Unity Linux 20.1050a Security Update: kernel (UTSA-2026-053338)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(343353);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/09/07");

  script_cve_id("CVE-2026-46052");

  script_name(english:"Unity Linux 20.1050a Security Update: kernel (UTSA-2026-053338)");

  script_set_attribute(attribute:"synopsis", value:
"The Unity Linux host is missing one or more security updates.");
  script_set_attribute(attribute:"description", value:
"The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the
UTSA-2026-053338 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    ceph: only d_add() negative dentries when they are unhashed

    Ceph can call d_add(dentry, NULL) on a negative dentry that is already
    present in the primary dcache hash.

    In the current VFS that is not safe.  d_add() goes through __d_add()
    to __d_rehash(), which unconditionally reinserts dentry->d_hash into
    the hlist_bl bucket.  If the dentry is already hashed, reinserting the
    same node can corrupt the bucket, including creating a self-loop.
    Once that happens, __d_lookup() can spin forever in the hlist_bl walk,
    typically looping only on the d_name.hash mismatch check and
    eventually triggering RCU stall reports like this one:

     rcu: INFO: rcu_sched self-detected stall on CPU
     rcu:         87-....: (2100 ticks this GP) idle=3a4c/1/0x4000000000000000 softirq=25003319/25003319
    fqs=829
     rcu:         (t=2101 jiffies g=79058445 q=698988 ncpus=192)
     CPU: 87 UID: 2952868916 PID: 3933303 Comm: php-cgi8.3 Not tainted 6.18.17-i1-amd #950 NONE
     Hardware name: Dell Inc. PowerEdge R7615/0G9DHV, BIOS 1.6.6 09/22/2023
     RIP: 0010:__d_lookup+0x46/0xb0
     Code: c1 e8 07 48 8d 04 c2 48 8b 00 49 89 fc 49 89 f5 48 89 c3 48 83 e3 fe 48 83 f8 01 77 0f eb 2d 0f 1f
    44 00 00 48 8b 1b 48 85 db <74> 20 39 6b 18 75 f3 48 8d 7b 78 e8 ba 85 d0 00 4c 39 63 10 74 1f
     RSP: 0018:ff745a70c8253898 EFLAGS: 00000282
     RAX: ff26e470054cb208 RBX: ff26e470054cb208 RCX: 000000006e958966
     RDX: ff26e48267340000 RSI: ff745a70c82539b0 RDI: ff26e458f74655c0
     RBP: 000000006e958966 R08: 0000000000000180 R09: 9cd08d909b919a89
     R10: ff26e458f74655c0 R11: 0000000000000000 R12: ff26e458f74655c0
     R13: ff745a70c82539b0 R14: d0d0d0d0d0d0d0d0 R15: 2f2f2f2f2f2f2f2f
     FS:  00007f5770896980(0000) GS:ff26e482c5d88000(0000) knlGS:0000000000000000
     CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
     CR2: 00007f5764de50c0 CR3: 000000a72abb5001 CR4: 0000000000771ef0
     PKRU: 55555554
     Call Trace:
      <TASK>
      lookup_fast+0x9f/0x100
      walk_component+0x1f/0x150
      link_path_walk+0x20e/0x3d0
      path_lookupat+0x68/0x180
      filename_lookup+0xdc/0x1e0
      vfs_statx+0x6c/0x140
      vfs_fstatat+0x67/0xa0
      __do_sys_newfstatat+0x24/0x60
      do_syscall_64+0x6a/0x230
      entry_SYSCALL_64_after_hwframe+0x76/0x7e

    This is reachable with reused cached negative dentries.  A Ceph lookup
    or atomic_open can be handed a negative dentry that is already hashed,
    and fs/ceph/dir.c then hits one of two paths that incorrectly assume
    negative also means unhashed:

      - ceph_finish_lookup():
          MDS reply is -ENOENT with no trace
          -> d_add(dentry, NULL)

      - ceph_lookup():
          local ENOENT fast path for a complete directory with shared caps
          -> d_add(dentry, NULL)

    Both paths can therefore re-add an already-hashed negative dentry.

    Ceph already uses the correct pattern elsewhere: ceph_fill_trace() only
    calls d_add(dn, NULL) for a negative null-dentry reply when d_unhashed(dn)
    is true.

    Fix both fs/ceph/dir.c sites the same way: only call d_add() for a
    negative dentry when it is actually unhashed.  If the negative dentry
    is already hashed, leave it in place and reuse it as-is.

    This preserves the existing behavior for unhashed dentries while
    avoiding d_hash list corruption for reused hashed negatives.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  # https://src.uniontech.com/#/security_advisory_detail?utsa_id=UTSA-2026-053338
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?c5c7feaf");
  # https://lore.kernel.org/linux-cve-announce/2026052754-CVE-2026-46052-d212@gregkh
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?5c2c1189");
  script_set_attribute(attribute:"see_also", value:"https://nvd.nist.gov/vuln/detail/CVE-2026-46052");
  script_set_attribute(attribute:"solution", value:
"Update the affected kernel package.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-46052");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/05/26");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/07/27");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/09/06");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Unity Linux Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info2.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/UOS-Server/release", "Host/UOS-Server/rpm-list", "Host/cpu");

  exit(0);
}
include('rpm2.inc');

if (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
var os_product = get_kb_item('installed_os/local/SSH/0/product');
if (isnull(os_product) || 'UOS Server' >!< os_product) audit(AUDIT_OS_NOT, 'UOS Server');
var os_version = get_kb_item('installed_os/local/SSH/0/version');
if (isnull(os_version)) audit(AUDIT_UNKNOWN_APP_VER, 'UOS Server');
if (! preg(pattern:"^(20.1050a)([^0-9]|$)", string:os_version)) audit(AUDIT_OS_NOT, 'UOS Server 20.1050a', 'UOS Server ' + os_version);

if (!get_kb_item('Host/UOS-Server/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('aarch64' >!< cpu && 'amd64' >!< cpu && 'loongarch64' >!< cpu && 'x86_64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'UOS Server', cpu);


var constraints = [
  {
    'release': '20',
    'sp': '1050a',
    'pkgs': [
      {'reference':'kernel-4.19.0-91.82.132.24.uelc20', 'sp':'1050a', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-4.19.0-91.82.132.24.uelc20', 'sp':'1050a', 'cpu':'amd64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-4.19.0-91.82.132.24.uelc20', 'sp':'1050a', 'cpu':'loongarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-4.19.0-91.82.132.24.uelc20', 'sp':'1050a', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE}
    ]
  }
];

var os_release = get_one_kb_item('installed_os/local/SSH/0/release');
var os_sp = get_one_kb_item('Host/*/minor_release');

var flag = 0;
var reference;
var sp;
var _cpu;
var el_string;
var rpm_spec_vers_cmp;
var epoch;
var allowmaj;
var exists_check;
var cves;
foreach var constraint ( constraints ) {
  # Check that the target release is equal to the affected release
  if (!empty_or_null(constraint['release'])){
    if (constraint['release'] != os_release) continue;
  }
  if (!empty_or_null(constraint['sp'])){
    if (constraint['sp'] != os_sp) continue;
  }
  foreach var pkg ( constraint['pkgs'] ) {
    reference = NULL;
    sp = NULL;
    _cpu = NULL;
    el_string = NULL;
    rpm_spec_vers_cmp = NULL;
    epoch = NULL;
    allowmaj = NULL;
    exists_check = NULL;
    cves = NULL;
    if (!empty_or_null(pkg['reference'])) reference = pkg['reference'];
    if (!empty_or_null(pkg['sp'])) sp = pkg['sp'];
    if (!empty_or_null(pkg['cpu'])) _cpu = pkg['cpu'];
    if (!empty_or_null(pkg['el_string'])) el_string = pkg['el_string'];
    if (!empty_or_null(pkg['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = pkg['rpm_spec_vers_cmp'];
    if (!empty_or_null(pkg['epoch'])) epoch = pkg['epoch'];
    if (!empty_or_null(pkg['allowmaj'])) allowmaj = pkg['allowmaj'];
    if (!empty_or_null(pkg['exists_check'])) exists_check = pkg['exists_check'];
    if (!empty_or_null(pkg['cves'])) cves = pkg['cves'];
    if (reference &&
        ## (no known rpm to check OR known rpm_exists)
        (!exists_check || rpm_exists(rpm:exists_check)) &&
        rpm_check(sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj, cves:cves)) flag++;
  }
}


if (flag)
{
  security_report_v4(
      port       : 0,
      severity   : SECURITY_HOLE,
      extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'kernel');
}