Oracle Linux 7 / 8 : Unbreakable Enterprise kernel (ELSA-2026-500375)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
#
# The descriptive text and package checks in this plugin were
# extracted from Oracle Linux Security Advisory ELSA-2026-500375.
##

include('compat.inc');

if (description)
{
  script_id(363859);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/10/07");

  script_cve_id(
    "CVE-2026-23455",
    "CVE-2026-23457",
    "CVE-2026-31588",
    "CVE-2026-31662",
    "CVE-2026-31664",
    "CVE-2026-64306",
    "CVE-2026-64312",
    "CVE-2026-64313",
    "CVE-2026-68121",
    "CVE-2026-74469",
    "CVE-2026-80590",
    "CVE-2026-80844",
    "CVE-2026-81000"
  );

  script_name(english:"Oracle Linux 7 / 8 : Unbreakable Enterprise kernel (ELSA-2026-500375)");

  script_set_attribute(attribute:"synopsis", value:
"The remote Oracle Linux host is missing one or more security updates.");
  script_set_attribute(attribute:"description", value:
"The remote Oracle Linux 7 / 8 host has packages installed that are affected by multiple vulnerabilities as referenced in
the ELSA-2026-500375 advisory.

    - net: tun: bound receive headroom (Asim Viladi Oglu Manizada)  [Orabug: 40020673]  {CVE-2026-81000}
    - xfrm: ah6: validate routing header segments_left (Asim Viladi Oglu Manizada)  [Orabug: 39982188]
    {CVE-2026-80844}
    - inet: frags: strip GSO state from fragments before reassembly (Xinyang Ge)  [Orabug: 39972532]
    {CVE-2026-80590}
    - sctp: prevent peer transport count overflow (Asim Viladi Oglu Manizada)  [Orabug: 39886843]
    {CVE-2026-74469}
    - pppoe: reload header pointer after dev_hard_header() (Asim Viladi Oglu Manizada)  [Orabug: 39859408]
    {CVE-2026-68121}
    - crypto: ecc - Fix carry overflow in vli multiplication (Anastasia Tishchenko) [Orabug: 39785911]
    {CVE-2026-64313}
    - crypto: pcrypt - restore callback for non-parallel fallback (Ruijie Li) [Orabug: 39785907]
    {CVE-2026-64312}
    - crypto: drbg - Fix returning success on failure in CTR_DRBG (Eric Biggers) [Orabug: 39785894]
    {CVE-2026-64306}
    - KVM: x86: Use scratch field in MMIO fragment to hold small write values (Sean Christopherson) [Orabug:
    39273524] {CVE-2026-31588}
    - xfrm: clear trailing padding in build_polexpire() (Yasuaki Torimaru) [Orabug: 39262403] {CVE-2026-31664}
    - tipc: fix bc_ackers underflow on duplicate GRP_ACK_MSG (Oleh Konko) [Orabug: 39262395] {CVE-2026-31662}
    - netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (Lukas Johannes Moller)
    [Orabug: 39167519] {CVE-2026-23457}
    - netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (Jenny Guanni Qu) [Orabug: 39167511]
    {CVE-2026-23455}
    - x86/bugs: Make Safe-RET robust against interrupt injection (Borislav Petkov) [Orabug: 39784513,39853776]
    {CVE-2026-68480}
    - x86/alternatives: Disable interrupts and sync when optimizing NOPs in place (Thomas Gleixner) [Orabug:
    39784513] {CVE-2026-68480}
    - x86/alternative: Support relocations in alternatives (Peter Zijlstra) [Orabug: 39784513]
    {CVE-2026-68480}
    - x86/alternative: Make debug-alternative selective (Peter Zijlstra) [Orabug: 39784513] {CVE-2026-68480}
    - x86/alternatives: Add alt_instr.flags (Borislav Petkov) [Orabug: 39784513] {CVE-2026-68480}
    - x86/asm: Provide ALTERNATIVE_3 (Peter Zijlstra) [Orabug: 39784513] {CVE-2026-68480}
    - x86/alternative: Optimize single-byte NOPs at an arbitrary position (Borislav Petkov) [Orabug: 39784513]
    {CVE-2026-68480}
    - x86/alternative: Align insn bytes vertically (Borislav Petkov) [Orabug: 39784513] {CVE-2026-68480}
    (H Peter Anvin) [Orabug: 39784513] {CVE-2026-68480}
    - x86/alternatives: Optimize optimize_nops() (Peter Zijlstra) [Orabug: 39784513] {CVE-2026-68480}
    - x86: Add insn_decode_kernel() (Peter Zijlstra) [Orabug: 39784513] {CVE-2026-68480}
    - x86/insn: Add an insn_decode() API (Borislav Petkov) [Orabug: 39784513] {CVE-2026-68480}
    - x86/alternative: Use ALTERNATIVE_TERNARY() in _static_cpu_has() (Juergen Gross) [Orabug: 39784513]
    {CVE-2026-68480}
    - x86/alternative: Support ALTERNATIVE_TERNARY (Juergen Gross) [Orabug: 39784513] {CVE-2026-68480}
    - x86/alternative: Merge include files (Juergen Gross) [Orabug: 39784513] {CVE-2026-68480}
    - x86/alternative: Drop unused feature parameter from ALTINSTR_REPLACEMENT() (Juergen Gross) [Orabug:
    39784513] {CVE-2026-68480}
    - x86/insn: Support big endian cross-compiles (Martin Schwidefsky) [Orabug: 39784513] {CVE-2026-68480}
    - x86/tools: Use tools headers for instruction decoder selftests (Vasily Gorbik) [Orabug: 39784513]
    {CVE-2026-68480}
    - tools headers: Get tools's linux/compiler.h closer to the kernel's (Arnaldo Carvalho de Melo) [Orabug:
    39784513] {CVE-2026-68480}
    - perf build: Allow nested externs to enable BUILD_BUG() usage (Vasily Gorbik) [Orabug: 39784513]
    {CVE-2026-68480}
    - objtool: Allow nested externs to enable BUILD_BUG() (Vasily Gorbik) [Orabug: 39784513] {CVE-2026-68480}
    - objtool: Make relocation in alternative handling arch dependent (Julien Thierry) [Orabug: 39784513]
    {CVE-2026-68480}
    - x86/alternatives: Add pr_fmt() to debug macros (Borislav Petkov) [Orabug: 39784513] {CVE-2026-68480}
    - tools headers: Adopt verbatim copy of compiletime_assert() from kernel sources (Arnaldo Carvalho de
    Melo) [Orabug: 39784513] {CVE-2026-68480}
    - x86/alternatives: Teach text_poke_bp() to emulate instructions (Peter Zijlstra) [Orabug: 39784513]
    {CVE-2026-68480}
    - tools headers: Synchronize linux/bits.h with the kernel sources (Arnaldo Carvalho de Melo) [Orabug:
    39784513] {CVE-2026-68480}
    - net: tap: set skb->dev before parsing virtio net header in tap_get_user_xdp() (Dongli Zhang) [Orabug:
    39558751,39919265] {CVE-2026-74684}
    - ocfs2: fix possible deadlock between unlink and dio_end_io_write (Joseph Qi) [Orabug: 39273589]
    {CVE-2026-31598}
    - fs/ocfs2: fix comments mentioning i_mutex (Hongnan Li) [Orabug: 39273589] {CVE-2026-31598}
    - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Michal Kosiorek) [Orabug: 39460235]
    {CVE-2026-46116}
    - net/rds: zero per-item info buffer before handing it to visitors (Michael Bommarito) [Orabug:
    39621716,39638198] {CVE-2026-52995}
    - xfs: resample the data fork mapping after cycling ILOCK (Darrick Wong) [Orabug: 39776792]
    {CVE-2026-64600}
    - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [Orabug:
    39673871,39686461] {CVE-2026-53359}
    - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (Sean Christopherson) [Orabug:
    39460223,39673871] {CVE-2026-46113}
    - net/sched: act_pedit: fix action bind logic (Pedro Tammela) [Orabug: 39567287] {CVE-2026-46331}
    - net/sched: act_pedit: free pedit keys on bail from offset check (Pedro Tammela) [Orabug: 39567287]
    {CVE-2026-46331}
    - net/sched: fix pedit partial COW leading to page cache corruption (Rajat Gupta) [Orabug:
    39567287,39680880] {CVE-2026-46331}
    - net/sched: act_pedit: Parse L3 Header for L4 offset (Max Tottenham) [Orabug: 39567287] {CVE-2026-46331}
    - net/sched: act_pedit: rate limit datapath messages (Pedro Tammela) [Orabug: 39567287] {CVE-2026-46331}
    - net/sched: act_pedit: check static offsets a priori (Pedro Tammela) [Orabug: 39567287] {CVE-2026-46331}
    - net/sched: act_pedit: remove extra check for key type (Pedro Tammela) [Orabug: 39567287]
    {CVE-2026-46331}
    - net/sched: simplify tcf_pedit_act (Pedro Tammela) [Orabug: 39567287] {CVE-2026-46331}
    - net/sched: transition act_pedit to rcu and percpu stats (Pedro Tammela) [Orabug: 39567287]
    {CVE-2026-46331}
    - net/sched: act_pedit: use NLA_POLICY for parsing 'ex' keys (Pedro Tammela) [Orabug: 39567287]
    {CVE-2026-46331}
    - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Hkbinbin) [Orabug: 39452261]
    {CVE-2026-46043}
    - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Davidlohr Bueso) [Orabug:
    39426001,39751168] {CVE-2026-43499,CVE-2026-53163}
    - rtmutex: Use waiter::task instead of current in remove_waiter() (Keenan Dong) [Orabug:
    39426001,39706958] {CVE-2026-43499}
    - ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (Eric Dumazet) [Orabug: 39300930]
    {CVE-2026-43038}
    - net: skbuff: fix missing zerocopy reference in pskb_carve helpers (Minh Nguyen) [Orabug:
    39619389,39639989] {CVE-2026-52943}
    - net: fix fanout UAF in packet_release() via NETDEV_UP race (Yochai Eisenrich) [Orabug: 39250953]
    {CVE-2026-31504}
    - net: tap: NULL pointer derefence in dev_parse_header_protocol when skb->dev is null (Cezar Bulinaru)
    [Orabug: 39526882] {CVE-2022-50073}
    - arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Rutland) [Orabug: 39548666,39674328]
    {CVE-2025-10263,CVE-2026-53354}
    - arm64: tlb: Add ARM64_WORKAROUND_REPEAT_TLBI_SYNC (Mark Rutland) [Orabug: 39548666] {CVE-2025-10263}
    - ARM: uek: Disable CONFIG_QCOM_FALKOR_ERRATUM_1003 (Boris Ostrovsky) [Orabug: 39548666] {CVE-2025-10263}
    - arm64: tlb: allow XZR argument to TLBI ops (Mark Rutland) [Orabug: 39548666] {CVE-2025-10263}
    - arm64: cputype: Add C1-Premium definitions (Mark Rutland) [Orabug: 39548666] {CVE-2025-10263}
    - arm64: cputype: Add C1-Ultra definitions (Mark Rutland) [Orabug: 39548666] {CVE-2025-10263}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://linux.oracle.com/errata/ELSA-2026-500375.html");
  script_set_attribute(attribute:"solution", value:
"Update the affected packages.");
  script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:S/C:N/I:N/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-64306");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/04/03");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/10/06");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/10/07");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:oracle:linux:7");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:oracle:linux:8");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:oracle:linux:8:10:baseos_patch");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:kernel-uek");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:kernel-uek-container");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:kernel-uek-container-debug");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:kernel-uek-debug");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:kernel-uek-debug-devel");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:kernel-uek-devel");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:kernel-uek-doc");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:kernel-uek-tools");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Oracle Linux Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("linux_alt_patch_detect.nasl", "ssh_get_info.nasl");
  script_require_keys("Host/OracleLinux", "Host/RedHat/release", "Host/RedHat/rpm-list", "Host/local_checks_enabled");

  exit(0);
}


include('rpm2.inc');
include('ksplice.inc');

if (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
var os_product = get_kb_item('installed_os/local/SSH/0/product');
if (isnull(os_product) || !pregmatch(pattern: "Oracle (?:Linux Server|Enterprise Linux)", string:os_product)) audit(AUDIT_OS_NOT, 'Oracle Linux');
var os_version = get_kb_item('installed_os/local/SSH/0/version');
if (isnull(os_version)) audit(AUDIT_UNKNOWN_APP_VER, 'Oracle Linux');
if (! preg(pattern:"^(7|8)([^0-9]|$)", string:os_version)) audit(AUDIT_OS_NOT, 'Oracle Linux 7.x / 8.x', 'Oracle Linux ' + os_version);

if (!get_kb_item('Host/RedHat/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('x86_64' >!< cpu && cpu !~ "^i[3-6]86$" && 'aarch64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'Oracle Linux', cpu);

var machine_uptrack_level = get_one_kb_item('Host/livepatch-kernel-version');
var livepatch_source = get_one_kb_item('Host/livepatch-kernel-source');
if (empty_or_null(livepatch_source)) livepatch_source = 'KSplice';

if (machine_uptrack_level)
{
  var trimmed_uptrack_level = ereg_replace(string:machine_uptrack_level, pattern:"\.(x86_64|i[3-6]86|aarch64)$", replace:'');
  var fixed_uptrack_levels = ['5.4.17-2136.360.3.el7uek', '5.4.17-2136.360.3.el8uek'];
  foreach var fixed_uptrack_level ( fixed_uptrack_levels ) {
    if (rpm_spec_vers_cmp(a:trimmed_uptrack_level, b:fixed_uptrack_level) >= 0)
    {
      audit(AUDIT_PATCH_INSTALLED, livepatch_source + ' hotfix for ELSA-2026-500375');
    }
  }
  __rpm_report = 'Running ' + livepatch_source + ' level of ' + trimmed_uptrack_level + ' does not meet the minimum fixed level of ' + join(fixed_uptrack_levels, sep:' / ') + ' for this advisory.\n\n';
}

var kernel_major_minor = get_kb_item('Host/uname/major_minor');
if (empty_or_null(kernel_major_minor)) exit(1, 'Unable to determine kernel major-minor level.');
var expected_kernel_major_minor = '5.4';
if (kernel_major_minor != expected_kernel_major_minor)
  audit(AUDIT_OS_NOT, 'running kernel level ' + expected_kernel_major_minor + ', it is running kernel level ' + kernel_major_minor);

var constraints = [
  {
    'release': '7',
    'pkgs': [
      {'reference':'kernel-uek-5.4.17-2136.360.3.el7uek', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'kernel-uek-5.4.17'},
      {'reference':'kernel-uek-container-5.4.17-2136.360.3.el7uek', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'kernel-uek-container-5.4.17'},
      {'reference':'kernel-uek-container-debug-5.4.17-2136.360.3.el7uek', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'kernel-uek-container-debug-5.4.17'},
      {'reference':'kernel-uek-debug-5.4.17-2136.360.3.el7uek', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'kernel-uek-debug-5.4.17'},
      {'reference':'kernel-uek-debug-devel-5.4.17-2136.360.3.el7uek', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'kernel-uek-debug-devel-5.4.17'},
      {'reference':'kernel-uek-devel-5.4.17-2136.360.3.el7uek', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'kernel-uek-devel-5.4.17'},
      {'reference':'kernel-uek-doc-5.4.17-2136.360.3.el7uek', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'kernel-uek-doc-5.4.17'},
      {'reference':'kernel-uek-tools-5.4.17-2136.360.3.el7uek', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'kernel-uek-tools-5.4.17'}
    ]
  },
  {
    'release': '8',
    'pkgs': [
      {'reference':'kernel-uek-5.4.17-2136.360.3.el8uek', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'kernel-uek-5.4.17'},
      {'reference':'kernel-uek-debug-5.4.17-2136.360.3.el8uek', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'kernel-uek-debug-5.4.17'},
      {'reference':'kernel-uek-debug-devel-5.4.17-2136.360.3.el8uek', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'kernel-uek-debug-devel-5.4.17'},
      {'reference':'kernel-uek-devel-5.4.17-2136.360.3.el8uek', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'kernel-uek-devel-5.4.17'},
      {'reference':'kernel-uek-doc-5.4.17-2136.360.3.el8uek', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'kernel-uek-doc-5.4.17'},
      {'reference':'kernel-uek-5.4.17-2136.360.3.el8uek', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'kernel-uek-5.4.17'},
      {'reference':'kernel-uek-container-5.4.17-2136.360.3.el8uek', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'kernel-uek-container-5.4.17'},
      {'reference':'kernel-uek-container-debug-5.4.17-2136.360.3.el8uek', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'kernel-uek-container-debug-5.4.17'},
      {'reference':'kernel-uek-debug-5.4.17-2136.360.3.el8uek', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'kernel-uek-debug-5.4.17'},
      {'reference':'kernel-uek-debug-devel-5.4.17-2136.360.3.el8uek', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'kernel-uek-debug-devel-5.4.17'},
      {'reference':'kernel-uek-devel-5.4.17-2136.360.3.el8uek', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'kernel-uek-devel-5.4.17'},
      {'reference':'kernel-uek-doc-5.4.17-2136.360.3.el8uek', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'kernel-uek-doc-5.4.17'}
    ]
  }
];

var os_release = get_one_kb_item('installed_os/local/SSH/0/release');
var os_sp = get_one_kb_item('Host/*/minor_release');

var flag = 0;
var reference;
var sp;
var _cpu;
var el_string;
var rpm_spec_vers_cmp;
var epoch;
var allowmaj;
var exists_check;
var cves;
foreach var constraint ( constraints ) {
  # Check that the target release is equal to the affected release
  if (!empty_or_null(constraint['release'])){
    if (constraint['release'] != os_release) continue;
  }
  if (!empty_or_null(constraint['sp'])){
    if (constraint['sp'] != os_sp) continue;
  }
  foreach var pkg ( constraint['pkgs'] ) {
    reference = NULL;
    sp = NULL;
    _cpu = NULL;
    el_string = NULL;
    rpm_spec_vers_cmp = NULL;
    epoch = NULL;
    allowmaj = NULL;
    exists_check = NULL;
    cves = NULL;
    if (!empty_or_null(pkg['reference'])) reference = pkg['reference'];
    if (!empty_or_null(pkg['sp'])) sp = pkg['sp'];
    if (!empty_or_null(pkg['cpu'])) _cpu = pkg['cpu'];
    if (!empty_or_null(pkg['el_string'])) el_string = pkg['el_string'];
    if (!empty_or_null(pkg['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = pkg['rpm_spec_vers_cmp'];
    if (!empty_or_null(pkg['epoch'])) epoch = pkg['epoch'];
    if (!empty_or_null(pkg['allowmaj'])) allowmaj = pkg['allowmaj'];
    if (!empty_or_null(pkg['exists_check'])) exists_check = pkg['exists_check'];
    if (!empty_or_null(pkg['cves'])) cves = pkg['cves'];
    if (reference &&
        ## (no known rpm to check OR known rpm_exists)
        (!exists_check || rpm_exists(rpm:exists_check)) &&
        rpm_check(sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj, cves:cves)) flag++;
  }
}

if (flag)
{
  security_report_v4(
      port       : 0,
      severity   : SECURITY_WARNING,
      extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'kernel-uek / kernel-uek-container / kernel-uek-container-debug / etc');
}