AlmaLinux 9.2 [TuxCare] Security Update: bpftool / kernel / kernel-abi-stablelists / kernel-core / etc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1787935638)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(361746);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/10/01");

  script_cve_id(
    "CVE-2021-46923",
    "CVE-2022-48706",
    "CVE-2022-48768",
    "CVE-2022-48879",
    "CVE-2022-49030",
    "CVE-2023-52515",
    "CVE-2023-52910",
    "CVE-2023-52913",
    "CVE-2023-53582",
    "CVE-2024-43854",
    "CVE-2024-49948",
    "CVE-2024-50039",
    "CVE-2024-56720",
    "CVE-2025-21673",
    "CVE-2025-38264",
    "CVE-2025-40048",
    "CVE-2025-54518",
    "CVE-2025-68815",
    "CVE-2026-23007",
    "CVE-2026-23278",
    "CVE-2026-31392",
    "CVE-2026-31393",
    "CVE-2026-31530",
    "CVE-2026-31679",
    "CVE-2026-43060",
    "CVE-2026-43062",
    "CVE-2026-43071",
    "CVE-2026-43187",
    "CVE-2026-43469",
    "CVE-2026-43501",
    "CVE-2026-45838",
    "CVE-2026-45839",
    "CVE-2026-45840",
    "CVE-2026-45841",
    "CVE-2026-45842",
    "CVE-2026-45847",
    "CVE-2026-45850",
    "CVE-2026-45856",
    "CVE-2026-45857",
    "CVE-2026-45886",
    "CVE-2026-45948",
    "CVE-2026-45964",
    "CVE-2026-45983",
    "CVE-2026-45987",
    "CVE-2026-46015",
    "CVE-2026-46018",
    "CVE-2026-46021",
    "CVE-2026-46023",
    "CVE-2026-46040",
    "CVE-2026-46049",
    "CVE-2026-46056",
    "CVE-2026-46082",
    "CVE-2026-46088",
    "CVE-2026-46101",
    "CVE-2026-46108",
    "CVE-2026-46119",
    "CVE-2026-46128",
    "CVE-2026-46132",
    "CVE-2026-46151",
    "CVE-2026-46161",
    "CVE-2026-46167",
    "CVE-2026-46172",
    "CVE-2026-46177",
    "CVE-2026-46184",
    "CVE-2026-46189",
    "CVE-2026-46191",
    "CVE-2026-46197",
    "CVE-2026-46218",
    "CVE-2026-46220",
    "CVE-2026-46234",
    "CVE-2026-46249",
    "CVE-2026-46259",
    "CVE-2026-46294",
    "CVE-2026-52920",
    "CVE-2026-52935",
    "CVE-2026-52947",
    "CVE-2026-52948",
    "CVE-2026-52955",
    "CVE-2026-52957",
    "CVE-2026-52962",
    "CVE-2026-52963",
    "CVE-2026-52969",
    "CVE-2026-52970",
    "CVE-2026-52972",
    "CVE-2026-52985",
    "CVE-2026-52993",
    "CVE-2026-53002",
    "CVE-2026-53012",
    "CVE-2026-53016",
    "CVE-2026-53022",
    "CVE-2026-53037",
    "CVE-2026-53064",
    "CVE-2026-53072",
    "CVE-2026-53075",
    "CVE-2026-53080",
    "CVE-2026-53093",
    "CVE-2026-53135",
    "CVE-2026-53136",
    "CVE-2026-53168",
    "CVE-2026-53176",
    "CVE-2026-53177",
    "CVE-2026-53181",
    "CVE-2026-53195",
    "CVE-2026-53196",
    "CVE-2026-53212",
    "CVE-2026-53218",
    "CVE-2026-53219",
    "CVE-2026-53223",
    "CVE-2026-53227",
    "CVE-2026-53228",
    "CVE-2026-53238",
    "CVE-2026-53239",
    "CVE-2026-53245",
    "CVE-2026-53249",
    "CVE-2026-53254",
    "CVE-2026-53255",
    "CVE-2026-53256",
    "CVE-2026-53263",
    "CVE-2026-53268",
    "CVE-2026-53269",
    "CVE-2026-53287",
    "CVE-2026-53295",
    "CVE-2026-53304",
    "CVE-2026-53337",
    "CVE-2026-53391",
    "CVE-2026-63800",
    "CVE-2026-63945",
    "CVE-2026-64174",
    "CVE-2026-64225",
    "CVE-2026-64237",
    "CVE-2026-64572",
    "CVE-2026-64576",
    "CVE-2026-64579",
    "CVE-2026-68093",
    "CVE-2026-68108",
    "CVE-2026-68121",
    "CVE-2026-68142",
    "CVE-2026-68143",
    "CVE-2026-68153",
    "CVE-2026-68155",
    "CVE-2026-68156",
    "CVE-2026-68160",
    "CVE-2026-68188",
    "CVE-2026-68189",
    "CVE-2026-68313",
    "CVE-2026-68315",
    "CVE-2026-68320",
    "CVE-2026-68324",
    "CVE-2026-68363",
    "CVE-2026-68377",
    "CVE-2026-68388",
    "CVE-2026-68398",
    "CVE-2026-68402",
    "CVE-2026-68414",
    "CVE-2026-68426",
    "CVE-2026-72396",
    "CVE-2026-74499"
  );
  script_xref(name:"CLSA", value:"2026:1787935638");

  script_name(english:"AlmaLinux 9.2 [TuxCare] Security Update: bpftool / kernel / kernel-abi-stablelists / kernel-core / etc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1787935638)");

  script_set_attribute(attribute:"synopsis", value:
"The AlmaLinux host is missing one or more security updates.");
  script_set_attribute(attribute:"description", value:
"The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare
ALMALINUX9.2:CLSA-2026:1787935638 advisory.

  - In the Linux kernel, the following vulnerability has been resolved: fs/mount_setattr: always cleanup
    mount_kattr Make sure that finish_mount_kattr() is called after mount_kattr was succesfully built in both
    the success and failure case to prevent leaking any references we took when we built it. We returned early
    if path lookup failed thereby risking to leak an additional reference we took when building mount_kattr
    when an idmapped mount was requested. (CVE-2021-46923)

  - In the Linux kernel, the following vulnerability has been resolved: vdpa: ifcvf: Do proper cleanup if
    IFCVF init fails ifcvf_mgmt_dev leaks memory if it is not freed before returning. Call is made to correct
    return statement so memory does not leak. ifcvf_init_hw does not take care of this so it is needed to do
    it here. (CVE-2022-48706)

  - In the Linux kernel, the following vulnerability has been resolved: tracing/histogram: Fix a potential
    memory leak for kstrdup() kfree() is missing on an error path to free the memory allocated by kstrdup(): p
    = param = kstrdup(data->params[i], GFP_KERNEL); So it is better to free it via kfree(p). (CVE-2022-48768)

  - In the Linux kernel, the following vulnerability has been resolved: efi: fix NULL-deref in init error path
    In cases where runtime services are not supported or have been disabled, the runtime services workqueue
    will never have been allocated. Do not try to destroy the workqueue unconditionally in the unlikely event
    that EFI initialisation fails to avoid dereferencing a NULL pointer. (CVE-2022-48879)

  - In the Linux kernel, the following vulnerability has been resolved: RDMA/srp: Do not call scsi_done() from
    srp_abort() After scmd_eh_abort_handler() has called the SCSI LLD eh_abort_handler callback, it performs
    one of the following actions: * Call scsi_queue_insert(). * Call scsi_finish_command(). * Call
    scsi_eh_scmd_add(). Hence, SCSI abort handlers must not call scsi_done(). Otherwise all the above actions
    would trigger a use-after-free. Hence remove the scsi_done() call from srp_abort(). Keep the
    srp_free_req() call before returning SUCCESS because we may not see the command again if SUCCESS is
    returned. (CVE-2023-52515)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  # https://security.tuxcare.com/csaf/v2/els_os/almalinux9.2esu/advisories/2026/clsa-2026_1787935638.json
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?05e487ee");
  script_set_attribute(attribute:"see_also", value:"https://cve.tuxcare.com/els/releases/CLSA-2026:1787935638");
  script_set_attribute(attribute:"solution", value:
"Update the affected packages based on the guidance in TuxCare advisory ALMALINUX9.2:CLSA-2026:1787935638.");
  script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
  script_set_attribute(attribute:"cvss4_vector", value:"CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N");
  script_set_attribute(attribute:"cvss4_threat_vector", value:"CVSS:4.0/E:P");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-53196");
  script_set_attribute(attribute:"cvss3_score_source", value:"CVE-2026-64225");
  script_set_attribute(attribute:"cvss4_score_source", value:"CVE-2025-54518");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");
  script_set_attribute(attribute:"vendor_severity", value:"Important");

  script_set_attribute(attribute:"vuln_publication_date", value:"2021/07/21");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/08/28");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/10/01");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Alma Linux Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info2.nasl");
  script_require_keys("Host/OS/extended-third-party", "Host/local_checks_enabled", "Host/AlmaLinux/release", "Host/AlmaLinux/rpm-list", "Host/cpu");

  exit(0);
}
include('rpm2.inc');

var third_party_support = get_kb_item('Host/OS/extended-third-party');
if (empty_or_null(third_party_support) || third_party_support != 'TuxCare') exit(0, 'TuxCare support not enabled.');

if (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
var os_product = get_kb_item('installed_os/local/SSH/0/product');
if (isnull(os_product) || 'AlmaLinux' >!< os_product) audit(AUDIT_OS_NOT, 'AlmaLinux');
var os_version = get_kb_item('installed_os/local/SSH/0/version');
if (isnull(os_version)) audit(AUDIT_UNKNOWN_APP_VER, 'AlmaLinux');
if (! preg(pattern:"^9.2([^0-9]|$)", string:os_version)) audit(AUDIT_OS_NOT, 'AlmaLinux 9.2', 'AlmaLinux ' + os_version);

if (!get_kb_item('Host/AlmaLinux/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if (cpu !~ "^i[3-6]86$" && 'x86_64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'AlmaLinux', cpu);


var constraints = [
  {
    'release': '9',
    'sp': '2',
    'pkgs': [
      {'reference':'bpftool-7.0.0-284.1101.el9_2.tuxcare.11.els13', 'sp':'2', 'cpu':'x86_64', 'el_string':'el9_2', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-5.14.0-284.1101.el9_2.tuxcare.11.els13', 'sp':'2', 'cpu':'x86_64', 'el_string':'el9_2', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-abi-stablelists-5.14.0-284.1101.el9_2.tuxcare.11.els13', 'sp':'2', 'el_string':'el9_2', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-core-5.14.0-284.1101.el9_2.tuxcare.11.els13', 'sp':'2', 'cpu':'x86_64', 'el_string':'el9_2', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-cross-headers-5.14.0-284.1101.el9_2.tuxcare.11.els13', 'sp':'2', 'cpu':'x86_64', 'el_string':'el9_2', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-debug-5.14.0-284.1101.el9_2.tuxcare.11.els13', 'sp':'2', 'cpu':'x86_64', 'el_string':'el9_2', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-debug-core-5.14.0-284.1101.el9_2.tuxcare.11.els13', 'sp':'2', 'cpu':'x86_64', 'el_string':'el9_2', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-debug-devel-5.14.0-284.1101.el9_2.tuxcare.11.els13', 'sp':'2', 'cpu':'x86_64', 'el_string':'el9_2', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-debug-devel-matched-5.14.0-284.1101.el9_2.tuxcare.11.els13', 'sp':'2', 'cpu':'x86_64', 'el_string':'el9_2', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-debug-modules-5.14.0-284.1101.el9_2.tuxcare.11.els13', 'sp':'2', 'cpu':'x86_64', 'el_string':'el9_2', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-debug-modules-core-5.14.0-284.1101.el9_2.tuxcare.11.els13', 'sp':'2', 'cpu':'x86_64', 'el_string':'el9_2', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-debug-modules-extra-5.14.0-284.1101.el9_2.tuxcare.11.els13', 'sp':'2', 'cpu':'x86_64', 'el_string':'el9_2', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-debug-modules-internal-5.14.0-284.1101.el9_2.tuxcare.11.els13', 'sp':'2', 'cpu':'x86_64', 'el_string':'el9_2', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-debug-modules-partner-5.14.0-284.1101.el9_2.tuxcare.11.els13', 'sp':'2', 'cpu':'x86_64', 'el_string':'el9_2', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-debug-uki-virt-5.14.0-284.1101.el9_2.tuxcare.11.els13', 'sp':'2', 'cpu':'x86_64', 'el_string':'el9_2', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-devel-5.14.0-284.1101.el9_2.tuxcare.11.els13', 'sp':'2', 'cpu':'x86_64', 'el_string':'el9_2', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-devel-matched-5.14.0-284.1101.el9_2.tuxcare.11.els13', 'sp':'2', 'cpu':'x86_64', 'el_string':'el9_2', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-headers-5.14.0-284.1101.el9_2.tuxcare.11.els13', 'sp':'2', 'cpu':'x86_64', 'el_string':'el9_2', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-ipaclones-internal-5.14.0-284.1101.el9_2.tuxcare.11.els13', 'sp':'2', 'cpu':'x86_64', 'el_string':'el9_2', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-modules-5.14.0-284.1101.el9_2.tuxcare.11.els13', 'sp':'2', 'cpu':'x86_64', 'el_string':'el9_2', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-modules-core-5.14.0-284.1101.el9_2.tuxcare.11.els13', 'sp':'2', 'cpu':'x86_64', 'el_string':'el9_2', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-modules-extra-5.14.0-284.1101.el9_2.tuxcare.11.els13', 'sp':'2', 'cpu':'x86_64', 'el_string':'el9_2', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-modules-internal-5.14.0-284.1101.el9_2.tuxcare.11.els13', 'sp':'2', 'cpu':'x86_64', 'el_string':'el9_2', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-modules-partner-5.14.0-284.1101.el9_2.tuxcare.11.els13', 'sp':'2', 'cpu':'x86_64', 'el_string':'el9_2', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-selftests-internal-5.14.0-284.1101.el9_2.tuxcare.11.els13', 'sp':'2', 'cpu':'x86_64', 'el_string':'el9_2', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-tools-5.14.0-284.1101.el9_2.tuxcare.11.els13', 'sp':'2', 'cpu':'x86_64', 'el_string':'el9_2', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-tools-libs-5.14.0-284.1101.el9_2.tuxcare.11.els13', 'sp':'2', 'cpu':'x86_64', 'el_string':'el9_2', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-tools-libs-devel-5.14.0-284.1101.el9_2.tuxcare.11.els13', 'sp':'2', 'cpu':'x86_64', 'el_string':'el9_2', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-uki-virt-5.14.0-284.1101.el9_2.tuxcare.11.els13', 'sp':'2', 'cpu':'x86_64', 'el_string':'el9_2', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'libbpf-1.0.0-2.el9_2.tuxcare.11.els13', 'sp':'2', 'cpu':'i686', 'el_string':'el9_2', 'rpm_spec_vers_cmp':TRUE, 'epoch':'2'},
      {'reference':'libbpf-1.0.0-2.el9_2.tuxcare.11.els13', 'sp':'2', 'cpu':'x86_64', 'el_string':'el9_2', 'rpm_spec_vers_cmp':TRUE, 'epoch':'2'},
      {'reference':'libbpf-devel-1.0.0-2.el9_2.tuxcare.11.els13', 'sp':'2', 'cpu':'i686', 'el_string':'el9_2', 'rpm_spec_vers_cmp':TRUE, 'epoch':'2'},
      {'reference':'libbpf-devel-1.0.0-2.el9_2.tuxcare.11.els13', 'sp':'2', 'cpu':'x86_64', 'el_string':'el9_2', 'rpm_spec_vers_cmp':TRUE, 'epoch':'2'},
      {'reference':'libbpf-static-1.0.0-2.el9_2.tuxcare.11.els13', 'sp':'2', 'cpu':'i686', 'el_string':'el9_2', 'rpm_spec_vers_cmp':TRUE, 'epoch':'2'},
      {'reference':'libbpf-static-1.0.0-2.el9_2.tuxcare.11.els13', 'sp':'2', 'cpu':'x86_64', 'el_string':'el9_2', 'rpm_spec_vers_cmp':TRUE, 'epoch':'2'},
      {'reference':'perf-5.14.0-284.1101.el9_2.tuxcare.11.els13', 'sp':'2', 'cpu':'x86_64', 'el_string':'el9_2', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'python3-perf-5.14.0-284.1101.el9_2.tuxcare.11.els13', 'sp':'2', 'cpu':'x86_64', 'el_string':'el9_2', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'rtla-5.14.0-284.1101.el9_2.tuxcare.11.els13', 'sp':'2', 'cpu':'x86_64', 'el_string':'el9_2', 'rpm_spec_vers_cmp':TRUE}
    ]
  }
];

var os_release = get_one_kb_item('installed_os/local/SSH/0/release');
var os_sp = get_one_kb_item('Host/*/minor_release');

var flag = 0;
var reference;
var sp;
var _cpu;
var el_string;
var rpm_spec_vers_cmp;
var epoch;
var allowmaj;
var exists_check;
var cves;
foreach var constraint ( constraints ) {
  # Check that the target release is equal to the affected release
  if (!empty_or_null(constraint['release'])){
    if (constraint['release'] != os_release) continue;
  }
  if (!empty_or_null(constraint['sp'])){
    if (constraint['sp'] != os_sp) continue;
  }
  foreach var pkg ( constraint['pkgs'] ) {
    reference = NULL;
    sp = NULL;
    _cpu = NULL;
    el_string = NULL;
    rpm_spec_vers_cmp = NULL;
    epoch = NULL;
    allowmaj = NULL;
    exists_check = NULL;
    cves = NULL;
    if (!empty_or_null(pkg['reference'])) reference = pkg['reference'];
    if (!empty_or_null(pkg['sp'])) sp = pkg['sp'];
    if (!empty_or_null(pkg['cpu'])) _cpu = pkg['cpu'];
    if (!empty_or_null(pkg['el_string'])) el_string = pkg['el_string'];
    if (!empty_or_null(pkg['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = pkg['rpm_spec_vers_cmp'];
    if (!empty_or_null(pkg['epoch'])) epoch = pkg['epoch'];
    if (!empty_or_null(pkg['allowmaj'])) allowmaj = pkg['allowmaj'];
    if (!empty_or_null(pkg['exists_check'])) exists_check = pkg['exists_check'];
    if (!empty_or_null(pkg['cves'])) cves = pkg['cves'];
    if (reference &&
        ## (no known rpm to check OR known rpm_exists)
        (!exists_check || rpm_exists(rpm:exists_check)) &&
        rpm_check(sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj, cves:cves)) flag++;
  }
}


if (flag)
{
  security_report_v4(
      port       : 0,
      severity   : SECURITY_HOLE,
      extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'bpftool / kernel / kernel-abi-stablelists / kernel-core / etc');
}