Unity Linux 20.1050e Security Update: kernel (UTSA-2026-006791)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(305494);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/04/08");

  script_cve_id("CVE-2025-39749");

  script_name(english:"Unity Linux 20.1050e Security Update: kernel (UTSA-2026-006791)");

  script_set_attribute(attribute:"synopsis", value:
"The Unity Linux host is missing one or more security updates.");
  script_set_attribute(attribute:"description", value:
"The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the
UTSA-2026-006791 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    rcu: Protect ->defer_qs_iw_pending from data race

    On kernels built with CONFIG_IRQ_WORK=y, when rcu_read_unlock() is
    invoked within an interrupts-disabled region of code [1], it will invoke
    rcu_read_unlock_special(), which uses an irq-work handler to force the
    system to notice when the RCU read-side critical section actually ends.
    That end won't happen until interrupts are enabled at the soonest.

    In some kernels, such as those booted with rcutree.use_softirq=y, the
    irq-work handler is used unconditionally.

    The per-CPU rcu_data structure's ->defer_qs_iw_pending field is
    updated by the irq-work handler and is both read and updated by
    rcu_read_unlock_special().  This resulted in the following KCSAN splat:

    ------------------------------------------------------------------------

    BUG: KCSAN: data-race in rcu_preempt_deferred_qs_handler / rcu_read_unlock_special

    read to 0xffff96b95f42d8d8 of 1 bytes by task 90 on cpu 8:
     rcu_read_unlock_special+0x175/0x260
     __rcu_read_unlock+0x92/0xa0
     rt_spin_unlock+0x9b/0xc0
     __local_bh_enable+0x10d/0x170
     __local_bh_enable_ip+0xfb/0x150
     rcu_do_batch+0x595/0xc40
     rcu_cpu_kthread+0x4e9/0x830
     smpboot_thread_fn+0x24d/0x3b0
     kthread+0x3bd/0x410
     ret_from_fork+0x35/0x40
     ret_from_fork_asm+0x1a/0x30

    write to 0xffff96b95f42d8d8 of 1 bytes by task 88 on cpu 8:
     rcu_preempt_deferred_qs_handler+0x1e/0x30
     irq_work_single+0xaf/0x160
     run_irq_workd+0x91/0xc0
     smpboot_thread_fn+0x24d/0x3b0
     kthread+0x3bd/0x410
     ret_from_fork+0x35/0x40
     ret_from_fork_asm+0x1a/0x30

    no locks held by irq_work/8/88.
    irq event stamp: 200272
    hardirqs last  enabled at (200272): [<ffffffffb0f56121>] finish_task_switch+0x131/0x320
    hardirqs last disabled at (200271): [<ffffffffb25c7859>] __schedule+0x129/0xd70
    softirqs last  enabled at (0): [<ffffffffb0ee093f>] copy_process+0x4df/0x1cc0
    softirqs last disabled at (0): [<0000000000000000>] 0x0

    ------------------------------------------------------------------------

    The problem is that irq-work handlers run with interrupts enabled, which
    means that rcu_preempt_deferred_qs_handler() could be interrupted,
    and that interrupt handler might contain an RCU read-side critical
    section, which might invoke rcu_read_unlock_special().  In the strict
    KCSAN mode of operation used by RCU, this constitutes a data race on
    the ->defer_qs_iw_pending field.

    This commit therefore disables interrupts across the portion of the
    rcu_preempt_deferred_qs_handler() that updates the ->defer_qs_iw_pending
    field.  This suffices because this handler is not a fast path.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  # https://src.uniontech.com/#/security_advisory_detail?utsa_id=UTSA-2026-006791
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?755d1d5f");
  # https://lore.kernel.org/linux-cve-announce/2025091141-CVE-2025-39749-1f58@gregkh
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?446ea258");
  script_set_attribute(attribute:"see_also", value:"https://nvd.nist.gov/vuln/detail/CVE-2025-39749");
  script_set_attribute(attribute:"solution", value:
"Update the affected kernel package.");
  script_set_cvss_base_vector("CVSS2#AV:L/AC:H/Au:S/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2025-39749");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2025/09/11");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/04/08");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/04/08");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Unity Linux Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info2.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/UOS-Server/release", "Host/UOS-Server/rpm-list", "Host/cpu");

  exit(0);
}
include('rpm2.inc');

if (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
var os_product = get_kb_item('installed_os/local/SSH/0/product');
if (isnull(os_product) || 'UOS Server' >!< os_product) audit(AUDIT_OS_NOT, 'UOS Server');
var os_version = get_kb_item('installed_os/local/SSH/0/version');
if (isnull(os_version)) audit(AUDIT_UNKNOWN_APP_VER, 'UOS Server');
if (! preg(pattern:"^20.1050e([^0-9]|$)", string:os_version)) audit(AUDIT_OS_NOT, 'UOS Server 20.1050e', 'UOS Server ' + os_version);

if (!get_kb_item('Host/UOS-Server/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('aarch64' >!< cpu && 'amd64' >!< cpu && 'x86_64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'UOS Server', cpu);


var constraints = [
  {
    'release': '20',
    'sp': '1050e',
    'pkgs': [
      {'reference':'kernel-5.10.0-27.5', 'sp':'1050e', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-5.10.0-27.5', 'sp':'1050e', 'cpu':'amd64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-5.10.0-27.5', 'sp':'1050e', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE}
    ]
  }
];

var os_release = get_one_kb_item('installed_os/local/SSH/0/release');
var os_sp = get_one_kb_item('Host/*/minor_release');

var flag = 0;
var reference;
var sp;
var _cpu;
var el_string;
var rpm_spec_vers_cmp;
var epoch;
var allowmaj;
var exists_check;
var cves;
foreach var constraint ( constraints ) {
  # Check that the target release is equal to the affected release
  if (!empty_or_null(constraint['release'])){
    if (constraint['release'] != os_release) continue;
  }
  if (!empty_or_null(constraint['sp'])){
    if (constraint['sp'] != os_sp) continue;
  }
  foreach var pkg ( constraint['pkgs'] ) {
    reference = NULL;
    sp = NULL;
    _cpu = NULL;
    el_string = NULL;
    rpm_spec_vers_cmp = NULL;
    epoch = NULL;
    allowmaj = NULL;
    exists_check = NULL;
    cves = NULL;
    if (!empty_or_null(pkg['reference'])) reference = pkg['reference'];
    if (!empty_or_null(pkg['sp'])) sp = pkg['sp'];
    if (!empty_or_null(pkg['cpu'])) _cpu = pkg['cpu'];
    if (!empty_or_null(pkg['el_string'])) el_string = pkg['el_string'];
    if (!empty_or_null(pkg['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = pkg['rpm_spec_vers_cmp'];
    if (!empty_or_null(pkg['epoch'])) epoch = pkg['epoch'];
    if (!empty_or_null(pkg['allowmaj'])) allowmaj = pkg['allowmaj'];
    if (!empty_or_null(pkg['exists_check'])) exists_check = pkg['exists_check'];
    if (!empty_or_null(pkg['cves'])) cves = pkg['cves'];
    if (reference &&
        ## (no known rpm to check OR known rpm_exists)
        (!exists_check || rpm_exists(rpm:exists_check)) &&
        rpm_check(sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj, cves:cves)) flag++;
  }
}


if (flag)
{
  security_report_v4(
      port       : 0,
      severity   : SECURITY_WARNING,
      extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'kernel');
}