Unity Linux 20.1050a Security Update: kernel (UTSA-2026-098678)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(340534);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/08/28");

  script_cve_id("CVE-2025-38211");

  script_name(english:"Unity Linux 20.1050a Security Update: kernel (UTSA-2026-098678)");

  script_set_attribute(attribute:"synopsis", value:
"The Unity Linux host is missing one or more security updates.");
  script_set_attribute(attribute:"description", value:
"The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the
UTSA-2026-098678 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    RDMA/iwcm: Fix use-after-free of work objects after cm_id destruction

    The commit 59c68ac31e15 (iw_cm: free cm_id resources on the last
    deref) simplified cm_id resource management by freeing cm_id once all
    references to the cm_id were removed. The references are removed either
    upon completion of iw_cm event handlers or when the application destroys
    the cm_id. This commit introduced the use-after-free condition where
    cm_id_private object could still be in use by event handler works during
    the destruction of cm_id. The commit aee2424246f9 (RDMA/iwcm: Fix a
    use-after-free related to destroying CM IDs) addressed this use-after-
    free by flushing all pending works at the cm_id destruction.

    However, still another use-after-free possibility remained. It happens
    with the work objects allocated for each cm_id_priv within
    alloc_work_entries() during cm_id creation, and subsequently freed in
    dealloc_work_entries() once all references to the cm_id are removed.
    If the cm_id's last reference is decremented in the event handler work,
    the work object for the work itself gets removed, and causes the use-
    after-free BUG below:

      BUG: KASAN: slab-use-after-free in __pwq_activate_work+0x1ff/0x250
      Read of size 8 at addr ffff88811f9cf800 by task kworker/u16:1/147091

      CPU: 2 UID: 0 PID: 147091 Comm: kworker/u16:1 Not tainted 6.15.0-rc2+ #27 PREEMPT(voluntary)
      Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-3.fc41 04/01/2014
      Workqueue:  0x0 (iw_cm_wq)
      Call Trace:
       <TASK>
       dump_stack_lvl+0x6a/0x90
       print_report+0x174/0x554
       ? __virt_addr_valid+0x208/0x430
       ? __pwq_activate_work+0x1ff/0x250
       kasan_report+0xae/0x170
       ? __pwq_activate_work+0x1ff/0x250
       __pwq_activate_work+0x1ff/0x250
       pwq_dec_nr_in_flight+0x8c5/0xfb0
       process_one_work+0xc11/0x1460
       ? __pfx_process_one_work+0x10/0x10
       ? assign_work+0x16c/0x240
       worker_thread+0x5ef/0xfd0
       ? __pfx_worker_thread+0x10/0x10
       kthread+0x3b0/0x770
       ? __pfx_kthread+0x10/0x10
       ? rcu_is_watching+0x11/0xb0
       ? _raw_spin_unlock_irq+0x24/0x50
       ? rcu_is_watching+0x11/0xb0
       ? __pfx_kthread+0x10/0x10
       ret_from_fork+0x30/0x70
       ? __pfx_kthread+0x10/0x10
       ret_from_fork_asm+0x1a/0x30
       </TASK>

      Allocated by task 147416:
       kasan_save_stack+0x2c/0x50
       kasan_save_track+0x10/0x30
       __kasan_kmalloc+0xa6/0xb0
       alloc_work_entries+0xa9/0x260 [iw_cm]
       iw_cm_connect+0x23/0x4a0 [iw_cm]
       rdma_connect_locked+0xbfd/0x1920 [rdma_cm]
       nvme_rdma_cm_handler+0x8e5/0x1b60 [nvme_rdma]
       cma_cm_event_handler+0xae/0x320 [rdma_cm]
       cma_work_handler+0x106/0x1b0 [rdma_cm]
       process_one_work+0x84f/0x1460
       worker_thread+0x5ef/0xfd0
       kthread+0x3b0/0x770
       ret_from_fork+0x30/0x70
       ret_from_fork_asm+0x1a/0x30

      Freed by task 147091:
       kasan_save_stack+0x2c/0x50
       kasan_save_track+0x10/0x30
       kasan_save_free_info+0x37/0x60
       __kasan_slab_free+0x4b/0x70
       kfree+0x13a/0x4b0
       dealloc_work_entries+0x125/0x1f0 [iw_cm]
       iwcm_deref_id+0x6f/0xa0 [iw_cm]
       cm_work_handler+0x136/0x1ba0 [iw_cm]
       process_one_work+0x84f/0x1460
       worker_thread+0x5ef/0xfd0
       kthread+0x3b0/0x770
       ret_from_fork+0x30/0x70
       ret_from_fork_asm+0x1a/0x30

      Last potentially related work creation:
       kasan_save_stack+0x2c/0x50
       kasan_record_aux_stack+0xa3/0xb0
       __queue_work+0x2ff/0x1390
       queue_work_on+0x67/0xc0
       cm_event_handler+0x46a/0x820 [iw_cm]
       siw_cm_upcall+0x330/0x650 [siw]
       siw_cm_work_handler+0x6b9/0x2b20 [siw]
       process_one_work+0x84f/0x1460
       worker_thread+0x5ef/0xfd0
       kthread+0x3b0/0x770
       ret_from_fork+0x30/0x70
       ret_from_fork_asm+0x1a/0x30

    This BUG is reproducible by repeating the blktests test case nvme/061
    for the rdma transport and the siw driver.

    To avoid the use-after-free of cm_id_private work objects, ensure that
    the last reference to the cm_id is decremented not in the event handler
    works, but in the cm_id destruction context. For that purpose, mo
    ---truncated---

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  # https://src.uniontech.com/#/security_advisory_detail?utsa_id=UTSA-2026-098678
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?d2e8698c");
  # https://lore.kernel.org/linux-cve-announce/2025070422-CVE-2025-38211-215a@gregkh
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?fdf2eda2");
  script_set_attribute(attribute:"see_also", value:"https://nvd.nist.gov/vuln/detail/CVE-2025-38211");
  script_set_attribute(attribute:"solution", value:
"Update the affected kernel package.");
  script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:S/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2025-38211");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2025/07/04");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/08/10");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/08/26");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Unity Linux Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info2.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/UOS-Server/release", "Host/UOS-Server/rpm-list", "Host/cpu");

  exit(0);
}
include('rpm2.inc');

if (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
var os_product = get_kb_item('installed_os/local/SSH/0/product');
if (isnull(os_product) || 'UOS Server' >!< os_product) audit(AUDIT_OS_NOT, 'UOS Server');
var os_version = get_kb_item('installed_os/local/SSH/0/version');
if (isnull(os_version)) audit(AUDIT_UNKNOWN_APP_VER, 'UOS Server');
if (! preg(pattern:"^(20.1050a)([^0-9]|$)", string:os_version)) audit(AUDIT_OS_NOT, 'UOS Server 20.1050a', 'UOS Server ' + os_version);

if (!get_kb_item('Host/UOS-Server/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('aarch64' >!< cpu && 'amd64' >!< cpu && 'loongarch64' >!< cpu && 'x86_64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'UOS Server', cpu);


var constraints = [
  {
    'release': '20',
    'sp': '1050a',
    'pkgs': [
      {'reference':'kernel-4.19.0-91.82.132.24.uelc20', 'sp':'1050a', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-4.19.0-91.82.132.24.uelc20', 'sp':'1050a', 'cpu':'amd64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-4.19.0-91.82.132.24.uelc20', 'sp':'1050a', 'cpu':'loongarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-4.19.0-91.82.132.24.uelc20', 'sp':'1050a', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE}
    ]
  }
];

var os_release = get_one_kb_item('installed_os/local/SSH/0/release');
var os_sp = get_one_kb_item('Host/*/minor_release');

var flag = 0;
var reference;
var sp;
var _cpu;
var el_string;
var rpm_spec_vers_cmp;
var epoch;
var allowmaj;
var exists_check;
var cves;
foreach var constraint ( constraints ) {
  # Check that the target release is equal to the affected release
  if (!empty_or_null(constraint['release'])){
    if (constraint['release'] != os_release) continue;
  }
  if (!empty_or_null(constraint['sp'])){
    if (constraint['sp'] != os_sp) continue;
  }
  foreach var pkg ( constraint['pkgs'] ) {
    reference = NULL;
    sp = NULL;
    _cpu = NULL;
    el_string = NULL;
    rpm_spec_vers_cmp = NULL;
    epoch = NULL;
    allowmaj = NULL;
    exists_check = NULL;
    cves = NULL;
    if (!empty_or_null(pkg['reference'])) reference = pkg['reference'];
    if (!empty_or_null(pkg['sp'])) sp = pkg['sp'];
    if (!empty_or_null(pkg['cpu'])) _cpu = pkg['cpu'];
    if (!empty_or_null(pkg['el_string'])) el_string = pkg['el_string'];
    if (!empty_or_null(pkg['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = pkg['rpm_spec_vers_cmp'];
    if (!empty_or_null(pkg['epoch'])) epoch = pkg['epoch'];
    if (!empty_or_null(pkg['allowmaj'])) allowmaj = pkg['allowmaj'];
    if (!empty_or_null(pkg['exists_check'])) exists_check = pkg['exists_check'];
    if (!empty_or_null(pkg['cves'])) cves = pkg['cves'];
    if (reference &&
        ## (no known rpm to check OR known rpm_exists)
        (!exists_check || rpm_exists(rpm:exists_check)) &&
        rpm_check(sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj, cves:cves)) flag++;
  }
}


if (flag)
{
  security_report_v4(
      port       : 0,
      severity   : SECURITY_WARNING,
      extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'kernel');
}