empty_or_null(pkg['exists_check'])) exists_check = pkg['exists_check'];
    if (!empty_or_null(pkg['cves'])) cves = pkg['cves'];
    if (reference &&
        ## (no known rpm to check OR known rpm_exists)
        (!exists_check || rpm_exists(rpm:exists_check)) &&
        rpm_check(sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj, cves:cves)) flag++;
  }
}

if (flag)
{
  security_report_v4(
      port       : 0,
      severity   : SECURITY_HOLE,
      extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'linux-firmware');
}