CentOS Linux 8.5 [TuxCare] Security Update: bpftool / kernel / kernel-core / kernel-cross-headers / etc Multiple Vulnerabilities (CENTOS8.5:CLSA-2026:1783414155)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(351793);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/09/30");

  script_cve_id(
    "CVE-2021-47379",
    "CVE-2023-39189",
    "CVE-2025-38004",
    "CVE-2025-38728",
    "CVE-2025-71089",
    "CVE-2026-23397",
    "CVE-2026-31527",
    "CVE-2026-43037",
    "CVE-2026-43038",
    "CVE-2026-43088",
    "CVE-2026-46113"
  );
  script_xref(name:"CLSA", value:"2026:1783414155");

  script_name(english:"CentOS Linux 8.5 [TuxCare] Security Update: bpftool / kernel / kernel-core / kernel-cross-headers / etc Multiple Vulnerabilities (CENTOS8.5:CLSA-2026:1783414155)");

  script_set_attribute(attribute:"synopsis", value:
"The CentOS Linux host is missing one or more security updates.");
  script_set_attribute(attribute:"description", value:
"The CentOS Linux 8.5 host has packages installed that are affected by multiple vulnerabilities as referenced in the
TuxCare CENTOS8.5:CLSA-2026:1783414155 advisory.

  - In the Linux kernel, the following vulnerability has been resolved: blk-cgroup: fix UAF by grabbing blkcg
    lock before destroying blkg pd KASAN reports a use-after-free report when doing fuzz test: [693354.104835]
    ================================================================== [693354.105094] BUG: KASAN: use-after-
    free in bfq_io_set_weight_legacy+0xd3/0x160 [693354.105336] Read of size 4 at addr ffff888be0a35664 by
    task sh/1453338 [693354.105607] CPU: 41 PID: 1453338 Comm: sh Kdump: loaded Not tainted 4.18.0-147
    [693354.105610] Hardware name: Huawei 2288H V5/BC11SPSCB0, BIOS 0.81 07/02/2018 [693354.105612] Call
    Trace: [693354.105621] dump_stack+0xf1/0x19b [693354.105626] ? show_regs_print_info+0x5/0x5
    [693354.105634] ? printk+0x9c/0xc3 [693354.105638] ? cpumask_weight+0x1f/0x1f [693354.105648]
    print_address_description+0x70/0x360 [693354.105654] kasan_report+0x1b2/0x330 [693354.105659] ?
    bfq_io_set_weight_legacy+0xd3/0x160 [693354.105665] ? bfq_io_set_weight_legacy+0xd3/0x160 [693354.105670]
    bfq_io_set_weight_legacy+0xd3/0x160 [693354.105675] ? bfq_cpd_init+0x20/0x20 [693354.105683]
    cgroup_file_write+0x3aa/0x510 [693354.105693] ? ___slab_alloc+0x507/0x540 [693354.105698] ?
    cgroup_file_poll+0x60/0x60 [693354.105702] ? 0xffffffff89600000 [693354.105708] ? usercopy_abort+0x90/0x90
    [693354.105716] ? mutex_lock+0xef/0x180 [693354.105726] kernfs_fop_write+0x1ab/0x280 [693354.105732] ?
    cgroup_file_poll+0x60/0x60 [693354.105738] vfs_write+0xe7/0x230 [693354.105744] ksys_write+0xb0/0x140
    [693354.105749] ? __ia32_sys_read+0x50/0x50 [693354.105760] do_syscall_64+0x112/0x370 [693354.105766] ?
    syscall_return_slowpath+0x260/0x260 [693354.105772] ? do_page_fault+0x9b/0x270 [693354.105779] ?
    prepare_exit_to_usermode+0xf9/0x1a0 [693354.105784] ? enter_from_user_mode+0x30/0x30 [693354.105793]
    entry_SYSCALL_64_after_hwframe+0x65/0xca [693354.105875] Allocated by task 1453337: [693354.106001]
    kasan_kmalloc+0xa0/0xd0 [693354.106006] kmem_cache_alloc_node_trace+0x108/0x220 [693354.106010]
    bfq_pd_alloc+0x96/0x120 [693354.106015] blkcg_activate_policy+0x1b7/0x2b0 [693354.106020]
    bfq_create_group_hierarchy+0x1e/0x80 [693354.106026] bfq_init_queue+0x678/0x8c0 [693354.106031]
    blk_mq_init_sched+0x1f8/0x460 [693354.106037] elevator_switch_mq+0xe1/0x240 [693354.106041]
    elevator_switch+0x25/0x40 [693354.106045] elv_iosched_store+0x1a1/0x230 [693354.106049]
    queue_attr_store+0x78/0xb0 [693354.106053] kernfs_fop_write+0x1ab/0x280 [693354.106056]
    vfs_write+0xe7/0x230 [693354.106060] ksys_write+0xb0/0x140 [693354.106064] do_syscall_64+0x112/0x370
    [693354.106069] entry_SYSCALL_64_after_hwframe+0x65/0xca [693354.106114] Freed by task 1453336:
    [693354.106225] __kasan_slab_free+0x130/0x180 [693354.106229] kfree+0x90/0x1b0 [693354.106233]
    blkcg_deactivate_policy+0x12c/0x220 [693354.106238] bfq_exit_queue+0xf5/0x110 [693354.106241]
    blk_mq_exit_sched+0x104/0x130 [693354.106245] __elevator_exit+0x45/0x60 [693354.106249]
    elevator_switch_mq+0xd6/0x240 [693354.106253] elevator_switch+0x25/0x40 [693354.106257]
    elv_iosched_store+0x1a1/0x230 [693354.106261] queue_attr_store+0x78/0xb0 [693354.106264]
    kernfs_fop_write+0x1ab/0x280 [693354.106268] vfs_write+0xe7/0x230 [693354.106271] ksys_write+0xb0/0x140
    [693354.106275] do_syscall_64+0x112/0x370 [693354.106280] entry_SYSCALL_64_after_hwframe+0x65/0xca
    [693354.106329] The buggy address belongs to the object at ffff888be0a35580 which belongs to the cache
    kmalloc-1k of size 1024 [693354.106736] The buggy address is located 228 bytes inside of 1024-byte region
    [ffff888be0a35580, ffff888be0a35980) [693354.107114] The buggy address belongs to the page:
    [693354.107273] page:ffffea002f828c00 count:1 mapcount:0 mapping:ffff888107c17080 index:0x0
    compound_mapcount: 0 [693354.107606] flags: 0x17ffffc0008100(slab|head) [693354.107760] raw:
    0017ffffc0008100 ffffea002fcbc808 ffffea0030bd3a08 ffff888107c17080 [693354.108020] r ---truncated---
    (CVE-2021-47379)

  - A flaw was found in the Netfilter subsystem in the Linux kernel. The nfnl_osf_add_callback function did
    not validate the user mode controlled opt_num field. This flaw allows a local privileged (CAP_NET_ADMIN)
    attacker to trigger an out-of-bounds read, leading to a crash or information disclosure. (CVE-2023-39189)

  - In the Linux kernel, the following vulnerability has been resolved: can: bcm: add locking for bcm_op
    runtime updates The CAN broadcast manager (CAN BCM) can send a sequence of CAN frames via hrtimer. The
    content and also the length of the sequence can be changed resp reduced at runtime where the 'currframe'
    counter is then set to zero. Although this appeared to be a safe operation the updates of 'currframe' can
    be triggered from user space and hrtimer context in bcm_can_tx(). Anderson Nascimento created a proof of
    concept that triggered a KASAN slab-out-of-bounds read access which can be prevented with a spin_lock_bh.
    At the rework of bcm_can_tx() the 'count' variable has been moved into the protected section as this
    variable can be modified from both contexts too. (CVE-2025-38004)

  - In the Linux kernel, the following vulnerability has been resolved: smb3: fix for slab out of bounds on
    mount to ksmbd With KASAN enabled, it is possible to get a slab out of bounds during mount to ksmbd due to
    missing check in parse_server_interfaces() (see below): BUG: KASAN: slab-out-of-bounds in
    parse_server_interfaces+0x14ee/0x1880 [cifs] Read of size 4 at addr ffff8881433dba98 by task mount/9827
    CPU: 5 UID: 0 PID: 9827 Comm: mount Tainted: G OE 6.16.0-rc2-kasan #2 PREEMPT(voluntary) Tainted:
    [O]=OOT_MODULE, [E]=UNSIGNED_MODULE Hardware name: Dell Inc. Precision Tower 3620/0MWYPT, BIOS 2.13.1
    06/14/2019 Call Trace: <TASK> dump_stack_lvl+0x9f/0xf0 print_report+0xd1/0x670
    __virt_addr_valid+0x22c/0x430 ? parse_server_interfaces+0x14ee/0x1880 [cifs] ?
    kasan_complete_mode_report_info+0x2a/0x1f0 ? parse_server_interfaces+0x14ee/0x1880 [cifs]
    kasan_report+0xd6/0x110 parse_server_interfaces+0x14ee/0x1880 [cifs]
    __asan_report_load_n_noabort+0x13/0x20 parse_server_interfaces+0x14ee/0x1880 [cifs] ?
    __pfx_parse_server_interfaces+0x10/0x10 [cifs] ? trace_hardirqs_on+0x51/0x60
    SMB3_request_interfaces+0x1ad/0x3f0 [cifs] ? __pfx_SMB3_request_interfaces+0x10/0x10 [cifs] ?
    SMB2_tcon+0x23c/0x15d0 [cifs] smb3_qfs_tcon+0x173/0x2b0 [cifs] ? __pfx_smb3_qfs_tcon+0x10/0x10 [cifs] ?
    cifs_get_tcon+0x105d/0x2120 [cifs] ? do_raw_spin_unlock+0x5d/0x200 ? cifs_get_tcon+0x105d/0x2120 [cifs] ?
    __pfx_smb3_qfs_tcon+0x10/0x10 [cifs] cifs_mount_get_tcon+0x369/0xb90 [cifs] ? dfs_cache_find+0xe7/0x150
    [cifs] dfs_mount_share+0x985/0x2970 [cifs] ? check_path.constprop.0+0x28/0x50 ? save_trace+0x54/0x370 ?
    __pfx_dfs_mount_share+0x10/0x10 [cifs] ? __lock_acquire+0xb82/0x2ba0 ? __kasan_check_write+0x18/0x20
    cifs_mount+0xbc/0x9e0 [cifs] ? __pfx_cifs_mount+0x10/0x10 [cifs] ? do_raw_spin_unlock+0x5d/0x200 ?
    cifs_setup_cifs_sb+0x29d/0x810 [cifs] cifs_smb3_do_mount+0x263/0x1990 [cifs] (CVE-2025-38728)

  - In the Linux kernel, the following vulnerability has been resolved: iommu: disable SVA when CONFIG_X86 is
    set Patch series Fix stale IOTLB entries for kernel address space, v7. This proposes a fix for a
    security vulnerability related to IOMMU Shared Virtual Addressing (SVA). In an SVA context, an IOMMU can
    cache kernel page table entries. When a kernel page table page is freed and reallocated for another
    purpose, the IOMMU might still hold stale, incorrect entries. This can be exploited to cause a use-after-
    free or write-after-free condition, potentially leading to privilege escalation or data corruption. This
    solution introduces a deferred freeing mechanism for kernel page table pages, which provides a safe window
    to notify the IOMMU to invalidate its caches before the page is reused. This patch (of 8): In the IOMMU
    Shared Virtual Addressing (SVA) context, the IOMMU hardware shares and walks the CPU's page tables. The
    x86 architecture maps the kernel's virtual address space into the upper portion of every process's page
    table. Consequently, in an SVA context, the IOMMU hardware can walk and cache kernel page table entries.
    The Linux kernel currently lacks a notification mechanism for kernel page table changes, specifically when
    page table pages are freed and reused. The IOMMU driver is only notified of changes to user virtual
    address mappings. This can cause the IOMMU's internal caches to retain stale entries for kernel VA. Use-
    After-Free (UAF) and Write-After-Free (WAF) conditions arise when kernel page table pages are freed and
    later reallocated. The IOMMU could misinterpret the new data as valid page table entries. The IOMMU might
    then walk into attacker-controlled memory, leading to arbitrary physical memory DMA access or privilege
    escalation. This is also a Write-After-Free issue, as the IOMMU will potentially continue to write
    Accessed and Dirty bits to the freed memory while attempting to walk the stale page tables. Currently, SVA
    contexts are unprivileged and cannot access kernel mappings. However, the IOMMU will still walk kernel-
    only page tables all the way down to the leaf entries, where it realizes the mapping is for the kernel and
    errors out. This means the IOMMU still caches these intermediate page table entries, making the described
    vulnerability a real concern. Disable SVA on x86 architecture until the IOMMU can receive notification to
    flush the paging cache before freeing the CPU kernel page table pages. (CVE-2025-71089)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  # https://security.tuxcare.com/csaf/v2/els_os/centos8.5els/advisories/2026/clsa-2026_1783414155.json
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?9788eab8");
  script_set_attribute(attribute:"see_also", value:"https://cve.tuxcare.com/els/releases/CLSA-2026:1783414155");
  script_set_attribute(attribute:"solution", value:
"Update the affected packages based on the guidance in TuxCare advisory CENTOS8.5:CLSA-2026:1783414155.");
  script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:S/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-31527");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");
  script_set_attribute(attribute:"vendor_severity", value:"Important");

  script_set_attribute(attribute:"vuln_publication_date", value:"2021/07/21");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/07/07");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/09/30");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"CentOS Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info2.nasl");
  script_require_keys("Host/OS/extended-third-party", "Host/local_checks_enabled", "Host/CentOS/release", "Host/CentOS/rpm-list");

  exit(0);
}
include('rpm2.inc');

var third_party_support = get_kb_item('Host/OS/extended-third-party');
if (empty_or_null(third_party_support) || third_party_support != 'TuxCare') exit(0, 'TuxCare support not enabled.');

if (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
var os_product = get_kb_item('installed_os/local/SSH/0/product');
if (isnull(os_product) || 'CentOS Linux' >!< os_product) audit(AUDIT_OS_NOT, 'CentOS Linux');
var os_version = get_kb_item('installed_os/local/SSH/0/version');
if (isnull(os_version)) audit(AUDIT_UNKNOWN_APP_VER, 'CentOS Linux');
if (! preg(pattern:"^8.5([^0-9]|$)", string:os_version)) audit(AUDIT_OS_NOT, 'CentOS Linux 8.5', 'CentOS Linux ' + os_version);

if (!get_kb_item('Host/CentOS/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('x86_64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'CentOS Linux', cpu);


var constraints = [
  {
    'release': '8',
    'sp': '5',
    'pkgs': [
      {'reference':'bpftool-4.18.0-348.7.1.el8_5.tuxcare.els43', 'sp':'5', 'cpu':'x86_64', 'el_string':'el8_5', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-4.18.0-348.7.1.el8_5.tuxcare.els43', 'sp':'5', 'cpu':'x86_64', 'el_string':'el8_5', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-core-4.18.0-348.7.1.el8_5.tuxcare.els43', 'sp':'5', 'cpu':'x86_64', 'el_string':'el8_5', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-cross-headers-4.18.0-348.7.1.el8_5.tuxcare.els43', 'sp':'5', 'cpu':'x86_64', 'el_string':'el8_5', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-debug-4.18.0-348.7.1.el8_5.tuxcare.els43', 'sp':'5', 'cpu':'x86_64', 'el_string':'el8_5', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-debug-core-4.18.0-348.7.1.el8_5.tuxcare.els43', 'sp':'5', 'cpu':'x86_64', 'el_string':'el8_5', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-debug-devel-4.18.0-348.7.1.el8_5.tuxcare.els43', 'sp':'5', 'cpu':'x86_64', 'el_string':'el8_5', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-debug-modules-4.18.0-348.7.1.el8_5.tuxcare.els43', 'sp':'5', 'cpu':'x86_64', 'el_string':'el8_5', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-debug-modules-extra-4.18.0-348.7.1.el8_5.tuxcare.els43', 'sp':'5', 'cpu':'x86_64', 'el_string':'el8_5', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-debug-modules-internal-4.18.0-348.7.1.el8_5.tuxcare.els43', 'sp':'5', 'cpu':'x86_64', 'el_string':'el8_5', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-devel-4.18.0-348.7.1.el8_5.tuxcare.els43', 'sp':'5', 'cpu':'x86_64', 'el_string':'el8_5', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-headers-4.18.0-348.7.1.el8_5.tuxcare.els43', 'sp':'5', 'cpu':'x86_64', 'el_string':'el8_5', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-ipaclones-internal-4.18.0-348.7.1.el8_5.tuxcare.els43', 'sp':'5', 'cpu':'x86_64', 'el_string':'el8_5', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-modules-4.18.0-348.7.1.el8_5.tuxcare.els43', 'sp':'5', 'cpu':'x86_64', 'el_string':'el8_5', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-modules-extra-4.18.0-348.7.1.el8_5.tuxcare.els43', 'sp':'5', 'cpu':'x86_64', 'el_string':'el8_5', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-modules-internal-4.18.0-348.7.1.el8_5.tuxcare.els43', 'sp':'5', 'cpu':'x86_64', 'el_string':'el8_5', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-selftests-internal-4.18.0-348.7.1.el8_5.tuxcare.els43', 'sp':'5', 'cpu':'x86_64', 'el_string':'el8_5', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-tools-4.18.0-348.7.1.el8_5.tuxcare.els43', 'sp':'5', 'cpu':'x86_64', 'el_string':'el8_5', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-tools-libs-4.18.0-348.7.1.el8_5.tuxcare.els43', 'sp':'5', 'cpu':'x86_64', 'el_string':'el8_5', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-tools-libs-devel-4.18.0-348.7.1.el8_5.tuxcare.els43', 'sp':'5', 'cpu':'x86_64', 'el_string':'el8_5', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'perf-4.18.0-348.7.1.el8_5.tuxcare.els43', 'sp':'5', 'cpu':'x86_64', 'el_string':'el8_5', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'python3-perf-4.18.0-348.7.1.el8_5.tuxcare.els43', 'sp':'5', 'cpu':'x86_64', 'el_string':'el8_5', 'rpm_spec_vers_cmp':TRUE}
    ]
  }
];

var os_release = get_one_kb_item('installed_os/local/SSH/0/release');
var os_sp = get_one_kb_item('Host/*/minor_release');

var flag = 0;
var reference;
var sp;
var _cpu;
var el_string;
var rpm_spec_vers_cmp;
var epoch;
var allowmaj;
var exists_check;
var cves;
foreach var constraint ( constraints ) {
  # Check that the target release is equal to the affected release
  if (!empty_or_null(constraint['release'])){
    if (constraint['release'] != os_release) continue;
  }
  if (!empty_or_null(constraint['sp'])){
    if (constraint['sp'] != os_sp) continue;
  }
  foreach var pkg ( constraint['pkgs'] ) {
    reference = NULL;
    sp = NULL;
    _cpu = NULL;
    el_string = NULL;
    rpm_spec_vers_cmp = NULL;
    epoch = NULL;
    allowmaj = NULL;
    exists_check = NULL;
    cves = NULL;
    if (!empty_or_null(pkg['reference'])) reference = pkg['reference'];
    if (!empty_or_null(pkg['sp'])) sp = pkg['sp'];
    if (!empty_or_null(pkg['cpu'])) _cpu = pkg['cpu'];
    if (!empty_or_null(pkg['el_string'])) el_string = pkg['el_string'];
    if (!empty_or_null(pkg['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = pkg['rpm_spec_vers_cmp'];
    if (!empty_or_null(pkg['epoch'])) epoch = pkg['epoch'];
    if (!empty_or_null(pkg['allowmaj'])) allowmaj = pkg['allowmaj'];
    if (!empty_or_null(pkg['exists_check'])) exists_check = pkg['exists_check'];
    if (!empty_or_null(pkg['cves'])) cves = pkg['cves'];
    if (reference &&
        ## (no known rpm to check OR known rpm_exists)
        (!exists_check || rpm_exists(rpm:exists_check)) &&
        rpm_check(sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj, cves:cves)) flag++;
  }
}


if (flag)
{
  security_report_v4(
      port       : 0,
      severity   : SECURITY_WARNING,
      extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'bpftool / kernel / kernel-core / kernel-cross-headers / etc');
}