Oracle Linux 9 : ELSA-2026-67150-0: / kernel (ELSA-2026-671500)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
#
# The descriptive text and package checks in this plugin were
# extracted from Oracle Linux Security Advisory ELSA-2026-671500.
##

include('compat.inc');

if (description)
{
  script_id(345896);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/09/15");

  script_cve_id(
    "CVE-2025-68745",
    "CVE-2026-23466",
    "CVE-2026-31479",
    "CVE-2026-31566",
    "CVE-2026-31656",
    "CVE-2026-31692",
    "CVE-2026-43334",
    "CVE-2026-43368",
    "CVE-2026-43370",
    "CVE-2026-52917",
    "CVE-2026-52918",
    "CVE-2026-52947",
    "CVE-2026-53053",
    "CVE-2026-53072",
    "CVE-2026-53091",
    "CVE-2026-53182",
    "CVE-2026-53209",
    "CVE-2026-53246",
    "CVE-2026-53254",
    "CVE-2026-53256",
    "CVE-2026-63801",
    "CVE-2026-63889",
    "CVE-2026-63944",
    "CVE-2026-63945",
    "CVE-2026-63946",
    "CVE-2026-63947",
    "CVE-2026-63971",
    "CVE-2026-63975",
    "CVE-2026-64037",
    "CVE-2026-64113",
    "CVE-2026-64117",
    "CVE-2026-64255",
    "CVE-2026-64515",
    "CVE-2026-68086",
    "CVE-2026-68117",
    "CVE-2026-68264",
    "CVE-2026-68300",
    "CVE-2026-68315",
    "CVE-2026-68376",
    "CVE-2026-68402",
    "CVE-2026-68406",
    "CVE-2026-72098"
  );

  script_name(english:"Oracle Linux 9 : ELSA-2026-67150-0: / kernel (ELSA-2026-671500)");

  script_set_attribute(attribute:"synopsis", value:
"The remote Oracle Linux host is missing one or more security updates.");
  script_set_attribute(attribute:"description", value:
"The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the
ELSA-2026-671500 advisory.

    - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098}
    - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332]
    {CVE-2026-68086}
    - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370}
    - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481]
    {CVE-2026-43368}
    - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417]
    {CVE-2026-31656}
    - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275]
    {CVE-2026-31566}
    - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479}
    - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466}
    - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (Jose Exposito) [RHEL-236583] {CVE-2026-68264}
    - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801}
    - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037]
    {CVE-2026-68117}
    - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971}
    - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917}
    - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315}
    - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376}
    - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300}
    - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084}
    - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745}
    - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206]
    {CVE-2026-53246}
    - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652]
    {CVE-2026-68406}
    - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez)
    [RHEL-237652] {CVE-2026-68406}
    - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652]
    {CVE-2026-68406}
    - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652]
    {CVE-2026-68406}
    - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez)
    [RHEL-236961] {CVE-2026-68402}
    - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez)
    [RHEL-232010] {CVE-2026-64255}
    - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez)
    [RHEL-231682] {CVE-2026-64117}
    - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez)
    [RHEL-231682] {CVE-2026-64117}
    - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez)
    [RHEL-230975] {CVE-2026-64037}
    - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587]
    {CVE-2026-53182}
    - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez)
    [RHEL-229728] {CVE-2026-52947}
    - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619]
    {CVE-2026-64515}
    - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515}
    - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670]
    {CVE-2026-53072}
    - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059]
    {CVE-2026-63947}
    - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073]
    {CVE-2026-53209}
    - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944}
    - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756]
    {CVE-2026-63975}
    - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721]
    {CVE-2026-63889}
    - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946}
    - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882]
    {CVE-2026-64113}
    - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport
    Bot) [RHEL-227536] {CVE-2026-43334}
    - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454]
    {CVE-2026-53053}
    - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431]
    {CVE-2026-63945}
    - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646]
    {CVE-2026-53254}
    - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254}
    - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576]
    {CVE-2026-53256}
    - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918}
    - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091}
    - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091}
    - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091}
    - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228]
    {CVE-2026-53091}
    - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091}
    - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091}
    - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091}
    - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532]
    {CVE-2026-31692}
    - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532]
    {CVE-2026-31692}
    - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692}
    - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692}
    - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692}
    - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://linux.oracle.com/errata/ELSA-2026-67150-0.html");
  script_set_attribute(attribute:"solution", value:
"Update the affected packages.");
  script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:S/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-31566");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2025/12/24");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/09/14");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/09/15");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:oracle:linux:9");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:oracle:linux:9:8:baseos_patch");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:kernel");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:kernel-abi-stablelists");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:kernel-core");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:kernel-cross-headers");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:kernel-debug");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:kernel-debug-core");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:kernel-debug-devel");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:kernel-debug-devel-matched");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:kernel-debug-modules");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:kernel-debug-modules-core");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:kernel-debug-modules-extra");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:kernel-debug-uki-virt");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:kernel-devel");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:kernel-devel-matched");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:kernel-headers");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:kernel-modules");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:kernel-modules-core");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:kernel-modules-extra");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:kernel-tools");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:kernel-tools-libs");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:kernel-tools-libs-devel");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:kernel-uki-virt");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:kernel-uki-virt-addons");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:libperf");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:perf");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:python3-perf");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:rtla");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:rv");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Oracle Linux Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("linux_alt_patch_detect.nasl", "ssh_get_info.nasl");
  script_require_keys("Host/OracleLinux", "Host/RedHat/release", "Host/RedHat/rpm-list", "Host/local_checks_enabled");

  exit(0);
}


include('rpm2.inc');
include('ksplice.inc');

if (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
var os_product = get_kb_item('installed_os/local/SSH/0/product');
if (isnull(os_product) || !pregmatch(pattern: "Oracle (?:Linux Server|Enterprise Linux)", string:os_product)) audit(AUDIT_OS_NOT, 'Oracle Linux');
var os_version = get_kb_item('installed_os/local/SSH/0/version');
if (isnull(os_version)) audit(AUDIT_UNKNOWN_APP_VER, 'Oracle Linux');
if (! preg(pattern:"^9([^0-9]|$)", string:os_version)) audit(AUDIT_OS_NOT, 'Oracle Linux 9.x', 'Oracle Linux ' + os_version);

if (!get_kb_item('Host/RedHat/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('x86_64' >!< cpu && cpu !~ "^i[3-6]86$" && 'aarch64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'Oracle Linux', cpu);

var machine_uptrack_level = get_one_kb_item('Host/livepatch-kernel-version');
var livepatch_source = get_one_kb_item('Host/livepatch-kernel-source');
if (empty_or_null(livepatch_source)) livepatch_source = 'KSplice';

if (machine_uptrack_level)
{
  var trimmed_uptrack_level = ereg_replace(string:machine_uptrack_level, pattern:"\.(x86_64|i[3-6]86|aarch64)$", replace:'');
  var fixed_uptrack_levels = ['5.14.0-687.47.1.el9_8'];
  foreach var fixed_uptrack_level ( fixed_uptrack_levels ) {
    if (rpm_spec_vers_cmp(a:trimmed_uptrack_level, b:fixed_uptrack_level) >= 0)
    {
      audit(AUDIT_PATCH_INSTALLED, livepatch_source + ' hotfix for ELSA-2026-671500');
    }
  }
  __rpm_report = 'Running ' + livepatch_source + ' level of ' + trimmed_uptrack_level + ' does not meet the minimum fixed level of ' + join(fixed_uptrack_levels, sep:' / ') + ' for this advisory.\n\n';
}

var kernel_major_minor = get_kb_item('Host/uname/major_minor');
if (empty_or_null(kernel_major_minor)) exit(1, 'Unable to determine kernel major-minor level.');
var expected_kernel_major_minor = '5.14';
if (kernel_major_minor != expected_kernel_major_minor)
  audit(AUDIT_OS_NOT, 'running kernel level ' + expected_kernel_major_minor + ', it is running kernel level ' + kernel_major_minor);

var constraints = [
  {
    'release': '9',
    'pkgs': [
      {'reference':'kernel-cross-headers-5.14.0-687.47.1.el9_8', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-headers-5.14.0-687.47.1.el9_8', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-tools-5.14.0-687.47.1.el9_8', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-tools-libs-5.14.0-687.47.1.el9_8', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-tools-libs-devel-5.14.0-687.47.1.el9_8', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'libperf-5.14.0-687.47.1.el9_8', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'perf-5.14.0-687.47.1.el9_8', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'python3-perf-5.14.0-687.47.1.el9_8', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'rtla-5.14.0-687.47.1.el9_8', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'rv-5.14.0-687.47.1.el9_8', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-5.14.0-687.47.1.el9_8', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-abi-stablelists-5.14.0-687.47.1.el9_8', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-core-5.14.0-687.47.1.el9_8', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-cross-headers-5.14.0-687.47.1.el9_8', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-debug-5.14.0-687.47.1.el9_8', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-debug-core-5.14.0-687.47.1.el9_8', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-debug-devel-5.14.0-687.47.1.el9_8', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-debug-devel-matched-5.14.0-687.47.1.el9_8', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-debug-modules-5.14.0-687.47.1.el9_8', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-debug-modules-core-5.14.0-687.47.1.el9_8', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-debug-modules-extra-5.14.0-687.47.1.el9_8', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-debug-uki-virt-5.14.0-687.47.1.el9_8', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-devel-5.14.0-687.47.1.el9_8', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-devel-matched-5.14.0-687.47.1.el9_8', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-headers-5.14.0-687.47.1.el9_8', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-modules-5.14.0-687.47.1.el9_8', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-modules-core-5.14.0-687.47.1.el9_8', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-modules-extra-5.14.0-687.47.1.el9_8', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-tools-5.14.0-687.47.1.el9_8', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-tools-libs-5.14.0-687.47.1.el9_8', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-tools-libs-devel-5.14.0-687.47.1.el9_8', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-uki-virt-5.14.0-687.47.1.el9_8', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-uki-virt-addons-5.14.0-687.47.1.el9_8', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'libperf-5.14.0-687.47.1.el9_8', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'perf-5.14.0-687.47.1.el9_8', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'python3-perf-5.14.0-687.47.1.el9_8', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'rtla-5.14.0-687.47.1.el9_8', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'rv-5.14.0-687.47.1.el9_8', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE}
    ]
  }
];

var os_release = get_one_kb_item('installed_os/local/SSH/0/release');
var os_sp = get_one_kb_item('Host/*/minor_release');

var flag = 0;
var reference;
var sp;
var _cpu;
var el_string;
var rpm_spec_vers_cmp;
var epoch;
var allowmaj;
var exists_check;
var cves;
foreach var constraint ( constraints ) {
  # Check that the target release is equal to the affected release
  if (!empty_or_null(constraint['release'])){
    if (constraint['release'] != os_release) continue;
  }
  if (!empty_or_null(constraint['sp'])){
    if (constraint['sp'] != os_sp) continue;
  }
  foreach var pkg ( constraint['pkgs'] ) {
    reference = NULL;
    sp = NULL;
    _cpu = NULL;
    el_string = NULL;
    rpm_spec_vers_cmp = NULL;
    epoch = NULL;
    allowmaj = NULL;
    exists_check = NULL;
    cves = NULL;
    if (!empty_or_null(pkg['reference'])) reference = pkg['reference'];
    if (!empty_or_null(pkg['sp'])) sp = pkg['sp'];
    if (!empty_or_null(pkg['cpu'])) _cpu = pkg['cpu'];
    if (!empty_or_null(pkg['el_string'])) el_string = pkg['el_string'];
    if (!empty_or_null(pkg['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = pkg['rpm_spec_vers_cmp'];
    if (!empty_or_null(pkg['epoch'])) epoch = pkg['epoch'];
    if (!empty_or_null(pkg['allowmaj'])) allowmaj = pkg['allowmaj'];
    if (!empty_or_null(pkg['exists_check'])) exists_check = pkg['exists_check'];
    if (!empty_or_null(pkg['cves'])) cves = pkg['cves'];
    if (reference &&
        ## (no known rpm to check OR known rpm_exists)
        (!exists_check || rpm_exists(rpm:exists_check)) &&
        rpm_check(sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj, cves:cves)) flag++;
  }
}

if (flag)
{
  security_report_v4(
      port       : 0,
      severity   : SECURITY_WARNING,
      extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'kernel / kernel-abi-stablelists / kernel-core / etc');
}