MiracleLinux 9 : kernel-5.14.0-687.41.1.el9_8 (AXSA:2026-1947:89)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
#
# The package checks in this plugin were extracted from
# Miracle Linux Security Advisory AXSA:2026-1947:89.
##

include('compat.inc');

if (description)
{
  script_id(362546);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/10/02");

  script_cve_id(
    "CVE-2026-43206",
    "CVE-2026-43233",
    "CVE-2026-43237",
    "CVE-2026-45878",
    "CVE-2026-45991",
    "CVE-2026-46120",
    "CVE-2026-52991",
    "CVE-2026-53136",
    "CVE-2026-53143",
    "CVE-2026-53189",
    "CVE-2026-53329",
    "CVE-2026-53356",
    "CVE-2026-53374",
    "CVE-2026-63879",
    "CVE-2026-63884",
    "CVE-2026-63888",
    "CVE-2026-63952",
    "CVE-2026-64007",
    "CVE-2026-64048",
    "CVE-2026-64219",
    "CVE-2026-64379",
    "CVE-2026-64382",
    "CVE-2026-64386",
    "CVE-2026-64560",
    "CVE-2026-68343",
    "CVE-2026-68388"
  );

  script_name(english:"MiracleLinux 9 : kernel-5.14.0-687.41.1.el9_8 (AXSA:2026-1947:89)");

  script_set_attribute(attribute:"synopsis", value:
"The remote MiracleLinux host is missing one or more security updates.");
  script_set_attribute(attribute:"description", value:
"The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the
AXSA:2026-1947:89 advisory.

    * kernel: netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CVE-2026-43233)
      * kernel: drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CVE-2026-43206)
      * kernel: drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline
    Management v4 (CVE-2026-43237)
      * kernel: udf: fix partition descriptor append bookkeeping (CVE-2026-45991)
      * kernel: drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CVE-2026-45878)
      * kernel: ip6_gre: Use cached t->net in ip6erspan_changelink() (CVE-2026-46120)
      * kernel: sched/psi: fix race between file release and pressure write (CVE-2026-52991)
      * kernel: drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CVE-2026-53143)
      * kernel: drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CVE-2026-53136)
      * kernel: mm/huge_memory: update file PMD counter before folio_put() (CVE-2026-53189)
      * kernel: drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CVE-2026-53329)
      * kernel: drm/i915/gem: Fix phys BO pread/pwrite with offset (CVE-2026-53356)
      * kernel: drm/amdgpu: zero-initialize GART table on allocation (CVE-2026-53374)
      * kernel: drm/i915: Fix potential UAF in TTM object purge (CVE-2026-63884)
      * kernel: netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CVE-2026-64007)
      * kernel: memfd: deny writeable mappings when implying SEAL_WRITE (CVE-2026-63952)
      * kernel: scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd()
    (CVE-2026-63888)
      * kernel: drm/amdgpu: fix amdgpu_hmm_range_get_pages (CVE-2026-63879)
      * kernel: net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CVE-2026-64048)
      * kernel: drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async
    (CVE-2026-64219)
      * kernel: smb: client: fix double-free in SMB2_open() replay (CVE-2026-64382)
      * kernel: smb: client: mask server-provided mode to 07777 in modefromsid (CVE-2026-64379)
      * kernel: smb: client: fix query_info() replay double-free (CVE-2026-64386)
      * kernel: posix-cpu-timers: Prevent UAF caused by non-leader exec() race (CVE-2026-64560)
      * kernel: smb: client: validate DFS referral PathConsumed (CVE-2026-68343)
      * kernel: smb/client: handle overlapping allocated ranges in fallocate (CVE-2026-68388)
    Bug Fix(es) and Enhancement(s):
      * kernel 5.14.0-687.5.1.el9_8 breaks wifi when using FIPS (JIRA:RHEL-181065)
      * vhost: reset the vring metadata cache on vring reconfiguration [rhel-9.8.z] (JIRA:RHEL-224549)
      * cifs: smb1 directory listings from xp server returning EINVAL and EIO [rhel-9.8.z] (JIRA:RHEL-235811)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://tsn.miraclelinux.com/en/node/24772");
  script_set_attribute(attribute:"solution", value:
"Update the affected packages.");
  script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:S/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-53143");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");
  script_set_attribute(attribute:"vendor_severity", value:"High");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/03/12");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/10/02");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/10/02");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:miracle:linux:kernel");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:miracle:linux:kernel-abi-stablelists");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:miracle:linux:kernel-core");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:miracle:linux:kernel-cross-headers");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:miracle:linux:kernel-debug");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:miracle:linux:kernel-debug-core");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:miracle:linux:kernel-debug-devel");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:miracle:linux:kernel-debug-devel-matched");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:miracle:linux:kernel-debug-modules");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:miracle:linux:kernel-debug-modules-core");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:miracle:linux:kernel-debug-modules-extra");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:miracle:linux:kernel-debug-uki-virt");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:miracle:linux:kernel-devel");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:miracle:linux:kernel-devel-matched");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:miracle:linux:kernel-headers");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:miracle:linux:kernel-modules");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:miracle:linux:kernel-modules-core");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:miracle:linux:kernel-modules-extra");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:miracle:linux:kernel-rt");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:miracle:linux:kernel-rt-core");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:miracle:linux:kernel-rt-debug");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:miracle:linux:kernel-rt-debug-core");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:miracle:linux:kernel-rt-debug-devel");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:miracle:linux:kernel-rt-debug-modules");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:miracle:linux:kernel-rt-debug-modules-core");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:miracle:linux:kernel-rt-debug-modules-extra");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:miracle:linux:kernel-rt-devel");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:miracle:linux:kernel-rt-modules");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:miracle:linux:kernel-rt-modules-core");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:miracle:linux:kernel-rt-modules-extra");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:miracle:linux:kernel-tools");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:miracle:linux:kernel-tools-libs");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:miracle:linux:kernel-tools-libs-devel");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:miracle:linux:kernel-uki-virt");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:miracle:linux:kernel-uki-virt-addons");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:miracle:linux:libperf");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:miracle:linux:perf");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:miracle:linux:python3-perf");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:miracle:linux:rtla");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:miracle:linux:rv");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:miracle:linux:9");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Miracle Linux Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/MiracleLinux/release", "Host/MiracleLinux/rpm-list", "Host/cpu");

  exit(0);
}


include('rpm2.inc');

if (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
var os_product = get_kb_item('installed_os/local/SSH/0/product');
if (isnull(os_product) || 'MIRACLE LINUX' >!< os_product) audit(AUDIT_OS_NOT, 'MIRACLE LINUX');
var os_version = get_kb_item('installed_os/local/SSH/0/version');
if (isnull(os_version)) audit(AUDIT_UNKNOWN_APP_VER, 'MIRACLE LINUX');
if (! preg(pattern:"^9([^0-9]|$)", string:os_version)) audit(AUDIT_OS_NOT, 'MiracleLinux 9.x', 'MIRACLE LINUX ' + os_version);

if (!get_kb_item('Host/MiracleLinux/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('aarch64' >!< cpu && 'ppc' >!< cpu && 's390' >!< cpu && 'x86_64' >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'MIRACLE LINUX', cpu);

var constraints = [
  {
    'release': '9',
    'pkgs': [
      {'reference':'kernel-5.14.0-687.41.1.el9_8', 'cpu':'x86_64', 'el_string':'el9_8', 'rpm_spec_vers_cmp':TRUE, 'epoch':'0'},
      {'reference':'kernel-abi-stablelists-5.14.0-687.41.1.el9_8', 'el_string':'el9_8', 'rpm_spec_vers_cmp':TRUE, 'epoch':'0'},
      {'reference':'kernel-core-5.14.0-687.41.1.el9_8', 'cpu':'x86_64', 'el_string':'el9_8', 'rpm_spec_vers_cmp':TRUE, 'epoch':'0'},
      {'reference':'kernel-cross-headers-5.14.0-687.41.1.el9_8', 'cpu':'x86_64', 'el_string':'el9_8', 'rpm_spec_vers_cmp':TRUE, 'epoch':'0'},
      {'reference':'kernel-debug-5.14.0-687.41.1.el9_8', 'cpu':'x86_64', 'el_string':'el9_8', 'rpm_spec_vers_cmp':TRUE, 'epoch':'0'},
      {'reference':'kernel-debug-core-5.14.0-687.41.1.el9_8', 'cpu':'x86_64', 'el_string':'el9_8', 'rpm_spec_vers_cmp':TRUE, 'epoch':'0'},
      {'reference':'kernel-debug-devel-5.14.0-687.41.1.el9_8', 'cpu':'x86_64', 'el_string':'el9_8', 'rpm_spec_vers_cmp':TRUE, 'epoch':'0'},
      {'reference':'kernel-debug-devel-matched-5.14.0-687.41.1.el9_8', 'cpu':'x86_64', 'el_string':'el9_8', 'rpm_spec_vers_cmp':TRUE, 'epoch':'0'},
      {'reference':'kernel-debug-modules-5.14.0-687.41.1.el9_8', 'cpu':'x86_64', 'el_string':'el9_8', 'rpm_spec_vers_cmp':TRUE, 'epoch':'0'},
      {'reference':'kernel-debug-modules-core-5.14.0-687.41.1.el9_8', 'cpu':'x86_64', 'el_string':'el9_8', 'rpm_spec_vers_cmp':TRUE, 'epoch':'0'},
      {'reference':'kernel-debug-modules-extra-5.14.0-687.41.1.el9_8', 'cpu':'x86_64', 'el_string':'el9_8', 'rpm_spec_vers_cmp':TRUE, 'epoch':'0'},
      {'reference':'kernel-debug-uki-virt-5.14.0-687.41.1.el9_8', 'cpu':'x86_64', 'el_string':'el9_8', 'rpm_spec_vers_cmp':TRUE, 'epoch':'0'},
      {'reference':'kernel-devel-5.14.0-687.41.1.el9_8', 'cpu':'x86_64', 'el_string':'el9_8', 'rpm_spec_vers_cmp':TRUE, 'epoch':'0'},
      {'reference':'kernel-devel-matched-5.14.0-687.41.1.el9_8', 'cpu':'x86_64', 'el_string':'el9_8', 'rpm_spec_vers_cmp':TRUE, 'epoch':'0'},
      {'reference':'kernel-headers-5.14.0-687.41.1.el9_8', 'cpu':'x86_64', 'el_string':'el9_8', 'rpm_spec_vers_cmp':TRUE, 'epoch':'0'},
      {'reference':'kernel-modules-5.14.0-687.41.1.el9_8', 'cpu':'x86_64', 'el_string':'el9_8', 'rpm_spec_vers_cmp':TRUE, 'epoch':'0'},
      {'reference':'kernel-modules-core-5.14.0-687.41.1.el9_8', 'cpu':'x86_64', 'el_string':'el9_8', 'rpm_spec_vers_cmp':TRUE, 'epoch':'0'},
      {'reference':'kernel-modules-extra-5.14.0-687.41.1.el9_8', 'cpu':'x86_64', 'el_string':'el9_8', 'rpm_spec_vers_cmp':TRUE, 'epoch':'0'},
      {'reference':'kernel-rt-5.14.0-687.41.1.el9_8', 'cpu':'x86_64', 'el_string':'el9_8', 'rpm_spec_vers_cmp':TRUE, 'epoch':'0'},
      {'reference':'kernel-rt-core-5.14.0-687.41.1.el9_8', 'cpu':'x86_64', 'el_string':'el9_8', 'rpm_spec_vers_cmp':TRUE, 'epoch':'0'},
      {'reference':'kernel-rt-debug-5.14.0-687.41.1.el9_8', 'cpu':'x86_64', 'el_string':'el9_8', 'rpm_spec_vers_cmp':TRUE, 'epoch':'0'},
      {'reference':'kernel-rt-debug-core-5.14.0-687.41.1.el9_8', 'cpu':'x86_64', 'el_string':'el9_8', 'rpm_spec_vers_cmp':TRUE, 'epoch':'0'},
      {'reference':'kernel-rt-debug-devel-5.14.0-687.41.1.el9_8', 'cpu':'x86_64', 'el_string':'el9_8', 'rpm_spec_vers_cmp':TRUE, 'epoch':'0'},
      {'reference':'kernel-rt-debug-modules-5.14.0-687.41.1.el9_8', 'cpu':'x86_64', 'el_string':'el9_8', 'rpm_spec_vers_cmp':TRUE, 'epoch':'0'},
      {'reference':'kernel-rt-debug-modules-core-5.14.0-687.41.1.el9_8', 'cpu':'x86_64', 'el_string':'el9_8', 'rpm_spec_vers_cmp':TRUE, 'epoch':'0'},
      {'reference':'kernel-rt-debug-modules-extra-5.14.0-687.41.1.el9_8', 'cpu':'x86_64', 'el_string':'el9_8', 'rpm_spec_vers_cmp':TRUE, 'epoch':'0'},
      {'reference':'kernel-rt-devel-5.14.0-687.41.1.el9_8', 'cpu':'x86_64', 'el_string':'el9_8', 'rpm_spec_vers_cmp':TRUE, 'epoch':'0'},
      {'reference':'kernel-rt-modules-5.14.0-687.41.1.el9_8', 'cpu':'x86_64', 'el_string':'el9_8', 'rpm_spec_vers_cmp':TRUE, 'epoch':'0'},
      {'reference':'kernel-rt-modules-core-5.14.0-687.41.1.el9_8', 'cpu':'x86_64', 'el_string':'el9_8', 'rpm_spec_vers_cmp':TRUE, 'epoch':'0'},
      {'reference':'kernel-rt-modules-extra-5.14.0-687.41.1.el9_8', 'cpu':'x86_64', 'el_string':'el9_8', 'rpm_spec_vers_cmp':TRUE, 'epoch':'0'},
      {'reference':'kernel-tools-5.14.0-687.41.1.el9_8', 'cpu':'x86_64', 'el_string':'el9_8', 'rpm_spec_vers_cmp':TRUE, 'epoch':'0'},
      {'reference':'kernel-tools-libs-5.14.0-687.41.1.el9_8', 'cpu':'x86_64', 'el_string':'el9_8', 'rpm_spec_vers_cmp':TRUE, 'epoch':'0'},
      {'reference':'kernel-tools-libs-devel-5.14.0-687.41.1.el9_8', 'cpu':'x86_64', 'el_string':'el9_8', 'rpm_spec_vers_cmp':TRUE, 'epoch':'0'},
      {'reference':'kernel-uki-virt-5.14.0-687.41.1.el9_8', 'cpu':'x86_64', 'el_string':'el9_8', 'rpm_spec_vers_cmp':TRUE, 'epoch':'0'},
      {'reference':'kernel-uki-virt-addons-5.14.0-687.41.1.el9_8', 'cpu':'x86_64', 'el_string':'el9_8', 'rpm_spec_vers_cmp':TRUE, 'epoch':'0'},
      {'reference':'libperf-5.14.0-687.41.1.el9_8', 'cpu':'x86_64', 'el_string':'el9_8', 'rpm_spec_vers_cmp':TRUE, 'epoch':'0'},
      {'reference':'perf-5.14.0-687.41.1.el9_8', 'cpu':'x86_64', 'el_string':'el9_8', 'rpm_spec_vers_cmp':TRUE, 'epoch':'0'},
      {'reference':'python3-perf-5.14.0-687.41.1.el9_8', 'cpu':'x86_64', 'el_string':'el9_8', 'rpm_spec_vers_cmp':TRUE, 'epoch':'0'},
      {'reference':'rtla-5.14.0-687.41.1.el9_8', 'cpu':'x86_64', 'el_string':'el9_8', 'rpm_spec_vers_cmp':TRUE, 'epoch':'0'},
      {'reference':'rv-5.14.0-687.41.1.el9_8', 'cpu':'x86_64', 'el_string':'el9_8', 'rpm_spec_vers_cmp':TRUE, 'epoch':'0'}
    ]
  }
];

var os_release = get_one_kb_item('installed_os/local/SSH/0/release');
var os_sp = get_one_kb_item('Host/*/minor_release');

var flag = 0;
var reference;
var sp;
var _cpu;
var el_string;
var rpm_spec_vers_cmp;
var epoch;
var allowmaj;
var exists_check;
var cves;
foreach var constraint ( constraints ) {
  # Check that the target release is equal to the affected release
  if (!empty_or_null(constraint['release'])){
    if (constraint['release'] != os_release) continue;
  }
  if (!empty_or_null(constraint['sp'])){
    if (constraint['sp'] != os_sp) continue;
  }
  foreach var pkg ( constraint['pkgs'] ) {
    reference = NULL;
    sp = NULL;
    _cpu = NULL;
    el_string = NULL;
    rpm_spec_vers_cmp = NULL;
    epoch = NULL;
    allowmaj = NULL;
    exists_check = NULL;
    cves = NULL;
    if (!empty_or_null(pkg['reference'])) reference = pkg['reference'];
    if (!empty_or_null(pkg['sp'])) sp = pkg['sp'];
    if (!empty_or_null(pkg['cpu'])) _cpu = pkg['cpu'];
    if (!empty_or_null(pkg['el_string'])) el_string = pkg['el_string'];
    if (!empty_or_null(pkg['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = pkg['rpm_spec_vers_cmp'];
    if (!empty_or_null(pkg['epoch'])) epoch = pkg['epoch'];
    if (!empty_or_null(pkg['allowmaj'])) allowmaj = pkg['allowmaj'];
    if (!empty_or_null(pkg['exists_check'])) exists_check = pkg['exists_check'];
    if (!empty_or_null(pkg['cves'])) cves = pkg['cves'];
    if (reference &&
        ## (no known rpm to check OR known rpm_exists)
        (!exists_check || rpm_exists(rpm:exists_check)) &&
        rpm_check(sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj, cves:cves)) flag++;
  }
}
if (flag)
{
  security_report_v4(
      port       : 0,
      severity   : SECURITY_WARNING,
      extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'kernel / kernel-abi-stablelists / kernel-core / etc');
}