Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-007495)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(307178);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/04/21");

  script_cve_id("CVE-2025-38578");

  script_name(english:"Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-007495)");

  script_set_attribute(attribute:"synopsis", value:
"The Unity Linux host is missing one or more security updates.");
  script_set_attribute(attribute:"description", value:
"The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the
UTSA-2026-007495 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    f2fs: fix to avoid UAF in f2fs_sync_inode_meta()

    syzbot reported an UAF issue as below: [1] [2]

    [1] https://syzkaller.appspot.com/text?tag=CrashReport&x=16594c60580000

    ==================================================================
    BUG: KASAN: use-after-free in __list_del_entry_valid+0xa6/0x130 lib/list_debug.c:62
    Read of size 8 at addr ffff888100567dc8 by task kworker/u4:0/8

    CPU: 1 PID: 8 Comm: kworker/u4:0 Tainted: G        W          6.1.129-syzkaller-00017-g642656a36791 #0
    Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025
    Workqueue: writeback wb_workfn (flush-7:0)
    Call Trace:
     <TASK>
     __dump_stack lib/dump_stack.c:88 [inline]
     dump_stack_lvl+0x151/0x1b7 lib/dump_stack.c:106
     print_address_description mm/kasan/report.c:316 [inline]
     print_report+0x158/0x4e0 mm/kasan/report.c:427
     kasan_report+0x13c/0x170 mm/kasan/report.c:531
     __asan_report_load8_noabort+0x14/0x20 mm/kasan/report_generic.c:351
     __list_del_entry_valid+0xa6/0x130 lib/list_debug.c:62
     __list_del_entry include/linux/list.h:134 [inline]
     list_del_init include/linux/list.h:206 [inline]
     f2fs_inode_synced+0x100/0x2e0 fs/f2fs/super.c:1553
     f2fs_update_inode+0x72/0x1c40 fs/f2fs/inode.c:588
     f2fs_update_inode_page+0x135/0x170 fs/f2fs/inode.c:706
     f2fs_write_inode+0x416/0x790 fs/f2fs/inode.c:734
     write_inode fs/fs-writeback.c:1460 [inline]
     __writeback_single_inode+0x4cf/0xb80 fs/fs-writeback.c:1677
     writeback_sb_inodes+0xb32/0x1910 fs/fs-writeback.c:1903
     __writeback_inodes_wb+0x118/0x3f0 fs/fs-writeback.c:1974
     wb_writeback+0x3da/0xa00 fs/fs-writeback.c:2081
     wb_check_background_flush fs/fs-writeback.c:2151 [inline]
     wb_do_writeback fs/fs-writeback.c:2239 [inline]
     wb_workfn+0xbba/0x1030 fs/fs-writeback.c:2266
     process_one_work+0x73d/0xcb0 kernel/workqueue.c:2299
     worker_thread+0xa60/0x1260 kernel/workqueue.c:2446
     kthread+0x26d/0x300 kernel/kthread.c:386
     ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295
     </TASK>

    Allocated by task 298:
     kasan_save_stack mm/kasan/common.c:45 [inline]
     kasan_set_track+0x4b/0x70 mm/kasan/common.c:52
     kasan_save_alloc_info+0x1f/0x30 mm/kasan/generic.c:505
     __kasan_slab_alloc+0x6c/0x80 mm/kasan/common.c:333
     kasan_slab_alloc include/linux/kasan.h:202 [inline]
     slab_post_alloc_hook+0x53/0x2c0 mm/slab.h:768
     slab_alloc_node mm/slub.c:3421 [inline]
     slab_alloc mm/slub.c:3431 [inline]
     __kmem_cache_alloc_lru mm/slub.c:3438 [inline]
     kmem_cache_alloc_lru+0x102/0x270 mm/slub.c:3454
     alloc_inode_sb include/linux/fs.h:3255 [inline]
     f2fs_alloc_inode+0x2d/0x350 fs/f2fs/super.c:1437
     alloc_inode fs/inode.c:261 [inline]
     iget_locked+0x18c/0x7e0 fs/inode.c:1373
     f2fs_iget+0x55/0x4ca0 fs/f2fs/inode.c:486
     f2fs_lookup+0x3c1/0xb50 fs/f2fs/namei.c:484
     __lookup_slow+0x2b9/0x3e0 fs/namei.c:1689
     lookup_slow+0x5a/0x80 fs/namei.c:1706
     walk_component+0x2e7/0x410 fs/namei.c:1997
     lookup_last fs/namei.c:2454 [inline]
     path_lookupat+0x16d/0x450 fs/namei.c:2478
     filename_lookup+0x251/0x600 fs/namei.c:2507
     vfs_statx+0x107/0x4b0 fs/stat.c:229
     vfs_fstatat fs/stat.c:267 [inline]
     vfs_lstat include/linux/fs.h:3434 [inline]
     __do_sys_newlstat fs/stat.c:423 [inline]
     __se_sys_newlstat+0xda/0x7c0 fs/stat.c:417
     __x64_sys_newlstat+0x5b/0x70 fs/stat.c:417
     x64_sys_call+0x52/0x9a0 arch/x86/include/generated/asm/syscalls_64.h:7
     do_syscall_x64 arch/x86/entry/common.c:51 [inline]
     do_syscall_64+0x3b/0x80 arch/x86/entry/common.c:81
     entry_SYSCALL_64_after_hwframe+0x68/0xd2

    Freed by task 0:
     kasan_save_stack mm/kasan/common.c:45 [inline]
     kasan_set_track+0x4b/0x70 mm/kasan/common.c:52
     kasan_save_free_info+0x2b/0x40 mm/kasan/generic.c:516
     ____kasan_slab_free+0x131/0x180 mm/kasan/common.c:241
     __kasan_slab_free+0x11/0x20 mm/kasan/common.c:249
     kasan_slab_free include/linux/kasan.h:178 [inline]
     slab_free_hook mm/slub.c:1745 [inline]
     slab_free_freelist_hook mm/slub.c:1771 [inline]
     slab_free mm/slub.c:3686 [inline]
     kmem_cache_free+0x
    ---truncated---

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  # https://src.uniontech.com/#/security_advisory_detail?utsa_id=UTSA-2026-007495
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?ae42efaa");
  # https://lore.kernel.org/linux-cve-announce/2025081912-CVE-2025-38578-d58a@gregkh
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?62922b0b");
  script_set_attribute(attribute:"see_also", value:"https://nvd.nist.gov/vuln/detail/CVE-2025-38578");
  script_set_attribute(attribute:"solution", value:
"Update the affected kernel package.");
  script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:S/C:N/I:N/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2025-38578");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2025/08/19");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/04/17");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/04/17");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Unity Linux Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info2.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/UOS-Server/release", "Host/UOS-Server/rpm-list", "Host/cpu");

  exit(0);
}
include('rpm2.inc');

if (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
var os_product = get_kb_item('installed_os/local/SSH/0/product');
if (isnull(os_product) || 'UOS Server' >!< os_product) audit(AUDIT_OS_NOT, 'UOS Server');
var os_version = get_kb_item('installed_os/local/SSH/0/version');
if (isnull(os_version)) audit(AUDIT_UNKNOWN_APP_VER, 'UOS Server');
if (! preg(pattern:"^20.1050e|20.1060e|20.1070e([^0-9]|$)", string:os_version)) audit(AUDIT_OS_NOT, 'UOS Server 20.1050e / 20.1060e / 20.1070e', 'UOS Server ' + os_version);

if (!get_kb_item('Host/UOS-Server/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('aarch64' >!< cpu && 'amd64' >!< cpu && 'sw_64' >!< cpu && 'x86_64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'UOS Server', cpu);


var constraints = [
  {
    'release': '20',
    'sp': '1050e',
    'pkgs': [
      {'reference':'kernel-4.19.90-2211.5.0.0178.39', 'sp':'1050e', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-4.19.90-2211.5.0.0178.39', 'sp':'1050e', 'cpu':'amd64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-4.19.90-2211.5.0.0178.39', 'sp':'1050e', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE}
    ]
  },
  {
    'release': '20',
    'sp': '1060e',
    'pkgs': [
      {'reference':'kernel-4.19.90-2305.1.0.0199.99', 'sp':'1060e', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-4.19.90-2305.1.0.0199.99', 'sp':'1060e', 'cpu':'amd64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-4.19.90-2305.1.0.0199.99', 'sp':'1060e', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE}
    ]
  },
  {
    'release': '20',
    'sp': '1070e',
    'pkgs': [
      {'reference':'kernel-4.19.90-2409.6.0.0297.103.001', 'sp':'1070e', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-4.19.90-2409.6.0.0297.103.001', 'sp':'1070e', 'cpu':'amd64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-4.19.90-2409.6.0.0297.103.001', 'sp':'1070e', 'cpu':'sw_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-4.19.90-2409.6.0.0297.103.001', 'sp':'1070e', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE}
    ]
  }
];

var os_release = get_one_kb_item('installed_os/local/SSH/0/release');
var os_sp = get_one_kb_item('Host/*/minor_release');

var flag = 0;
var reference;
var sp;
var _cpu;
var el_string;
var rpm_spec_vers_cmp;
var epoch;
var allowmaj;
var exists_check;
var cves;
foreach var constraint ( constraints ) {
  # Check that the target release is equal to the affected release
  if (!empty_or_null(constraint['release'])){
    if (constraint['release'] != os_release) continue;
  }
  if (!empty_or_null(constraint['sp'])){
    if (constraint['sp'] != os_sp) continue;
  }
  foreach var pkg ( constraint['pkgs'] ) {
    reference = NULL;
    sp = NULL;
    _cpu = NULL;
    el_string = NULL;
    rpm_spec_vers_cmp = NULL;
    epoch = NULL;
    allowmaj = NULL;
    exists_check = NULL;
    cves = NULL;
    if (!empty_or_null(pkg['reference'])) reference = pkg['reference'];
    if (!empty_or_null(pkg['sp'])) sp = pkg['sp'];
    if (!empty_or_null(pkg['cpu'])) _cpu = pkg['cpu'];
    if (!empty_or_null(pkg['el_string'])) el_string = pkg['el_string'];
    if (!empty_or_null(pkg['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = pkg['rpm_spec_vers_cmp'];
    if (!empty_or_null(pkg['epoch'])) epoch = pkg['epoch'];
    if (!empty_or_null(pkg['allowmaj'])) allowmaj = pkg['allowmaj'];
    if (!empty_or_null(pkg['exists_check'])) exists_check = pkg['exists_check'];
    if (!empty_or_null(pkg['cves'])) cves = pkg['cves'];
    if (reference &&
        ## (no known rpm to check OR known rpm_exists)
        (!exists_check || rpm_exists(rpm:exists_check)) &&
        rpm_check(sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj, cves:cves)) flag++;
  }
}


if (flag)
{
  security_report_v4(
      port       : 0,
      severity   : SECURITY_WARNING,
      extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'kernel');
}