Unity Linux 20.1050a Security Update: kernel (UTSA-2026-098683)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(340203);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/08/26");

  script_cve_id("CVE-2025-38051");

  script_name(english:"Unity Linux 20.1050a Security Update: kernel (UTSA-2026-098683)");

  script_set_attribute(attribute:"synopsis", value:
"The Unity Linux host is missing one or more security updates.");
  script_set_attribute(attribute:"description", value:
"The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the
UTSA-2026-098683 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    smb: client: Fix use-after-free in cifs_fill_dirent

    There is a race condition in the readdir concurrency process, which may
    access the rsp buffer after it has been released, triggering the
    following KASAN warning.

     ==================================================================
     BUG: KASAN: slab-use-after-free in cifs_fill_dirent+0xb03/0xb60 [cifs]
     Read of size 4 at addr ffff8880099b819c by task a.out/342975

     CPU: 2 UID: 0 PID: 342975 Comm: a.out Not tainted 6.15.0-rc6+ #240 PREEMPT(full)
     Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.1-2.fc37 04/01/2014
     Call Trace:
      <TASK>
      dump_stack_lvl+0x53/0x70
      print_report+0xce/0x640
      kasan_report+0xb8/0xf0
      cifs_fill_dirent+0xb03/0xb60 [cifs]
      cifs_readdir+0x12cb/0x3190 [cifs]
      iterate_dir+0x1a1/0x520
      __x64_sys_getdents+0x134/0x220
      do_syscall_64+0x4b/0x110
      entry_SYSCALL_64_after_hwframe+0x76/0x7e
     RIP: 0033:0x7f996f64b9f9
     Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89
     f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01
     f0 ff ff  0d f7 c3 0c 00 f7 d8 64 89 8
     RSP: 002b:00007f996f53de78 EFLAGS: 00000207 ORIG_RAX: 000000000000004e
     RAX: ffffffffffffffda RBX: 00007f996f53ecdc RCX: 00007f996f64b9f9
     RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000003
     RBP: 00007f996f53dea0 R08: 0000000000000000 R09: 0000000000000000
     R10: 0000000000000000 R11: 0000000000000207 R12: ffffffffffffff88
     R13: 0000000000000000 R14: 00007ffc8cd9a500 R15: 00007f996f51e000
      </TASK>

     Allocated by task 408:
      kasan_save_stack+0x20/0x40
      kasan_save_track+0x14/0x30
      __kasan_slab_alloc+0x6e/0x70
      kmem_cache_alloc_noprof+0x117/0x3d0
      mempool_alloc_noprof+0xf2/0x2c0
      cifs_buf_get+0x36/0x80 [cifs]
      allocate_buffers+0x1d2/0x330 [cifs]
      cifs_demultiplex_thread+0x22b/0x2690 [cifs]
      kthread+0x394/0x720
      ret_from_fork+0x34/0x70
      ret_from_fork_asm+0x1a/0x30

     Freed by task 342979:
      kasan_save_stack+0x20/0x40
      kasan_save_track+0x14/0x30
      kasan_save_free_info+0x3b/0x60
      __kasan_slab_free+0x37/0x50
      kmem_cache_free+0x2b8/0x500
      cifs_buf_release+0x3c/0x70 [cifs]
      cifs_readdir+0x1c97/0x3190 [cifs]
      iterate_dir+0x1a1/0x520
      __x64_sys_getdents64+0x134/0x220
      do_syscall_64+0x4b/0x110
      entry_SYSCALL_64_after_hwframe+0x76/0x7e

     The buggy address belongs to the object at ffff8880099b8000
      which belongs to the cache cifs_request of size 16588
     The buggy address is located 412 bytes inside of
      freed 16588-byte region [ffff8880099b8000, ffff8880099bc0cc)

     The buggy address belongs to the physical page:
     page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x99b8
     head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
     anon flags: 0x80000000000040(head|node=0|zone=1)
     page_type: f5(slab)
     raw: 0080000000000040 ffff888001e03400 0000000000000000 dead000000000001
     raw: 0000000000000000 0000000000010001 00000000f5000000 0000000000000000
     head: 0080000000000040 ffff888001e03400 0000000000000000 dead000000000001
     head: 0000000000000000 0000000000010001 00000000f5000000 0000000000000000
     head: 0080000000000003 ffffea0000266e01 00000000ffffffff 00000000ffffffff
     head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008
     page dumped because: kasan: bad access detected

     Memory state around the buggy address:
      ffff8880099b8080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
      ffff8880099b8100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
     >ffff8880099b8180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
                                 ^
      ffff8880099b8200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
      ffff8880099b8280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
     ==================================================================

    POC is available in the link [1].

    The problem triggering process is as follows:

    Process 1                       Process 2
    -----------------------------------
    ---truncated---

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  # https://src.uniontech.com/#/security_advisory_detail?utsa_id=UTSA-2026-098683
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?bd7357bc");
  # https://lore.kernel.org/linux-cve-announce/2025061831-CVE-2025-38051-77da@gregkh
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?b4a5095c");
  script_set_attribute(attribute:"see_also", value:"https://nvd.nist.gov/vuln/detail/CVE-2025-38051");
  script_set_attribute(attribute:"solution", value:
"Update the affected kernel package.");
  script_set_cvss_base_vector("CVSS2#AV:L/AC:H/Au:S/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2025-38051");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2025/06/12");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/08/10");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/08/26");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Unity Linux Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info2.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/UOS-Server/release", "Host/UOS-Server/rpm-list", "Host/cpu");

  exit(0);
}
include('rpm2.inc');

if (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
var os_product = get_kb_item('installed_os/local/SSH/0/product');
if (isnull(os_product) || 'UOS Server' >!< os_product) audit(AUDIT_OS_NOT, 'UOS Server');
var os_version = get_kb_item('installed_os/local/SSH/0/version');
if (isnull(os_version)) audit(AUDIT_UNKNOWN_APP_VER, 'UOS Server');
if (! preg(pattern:"^20.1050a([^0-9]|$)", string:os_version)) audit(AUDIT_OS_NOT, 'UOS Server 20.1050a', 'UOS Server ' + os_version);

if (!get_kb_item('Host/UOS-Server/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('aarch64' >!< cpu && 'amd64' >!< cpu && 'loongarch64' >!< cpu && 'x86_64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'UOS Server', cpu);


var constraints = [
  {
    'release': '20',
    'sp': '1050a',
    'pkgs': [
      {'reference':'kernel-4.19.0-91.82.132.24.uelc20', 'sp':'1050a', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-4.19.0-91.82.132.24.uelc20', 'sp':'1050a', 'cpu':'amd64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-4.19.0-91.82.132.24.uelc20', 'sp':'1050a', 'cpu':'loongarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-4.19.0-91.82.132.24.uelc20', 'sp':'1050a', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE}
    ]
  }
];

var os_release = get_one_kb_item('installed_os/local/SSH/0/release');
var os_sp = get_one_kb_item('Host/*/minor_release');

var flag = 0;
var reference;
var sp;
var _cpu;
var el_string;
var rpm_spec_vers_cmp;
var epoch;
var allowmaj;
var exists_check;
var cves;
foreach var constraint ( constraints ) {
  # Check that the target release is equal to the affected release
  if (!empty_or_null(constraint['release'])){
    if (constraint['release'] != os_release) continue;
  }
  if (!empty_or_null(constraint['sp'])){
    if (constraint['sp'] != os_sp) continue;
  }
  foreach var pkg ( constraint['pkgs'] ) {
    reference = NULL;
    sp = NULL;
    _cpu = NULL;
    el_string = NULL;
    rpm_spec_vers_cmp = NULL;
    epoch = NULL;
    allowmaj = NULL;
    exists_check = NULL;
    cves = NULL;
    if (!empty_or_null(pkg['reference'])) reference = pkg['reference'];
    if (!empty_or_null(pkg['sp'])) sp = pkg['sp'];
    if (!empty_or_null(pkg['cpu'])) _cpu = pkg['cpu'];
    if (!empty_or_null(pkg['el_string'])) el_string = pkg['el_string'];
    if (!empty_or_null(pkg['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = pkg['rpm_spec_vers_cmp'];
    if (!empty_or_null(pkg['epoch'])) epoch = pkg['epoch'];
    if (!empty_or_null(pkg['allowmaj'])) allowmaj = pkg['allowmaj'];
    if (!empty_or_null(pkg['exists_check'])) exists_check = pkg['exists_check'];
    if (!empty_or_null(pkg['cves'])) cves = pkg['cves'];
    if (reference &&
        ## (no known rpm to check OR known rpm_exists)
        (!exists_check || rpm_exists(rpm:exists_check)) &&
        rpm_check(sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj, cves:cves)) flag++;
  }
}


if (flag)
{
  security_report_v4(
      port       : 0,
      severity   : SECURITY_WARNING,
      extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'kernel');
}