Unity Linux 20.1070a Security Update: kernel (UTSA-2026-012997)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(307743);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/04/21");

  script_cve_id("CVE-2025-40220");

  script_name(english:"Unity Linux 20.1070a Security Update: kernel (UTSA-2026-012997)");

  script_set_attribute(attribute:"synopsis", value:
"The Unity Linux host is missing one or more security updates.");
  script_set_attribute(attribute:"description", value:
"The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the
UTSA-2026-012997 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    fuse: fix livelock in synchronous file put from fuseblk workers

    I observed a hang when running generic/323 against a fuseblk server.
    This test opens a file, initiates a lot of AIO writes to that file
    descriptor, and closes the file descriptor before the writes complete.
    Unsurprisingly, the AIO exerciser threads are mostly stuck waiting for
    responses from the fuseblk server:

    # cat /proc/372265/task/372313/stack
    [<0>] request_wait_answer+0x1fe/0x2a0 [fuse]
    [<0>] __fuse_simple_request+0xd3/0x2b0 [fuse]
    [<0>] fuse_do_getattr+0xfc/0x1f0 [fuse]
    [<0>] fuse_file_read_iter+0xbe/0x1c0 [fuse]
    [<0>] aio_read+0x130/0x1e0
    [<0>] io_submit_one+0x542/0x860
    [<0>] __x64_sys_io_submit+0x98/0x1a0
    [<0>] do_syscall_64+0x37/0xf0
    [<0>] entry_SYSCALL_64_after_hwframe+0x4b/0x53

    But the /weird/ part is that the fuseblk server threads are waiting for
    responses from itself:

    # cat /proc/372210/task/372232/stack
    [<0>] request_wait_answer+0x1fe/0x2a0 [fuse]
    [<0>] __fuse_simple_request+0xd3/0x2b0 [fuse]
    [<0>] fuse_file_put+0x9a/0xd0 [fuse]
    [<0>] fuse_release+0x36/0x50 [fuse]
    [<0>] __fput+0xec/0x2b0
    [<0>] task_work_run+0x55/0x90
    [<0>] syscall_exit_to_user_mode+0xe9/0x100
    [<0>] do_syscall_64+0x43/0xf0
    [<0>] entry_SYSCALL_64_after_hwframe+0x4b/0x53

    The fuseblk server is fuse2fs so there's nothing all that exciting in
    the server itself.  So why is the fuse server calling fuse_file_put?
    The commit message for the fstest sheds some light on that:

    By closing the file descriptor before calling io_destroy, you pretty
    much guarantee that the last put on the ioctx will be done in interrupt
    context (during I/O completion).

    Aha.  AIO fgets a new struct file from the fd when it queues the ioctx.
    The completion of the FUSE_WRITE command from userspace causes the fuse
    server to call the AIO completion function.  The completion puts the
    struct file, queuing a delayed fput to the fuse server task.  When the
    fuse server task returns to userspace, it has to run the delayed fput,
    which in the case of a fuseblk server, it does synchronously.

    Sending the FUSE_RELEASE command sychronously from fuse server threads
    is a bad idea because a client program can initiate enough simultaneous
    AIOs such that all the fuse server threads end up in delayed_fput, and
    now there aren't any threads left to handle the queued fuse commands.

    Fix this by only using asynchronous fputs when closing files, and leave
    a comment explaining why.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  # https://src.uniontech.com/#/security_advisory_detail?utsa_id=UTSA-2026-012997
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?31fec39e");
  # https://lore.kernel.org/linux-cve-announce/2025120454-CVE-2025-40220-2127@gregkh
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?42da2086");
  script_set_attribute(attribute:"see_also", value:"https://nvd.nist.gov/vuln/detail/CVE-2025-40220");
  script_set_attribute(attribute:"solution", value:
"Update the affected kernel package.");
  script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:S/C:N/I:P/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2025-40220");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2025/11/14");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/04/21");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/04/21");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Unity Linux Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info2.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/UOS-Server/release", "Host/UOS-Server/rpm-list", "Host/cpu");

  exit(0);
}
include('rpm2.inc');

if (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
var os_product = get_kb_item('installed_os/local/SSH/0/product');
if (isnull(os_product) || 'UOS Server' >!< os_product) audit(AUDIT_OS_NOT, 'UOS Server');
var os_version = get_kb_item('installed_os/local/SSH/0/version');
if (isnull(os_version)) audit(AUDIT_UNKNOWN_APP_VER, 'UOS Server');
if (! preg(pattern:"^20.1070a([^0-9]|$)", string:os_version)) audit(AUDIT_OS_NOT, 'UOS Server 20.1070a', 'UOS Server ' + os_version);

if (!get_kb_item('Host/UOS-Server/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('aarch64' >!< cpu && 'amd64' >!< cpu && 'x86_64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'UOS Server', cpu);


var constraints = [
  {
    'release': '20',
    'sp': '1070a',
    'pkgs': [
      {'reference':'kernel-5.10.0-79.10', 'sp':'1070a', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-5.10.0-79.10', 'sp':'1070a', 'cpu':'amd64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-5.10.0-79.10', 'sp':'1070a', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE}
    ]
  }
];

var os_release = get_one_kb_item('installed_os/local/SSH/0/release');
var os_sp = get_one_kb_item('Host/*/minor_release');

var flag = 0;
var reference;
var sp;
var _cpu;
var el_string;
var rpm_spec_vers_cmp;
var epoch;
var allowmaj;
var exists_check;
var cves;
foreach var constraint ( constraints ) {
  # Check that the target release is equal to the affected release
  if (!empty_or_null(constraint['release'])){
    if (constraint['release'] != os_release) continue;
  }
  if (!empty_or_null(constraint['sp'])){
    if (constraint['sp'] != os_sp) continue;
  }
  foreach var pkg ( constraint['pkgs'] ) {
    reference = NULL;
    sp = NULL;
    _cpu = NULL;
    el_string = NULL;
    rpm_spec_vers_cmp = NULL;
    epoch = NULL;
    allowmaj = NULL;
    exists_check = NULL;
    cves = NULL;
    if (!empty_or_null(pkg['reference'])) reference = pkg['reference'];
    if (!empty_or_null(pkg['sp'])) sp = pkg['sp'];
    if (!empty_or_null(pkg['cpu'])) _cpu = pkg['cpu'];
    if (!empty_or_null(pkg['el_string'])) el_string = pkg['el_string'];
    if (!empty_or_null(pkg['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = pkg['rpm_spec_vers_cmp'];
    if (!empty_or_null(pkg['epoch'])) epoch = pkg['epoch'];
    if (!empty_or_null(pkg['allowmaj'])) allowmaj = pkg['allowmaj'];
    if (!empty_or_null(pkg['exists_check'])) exists_check = pkg['exists_check'];
    if (!empty_or_null(pkg['cves'])) cves = pkg['cves'];
    if (reference &&
        ## (no known rpm to check OR known rpm_exists)
        (!exists_check || rpm_exists(rpm:exists_check)) &&
        rpm_check(sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj, cves:cves)) flag++;
  }
}


if (flag)
{
  security_report_v4(
      port       : 0,
      severity   : SECURITY_WARNING,
      extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'kernel');
}