CentOS Linux 8 [TuxCare] Security Update: bpftool / kernel / kernel-core / kernel-cross-headers / etc Multiple Vulnerabilities (CENTOS-STREAM8:CLSA-2026:1784275029)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(352747);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/09/30");

  script_cve_id(
    "CVE-2022-49892",
    "CVE-2024-41069",
    "CVE-2024-58240",
    "CVE-2025-38004",
    "CVE-2025-39797",
    "CVE-2025-39905",
    "CVE-2026-22980"
  );
  script_xref(name:"CLSA", value:"2026:1784275029");

  script_name(english:"CentOS Linux 8 [TuxCare] Security Update: bpftool / kernel / kernel-core / kernel-cross-headers / etc Multiple Vulnerabilities (CENTOS-STREAM8:CLSA-2026:1784275029)");

  script_set_attribute(attribute:"synopsis", value:
"The CentOS Linux host is missing one or more security updates.");
  script_set_attribute(attribute:"description", value:
"The CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the
TuxCare CENTOS-STREAM8:CLSA-2026:1784275029 advisory.

  - In the Linux kernel, the following vulnerability has been resolved: ftrace: Fix use-after-free for dynamic
    ftrace_ops KASAN reported a use-after-free with ftrace ops [1]. It was found from vmcore that perf had
    registered two ops with the same content successively, both dynamic. After unregistering the second ops, a
    use-after-free occurred. In ftrace_shutdown(), when the second ops is unregistered, the
    FTRACE_UPDATE_CALLS command is not set because there is another enabled ops with the same content. Also,
    both ops are dynamic and the ftrace callback function is ftrace_ops_list_func, so the
    FTRACE_UPDATE_TRACE_FUNC command will not be set. Eventually the value of 'command' will be 0 and
    ftrace_shutdown() will skip the rcu synchronization. However, ftrace may be activated. When the ops is
    released, another CPU may be accessing the ops. Add the missing synchronization to fix this problem. [1]
    BUG: KASAN: use-after-free in __ftrace_ops_list_func kernel/trace/ftrace.c:7020 [inline] BUG: KASAN: use-
    after-free in ftrace_ops_list_func+0x2b0/0x31c kernel/trace/ftrace.c:7049 Read of size 8 at addr
    ffff56551965bbc8 by task syz-executor.2/14468 CPU: 1 PID: 14468 Comm: syz-executor.2 Not tainted 5.10.0 #7
    Hardware name: linux,dummy-virt (DT) Call trace: dump_backtrace+0x0/0x40c
    arch/arm64/kernel/stacktrace.c:132 show_stack+0x30/0x40 arch/arm64/kernel/stacktrace.c:196 __dump_stack
    lib/dump_stack.c:77 [inline] dump_stack+0x1b4/0x248 lib/dump_stack.c:118
    print_address_description.constprop.0+0x28/0x48c mm/kasan/report.c:387 __kasan_report
    mm/kasan/report.c:547 [inline] kasan_report+0x118/0x210 mm/kasan/report.c:564 check_memory_region_inline
    mm/kasan/generic.c:187 [inline] __asan_load8+0x98/0xc0 mm/kasan/generic.c:253 __ftrace_ops_list_func
    kernel/trace/ftrace.c:7020 [inline] ftrace_ops_list_func+0x2b0/0x31c kernel/trace/ftrace.c:7049
    ftrace_graph_call+0x0/0x4 __might_sleep+0x8/0x100 include/linux/perf_event.h:1170 __might_fault
    mm/memory.c:5183 [inline] __might_fault+0x58/0x70 mm/memory.c:5171 do_strncpy_from_user
    lib/strncpy_from_user.c:41 [inline] strncpy_from_user+0x1f4/0x4b0 lib/strncpy_from_user.c:139
    getname_flags+0xb0/0x31c fs/namei.c:149 getname+0x2c/0x40 fs/namei.c:209 [...] Allocated by task 14445:
    kasan_save_stack+0x24/0x50 mm/kasan/common.c:48 kasan_set_track mm/kasan/common.c:56 [inline]
    __kasan_kmalloc mm/kasan/common.c:479 [inline] __kasan_kmalloc.constprop.0+0x110/0x13c
    mm/kasan/common.c:449 kasan_kmalloc+0xc/0x14 mm/kasan/common.c:493 kmem_cache_alloc_trace+0x440/0x924
    mm/slub.c:2950 kmalloc include/linux/slab.h:563 [inline] kzalloc include/linux/slab.h:675 [inline]
    perf_event_alloc.part.0+0xb4/0x1350 kernel/events/core.c:11230 perf_event_alloc kernel/events/core.c:11733
    [inline] __do_sys_perf_event_open kernel/events/core.c:11831 [inline]
    __se_sys_perf_event_open+0x550/0x15f4 kernel/events/core.c:11723 __arm64_sys_perf_event_open+0x6c/0x80
    kernel/events/core.c:11723 [...] Freed by task 14445: kasan_save_stack+0x24/0x50 mm/kasan/common.c:48
    kasan_set_track+0x24/0x34 mm/kasan/common.c:56 kasan_set_free_info+0x20/0x40 mm/kasan/generic.c:358
    __kasan_slab_free.part.0+0x11c/0x1b0 mm/kasan/common.c:437 __kasan_slab_free mm/kasan/common.c:445
    [inline] kasan_slab_free+0x2c/0x40 mm/kasan/common.c:446 slab_free_hook mm/slub.c:1569 [inline]
    slab_free_freelist_hook mm/slub.c:1608 [inline] slab_free mm/slub.c:3179 [inline] kfree+0x12c/0xc10
    mm/slub.c:4176 perf_event_alloc.part.0+0xa0c/0x1350 kernel/events/core.c:11434 perf_event_alloc
    kernel/events/core.c:11733 [inline] __do_sys_perf_event_open kernel/events/core.c:11831 [inline]
    __se_sys_perf_event_open+0x550/0x15f4 kernel/events/core.c:11723 [...] (CVE-2022-49892)

  - In the Linux kernel, the following vulnerability has been resolved: ASoC: topology: Fix references to
    freed memory Most users after parsing a topology file, release memory used by it, so having pointer
    references directly into topology file contents is wrong. Use devm_kmemdup(), to allocate memory as
    needed. (CVE-2024-41069)

  - In the Linux kernel, the following vulnerability has been resolved: tls: separate no-async decryption
    request handling from async If we're not doing async, the handling is much simpler. There's no reference
    counting, we just need to wait for the completion to wake us up and return its result. We should
    preferably also use a separate crypto_wait. I'm not seeing a UAF as I did in the past, I think
    aec7961916f3 (tls: fix race between async notify and socket close) took care of it. This will make the
    next fix easier. (CVE-2024-58240)

  - In the Linux kernel, the following vulnerability has been resolved: can: bcm: add locking for bcm_op
    runtime updates The CAN broadcast manager (CAN BCM) can send a sequence of CAN frames via hrtimer. The
    content and also the length of the sequence can be changed resp reduced at runtime where the 'currframe'
    counter is then set to zero. Although this appeared to be a safe operation the updates of 'currframe' can
    be triggered from user space and hrtimer context in bcm_can_tx(). Anderson Nascimento created a proof of
    concept that triggered a KASAN slab-out-of-bounds read access which can be prevented with a spin_lock_bh.
    At the rework of bcm_can_tx() the 'count' variable has been moved into the protected section as this
    variable can be modified from both contexts too. (CVE-2025-38004)

  - In the Linux kernel, the following vulnerability has been resolved: xfrm: Duplicate SPI Handling The issue
    originates when Strongswan initiates an XFRM_MSG_ALLOCSPI Netlink message, which triggers the kernel
    function xfrm_alloc_spi(). This function is expected to ensure uniqueness of the Security Parameter Index
    (SPI) for inbound Security Associations (SAs). However, it can return success even when the requested SPI
    is already in use, leading to duplicate SPIs assigned to multiple inbound SAs, differentiated only by
    their destination addresses. This behavior causes inconsistencies during SPI lookups for inbound packets.
    Since the lookup may return an arbitrary SA among those with the same SPI, packet processing can fail,
    resulting in packet drops. According to RFC 4301 section 4.4.2 , for inbound processing a unicast SA is
    uniquely identified by the SPI and optionally protocol. Reproducing the Issue Reliably: To consistently
    reproduce the problem, restrict the available SPI range in charon.conf : spi_min = 0x10000000 spi_max =
    0x10000002 This limits the system to only 2 usable SPI values. Next, create more than 2 Child SA. each
    using unique pair of src/dst address. As soon as the 3rd Child SA is initiated, it will be assigned a
    duplicate SPI, since the SPI pool is already exhausted. With a narrow SPI range, the issue is consistently
    reproducible. With a broader/default range, it becomes rare and unpredictable. Current implementation:
    xfrm_spi_hash() lookup function computes hash using daddr, proto, and family. So if two SAs have the same
    SPI but different destination addresses, then they will: a. Hash into different buckets b. Be stored in
    different linked lists (byspi + h) c. Not be seen in the same hlist_for_each_entry_rcu() iteration. As a
    result, the lookup will result in NULL and kernel allows that Duplicate SPI Proposed Change:
    xfrm_state_lookup_spi_proto() does a truly global search - across all states, regardless of hash bucket
    and matches SPI and proto. (CVE-2025-39797)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  # https://security.tuxcare.com/csaf/v2/els_os/centos-stream8els/advisories/2026/clsa-2026_1784275029.json
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?2e3dd44c");
  script_set_attribute(attribute:"see_also", value:"https://cve.tuxcare.com/els/releases/CLSA-2026:1784275029");
  script_set_attribute(attribute:"solution", value:
"Update the affected packages based on the guidance in TuxCare advisory CENTOS-STREAM8:CLSA-2026:1784275029.");
  script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:S/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-22980");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");
  script_set_attribute(attribute:"vendor_severity", value:"Important");

  script_set_attribute(attribute:"vuln_publication_date", value:"2021/07/21");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/07/17");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/09/30");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"CentOS Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info2.nasl");
  script_require_keys("Host/OS/extended-third-party", "Host/local_checks_enabled", "Host/CentOS/release", "Host/CentOS/rpm-list");

  exit(0);
}
include('rpm2.inc');

var third_party_support = get_kb_item('Host/OS/extended-third-party');
if (empty_or_null(third_party_support) || third_party_support != 'TuxCare') exit(0, 'TuxCare support not enabled.');

if (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
var os_product = get_kb_item('installed_os/local/SSH/0/product');
if (isnull(os_product) || 'CentOS Linux' >!< os_product) audit(AUDIT_OS_NOT, 'CentOS Linux');
var os_version = get_kb_item('installed_os/local/SSH/0/version');
if (isnull(os_version)) audit(AUDIT_UNKNOWN_APP_VER, 'CentOS Linux');
if (! preg(pattern:"^8([^0-9]|$)", string:os_version)) audit(AUDIT_OS_NOT, 'CentOS Linux 8', 'CentOS Linux ' + os_version);

if (!get_kb_item('Host/CentOS/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('x86_64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'CentOS Linux', cpu);


var constraints = [
  {
    'release': '8',
    'pkgs': [
      {'reference':'bpftool-4.18.0-553.6.1.el8_10.tuxcare.els27', 'cpu':'x86_64', 'el_string':'el8_10', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-4.18.0-553.6.1.el8_10.tuxcare.els27', 'cpu':'x86_64', 'el_string':'el8_10', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-core-4.18.0-553.6.1.el8_10.tuxcare.els27', 'cpu':'x86_64', 'el_string':'el8_10', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-cross-headers-4.18.0-553.6.1.el8_10.tuxcare.els27', 'cpu':'x86_64', 'el_string':'el8_10', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-debug-4.18.0-553.6.1.el8_10.tuxcare.els27', 'cpu':'x86_64', 'el_string':'el8_10', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-debug-core-4.18.0-553.6.1.el8_10.tuxcare.els27', 'cpu':'x86_64', 'el_string':'el8_10', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-debug-devel-4.18.0-553.6.1.el8_10.tuxcare.els27', 'cpu':'x86_64', 'el_string':'el8_10', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-debug-modules-4.18.0-553.6.1.el8_10.tuxcare.els27', 'cpu':'x86_64', 'el_string':'el8_10', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-debug-modules-extra-4.18.0-553.6.1.el8_10.tuxcare.els27', 'cpu':'x86_64', 'el_string':'el8_10', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-debug-modules-internal-4.18.0-553.6.1.el8_10.tuxcare.els27', 'cpu':'x86_64', 'el_string':'el8_10', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-devel-4.18.0-553.6.1.el8_10.tuxcare.els27', 'cpu':'x86_64', 'el_string':'el8_10', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-headers-4.18.0-553.6.1.el8_10.tuxcare.els27', 'cpu':'x86_64', 'el_string':'el8_10', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-ipaclones-internal-4.18.0-553.6.1.el8_10.tuxcare.els27', 'cpu':'x86_64', 'el_string':'el8_10', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-modules-4.18.0-553.6.1.el8_10.tuxcare.els27', 'cpu':'x86_64', 'el_string':'el8_10', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-modules-extra-4.18.0-553.6.1.el8_10.tuxcare.els27', 'cpu':'x86_64', 'el_string':'el8_10', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-modules-internal-4.18.0-553.6.1.el8_10.tuxcare.els27', 'cpu':'x86_64', 'el_string':'el8_10', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-selftests-internal-4.18.0-553.6.1.el8_10.tuxcare.els27', 'cpu':'x86_64', 'el_string':'el8_10', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-tools-4.18.0-553.6.1.el8_10.tuxcare.els27', 'cpu':'x86_64', 'el_string':'el8_10', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-tools-libs-4.18.0-553.6.1.el8_10.tuxcare.els27', 'cpu':'x86_64', 'el_string':'el8_10', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-tools-libs-devel-4.18.0-553.6.1.el8_10.tuxcare.els27', 'cpu':'x86_64', 'el_string':'el8_10', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'perf-4.18.0-553.6.1.el8_10.tuxcare.els27', 'cpu':'x86_64', 'el_string':'el8_10', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'python3-perf-4.18.0-553.6.1.el8_10.tuxcare.els27', 'cpu':'x86_64', 'el_string':'el8_10', 'rpm_spec_vers_cmp':TRUE}
    ]
  }
];

var os_release = get_one_kb_item('installed_os/local/SSH/0/release');
var os_sp = get_one_kb_item('Host/*/minor_release');

var flag = 0;
var reference;
var sp;
var _cpu;
var el_string;
var rpm_spec_vers_cmp;
var epoch;
var allowmaj;
var exists_check;
var cves;
foreach var constraint ( constraints ) {
  # Check that the target release is equal to the affected release
  if (!empty_or_null(constraint['release'])){
    if (constraint['release'] != os_release) continue;
  }
  if (!empty_or_null(constraint['sp'])){
    if (constraint['sp'] != os_sp) continue;
  }
  foreach var pkg ( constraint['pkgs'] ) {
    reference = NULL;
    sp = NULL;
    _cpu = NULL;
    el_string = NULL;
    rpm_spec_vers_cmp = NULL;
    epoch = NULL;
    allowmaj = NULL;
    exists_check = NULL;
    cves = NULL;
    if (!empty_or_null(pkg['reference'])) reference = pkg['reference'];
    if (!empty_or_null(pkg['sp'])) sp = pkg['sp'];
    if (!empty_or_null(pkg['cpu'])) _cpu = pkg['cpu'];
    if (!empty_or_null(pkg['el_string'])) el_string = pkg['el_string'];
    if (!empty_or_null(pkg['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = pkg['rpm_spec_vers_cmp'];
    if (!empty_or_null(pkg['epoch'])) epoch = pkg['epoch'];
    if (!empty_or_null(pkg['allowmaj'])) allowmaj = pkg['allowmaj'];
    if (!empty_or_null(pkg['exists_check'])) exists_check = pkg['exists_check'];
    if (!empty_or_null(pkg['cves'])) cves = pkg['cves'];
    if (reference &&
        ## (no known rpm to check OR known rpm_exists)
        (!exists_check || rpm_exists(rpm:exists_check)) &&
        rpm_check(sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj, cves:cves)) flag++;
  }
}


if (flag)
{
  security_report_v4(
      port       : 0,
      severity   : SECURITY_WARNING,
      extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'bpftool / kernel / kernel-core / kernel-cross-headers / etc');
}