Unity Linux 20.1050a Security Update: kernel (UTSA-2026-053256)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(343340);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/09/06");

  script_cve_id("CVE-2025-38263");

  script_name(english:"Unity Linux 20.1050a Security Update: kernel (UTSA-2026-053256)");

  script_set_attribute(attribute:"synopsis", value:
"The Unity Linux host is missing one or more security updates.");
  script_set_attribute(attribute:"description", value:
"The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the
UTSA-2026-053256 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    bcache: fix NULL pointer in cache_set_flush()

    1. LINE#1794 - LINE#1887 is some codes about function of
       bch_cache_set_alloc().
    2. LINE#2078 - LINE#2142 is some codes about function of
       register_cache_set().
    3. register_cache_set() will call bch_cache_set_alloc() in LINE#2098.

     1794 struct cache_set *bch_cache_set_alloc(struct cache_sb *sb)
     1795 {
     ...
     1860         if (!(c->devices = kcalloc(c->nr_uuids, sizeof(void *), GFP_KERNEL)) ||
     1861             mempool_init_slab_pool(&c->search, 32, bch_search_cache) ||
     1862             mempool_init_kmalloc_pool(&c->bio_meta, 2,
     1863                                 sizeof(struct bbio) + sizeof(struct bio_vec) *
     1864                                 bucket_pages(c)) ||
     1865             mempool_init_kmalloc_pool(&c->fill_iter, 1, iter_size) ||
     1866             bioset_init(&c->bio_split, 4, offsetof(struct bbio, bio),
     1867                         BIOSET_NEED_BVECS|BIOSET_NEED_RESCUER) ||
     1868             !(c->uuids = alloc_bucket_pages(GFP_KERNEL, c)) ||
     1869             !(c->moving_gc_wq = alloc_workqueue(bcache_gc,
     1870                                                 WQ_MEM_RECLAIM, 0)) ||
     1871             bch_journal_alloc(c) ||
     1872             bch_btree_cache_alloc(c) ||
     1873             bch_open_buckets_alloc(c) ||
     1874             bch_bset_sort_state_init(&c->sort, ilog2(c->btree_pages)))
     1875                 goto err;
                          ^^^^^^^^
     1876
     ...
     1883         return c;
     1884 err:
     1885         bch_cache_set_unregister(c);
                  ^^^^^^^^^^^^^^^^^^^^^^^^^^^
     1886         return NULL;
     1887 }
     ...
     2078 static const char *register_cache_set(struct cache *ca)
     2079 {
     ...
     2098         c = bch_cache_set_alloc(&ca->sb);
     2099         if (!c)
     2100                 return err;
                          ^^^^^^^^^^
     ...
     2128         ca->set = c;
     2129         ca->set->cache[ca->sb.nr_this_dev] = ca;
                  ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
     ...
     2138         return NULL;
     2139 err:
     2140         bch_cache_set_unregister(c);
     2141         return err;
     2142 }

    (1) If LINE#1860 - LINE#1874 is true, then do 'goto err'(LINE#1875) and
        call bch_cache_set_unregister()(LINE#1885).
    (2) As (1) return NULL(LINE#1886), LINE#2098 - LINE#2100 would return.
    (3) As (2) has returned, LINE#2128 - LINE#2129 would do *not* give the
        value to c->cache[], it means that c->cache[] is NULL.

    LINE#1624 - LINE#1665 is some codes about function of cache_set_flush().
    As (1), in LINE#1885 call
    bch_cache_set_unregister()
    ---> bch_cache_set_stop()
         ---> closure_queue()
              -.-> cache_set_flush() (as below LINE#1624)

     1624 static void cache_set_flush(struct closure *cl)
     1625 {
     ...
     1654         for_each_cache(ca, c, i)
     1655                 if (ca->alloc_thread)
                              ^^
     1656                         kthread_stop(ca->alloc_thread);
     ...
     1665 }

    (4) In LINE#1655 ca is NULL(see (3)) in cache_set_flush() then the
        kernel crash occurred as below:
    [  846.712887] bcache: register_cache() error drbd6: cannot allocate memory
    [  846.713242] bcache: register_bcache() error : failed to register device
    [  846.713336] bcache: cache_set_free() Cache set 2f84bdc1-498a-4f2f-98a7-01946bf54287 unregistered
    [  846.713768] BUG: unable to handle kernel NULL pointer dereference at 00000000000009f8
    [  846.714790] PGD 0 P4D 0
    [  846.715129] Oops: 0000 [#1] SMP PTI
    [  846.715472] CPU: 19 PID: 5057 Comm: kworker/19:16 Kdump: loaded Tainted: G           OE    --------- -
    - 4.18.0-147.5.1.el8_1.5es.3.x86_64 #1
    [  846.716082] Hardware name: ESPAN GI-25212/X11DPL-i, BIOS 2.1 06/15/2018
    [  846.716451] Workqueue: events cache_set_flush [bcache]
    [  846.716808] RIP: 0010:cache_set_flush+0xc9/0x1b0 [bcache]
    [  846.717155] Code: 00 4c 89 a5 b0 03 00 00 48 8b 85 68 f6 ff ff a8 08 0f 84 88 00 00 00 31 db 66 83 bd
    3c f7 ff ff 00 48 8b 85 48 ff ff ff 74 28 <48> 8b b8 f8 09 00 0
    ---truncated---

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  # https://src.uniontech.com/#/security_advisory_detail?utsa_id=UTSA-2026-053256
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?462ba5c2");
  # https://lore.kernel.org/linux-cve-announce/2025070937-CVE-2025-38263-cc93@gregkh
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?b401edc8");
  script_set_attribute(attribute:"see_also", value:"https://nvd.nist.gov/vuln/detail/CVE-2025-38263");
  script_set_attribute(attribute:"solution", value:
"Update the affected kernel package.");
  script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:S/C:N/I:N/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2025-38263");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2025/07/09");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/07/27");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/09/06");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Unity Linux Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info2.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/UOS-Server/release", "Host/UOS-Server/rpm-list", "Host/cpu");

  exit(0);
}
include('rpm2.inc');

if (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
var os_product = get_kb_item('installed_os/local/SSH/0/product');
if (isnull(os_product) || 'UOS Server' >!< os_product) audit(AUDIT_OS_NOT, 'UOS Server');
var os_version = get_kb_item('installed_os/local/SSH/0/version');
if (isnull(os_version)) audit(AUDIT_UNKNOWN_APP_VER, 'UOS Server');
if (! preg(pattern:"^(20.1050a)([^0-9]|$)", string:os_version)) audit(AUDIT_OS_NOT, 'UOS Server 20.1050a', 'UOS Server ' + os_version);

if (!get_kb_item('Host/UOS-Server/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('aarch64' >!< cpu && 'amd64' >!< cpu && 'loongarch64' >!< cpu && 'x86_64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'UOS Server', cpu);


var constraints = [
  {
    'release': '20',
    'sp': '1050a',
    'pkgs': [
      {'reference':'kernel-4.19.0-91.82.132.24.uelc20', 'sp':'1050a', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-4.19.0-91.82.132.24.uelc20', 'sp':'1050a', 'cpu':'amd64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-4.19.0-91.82.132.24.uelc20', 'sp':'1050a', 'cpu':'loongarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-4.19.0-91.82.132.24.uelc20', 'sp':'1050a', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE}
    ]
  }
];

var os_release = get_one_kb_item('installed_os/local/SSH/0/release');
var os_sp = get_one_kb_item('Host/*/minor_release');

var flag = 0;
var reference;
var sp;
var _cpu;
var el_string;
var rpm_spec_vers_cmp;
var epoch;
var allowmaj;
var exists_check;
var cves;
foreach var constraint ( constraints ) {
  # Check that the target release is equal to the affected release
  if (!empty_or_null(constraint['release'])){
    if (constraint['release'] != os_release) continue;
  }
  if (!empty_or_null(constraint['sp'])){
    if (constraint['sp'] != os_sp) continue;
  }
  foreach var pkg ( constraint['pkgs'] ) {
    reference = NULL;
    sp = NULL;
    _cpu = NULL;
    el_string = NULL;
    rpm_spec_vers_cmp = NULL;
    epoch = NULL;
    allowmaj = NULL;
    exists_check = NULL;
    cves = NULL;
    if (!empty_or_null(pkg['reference'])) reference = pkg['reference'];
    if (!empty_or_null(pkg['sp'])) sp = pkg['sp'];
    if (!empty_or_null(pkg['cpu'])) _cpu = pkg['cpu'];
    if (!empty_or_null(pkg['el_string'])) el_string = pkg['el_string'];
    if (!empty_or_null(pkg['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = pkg['rpm_spec_vers_cmp'];
    if (!empty_or_null(pkg['epoch'])) epoch = pkg['epoch'];
    if (!empty_or_null(pkg['allowmaj'])) allowmaj = pkg['allowmaj'];
    if (!empty_or_null(pkg['exists_check'])) exists_check = pkg['exists_check'];
    if (!empty_or_null(pkg['cves'])) cves = pkg['cves'];
    if (reference &&
        ## (no known rpm to check OR known rpm_exists)
        (!exists_check || rpm_exists(rpm:exists_check)) &&
        rpm_check(sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj, cves:cves)) flag++;
  }
}


if (flag)
{
  security_report_v4(
      port       : 0,
      severity   : SECURITY_WARNING,
      extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'kernel');
}