AlmaLinux 9.2 [TuxCare] Security Update: bpftool / kernel / kernel-abi-stablelists / kernel-core / etc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1789898700)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(360912);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/10/01");

  script_cve_id(
    "CVE-2022-49296",
    "CVE-2022-50255",
    "CVE-2023-52615",
    "CVE-2023-52982",
    "CVE-2023-54164",
    "CVE-2023-54258",
    "CVE-2024-36909",
    "CVE-2024-36949",
    "CVE-2024-47728",
    "CVE-2024-53230",
    "CVE-2024-56703",
    "CVE-2024-57898",
    "CVE-2025-21918",
    "CVE-2025-37795",
    "CVE-2025-37844",
    "CVE-2025-38120",
    "CVE-2025-38304",
    "CVE-2025-38510",
    "CVE-2025-38587",
    "CVE-2025-39865",
    "CVE-2025-39944",
    "CVE-2025-39977",
    "CVE-2025-40018",
    "CVE-2025-40085",
    "CVE-2025-40111",
    "CVE-2025-40237",
    "CVE-2025-40281",
    "CVE-2025-68229",
    "CVE-2025-68261",
    "CVE-2025-68337",
    "CVE-2025-68782",
    "CVE-2025-68788",
    "CVE-2026-23151",
    "CVE-2026-23272",
    "CVE-2026-23391",
    "CVE-2026-23457",
    "CVE-2026-31454",
    "CVE-2026-31533",
    "CVE-2026-31566",
    "CVE-2026-31665",
    "CVE-2026-31673",
    "CVE-2026-43024",
    "CVE-2026-43041",
    "CVE-2026-43065",
    "CVE-2026-43091",
    "CVE-2026-43201",
    "CVE-2026-43406",
    "CVE-2026-43407",
    "CVE-2026-45843",
    "CVE-2026-45870",
    "CVE-2026-45873",
    "CVE-2026-45919",
    "CVE-2026-46050",
    "CVE-2026-46051",
    "CVE-2026-46071",
    "CVE-2026-46102",
    "CVE-2026-46146",
    "CVE-2026-46173",
    "CVE-2026-46196",
    "CVE-2026-46253",
    "CVE-2026-46303",
    "CVE-2026-52921",
    "CVE-2026-52929",
    "CVE-2026-53035",
    "CVE-2026-53048",
    "CVE-2026-53184",
    "CVE-2026-53225",
    "CVE-2026-53229",
    "CVE-2026-53270",
    "CVE-2026-53349",
    "CVE-2026-53352",
    "CVE-2026-53357",
    "CVE-2026-63884",
    "CVE-2026-63968",
    "CVE-2026-64299",
    "CVE-2026-64303",
    "CVE-2026-64304",
    "CVE-2026-64305",
    "CVE-2026-64306",
    "CVE-2026-64313",
    "CVE-2026-64317",
    "CVE-2026-64320",
    "CVE-2026-64322",
    "CVE-2026-64323",
    "CVE-2026-64329",
    "CVE-2026-64330",
    "CVE-2026-64334",
    "CVE-2026-64335",
    "CVE-2026-64336",
    "CVE-2026-64340",
    "CVE-2026-64341",
    "CVE-2026-64343",
    "CVE-2026-64344",
    "CVE-2026-64348",
    "CVE-2026-64352",
    "CVE-2026-64355",
    "CVE-2026-64370",
    "CVE-2026-64374",
    "CVE-2026-64375",
    "CVE-2026-64380",
    "CVE-2026-64381",
    "CVE-2026-64403",
    "CVE-2026-64408",
    "CVE-2026-64411",
    "CVE-2026-64412",
    "CVE-2026-64422",
    "CVE-2026-64423",
    "CVE-2026-64435",
    "CVE-2026-64436",
    "CVE-2026-64448",
    "CVE-2026-64450",
    "CVE-2026-64563",
    "CVE-2026-68202",
    "CVE-2026-68251",
    "CVE-2026-68294",
    "CVE-2026-68336",
    "CVE-2026-68365",
    "CVE-2026-68376",
    "CVE-2026-68391",
    "CVE-2026-72125",
    "CVE-2026-72126",
    "CVE-2026-72389",
    "CVE-2026-72438",
    "CVE-2026-72472",
    "CVE-2026-74470",
    "CVE-2026-74556",
    "CVE-2026-74565",
    "CVE-2026-74580",
    "CVE-2026-74582",
    "CVE-2026-74587",
    "CVE-2026-74588",
    "CVE-2026-74589",
    "CVE-2026-74597",
    "CVE-2026-74599",
    "CVE-2026-74604",
    "CVE-2026-74609",
    "CVE-2026-74621",
    "CVE-2026-74630",
    "CVE-2026-74641",
    "CVE-2026-74656",
    "CVE-2026-74660",
    "CVE-2026-74667",
    "CVE-2026-74669",
    "CVE-2026-74672",
    "CVE-2026-74682",
    "CVE-2026-74688",
    "CVE-2026-74689",
    "CVE-2026-74700",
    "CVE-2026-74704",
    "CVE-2026-74705",
    "CVE-2026-74714",
    "CVE-2026-74720",
    "CVE-2026-74725",
    "CVE-2026-74730",
    "CVE-2026-74744",
    "CVE-2026-74746",
    "CVE-2026-74752",
    "CVE-2026-80529",
    "CVE-2026-80536",
    "CVE-2026-80558",
    "CVE-2026-80576",
    "CVE-2026-80725",
    "CVE-2026-89555"
  );
  script_xref(name:"CLSA", value:"2026:1789898700");

  script_name(english:"AlmaLinux 9.2 [TuxCare] Security Update: bpftool / kernel / kernel-abi-stablelists / kernel-core / etc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1789898700)");

  script_set_attribute(attribute:"synopsis", value:
"The AlmaLinux host is missing one or more security updates.");
  script_set_attribute(attribute:"description", value:
"The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare
ALMALINUX9.2:CLSA-2026:1789898700 advisory.

  - In the Linux kernel, the following vulnerability has been resolved: ceph: fix possible deadlock when
    holding Fwb to get inline_data 1, mount with wsync. 2, create a file with O_RDWR, and the request was sent
    to mds.0: ceph_atomic_open()--> ceph_mdsc_do_request(openc) finish_open(file, dentry, ceph_open)-->
    ceph_open()--> ceph_init_file()--> ceph_init_file_info()--> ceph_uninline_data()--> { ... if
    (inline_version == 1 || /* initial version, no data */ inline_version == CEPH_INLINE_NONE) goto
    out_unlock; ... } The inline_version will be 1, which is the initial version for the new create file. And
    here the ci->i_inline_version will keep with 1, it's buggy. 3, buffer write to the file immediately:
    ceph_write_iter()--> ceph_get_caps(file, need=Fw, want=Fb, ...); generic_perform_write()-->
    a_ops->write_begin()--> ceph_write_begin()--> netfs_write_begin()--> netfs_begin_read()-->
    netfs_rreq_submit_slice()--> netfs_read_from_server()--> rreq->netfs_ops->issue_read()-->
    ceph_netfs_issue_read()--> { ... if (ci->i_inline_version != CEPH_INLINE_NONE &&
    ceph_netfs_issue_op_inline(subreq)) return; ... } ceph_put_cap_refs(ci, Fwb); The
    ceph_netfs_issue_op_inline() will send a getattr(Fsr) request to mds.1. 4, then the mds.1 will request the
    rd lock for CInode::filelock from the auth mds.0, the mds.0 will do the CInode::filelock state transation
    from excl --> sync, but it need to revoke the Fxwb caps back from the clients. While the kernel client has
    aleady held the Fwb caps and waiting for the getattr(Fsr). It's deadlock! URL:
    https://tracker.ceph.com/issues/55377 (CVE-2022-49296)

  - In the Linux kernel, the following vulnerability has been resolved: tracing: Fix reading strings from
    synthetic events The follow commands caused a crash: # cd /sys/kernel/tracing # echo 's:open char file[]'
    > dynamic_events # echo 'hist:keys=common_pid:file=filename:onchange($file).trace(open,$file)' >
    events/syscalls/sys_enter_openat/trigger' # echo 1 > events/synthetic/open/enable BOOM! The problem is
    that the synthetic event field char file[] will read the value given to it as a string without any
    memory checks to make sure the address is valid. The above example will pass in the user space address and
    the sythetic event code will happily call strlen() on it and then strscpy() where either one will cause an
    oops when accessing user space addresses. Use the helper functions from trace_kprobe and trace_eprobe that
    can read strings safely (and actually succeed when the address is from user space and the memory is mapped
    in). Now the above can show: packagekitd-1721 [000] ...2. 104.597170: open:
    file=/usr/lib/rpm/fileattrs/cmake.attr in:imjournal-978 [006] ...2. 104.599642: open:
    file=/var/lib/rsyslog/imjournal.state.tmp packagekitd-1721 [000] ...2. 104.626308: open:
    file=/usr/lib/rpm/fileattrs/debuginfo.attr (CVE-2022-50255)

  - In the Linux kernel, the following vulnerability has been resolved: hwrng: core - Fix page fault dead lock
    on mmap-ed hwrng There is a dead-lock in the hwrng device read path. This triggers when the user reads
    from /dev/hwrng into memory also mmap-ed from /dev/hwrng. The resulting page fault triggers a recursive
    read which then dead-locks. Fix this by using a stack buffer when calling copy_to_user. (CVE-2023-52615)

  - In the Linux kernel, the following vulnerability has been resolved: fscache: Use wait_on_bit() to wait for
    the freeing of relinquished volume The freeing of relinquished volume will wake up the pending volume
    acquisition by using wake_up_bit(), however it is mismatched with wait_var_event() used in
    fscache_wait_on_volume_collision() and it will never wake up the waiter in the wait-queue because these
    two functions operate on different wait-queues. According to the implementation in
    fscache_wait_on_volume_collision(), if the wake-up of pending acquisition is delayed longer than 20
    seconds (e.g., due to the delay of on-demand fd closing), the first wait_var_event_timeout() will timeout
    and the following wait_var_event() will hang forever as shown below: FS-Cache: Potential volume collision
    new=00000024 old=00000022 ...... INFO: task mount:1148 blocked for more than 122 seconds. Not tainted
    6.1.0-rc6+ #1 task:mount state:D stack:0 pid:1148 ppid:1 Call Trace: <TASK> __schedule+0x2f6/0xb80
    schedule+0x67/0xe0 fscache_wait_on_volume_collision.cold+0x80/0x82 __fscache_acquire_volume+0x40d/0x4e0
    erofs_fscache_register_volume+0x51/0xe0 [erofs] erofs_fscache_register_fs+0x19c/0x240 [erofs]
    erofs_fc_fill_super+0x746/0xaf0 [erofs] vfs_get_super+0x7d/0x100 get_tree_nodev+0x16/0x20
    erofs_fc_get_tree+0x20/0x30 [erofs] vfs_get_tree+0x24/0xb0 path_mount+0x2fa/0xa90 do_mount+0x7c/0xa0
    __x64_sys_mount+0x8b/0xe0 do_syscall_64+0x30/0x60 entry_SYSCALL_64_after_hwframe+0x46/0xb0 Considering
    that wake_up_bit() is more selective, so fix it by using wait_on_bit() instead of wait_var_event() to wait
    for the freeing of relinquished volume. In addition because waitqueue_active() is used in wake_up_bit()
    and clear_bit() doesn't imply any memory barrier, use clear_and_wake_up_bit() to add the missing memory
    barrier between cursor->flags and waitqueue_active(). (CVE-2023-52982)

  - In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: fix iso_conn related
    locking and validity issues sk->sk_state indicates whether iso_pi(sk)->conn is valid. Operations that
    check/update sk_state and access conn should hold lock_sock, otherwise they can race. The order of taking
    locks is hci_dev_lock > lock_sock > iso_conn_lock, which is how it is in connect/disconnect_cfm ->
    iso_conn_del -> iso_chan_del. Fix locking in iso_connect_cis/bis and sendmsg/recvmsg to take lock_sock
    around updating sk_state and conn. iso_conn_del must not occur during iso_connect_cis/bis, as it frees the
    iso_conn. Hold hdev->lock longer to prevent that. This should not reintroduce the issue fixed in commit
    241f51931c35 (Bluetooth: ISO: Avoid circular locking dependency), since the we acquire locks in order.
    We retain the fix in iso_sock_connect to release lock_sock before iso_connect_* acquires hdev->lock.
    Similarly for commit 6a5ad251b7cd (Bluetooth: ISO: Fix possible circular locking dependency). We retain
    the fix in iso_conn_ready to not acquire iso_conn_lock before lock_sock. iso_conn_add shall return
    iso_conn with valid hcon. Make it so also when reusing an old CIS connection waiting for disconnect
    timeout (see __iso_sock_close where conn->hcon is set to NULL). Trace with iso_conn_del after iso_chan_add
    in iso_connect_cis: =============================================================== iso_sock_create:771:
    sock 00000000be9b69b7 iso_sock_init:693: sk 000000004dff667e iso_sock_bind:827: sk 000000004dff667e
    70:1a:b8:98:ff:a2 type 1 iso_sock_setsockopt:1289: sk 000000004dff667e iso_sock_setsockopt:1289: sk
    000000004dff667e iso_sock_setsockopt:1289: sk 000000004dff667e iso_sock_connect:875: sk 000000004dff667e
    iso_connect_cis:353: 70:1a:b8:98:ff:a2 -> 28:3d:c2:4a:7e:da hci_get_route:1199: 70:1a:b8:98:ff:a2 ->
    28:3d:c2:4a:7e:da hci_conn_add:1005: hci0 dst 28:3d:c2:4a:7e:da iso_conn_add:140: hcon 000000007b65d182
    conn 00000000daf8625e __iso_chan_add:214: conn 00000000daf8625e iso_connect_cfm:1700: hcon
    000000007b65d182 bdaddr 28:3d:c2:4a:7e:da status 12 iso_conn_del:187: hcon 000000007b65d182 conn
    00000000daf8625e, err 16 iso_sock_clear_timer:117: sock 000000004dff667e state 3 <Note: sk_state is
    BT_BOUND (3), so iso_connect_cis is still running at this point> iso_chan_del:153: sk 000000004dff667e,
    conn 00000000daf8625e, err 16 hci_conn_del:1151: hci0 hcon 000000007b65d182 handle 65535
    hci_conn_unlink:1102: hci0: hcon 000000007b65d182 hci_chan_list_flush:2780: hcon 000000007b65d182
    iso_sock_getsockopt:1376: sk 000000004dff667e iso_sock_getname:1070: sock 00000000be9b69b7, sk
    000000004dff667e iso_sock_getname:1070: sock 00000000be9b69b7, sk 000000004dff667e
    iso_sock_getsockopt:1376: sk 000000004dff667e iso_sock_getname:1070: sock 00000000be9b69b7, sk
    000000004dff667e iso_sock_getname:1070: sock 00000000be9b69b7, sk 000000004dff667e iso_sock_shutdown:1434:
    sock 00000000be9b69b7, sk 000000004dff667e, how 1 __iso_sock_close:632: sk 000000004dff667e state 5 socket
    00000000be9b69b7 <Note: sk_state is BT_CONNECT (5), even though iso_chan_del sets BT_CLOSED (6). Only
    iso_connect_cis sets it to BT_CONNECT, so it must be that iso_chan_del occurred between iso_chan_add and
    end of iso_connect_cis.> BUG: kernel NULL pointer dereference, address: 0000000000000000 PGD
    8000000006467067 P4D 8000000006467067 PUD 3f5f067 PMD 0 Oops: 0000 [#1] PREEMPT SMP PTI Hardware name:
    QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-1.fc38 04/01/2014 RIP: 0010:__iso_sock_close
    (net/bluetooth/iso.c:664) bluetooth =============================================================== Trace
    with iso_conn_del before iso_chan_add in iso_connect_cis:
    =============================================================== iso_connect_cis:356: 70:1a:b8:98:ff:a2 ->
    28:3d:c2:4a:7e:da ... iso_conn_add:140: hcon 0000000093bc551f conn 00000000768ae504 hci_dev_put:1487: hci0
    orig refcnt 21 hci_event_packet:7607: hci0: e ---truncated--- (CVE-2023-54164)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  # https://security.tuxcare.com/csaf/v2/els_os/almalinux9.2esu/advisories/2026/clsa-2026_1789898700.json
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?0eca2f76");
  script_set_attribute(attribute:"see_also", value:"https://cve.tuxcare.com/els/releases/CLSA-2026:1789898700");
  script_set_attribute(attribute:"solution", value:
"Update the affected packages based on the guidance in TuxCare advisory ALMALINUX9.2:CLSA-2026:1789898700.");
  script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:S/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-64381");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");
  script_set_attribute(attribute:"vendor_severity", value:"Critical");

  script_set_attribute(attribute:"vuln_publication_date", value:"2021/07/21");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/09/20");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/10/01");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Alma Linux Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info2.nasl");
  script_require_keys("Host/OS/extended-third-party", "Host/local_checks_enabled", "Host/AlmaLinux/release", "Host/AlmaLinux/rpm-list", "Host/cpu");

  exit(0);
}
include('rpm2.inc');

var third_party_support = get_kb_item('Host/OS/extended-third-party');
if (empty_or_null(third_party_support) || third_party_support != 'TuxCare') exit(0, 'TuxCare support not enabled.');

if (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
var os_product = get_kb_item('installed_os/local/SSH/0/product');
if (isnull(os_product) || 'AlmaLinux' >!< os_product) audit(AUDIT_OS_NOT, 'AlmaLinux');
var os_version = get_kb_item('installed_os/local/SSH/0/version');
if (isnull(os_version)) audit(AUDIT_UNKNOWN_APP_VER, 'AlmaLinux');
if (! preg(pattern:"^9.2([^0-9]|$)", string:os_version)) audit(AUDIT_OS_NOT, 'AlmaLinux 9.2', 'AlmaLinux ' + os_version);

if (!get_kb_item('Host/AlmaLinux/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if (cpu !~ "^i[3-6]86$" && 'x86_64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'AlmaLinux', cpu);


var constraints = [
  {
    'release': '9',
    'sp': '2',
    'pkgs': [
      {'reference':'bpftool-7.0.0-284.1101.el9_2.tuxcare.11.els14', 'sp':'2', 'cpu':'x86_64', 'el_string':'el9_2', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-5.14.0-284.1101.el9_2.tuxcare.11.els14', 'sp':'2', 'cpu':'x86_64', 'el_string':'el9_2', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-abi-stablelists-5.14.0-284.1101.el9_2.tuxcare.11.els14', 'sp':'2', 'el_string':'el9_2', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-core-5.14.0-284.1101.el9_2.tuxcare.11.els14', 'sp':'2', 'cpu':'x86_64', 'el_string':'el9_2', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-cross-headers-5.14.0-284.1101.el9_2.tuxcare.11.els14', 'sp':'2', 'cpu':'x86_64', 'el_string':'el9_2', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-debug-5.14.0-284.1101.el9_2.tuxcare.11.els14', 'sp':'2', 'cpu':'x86_64', 'el_string':'el9_2', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-debug-core-5.14.0-284.1101.el9_2.tuxcare.11.els14', 'sp':'2', 'cpu':'x86_64', 'el_string':'el9_2', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-debug-devel-5.14.0-284.1101.el9_2.tuxcare.11.els14', 'sp':'2', 'cpu':'x86_64', 'el_string':'el9_2', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-debug-devel-matched-5.14.0-284.1101.el9_2.tuxcare.11.els14', 'sp':'2', 'cpu':'x86_64', 'el_string':'el9_2', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-debug-modules-5.14.0-284.1101.el9_2.tuxcare.11.els14', 'sp':'2', 'cpu':'x86_64', 'el_string':'el9_2', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-debug-modules-core-5.14.0-284.1101.el9_2.tuxcare.11.els14', 'sp':'2', 'cpu':'x86_64', 'el_string':'el9_2', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-debug-modules-extra-5.14.0-284.1101.el9_2.tuxcare.11.els14', 'sp':'2', 'cpu':'x86_64', 'el_string':'el9_2', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-debug-modules-internal-5.14.0-284.1101.el9_2.tuxcare.11.els14', 'sp':'2', 'cpu':'x86_64', 'el_string':'el9_2', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-debug-modules-partner-5.14.0-284.1101.el9_2.tuxcare.11.els14', 'sp':'2', 'cpu':'x86_64', 'el_string':'el9_2', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-debug-uki-virt-5.14.0-284.1101.el9_2.tuxcare.11.els14', 'sp':'2', 'cpu':'x86_64', 'el_string':'el9_2', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-devel-5.14.0-284.1101.el9_2.tuxcare.11.els14', 'sp':'2', 'cpu':'x86_64', 'el_string':'el9_2', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-devel-matched-5.14.0-284.1101.el9_2.tuxcare.11.els14', 'sp':'2', 'cpu':'x86_64', 'el_string':'el9_2', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-headers-5.14.0-284.1101.el9_2.tuxcare.11.els14', 'sp':'2', 'cpu':'x86_64', 'el_string':'el9_2', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-ipaclones-internal-5.14.0-284.1101.el9_2.tuxcare.11.els14', 'sp':'2', 'cpu':'x86_64', 'el_string':'el9_2', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-modules-5.14.0-284.1101.el9_2.tuxcare.11.els14', 'sp':'2', 'cpu':'x86_64', 'el_string':'el9_2', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-modules-core-5.14.0-284.1101.el9_2.tuxcare.11.els14', 'sp':'2', 'cpu':'x86_64', 'el_string':'el9_2', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-modules-extra-5.14.0-284.1101.el9_2.tuxcare.11.els14', 'sp':'2', 'cpu':'x86_64', 'el_string':'el9_2', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-modules-internal-5.14.0-284.1101.el9_2.tuxcare.11.els14', 'sp':'2', 'cpu':'x86_64', 'el_string':'el9_2', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-modules-partner-5.14.0-284.1101.el9_2.tuxcare.11.els14', 'sp':'2', 'cpu':'x86_64', 'el_string':'el9_2', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-selftests-internal-5.14.0-284.1101.el9_2.tuxcare.11.els14', 'sp':'2', 'cpu':'x86_64', 'el_string':'el9_2', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-tools-5.14.0-284.1101.el9_2.tuxcare.11.els14', 'sp':'2', 'cpu':'x86_64', 'el_string':'el9_2', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-tools-libs-5.14.0-284.1101.el9_2.tuxcare.11.els14', 'sp':'2', 'cpu':'x86_64', 'el_string':'el9_2', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-tools-libs-devel-5.14.0-284.1101.el9_2.tuxcare.11.els14', 'sp':'2', 'cpu':'x86_64', 'el_string':'el9_2', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-uki-virt-5.14.0-284.1101.el9_2.tuxcare.11.els14', 'sp':'2', 'cpu':'x86_64', 'el_string':'el9_2', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'libbpf-1.0.0-2.el9_2.tuxcare.11.els14', 'sp':'2', 'cpu':'i686', 'el_string':'el9_2', 'rpm_spec_vers_cmp':TRUE, 'epoch':'2'},
      {'reference':'libbpf-1.0.0-2.el9_2.tuxcare.11.els14', 'sp':'2', 'cpu':'x86_64', 'el_string':'el9_2', 'rpm_spec_vers_cmp':TRUE, 'epoch':'2'},
      {'reference':'libbpf-devel-1.0.0-2.el9_2.tuxcare.11.els14', 'sp':'2', 'cpu':'i686', 'el_string':'el9_2', 'rpm_spec_vers_cmp':TRUE, 'epoch':'2'},
      {'reference':'libbpf-devel-1.0.0-2.el9_2.tuxcare.11.els14', 'sp':'2', 'cpu':'x86_64', 'el_string':'el9_2', 'rpm_spec_vers_cmp':TRUE, 'epoch':'2'},
      {'reference':'libbpf-static-1.0.0-2.el9_2.tuxcare.11.els14', 'sp':'2', 'cpu':'i686', 'el_string':'el9_2', 'rpm_spec_vers_cmp':TRUE, 'epoch':'2'},
      {'reference':'libbpf-static-1.0.0-2.el9_2.tuxcare.11.els14', 'sp':'2', 'cpu':'x86_64', 'el_string':'el9_2', 'rpm_spec_vers_cmp':TRUE, 'epoch':'2'},
      {'reference':'perf-5.14.0-284.1101.el9_2.tuxcare.11.els14', 'sp':'2', 'cpu':'x86_64', 'el_string':'el9_2', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'python3-perf-5.14.0-284.1101.el9_2.tuxcare.11.els14', 'sp':'2', 'cpu':'x86_64', 'el_string':'el9_2', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'rtla-5.14.0-284.1101.el9_2.tuxcare.11.els14', 'sp':'2', 'cpu':'x86_64', 'el_string':'el9_2', 'rpm_spec_vers_cmp':TRUE}
    ]
  }
];

var os_release = get_one_kb_item('installed_os/local/SSH/0/release');
var os_sp = get_one_kb_item('Host/*/minor_release');

var flag = 0;
var reference;
var sp;
var _cpu;
var el_string;
var rpm_spec_vers_cmp;
var epoch;
var allowmaj;
var exists_check;
var cves;
foreach var constraint ( constraints ) {
  # Check that the target release is equal to the affected release
  if (!empty_or_null(constraint['release'])){
    if (constraint['release'] != os_release) continue;
  }
  if (!empty_or_null(constraint['sp'])){
    if (constraint['sp'] != os_sp) continue;
  }
  foreach var pkg ( constraint['pkgs'] ) {
    reference = NULL;
    sp = NULL;
    _cpu = NULL;
    el_string = NULL;
    rpm_spec_vers_cmp = NULL;
    epoch = NULL;
    allowmaj = NULL;
    exists_check = NULL;
    cves = NULL;
    if (!empty_or_null(pkg['reference'])) reference = pkg['reference'];
    if (!empty_or_null(pkg['sp'])) sp = pkg['sp'];
    if (!empty_or_null(pkg['cpu'])) _cpu = pkg['cpu'];
    if (!empty_or_null(pkg['el_string'])) el_string = pkg['el_string'];
    if (!empty_or_null(pkg['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = pkg['rpm_spec_vers_cmp'];
    if (!empty_or_null(pkg['epoch'])) epoch = pkg['epoch'];
    if (!empty_or_null(pkg['allowmaj'])) allowmaj = pkg['allowmaj'];
    if (!empty_or_null(pkg['exists_check'])) exists_check = pkg['exists_check'];
    if (!empty_or_null(pkg['cves'])) cves = pkg['cves'];
    if (reference &&
        ## (no known rpm to check OR known rpm_exists)
        (!exists_check || rpm_exists(rpm:exists_check)) &&
        rpm_check(sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj, cves:cves)) flag++;
  }
}


if (flag)
{
  security_report_v4(
      port       : 0,
      severity   : SECURITY_WARNING,
      extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'bpftool / kernel / kernel-abi-stablelists / kernel-core / etc');
}