CentOS Linux 8 [TuxCare] Security Update: bpftool / kernel / kernel-core / kernel-cross-headers / etc Multiple Vulnerabilities (CENTOS-STREAM8:CLSA-2026:1786444011)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(352448);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/09/30");

  script_cve_id(
    "CVE-2021-47474",
    "CVE-2022-50384",
    "CVE-2023-53272",
    "CVE-2024-26589",
    "CVE-2024-39479",
    "CVE-2025-38239",
    "CVE-2025-38443",
    "CVE-2026-23277",
    "CVE-2026-43056",
    "CVE-2026-43133",
    "CVE-2026-43233",
    "CVE-2026-43334",
    "CVE-2026-43339",
    "CVE-2026-46234",
    "CVE-2026-53064",
    "CVE-2026-53112",
    "CVE-2026-53352",
    "CVE-2026-64561"
  );
  script_xref(name:"CLSA", value:"2026:1786444011");

  script_name(english:"CentOS Linux 8 [TuxCare] Security Update: bpftool / kernel / kernel-core / kernel-cross-headers / etc Multiple Vulnerabilities (CENTOS-STREAM8:CLSA-2026:1786444011)");

  script_set_attribute(attribute:"synopsis", value:
"The CentOS Linux host is missing one or more security updates.");
  script_set_attribute(attribute:"description", value:
"The CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the
TuxCare CENTOS-STREAM8:CLSA-2026:1786444011 advisory.

  - In the Linux kernel, the following vulnerability has been resolved: comedi: vmk80xx: fix bulk-buffer
    overflow The driver is using endpoint-sized buffers but must not assume that the tx and rx buffers are of
    equal size or a malicious device could overflow the slab-allocated receive buffer when doing bulk
    transfers. (CVE-2021-47474)

  - In the Linux kernel, the following vulnerability has been resolved: staging: vme_user: Fix possible UAF in
    tsi148_dma_list_add Smatch report warning as follows: drivers/staging/vme_user/vme_tsi148.c:1757
    tsi148_dma_list_add() warn: '&entry->list' not removed from list In tsi148_dma_list_add(), the error path
    goto err_dma will not remove entry->list from list->entries, but entry will be freed, then list
    traversal may cause UAF. Fix by removeing it from list->entries before free(). (CVE-2022-50384)

  - In the Linux kernel, the following vulnerability has been resolved: net: ena: fix shift-out-of-bounds in
    exponential backoff The ENA adapters on our instances occasionally reset. Once recently logged a UBSAN
    failure to console in the process: UBSAN: shift-out-of-bounds in
    build/linux/drivers/net/ethernet/amazon/ena/ena_com.c:540:13 shift exponent 32 is too large for 32-bit
    type 'unsigned int' CPU: 28 PID: 70012 Comm: kworker/u72:2 Kdump: loaded not tainted 5.15.117 Hardware
    name: Amazon EC2 c5d.9xlarge/, BIOS 1.0 10/16/2017 Workqueue: ena ena_fw_reset_device [ena] Call Trace:
    <TASK> dump_stack_lvl+0x4a/0x63 dump_stack+0x10/0x16 ubsan_epilogue+0x9/0x36
    __ubsan_handle_shift_out_of_bounds.cold+0x61/0x10e ? __const_udelay+0x43/0x50
    ena_delay_exponential_backoff_us.cold+0x16/0x1e [ena] wait_for_reset_state+0x54/0xa0 [ena]
    ena_com_dev_reset+0xc8/0x110 [ena] ena_down+0x3fe/0x480 [ena] ena_destroy_device+0xeb/0xf0 [ena]
    ena_fw_reset_device+0x30/0x50 [ena] process_one_work+0x22b/0x3d0 worker_thread+0x4d/0x3f0 ?
    process_one_work+0x3d0/0x3d0 kthread+0x12a/0x150 ? set_kthread_struct+0x50/0x50 ret_from_fork+0x22/0x30
    </TASK> Apparently, the reset delays are getting so large they can trigger a UBSAN panic. Looking at the
    code, the current timeout is capped at 5000us. Using a base value of 100us, the current code will overflow
    after (1<<29). Even at values before 32, this function wraps around, perhaps unintentionally. Cap the
    value of the exponent used for this backoff at (1<<16) which is larger than currently necessary, but large
    enough to support bigger values in the future. (CVE-2023-53272)

  - In the Linux kernel, the following vulnerability has been resolved: bpf: Reject variable offset alu on
    PTR_TO_FLOW_KEYS For PTR_TO_FLOW_KEYS, check_flow_keys_access() only uses fixed off for validation.
    However, variable offset ptr alu is not prohibited for this ptr kind. So the variable offset is not
    checked. The following prog is accepted: func#0 @0 0: R1=ctx() R10=fp0 0: (bf) r6 = r1 ; R1=ctx()
    R6_w=ctx() 1: (79) r7 = *(u64 *)(r6 +144) ; R6_w=ctx() R7_w=flow_keys() 2: (b7) r8 = 1024 ; R8_w=1024 3:
    (37) r8 /= 1 ; R8_w=scalar() 4: (57) r8 &= 1024 ; R8_w=scalar(smin=smin32=0,
    smax=umax=smax32=umax32=1024,var_off=(0x0; 0x400)) 5: (0f) r7 += r8 mark_precise: frame0: last_idx 5
    first_idx 0 subseq_idx -1 mark_precise: frame0: regs=r8 stack= before 4: (57) r8 &= 1024 mark_precise:
    frame0: regs=r8 stack= before 3: (37) r8 /= 1 mark_precise: frame0: regs=r8 stack= before 2: (b7) r8 =
    1024 6: R7_w=flow_keys(smin=smin32=0,smax=umax=smax32=umax32=1024,var_off =(0x0; 0x400))
    R8_w=scalar(smin=smin32=0,smax=umax=smax32=umax32=1024, var_off=(0x0; 0x400)) 6: (79) r0 = *(u64 *)(r7 +0)
    ; R0_w=scalar() 7: (95) exit This prog loads flow_keys to r7, and adds the variable offset r8 to r7, and
    finally causes out-of-bounds access: BUG: unable to handle page fault for address: ffffc90014c80038 [...]
    Call Trace: <TASK> bpf_dispatcher_nop_func include/linux/bpf.h:1231 [inline] __bpf_prog_run
    include/linux/filter.h:651 [inline] bpf_prog_run include/linux/filter.h:658 [inline]
    bpf_prog_run_pin_on_cpu include/linux/filter.h:675 [inline] bpf_flow_dissect+0x15f/0x350
    net/core/flow_dissector.c:991 bpf_prog_test_run_flow_dissector+0x39d/0x620 net/bpf/test_run.c:1359
    bpf_prog_test_run kernel/bpf/syscall.c:4107 [inline] __sys_bpf+0xf8f/0x4560 kernel/bpf/syscall.c:5475
    __do_sys_bpf kernel/bpf/syscall.c:5561 [inline] __se_sys_bpf kernel/bpf/syscall.c:5559 [inline]
    __x64_sys_bpf+0x73/0xb0 kernel/bpf/syscall.c:5559 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
    do_syscall_64+0x3f/0x110 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x63/0x6b Fix this by
    rejecting ptr alu with variable offset on flow_keys. Applying the patch rejects the program with R7
    pointer arithmetic on flow_keys prohibited. (CVE-2024-26589)

  - In the Linux kernel, the following vulnerability has been resolved: drm/i915/hwmon: Get rid of devm When
    both hwmon and hwmon drvdata (on which hwmon depends) are device managed resources, the expectation, on
    device unbind, is that hwmon will be released before drvdata. However, in i915 there are two separate code
    paths, which both release either drvdata or hwmon and either can be released before the other. These code
    paths (for device unbind) are as follows (see also the bug referenced below): Call Trace:
    release_nodes+0x11/0x70 devres_release_group+0xb2/0x110 component_unbind_all+0x8d/0xa0
    component_del+0xa5/0x140 intel_pxp_tee_component_fini+0x29/0x40 [i915] intel_pxp_fini+0x33/0x80 [i915]
    i915_driver_remove+0x4c/0x120 [i915] i915_pci_remove+0x19/0x30 [i915] pci_device_remove+0x32/0xa0
    device_release_driver_internal+0x19c/0x200 unbind_store+0x9c/0xb0 and Call Trace: release_nodes+0x11/0x70
    devres_release_all+0x8a/0xc0 device_unbind_cleanup+0x9/0x70 device_release_driver_internal+0x1c1/0x200
    unbind_store+0x9c/0xb0 This means that in i915, if use devm, we cannot gurantee that hwmon will always be
    released before drvdata. Which means that we have a uaf if hwmon sysfs is accessed when drvdata has been
    released but hwmon hasn't. The only way out of this seems to be do get rid of devm_ and release/free
    everything explicitly during device unbind. v2: Change commit message and other minor code changes v3:
    Cleanup from i915_hwmon_register on error (Armin Wolf) v4: Eliminate potential static analyzer warning
    (Rodrigo) Eliminate fetch_and_zero (Jani) v5: Restore previous logic for ddat_gt->hwmon_dev error return
    (Andi) (CVE-2024-39479)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  # https://security.tuxcare.com/csaf/v2/els_os/centos-stream8els/advisories/2026/clsa-2026_1786444011.json
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?9bc95a0e");
  script_set_attribute(attribute:"see_also", value:"https://cve.tuxcare.com/els/releases/CLSA-2026:1786444011");
  script_set_attribute(attribute:"solution", value:
"Update the affected packages based on the guidance in TuxCare advisory CENTOS-STREAM8:CLSA-2026:1786444011.");
  script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:S/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-53112");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");
  script_set_attribute(attribute:"vendor_severity", value:"Important");

  script_set_attribute(attribute:"vuln_publication_date", value:"2021/07/21");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/08/11");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/09/30");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"CentOS Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info2.nasl");
  script_require_keys("Host/OS/extended-third-party", "Host/local_checks_enabled", "Host/CentOS/release", "Host/CentOS/rpm-list");

  exit(0);
}
include('rpm2.inc');

var third_party_support = get_kb_item('Host/OS/extended-third-party');
if (empty_or_null(third_party_support) || third_party_support != 'TuxCare') exit(0, 'TuxCare support not enabled.');

if (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
var os_product = get_kb_item('installed_os/local/SSH/0/product');
if (isnull(os_product) || 'CentOS Linux' >!< os_product) audit(AUDIT_OS_NOT, 'CentOS Linux');
var os_version = get_kb_item('installed_os/local/SSH/0/version');
if (isnull(os_version)) audit(AUDIT_UNKNOWN_APP_VER, 'CentOS Linux');
if (! preg(pattern:"^8([^0-9]|$)", string:os_version)) audit(AUDIT_OS_NOT, 'CentOS Linux 8', 'CentOS Linux ' + os_version);

if (!get_kb_item('Host/CentOS/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('x86_64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'CentOS Linux', cpu);


var constraints = [
  {
    'release': '8',
    'pkgs': [
      {'reference':'bpftool-4.18.0-553.6.1.el8_10.tuxcare.els28', 'cpu':'x86_64', 'el_string':'el8_10', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-4.18.0-553.6.1.el8_10.tuxcare.els28', 'cpu':'x86_64', 'el_string':'el8_10', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-core-4.18.0-553.6.1.el8_10.tuxcare.els28', 'cpu':'x86_64', 'el_string':'el8_10', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-cross-headers-4.18.0-553.6.1.el8_10.tuxcare.els28', 'cpu':'x86_64', 'el_string':'el8_10', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-debug-4.18.0-553.6.1.el8_10.tuxcare.els28', 'cpu':'x86_64', 'el_string':'el8_10', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-debug-core-4.18.0-553.6.1.el8_10.tuxcare.els28', 'cpu':'x86_64', 'el_string':'el8_10', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-debug-devel-4.18.0-553.6.1.el8_10.tuxcare.els28', 'cpu':'x86_64', 'el_string':'el8_10', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-debug-modules-4.18.0-553.6.1.el8_10.tuxcare.els28', 'cpu':'x86_64', 'el_string':'el8_10', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-debug-modules-extra-4.18.0-553.6.1.el8_10.tuxcare.els28', 'cpu':'x86_64', 'el_string':'el8_10', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-debug-modules-internal-4.18.0-553.6.1.el8_10.tuxcare.els28', 'cpu':'x86_64', 'el_string':'el8_10', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-devel-4.18.0-553.6.1.el8_10.tuxcare.els28', 'cpu':'x86_64', 'el_string':'el8_10', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-headers-4.18.0-553.6.1.el8_10.tuxcare.els28', 'cpu':'x86_64', 'el_string':'el8_10', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-ipaclones-internal-4.18.0-553.6.1.el8_10.tuxcare.els28', 'cpu':'x86_64', 'el_string':'el8_10', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-modules-4.18.0-553.6.1.el8_10.tuxcare.els28', 'cpu':'x86_64', 'el_string':'el8_10', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-modules-extra-4.18.0-553.6.1.el8_10.tuxcare.els28', 'cpu':'x86_64', 'el_string':'el8_10', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-modules-internal-4.18.0-553.6.1.el8_10.tuxcare.els28', 'cpu':'x86_64', 'el_string':'el8_10', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-selftests-internal-4.18.0-553.6.1.el8_10.tuxcare.els28', 'cpu':'x86_64', 'el_string':'el8_10', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-tools-4.18.0-553.6.1.el8_10.tuxcare.els28', 'cpu':'x86_64', 'el_string':'el8_10', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-tools-libs-4.18.0-553.6.1.el8_10.tuxcare.els28', 'cpu':'x86_64', 'el_string':'el8_10', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-tools-libs-devel-4.18.0-553.6.1.el8_10.tuxcare.els28', 'cpu':'x86_64', 'el_string':'el8_10', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'perf-4.18.0-553.6.1.el8_10.tuxcare.els28', 'cpu':'x86_64', 'el_string':'el8_10', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'python3-perf-4.18.0-553.6.1.el8_10.tuxcare.els28', 'cpu':'x86_64', 'el_string':'el8_10', 'rpm_spec_vers_cmp':TRUE}
    ]
  }
];

var os_release = get_one_kb_item('installed_os/local/SSH/0/release');
var os_sp = get_one_kb_item('Host/*/minor_release');

var flag = 0;
var reference;
var sp;
var _cpu;
var el_string;
var rpm_spec_vers_cmp;
var epoch;
var allowmaj;
var exists_check;
var cves;
foreach var constraint ( constraints ) {
  # Check that the target release is equal to the affected release
  if (!empty_or_null(constraint['release'])){
    if (constraint['release'] != os_release) continue;
  }
  if (!empty_or_null(constraint['sp'])){
    if (constraint['sp'] != os_sp) continue;
  }
  foreach var pkg ( constraint['pkgs'] ) {
    reference = NULL;
    sp = NULL;
    _cpu = NULL;
    el_string = NULL;
    rpm_spec_vers_cmp = NULL;
    epoch = NULL;
    allowmaj = NULL;
    exists_check = NULL;
    cves = NULL;
    if (!empty_or_null(pkg['reference'])) reference = pkg['reference'];
    if (!empty_or_null(pkg['sp'])) sp = pkg['sp'];
    if (!empty_or_null(pkg['cpu'])) _cpu = pkg['cpu'];
    if (!empty_or_null(pkg['el_string'])) el_string = pkg['el_string'];
    if (!empty_or_null(pkg['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = pkg['rpm_spec_vers_cmp'];
    if (!empty_or_null(pkg['epoch'])) epoch = pkg['epoch'];
    if (!empty_or_null(pkg['allowmaj'])) allowmaj = pkg['allowmaj'];
    if (!empty_or_null(pkg['exists_check'])) exists_check = pkg['exists_check'];
    if (!empty_or_null(pkg['cves'])) cves = pkg['cves'];
    if (reference &&
        ## (no known rpm to check OR known rpm_exists)
        (!exists_check || rpm_exists(rpm:exists_check)) &&
        rpm_check(sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj, cves:cves)) flag++;
  }
}


if (flag)
{
  security_report_v4(
      port       : 0,
      severity   : SECURITY_WARNING,
      extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'bpftool / kernel / kernel-core / kernel-cross-headers / etc');
}