Unity Linux 20.1070e Security Update: kernel (UTSA-2026-005508)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(300244);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/03/02");

  script_cve_id("CVE-2024-47706");

  script_name(english:"Unity Linux 20.1070e Security Update: kernel (UTSA-2026-005508)");

  script_set_attribute(attribute:"synopsis", value:
"The Unity Linux host is missing one or more security updates.");
  script_set_attribute(attribute:"description", value:
"The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the
UTSA-2026-005508 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    block, bfq: fix possible UAF for bfqq->bic with merge chain

    1) initial state, three tasks:

                    Process 1       Process 2       Process 3
                     (BIC1)          (BIC2)          (BIC3)
                      |              |                    |  
                      |  |            |  |            |  |
                      V  |            V  |            V  |
                      bfqq1           bfqq2           bfqq3
    process ref:       1                1               1

    2) bfqq1 merged to bfqq2:

                    Process 1       Process 2       Process 3
                     (BIC1)          (BIC2)          (BIC3)
                      |               |               |  
                      \--------------\|               |  |
                                      V               V  |
                      bfqq1--------->bfqq2            bfqq3
    process ref:       0                2               1

    3) bfqq2 merged to bfqq3:

                    Process 1       Process 2       Process 3
                     (BIC1)          (BIC2)          (BIC3)
             here ->                 |              |
                      \--------------\ \-------------\|
                                      V               V
                      bfqq1--------->bfqq2---------->bfqq3
    process ref:       0                1               3

    In this case, IO from Process 1 will get bfqq2 from BIC1 first, and then
    get bfqq3 through merge chain, and finially handle IO by bfqq3.
    Howerver, current code will think bfqq2 is owned by BIC1, like initial
    state, and set bfqq2->bic to BIC1.

    bfq_insert_request
    -> by Process 1
     bfqq = bfq_init_rq(rq)
      bfqq = bfq_get_bfqq_handle_split
       bfqq = bic_to_bfqq
       -> get bfqq2 from BIC1
     bfqq->ref++
     rq->elv.priv[0] = bic
     rq->elv.priv[1] = bfqq
     if (bfqq_process_refs(bfqq) == 1)
      bfqq->bic = bic
      -> record BIC1 to bfqq2

      __bfq_insert_request
       new_bfqq = bfq_setup_cooperator
       -> get bfqq3 from bfqq2->new_bfqq
       bfqq_request_freed(bfqq)
       new_bfqq->ref++
       rq->elv.priv[1] = new_bfqq
       -> handle IO by bfqq3

    Fix the problem by checking bfqq is from merge chain fist. And this
    might fix a following problem reported by our syzkaller(unreproducible):

    ==================================================================
    BUG: KASAN: slab-use-after-free in bfq_do_early_stable_merge block/bfq-iosched.c:5692 [inline]
    BUG: KASAN: slab-use-after-free in bfq_do_or_sched_stable_merge block/bfq-iosched.c:5805 [inline]
    BUG: KASAN: slab-use-after-free in bfq_get_queue+0x25b0/0x2610 block/bfq-iosched.c:5889
    Write of size 1 at addr ffff888123839eb8 by task kworker/0:1H/18595

    CPU: 0 PID: 18595 Comm: kworker/0:1H Tainted: G             L     6.6.0-07439-gba2303cacfda #6
    Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org
    04/01/2014
    Workqueue: kblockd blk_mq_requeue_work
    Call Trace:
     <TASK>
     __dump_stack lib/dump_stack.c:88 [inline]
     dump_stack_lvl+0x91/0xf0 lib/dump_stack.c:106
     print_address_description mm/kasan/report.c:364 [inline]
     print_report+0x10d/0x610 mm/kasan/report.c:475
     kasan_report+0x8e/0xc0 mm/kasan/report.c:588
     bfq_do_early_stable_merge block/bfq-iosched.c:5692 [inline]
     bfq_do_or_sched_stable_merge block/bfq-iosched.c:5805 [inline]
     bfq_get_queue+0x25b0/0x2610 block/bfq-iosched.c:5889
     bfq_get_bfqq_handle_split+0x169/0x5d0 block/bfq-iosched.c:6757
     bfq_init_rq block/bfq-iosched.c:6876 [inline]
     bfq_insert_request block/bfq-iosched.c:6254 [inline]
     bfq_insert_requests+0x1112/0x5cf0 block/bfq-iosched.c:6304
     blk_mq_insert_request+0x290/0x8d0 block/blk-mq.c:2593
     blk_mq_requeue_work+0x6bc/0xa70 block/blk-mq.c:1502
     process_one_work kernel/workqueue.c:2627 [inline]
     process_scheduled_works+0x432/0x13f0 kernel/workqueue.c:2700
     worker_thread+0x6f2/0x1160 kernel/workqueue.c:2781
     kthread+0x33c/0x440 kernel/kthread.c:388
     ret_from_fork+0x4d/0x80 arch/x86/kernel/process.c:147
     ret_from_fork_asm+0x1b/0x30 arch/x86/entry/entry_64.S:305
     </TASK>

    Allocated by task 20776:
     kasan_save_stack+0x20/0x40 mm/kasan/common.c:45
     kasan_set_track+0x25/0x30 mm/kasan/common.c:52
     __kasan_slab_alloc+0x87/0x90 mm/kasan/common.c:328
     kasan_slab_alloc include/linux/kasan.h:188 [inline]
     slab_post_alloc_hook mm/slab.h:763 [inline]
     slab_alloc_node mm/slub.c:3458 [inline]
     kmem_cache_alloc_node+0x1a4/0x6f0 mm/slub.c:3503
     ioc_create_icq block/blk-ioc.c:370 [inline]
    ---truncated---

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  # https://src.uniontech.com/#/security_advisory_detail?utsa_id=UTSA-2026-005508
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?18d6e9ec");
  script_set_attribute(attribute:"see_also", value:"https://nvd.nist.gov/vuln/detail/CVE-2024-47706");
  script_set_attribute(attribute:"solution", value:
"Update the affected kernel package.");
  script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:S/C:N/I:N/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2024-47706");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2024/04/09");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/03/02");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/03/02");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Unity Linux Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info2.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/UOS-Server/release", "Host/UOS-Server/rpm-list", "Host/cpu");

  exit(0);
}
include('rpm2.inc');

if (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
var os_product = get_kb_item('installed_os/local/SSH/0/product');
if (isnull(os_product) || 'UOS Server' >!< os_product) audit(AUDIT_OS_NOT, 'UOS Server');
var os_version = get_kb_item('installed_os/local/SSH/0/version');
if (isnull(os_version)) audit(AUDIT_UNKNOWN_APP_VER, 'UOS Server');
if (! preg(pattern:"^20.1070e([^0-9]|$)", string:os_version)) audit(AUDIT_OS_NOT, 'UOS Server 20.1070e', 'UOS Server ' + os_version);

if (!get_kb_item('Host/UOS-Server/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('aarch64' >!< cpu && 'amd64' >!< cpu && 'sw_64' >!< cpu && 'x86_64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'UOS Server', cpu);


var constraints = [
  {
    'release': '20',
    'sp': '1070e',
    'pkgs': [
      {'reference':'kernel-4.19.90-2601.1.0.0002', 'sp':'1070e', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-4.19.90-2601.1.0.0002', 'sp':'1070e', 'cpu':'amd64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-4.19.90-2601.1.0.0002', 'sp':'1070e', 'cpu':'sw_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-4.19.90-2601.1.0.0002', 'sp':'1070e', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE}
    ]
  }
];

var os_release = get_one_kb_item('installed_os/local/SSH/0/release');
var os_sp = get_one_kb_item('Host/*/minor_release');

var flag = 0;
var reference;
var sp;
var _cpu;
var el_string;
var rpm_spec_vers_cmp;
var epoch;
var allowmaj;
var exists_check;
var cves;
foreach var constraint ( constraints ) {
  # Check that the target release is equal to the affected release
  if (!empty_or_null(constraint['release'])){
    if (constraint['release'] != os_release) continue;
  }
  if (!empty_or_null(constraint['sp'])){
    if (constraint['sp'] != os_sp) continue;
  }
  foreach var pkg ( constraint['pkgs'] ) {
    reference = NULL;
    sp = NULL;
    _cpu = NULL;
    el_string = NULL;
    rpm_spec_vers_cmp = NULL;
    epoch = NULL;
    allowmaj = NULL;
    exists_check = NULL;
    cves = NULL;
    if (!empty_or_null(pkg['reference'])) reference = pkg['reference'];
    if (!empty_or_null(pkg['sp'])) sp = pkg['sp'];
    if (!empty_or_null(pkg['cpu'])) _cpu = pkg['cpu'];
    if (!empty_or_null(pkg['el_string'])) el_string = pkg['el_string'];
    if (!empty_or_null(pkg['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = pkg['rpm_spec_vers_cmp'];
    if (!empty_or_null(pkg['epoch'])) epoch = pkg['epoch'];
    if (!empty_or_null(pkg['allowmaj'])) allowmaj = pkg['allowmaj'];
    if (!empty_or_null(pkg['exists_check'])) exists_check = pkg['exists_check'];
    if (!empty_or_null(pkg['cves'])) cves = pkg['cves'];
    if (reference &&
        ## (no known rpm to check OR known rpm_exists)
        (!exists_check || rpm_exists(rpm:exists_check)) &&
        rpm_check(sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj, cves:cves)) flag++;
  }
}


if (flag)
{
  security_report_v4(
      port       : 0,
      severity   : SECURITY_WARNING,
      extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'kernel');
}