Unity Linux 20.1050a Security Update: kernel (UTSA-2026-098699)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(340297);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/08/26");

  script_cve_id("CVE-2025-23143");

  script_name(english:"Unity Linux 20.1050a Security Update: kernel (UTSA-2026-098699)");

  script_set_attribute(attribute:"synopsis", value:
"The Unity Linux host is missing one or more security updates.");
  script_set_attribute(attribute:"description", value:
"The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the
UTSA-2026-098699 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    net: Fix null-ptr-deref by sock_lock_init_class_and_name() and rmmod.

    When I ran the repro [0] and waited a few seconds, I observed two
    LOCKDEP splats: a warning immediately followed by a null-ptr-deref. [1]

    Reproduction Steps:

      1) Mount CIFS
      2) Add an iptables rule to drop incoming FIN packets for CIFS
      3) Unmount CIFS
      4) Unload the CIFS module
      5) Remove the iptables rule

    At step 3), the CIFS module calls sock_release() for the underlying
    TCP socket, and it returns quickly.  However, the socket remains in
    FIN_WAIT_1 because incoming FIN packets are dropped.

    At this point, the module's refcnt is 0 while the socket is still
    alive, so the following rmmod command succeeds.

      # ss -tan
      State      Recv-Q Send-Q Local Address:Port  Peer Address:Port
      FIN-WAIT-1 0      477        10.0.2.15:51062   10.0.0.137:445

      # lsmod | grep cifs
      cifs                 1159168  0

    This highlights a discrepancy between the lifetime of the CIFS module
    and the underlying TCP socket.  Even after CIFS calls sock_release()
    and it returns, the TCP socket does not die immediately in order to
    close the connection gracefully.

    While this is generally fine, it causes an issue with LOCKDEP because
    CIFS assigns a different lock class to the TCP socket's sk->sk_lock
    using sock_lock_init_class_and_name().

    Once an incoming packet is processed for the socket or a timer fires,
    sk->sk_lock is acquired.

    Then, LOCKDEP checks the lock context in check_wait_context(), where
    hlock_class() is called to retrieve the lock class.  However, since
    the module has already been unloaded, hlock_class() logs a warning
    and returns NULL, triggering the null-ptr-deref.

    If LOCKDEP is enabled, we must ensure that a module calling
    sock_lock_init_class_and_name() (CIFS, NFS, etc) cannot be unloaded
    while such a socket is still alive to prevent this issue.

    Let's hold the module reference in sock_lock_init_class_and_name()
    and release it when the socket is freed in sk_prot_free().

    Note that sock_lock_init() clears sk->sk_owner for svc_create_socket()
    that calls sock_lock_init_class_and_name() for a listening socket,
    which clones a socket by sk_clone_lock() without GFP_ZERO.

    [0]:
    CIFS_SERVER=10.0.0.137
    CIFS_PATH=//${CIFS_SERVER}/Users/Administrator/Desktop/CIFS_TEST
    DEV=enp0s3
    CRED=/root/WindowsCredential.txt

    MNT=$(mktemp -d /tmp/XXXXXX)
    mount -t cifs ${CIFS_PATH} ${MNT} -o vers=3.0,credentials=${CRED},cache=none,echo_interval=1

    iptables -A INPUT -s ${CIFS_SERVER} -j DROP

    for i in $(seq 10);
    do
        umount ${MNT}
        rmmod cifs
        sleep 1
    done

    rm -r ${MNT}

    iptables -D INPUT -s ${CIFS_SERVER} -j DROP

    [1]:
    DEBUG_LOCKS_WARN_ON(1)
    WARNING: CPU: 10 PID: 0 at kernel/locking/lockdep.c:234 hlock_class (kernel/locking/lockdep.c:234
    kernel/locking/lockdep.c:223)
    Modules linked in: cifs_arc4 nls_ucs2_utils cifs_md4 [last unloaded: cifs]
    CPU: 10 UID: 0 PID: 0 Comm: swapper/10 Not tainted 6.14.0 #36
    Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org
    04/01/2014
    RIP: 0010:hlock_class (kernel/locking/lockdep.c:234 kernel/locking/lockdep.c:223)
    ...
    Call Trace:
     <IRQ>
     __lock_acquire (kernel/locking/lockdep.c:4853 kernel/locking/lockdep.c:5178)
     lock_acquire (kernel/locking/lockdep.c:469 kernel/locking/lockdep.c:5853 kernel/locking/lockdep.c:5816)
     _raw_spin_lock_nested (kernel/locking/spinlock.c:379)
     tcp_v4_rcv (./include/linux/skbuff.h:1678 ./include/net/tcp.h:2547 net/ipv4/tcp_ipv4.c:2350)
    ...

    BUG: kernel NULL pointer dereference, address: 00000000000000c4
     PF: supervisor read access in kernel mode
     PF: error_code(0x0000) - not-present page
    PGD 0
    Oops: Oops: 0000 [#1] PREEMPT SMP NOPTI
    CPU: 10 UID: 0 PID: 0 Comm: swapper/10 Tainted: G        W          6.14.0 #36
    Tainted: [W]=WARN
    Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org
    04/01/2014
    RIP: 0010:__lock_acquire (kernel/
    ---truncated---

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  # https://src.uniontech.com/#/security_advisory_detail?utsa_id=UTSA-2026-098699
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?12195c62");
  # https://lore.kernel.org/linux-cve-announce/2025050125-CVE-2025-23143-6019@gregkh
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?4f8407da");
  script_set_attribute(attribute:"see_also", value:"https://nvd.nist.gov/vuln/detail/CVE-2025-23143");
  script_set_attribute(attribute:"solution", value:
"Update the affected kernel package.");
  script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:S/C:N/I:N/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2025-23143");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2025/05/01");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/08/10");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/08/26");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Unity Linux Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info2.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/UOS-Server/release", "Host/UOS-Server/rpm-list", "Host/cpu");

  exit(0);
}
include('rpm2.inc');

if (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
var os_product = get_kb_item('installed_os/local/SSH/0/product');
if (isnull(os_product) || 'UOS Server' >!< os_product) audit(AUDIT_OS_NOT, 'UOS Server');
var os_version = get_kb_item('installed_os/local/SSH/0/version');
if (isnull(os_version)) audit(AUDIT_UNKNOWN_APP_VER, 'UOS Server');
if (! preg(pattern:"^20.1050a([^0-9]|$)", string:os_version)) audit(AUDIT_OS_NOT, 'UOS Server 20.1050a', 'UOS Server ' + os_version);

if (!get_kb_item('Host/UOS-Server/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('aarch64' >!< cpu && 'amd64' >!< cpu && 'loongarch64' >!< cpu && 'x86_64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'UOS Server', cpu);


var constraints = [
  {
    'release': '20',
    'sp': '1050a',
    'pkgs': [
      {'reference':'kernel-4.19.0-91.82.132.24.uelc20', 'sp':'1050a', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-4.19.0-91.82.132.24.uelc20', 'sp':'1050a', 'cpu':'amd64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-4.19.0-91.82.132.24.uelc20', 'sp':'1050a', 'cpu':'loongarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-4.19.0-91.82.132.24.uelc20', 'sp':'1050a', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE}
    ]
  }
];

var os_release = get_one_kb_item('installed_os/local/SSH/0/release');
var os_sp = get_one_kb_item('Host/*/minor_release');

var flag = 0;
var reference;
var sp;
var _cpu;
var el_string;
var rpm_spec_vers_cmp;
var epoch;
var allowmaj;
var exists_check;
var cves;
foreach var constraint ( constraints ) {
  # Check that the target release is equal to the affected release
  if (!empty_or_null(constraint['release'])){
    if (constraint['release'] != os_release) continue;
  }
  if (!empty_or_null(constraint['sp'])){
    if (constraint['sp'] != os_sp) continue;
  }
  foreach var pkg ( constraint['pkgs'] ) {
    reference = NULL;
    sp = NULL;
    _cpu = NULL;
    el_string = NULL;
    rpm_spec_vers_cmp = NULL;
    epoch = NULL;
    allowmaj = NULL;
    exists_check = NULL;
    cves = NULL;
    if (!empty_or_null(pkg['reference'])) reference = pkg['reference'];
    if (!empty_or_null(pkg['sp'])) sp = pkg['sp'];
    if (!empty_or_null(pkg['cpu'])) _cpu = pkg['cpu'];
    if (!empty_or_null(pkg['el_string'])) el_string = pkg['el_string'];
    if (!empty_or_null(pkg['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = pkg['rpm_spec_vers_cmp'];
    if (!empty_or_null(pkg['epoch'])) epoch = pkg['epoch'];
    if (!empty_or_null(pkg['allowmaj'])) allowmaj = pkg['allowmaj'];
    if (!empty_or_null(pkg['exists_check'])) exists_check = pkg['exists_check'];
    if (!empty_or_null(pkg['cves'])) cves = pkg['cves'];
    if (reference &&
        ## (no known rpm to check OR known rpm_exists)
        (!exists_check || rpm_exists(rpm:exists_check)) &&
        rpm_check(sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj, cves:cves)) flag++;
  }
}


if (flag)
{
  security_report_v4(
      port       : 0,
      severity   : SECURITY_WARNING,
      extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'kernel');
}