Unity Linux 20.1050a Security Update: kernel (UTSA-2026-098799)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(340574);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/08/26");

  script_cve_id("CVE-2026-46160");

  script_name(english:"Unity Linux 20.1050a Security Update: kernel (UTSA-2026-098799)");

  script_set_attribute(attribute:"synopsis", value:
"The Unity Linux host is missing one or more security updates.");
  script_set_attribute(attribute:"description", value:
"The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the
UTSA-2026-098799 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    btrfs: fix missing last_unlink_trans update when removing a directory

    When removing a directory we are not updating its last_unlink_trans field,
    which can result in incorrect fsync behaviour in case some one fsyncs the
    directory after it was removed because it's holding a file descriptor on
    it.

    Example scenario:

       mkdir /mnt/dir1
       mkdir /mnt/dir1/dir2
       mkdir /mnt/dir3

       sync -f /mnt

       # Do some change to the directory and fsync it.
       chmod 700 /mnt/dir1
       xfs_io -c fsync /mnt/dir1

       # Move dir2 out of dir1 so that dir1 becomes empty.
       mv /mnt/dir1/dir2 /mnt/dir3/

       open fd on /mnt/dir1
       call rmdir(2) on path /mnt/dir1
       fsync fd

       <trigger power failure>

    When attempting to mount the filesystem, the log replay will fail with
    an -EIO error and dmesg/syslog has the following:

       [445771.626482] BTRFS info (device dm-0): first mount of filesystem
    0368bbea-6c5e-44b5-b409-09abe496e650
       [445771.626486] BTRFS info (device dm-0): using crc32c checksum algorithm
       [445771.627912] BTRFS info (device dm-0): start tree-log replay
       [445771.628335] page: refcount:2 mapcount:0 mapping:0000000061443ddc index:0x1d00 pfn:0x7072a5
       [445771.629453] memcg:ffff89f400351b00
       [445771.629892] aops:btree_aops [btrfs] ino:1
       [445771.630737] flags:
    0x17fffc00000402a(uptodate|lru|private|writeback|node=0|zone=2|lastcpupid=0x1ffff)
       [445771.632359] raw: 017fffc00000402a fffff47284d950c8 fffff472907b7c08 ffff89f458e412b8
       [445771.633713] raw: 0000000000001d00 ffff89f6c51d1a90 00000002ffffffff ffff89f400351b00
       [445771.635029] page dumped because: eb page dump
       [445771.635825] BTRFS critical (device dm-0): corrupt leaf: root=5 block=30408704 slot=10 ino=258,
    invalid nlink: has 2 expect no more than 1 for dir
       [445771.638088] BTRFS info (device dm-0): leaf 30408704 gen 10 total ptrs 17 free space 14878 owner 5
       [445771.638091] BTRFS info (device dm-0): refs 4 lock_owner 0 current 3581087
       [445771.638094]      item 0 key (256 INODE_ITEM 0) itemoff 16123 itemsize 160
       [445771.638097]              inode generation 3 transid 9 size 16 nbytes 16384
       [445771.638098]              block group 0 mode 40755 links 1 uid 0 gid 0
       [445771.638100]              rdev 0 sequence 2 flags 0x0
       [445771.638102]              atime 1775744884.0
       [445771.660056]              ctime 1775744885.645502983
       [445771.660058]              mtime 1775744885.645502983
       [445771.660060]              otime 1775744884.0
       [445771.660062]      item 1 key (256 INODE_REF 256) itemoff 16111 itemsize 12
       [445771.660064]              index 0 name_len 2
       [445771.660066]      item 2 key (256 DIR_ITEM 1843588421) itemoff 16077 itemsize 34
       [445771.660068]              location key (259 1 0) type 2
       [445771.660070]              transid 9 data_len 0 name_len 4
       [445771.660075]      item 3 key (256 DIR_ITEM 2363071922) itemoff 16043 itemsize 34
       [445771.660076]              location key (257 1 0) type 2
       [445771.660077]              transid 9 data_len 0 name_len 4
       [445771.660078]      item 4 key (256 DIR_INDEX 2) itemoff 16009 itemsize 34
       [445771.660079]              location key (257 1 0) type 2
       [445771.660080]              transid 9 data_len 0 name_len 4
       [445771.660081]      item 5 key (256 DIR_INDEX 3) itemoff 15975 itemsize 34
       [445771.660082]              location key (259 1 0) type 2
       [445771.660083]              transid 9 data_len 0 name_len 4
       [445771.660084]      item 6 key (257 INODE_ITEM 0) itemoff 15815 itemsize 160
       [445771.660086]              inode generation 9 transid 9 size 8 nbytes 0
       [445771.660087]              block group 0 mode 40777 links 1 uid 0 gid 0
       [445771.660088]              rdev 0 sequence 2 flags 0x0
       [445771.660089]              atime 1775744885.641174097
       [445771.660090]              ctime 1775744885.645502983
       [445771.660091]              mtime 1775744885.645502983
       [445771.660105]              otime 1775744885.641174097
       [445771.660106]      item 7 key (257 INODE_REF 256) itemoff 15801 itemsize 14
       [445771.660107]              index 2 name_len 4
       [445771.660108]      item 8 key (257 DIR_ITEM 2676584006) itemoff 15767 itemsize 34
       [445771.660109]              location key (2
    ---truncated---

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  # https://src.uniontech.com/#/security_advisory_detail?utsa_id=UTSA-2026-098799
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?83875d2d");
  # https://lore.kernel.org/linux-cve-announce/2026052824-CVE-2026-46160-5908@gregkh
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?5908d136");
  script_set_attribute(attribute:"see_also", value:"https://nvd.nist.gov/vuln/detail/CVE-2026-46160");
  script_set_attribute(attribute:"solution", value:
"Update the affected kernel package.");
  script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:S/C:N/I:N/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-46160");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/05/26");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/08/10");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/08/26");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Unity Linux Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info2.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/UOS-Server/release", "Host/UOS-Server/rpm-list", "Host/cpu");

  exit(0);
}
include('rpm2.inc');

if (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
var os_product = get_kb_item('installed_os/local/SSH/0/product');
if (isnull(os_product) || 'UOS Server' >!< os_product) audit(AUDIT_OS_NOT, 'UOS Server');
var os_version = get_kb_item('installed_os/local/SSH/0/version');
if (isnull(os_version)) audit(AUDIT_UNKNOWN_APP_VER, 'UOS Server');
if (! preg(pattern:"^20.1050a([^0-9]|$)", string:os_version)) audit(AUDIT_OS_NOT, 'UOS Server 20.1050a', 'UOS Server ' + os_version);

if (!get_kb_item('Host/UOS-Server/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('aarch64' >!< cpu && 'amd64' >!< cpu && 'loongarch64' >!< cpu && 'x86_64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'UOS Server', cpu);


var constraints = [
  {
    'release': '20',
    'sp': '1050a',
    'pkgs': [
      {'reference':'kernel-4.19.0-91.82.132.24.uelc20', 'sp':'1050a', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-4.19.0-91.82.132.24.uelc20', 'sp':'1050a', 'cpu':'amd64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-4.19.0-91.82.132.24.uelc20', 'sp':'1050a', 'cpu':'loongarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-4.19.0-91.82.132.24.uelc20', 'sp':'1050a', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE}
    ]
  }
];

var os_release = get_one_kb_item('installed_os/local/SSH/0/release');
var os_sp = get_one_kb_item('Host/*/minor_release');

var flag = 0;
var reference;
var sp;
var _cpu;
var el_string;
var rpm_spec_vers_cmp;
var epoch;
var allowmaj;
var exists_check;
var cves;
foreach var constraint ( constraints ) {
  # Check that the target release is equal to the affected release
  if (!empty_or_null(constraint['release'])){
    if (constraint['release'] != os_release) continue;
  }
  if (!empty_or_null(constraint['sp'])){
    if (constraint['sp'] != os_sp) continue;
  }
  foreach var pkg ( constraint['pkgs'] ) {
    reference = NULL;
    sp = NULL;
    _cpu = NULL;
    el_string = NULL;
    rpm_spec_vers_cmp = NULL;
    epoch = NULL;
    allowmaj = NULL;
    exists_check = NULL;
    cves = NULL;
    if (!empty_or_null(pkg['reference'])) reference = pkg['reference'];
    if (!empty_or_null(pkg['sp'])) sp = pkg['sp'];
    if (!empty_or_null(pkg['cpu'])) _cpu = pkg['cpu'];
    if (!empty_or_null(pkg['el_string'])) el_string = pkg['el_string'];
    if (!empty_or_null(pkg['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = pkg['rpm_spec_vers_cmp'];
    if (!empty_or_null(pkg['epoch'])) epoch = pkg['epoch'];
    if (!empty_or_null(pkg['allowmaj'])) allowmaj = pkg['allowmaj'];
    if (!empty_or_null(pkg['exists_check'])) exists_check = pkg['exists_check'];
    if (!empty_or_null(pkg['cves'])) cves = pkg['cves'];
    if (reference &&
        ## (no known rpm to check OR known rpm_exists)
        (!exists_check || rpm_exists(rpm:exists_check)) &&
        rpm_check(sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj, cves:cves)) flag++;
  }
}


if (flag)
{
  security_report_v4(
      port       : 0,
      severity   : SECURITY_WARNING,
      extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'kernel');
}