Unity Linux 20.1050a Security Update: kernel (UTSA-2026-098770)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(340272);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/08/28");

  script_cve_id("CVE-2025-40280");

  script_name(english:"Unity Linux 20.1050a Security Update: kernel (UTSA-2026-098770)");

  script_set_attribute(attribute:"synopsis", value:
"The Unity Linux host is missing one or more security updates.");
  script_set_attribute(attribute:"description", value:
"The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the
UTSA-2026-098770 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    tipc: Fix use-after-free in tipc_mon_reinit_self().

    syzbot reported use-after-free of tipc_net(net)->monitors[]
    in tipc_mon_reinit_self(). [0]

    The array is protected by RTNL, but tipc_mon_reinit_self()
    iterates over it without RTNL.

    tipc_mon_reinit_self() is called from tipc_net_finalize(),
    which is always under RTNL except for tipc_net_finalize_work().

    Let's hold RTNL in tipc_net_finalize_work().

    [0]:
    BUG: KASAN: slab-use-after-free in __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
    BUG: KASAN: slab-use-after-free in _raw_spin_lock_irqsave+0xa7/0xf0 kernel/locking/spinlock.c:162
    Read of size 1 at addr ffff88805eae1030 by task kworker/0:7/5989

    CPU: 0 UID: 0 PID: 5989 Comm: kworker/0:7 Not tainted syzkaller #0 PREEMPT_{RT,(full)}
    Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025
    Workqueue: events tipc_net_finalize_work
    Call Trace:
     <TASK>
     dump_stack_lvl+0x189/0x250 lib/dump_stack.c:120
     print_address_description mm/kasan/report.c:378 [inline]
     print_report+0xca/0x240 mm/kasan/report.c:482
     kasan_report+0x118/0x150 mm/kasan/report.c:595
     __kasan_check_byte+0x2a/0x40 mm/kasan/common.c:568
     kasan_check_byte include/linux/kasan.h:399 [inline]
     lock_acquire+0x8d/0x360 kernel/locking/lockdep.c:5842
     __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
     _raw_spin_lock_irqsave+0xa7/0xf0 kernel/locking/spinlock.c:162
     rtlock_slowlock kernel/locking/rtmutex.c:1894 [inline]
     rwbase_rtmutex_lock_state kernel/locking/spinlock_rt.c:160 [inline]
     rwbase_write_lock+0xd3/0x7e0 kernel/locking/rwbase_rt.c:244
     rt_write_lock+0x76/0x110 kernel/locking/spinlock_rt.c:243
     write_lock_bh include/linux/rwlock_rt.h:99 [inline]
     tipc_mon_reinit_self+0x79/0x430 net/tipc/monitor.c:718
     tipc_net_finalize+0x115/0x190 net/tipc/net.c:140
     process_one_work kernel/workqueue.c:3236 [inline]
     process_scheduled_works+0xade/0x17b0 kernel/workqueue.c:3319
     worker_thread+0x8a0/0xda0 kernel/workqueue.c:3400
     kthread+0x70e/0x8a0 kernel/kthread.c:463
     ret_from_fork+0x439/0x7d0 arch/x86/kernel/process.c:148
     ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
     </TASK>

    Allocated by task 6089:
     kasan_save_stack mm/kasan/common.c:47 [inline]
     kasan_save_track+0x3e/0x80 mm/kasan/common.c:68
     poison_kmalloc_redzone mm/kasan/common.c:388 [inline]
     __kasan_kmalloc+0x93/0xb0 mm/kasan/common.c:405
     kasan_kmalloc include/linux/kasan.h:260 [inline]
     __kmalloc_cache_noprof+0x1a8/0x320 mm/slub.c:4407
     kmalloc_noprof include/linux/slab.h:905 [inline]
     kzalloc_noprof include/linux/slab.h:1039 [inline]
     tipc_mon_create+0xc3/0x4d0 net/tipc/monitor.c:657
     tipc_enable_bearer net/tipc/bearer.c:357 [inline]
     __tipc_nl_bearer_enable+0xe16/0x13f0 net/tipc/bearer.c:1047
     __tipc_nl_compat_doit net/tipc/netlink_compat.c:371 [inline]
     tipc_nl_compat_doit+0x3bc/0x5f0 net/tipc/netlink_compat.c:393
     tipc_nl_compat_handle net/tipc/netlink_compat.c:-1 [inline]
     tipc_nl_compat_recv+0x83c/0xbe0 net/tipc/netlink_compat.c:1321
     genl_family_rcv_msg_doit+0x215/0x300 net/netlink/genetlink.c:1115
     genl_family_rcv_msg net/netlink/genetlink.c:1195 [inline]
     genl_rcv_msg+0x60e/0x790 net/netlink/genetlink.c:1210
     netlink_rcv_skb+0x208/0x470 net/netlink/af_netlink.c:2552
     genl_rcv+0x28/0x40 net/netlink/genetlink.c:1219
     netlink_unicast_kernel net/netlink/af_netlink.c:1320 [inline]
     netlink_unicast+0x846/0xa10 net/netlink/af_netlink.c:1346
     netlink_sendmsg+0x805/0xb30 net/netlink/af_netlink.c:1896
     sock_sendmsg_nosec net/socket.c:714 [inline]
     __sock_sendmsg+0x21c/0x270 net/socket.c:729
     ____sys_sendmsg+0x508/0x820 net/socket.c:2614
     ___sys_sendmsg+0x21f/0x2a0 net/socket.c:2668
     __sys_sendmsg net/socket.c:2700 [inline]
     __do_sys_sendmsg net/socket.c:2705 [inline]
     __se_sys_sendmsg net/socket.c:2703 [inline]
     __x64_sys_sendmsg+0x1a1/0x260 net/socket.c:2703
     do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
     do_syscall_64+0xfa/0x3b0 arch/
    ---truncated---

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  # https://src.uniontech.com/#/security_advisory_detail?utsa_id=UTSA-2026-098770
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?0c8fb1a3");
  # https://git.kernel.org/stable/c/0725e6afb55128be21a2ca36e9674f573ccec173
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?919fc5ea");
  # https://git.kernel.org/stable/c/499b5fa78d525c4450ebb76db83207db71efea77
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?4d602087");
  # https://git.kernel.org/stable/c/51b8f0ab888f8aa5dfac954918864eeda8c12c19
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?46b8109e");
  # https://git.kernel.org/stable/c/5f541300b02ef8b2af34f6f7d41ce617f3571e88
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?c5c7f4e6");
  # https://git.kernel.org/stable/c/b2e77c789c234e7fe49057d2ced8f32e2d2c7901
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?8c42457a");
  # https://git.kernel.org/stable/c/c92dbf85627b5c29e52d9c120a24e785801716df
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?fde1764e");
  # https://git.kernel.org/stable/c/f0104977fed25ebe001fd63dab2b6b7fefad3373
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?e83c7af8");
  # https://git.kernel.org/stable/c/fdf7c4c9af4f246323ce854e84b6aec198d49f7e
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?4a03429c");
  # https://lore.kernel.org/linux-cve-announce/2025120717-CVE-2025-40280-4612@gregkh
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?ac9657fb");
  script_set_attribute(attribute:"see_also", value:"https://nvd.nist.gov/vuln/detail/CVE-2025-40280");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2025-40280");
  script_set_attribute(attribute:"solution", value:
"Update the affected kernel package.");
  script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:S/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2025-40280");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2025/12/06");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/08/10");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/08/26");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Unity Linux Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info2.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/UOS-Server/release", "Host/UOS-Server/rpm-list", "Host/cpu");

  exit(0);
}
include('rpm2.inc');

if (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
var os_product = get_kb_item('installed_os/local/SSH/0/product');
if (isnull(os_product) || 'UOS Server' >!< os_product) audit(AUDIT_OS_NOT, 'UOS Server');
var os_version = get_kb_item('installed_os/local/SSH/0/version');
if (isnull(os_version)) audit(AUDIT_UNKNOWN_APP_VER, 'UOS Server');
if (! preg(pattern:"^(20.1050a)([^0-9]|$)", string:os_version)) audit(AUDIT_OS_NOT, 'UOS Server 20.1050a', 'UOS Server ' + os_version);

if (!get_kb_item('Host/UOS-Server/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('aarch64' >!< cpu && 'amd64' >!< cpu && 'loongarch64' >!< cpu && 'x86_64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'UOS Server', cpu);


var constraints = [
  {
    'release': '20',
    'sp': '1050a',
    'pkgs': [
      {'reference':'kernel-4.19.0-91.82.132.24.uelc20', 'sp':'1050a', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-4.19.0-91.82.132.24.uelc20', 'sp':'1050a', 'cpu':'amd64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-4.19.0-91.82.132.24.uelc20', 'sp':'1050a', 'cpu':'loongarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-4.19.0-91.82.132.24.uelc20', 'sp':'1050a', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE}
    ]
  }
];

var os_release = get_one_kb_item('installed_os/local/SSH/0/release');
var os_sp = get_one_kb_item('Host/*/minor_release');

var flag = 0;
var reference;
var sp;
var _cpu;
var el_string;
var rpm_spec_vers_cmp;
var epoch;
var allowmaj;
var exists_check;
var cves;
foreach var constraint ( constraints ) {
  # Check that the target release is equal to the affected release
  if (!empty_or_null(constraint['release'])){
    if (constraint['release'] != os_release) continue;
  }
  if (!empty_or_null(constraint['sp'])){
    if (constraint['sp'] != os_sp) continue;
  }
  foreach var pkg ( constraint['pkgs'] ) {
    reference = NULL;
    sp = NULL;
    _cpu = NULL;
    el_string = NULL;
    rpm_spec_vers_cmp = NULL;
    epoch = NULL;
    allowmaj = NULL;
    exists_check = NULL;
    cves = NULL;
    if (!empty_or_null(pkg['reference'])) reference = pkg['reference'];
    if (!empty_or_null(pkg['sp'])) sp = pkg['sp'];
    if (!empty_or_null(pkg['cpu'])) _cpu = pkg['cpu'];
    if (!empty_or_null(pkg['el_string'])) el_string = pkg['el_string'];
    if (!empty_or_null(pkg['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = pkg['rpm_spec_vers_cmp'];
    if (!empty_or_null(pkg['epoch'])) epoch = pkg['epoch'];
    if (!empty_or_null(pkg['allowmaj'])) allowmaj = pkg['allowmaj'];
    if (!empty_or_null(pkg['exists_check'])) exists_check = pkg['exists_check'];
    if (!empty_or_null(pkg['cves'])) cves = pkg['cves'];
    if (reference &&
        ## (no known rpm to check OR known rpm_exists)
        (!exists_check || rpm_exists(rpm:exists_check)) &&
        rpm_check(sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj, cves:cves)) flag++;
  }
}


if (flag)
{
  security_report_v4(
      port       : 0,
      severity   : SECURITY_WARNING,
      extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'kernel');
}