Unity Linux 20.1050a Security Update: kernel (UTSA-2026-098963)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(340422);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/08/26");

  script_cve_id("CVE-2026-23099");

  script_name(english:"Unity Linux 20.1050a Security Update: kernel (UTSA-2026-098963)");

  script_set_attribute(attribute:"synopsis", value:
"The Unity Linux host is missing one or more security updates.");
  script_set_attribute(attribute:"description", value:
"The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the
UTSA-2026-098963 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    bonding: limit BOND_MODE_8023AD to Ethernet devices

    BOND_MODE_8023AD makes sense for ARPHRD_ETHER only.

    syzbot reported:

     BUG: KASAN: global-out-of-bounds in __hw_addr_create net/core/dev_addr_lists.c:63 [inline]
     BUG: KASAN: global-out-of-bounds in __hw_addr_add_ex+0x25d/0x760 net/core/dev_addr_lists.c:118
    Read of size 16 at addr ffffffff8bf94040 by task syz.1.3580/19497

    CPU: 1 UID: 0 PID: 19497 Comm: syz.1.3580 Tainted: G             L      syzkaller #0 PREEMPT(full)
    Tainted: [L]=SOFTLOCKUP
    Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
    Call Trace:
     <TASK>
      dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
      print_address_description mm/kasan/report.c:378 [inline]
      print_report+0xca/0x240 mm/kasan/report.c:482
      kasan_report+0x118/0x150 mm/kasan/report.c:595
     check_region_inline mm/kasan/generic.c:-1 [inline]
      kasan_check_range+0x2b0/0x2c0 mm/kasan/generic.c:200
      __asan_memcpy+0x29/0x70 mm/kasan/shadow.c:105
      __hw_addr_create net/core/dev_addr_lists.c:63 [inline]
      __hw_addr_add_ex+0x25d/0x760 net/core/dev_addr_lists.c:118
      __dev_mc_add net/core/dev_addr_lists.c:868 [inline]
      dev_mc_add+0xa1/0x120 net/core/dev_addr_lists.c:886
      bond_enslave+0x2b8b/0x3ac0 drivers/net/bonding/bond_main.c:2180
      do_set_master+0x533/0x6d0 net/core/rtnetlink.c:2963
      do_setlink+0xcf0/0x41c0 net/core/rtnetlink.c:3165
      rtnl_changelink net/core/rtnetlink.c:3776 [inline]
      __rtnl_newlink net/core/rtnetlink.c:3935 [inline]
      rtnl_newlink+0x161c/0x1c90 net/core/rtnetlink.c:4072
      rtnetlink_rcv_msg+0x7cf/0xb70 net/core/rtnetlink.c:6958
      netlink_rcv_skb+0x208/0x470 net/netlink/af_netlink.c:2550
      netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline]
      netlink_unicast+0x82f/0x9e0 net/netlink/af_netlink.c:1344
      netlink_sendmsg+0x805/0xb30 net/netlink/af_netlink.c:1894
      sock_sendmsg_nosec net/socket.c:727 [inline]
      __sock_sendmsg+0x21c/0x270 net/socket.c:742
      ____sys_sendmsg+0x505/0x820 net/socket.c:2592
      ___sys_sendmsg+0x21f/0x2a0 net/socket.c:2646
      __sys_sendmsg+0x164/0x220 net/socket.c:2678
      do_syscall_32_irqs_on arch/x86/entry/syscall_32.c:83 [inline]
      __do_fast_syscall_32+0x1dc/0x560 arch/x86/entry/syscall_32.c:307
      do_fast_syscall_32+0x34/0x80 arch/x86/entry/syscall_32.c:332
     entry_SYSENTER_compat_after_hwframe+0x84/0x8e
     </TASK>

    The buggy address belongs to the variable:
     lacpdu_mcast_addr+0x0/0x40

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  # https://src.uniontech.com/#/security_advisory_detail?utsa_id=UTSA-2026-098963
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?58b057b6");
  # https://lore.kernel.org/linux-cve-announce/2026020428-CVE-2026-23099-a393@gregkh
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?f258c8ae");
  script_set_attribute(attribute:"see_also", value:"https://nvd.nist.gov/vuln/detail/CVE-2026-23099");
  script_set_attribute(attribute:"solution", value:
"Update the affected kernel package.");
  script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:S/C:C/I:N/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-23099");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/02/04");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/08/10");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/08/26");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Unity Linux Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info2.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/UOS-Server/release", "Host/UOS-Server/rpm-list", "Host/cpu");

  exit(0);
}
include('rpm2.inc');

if (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
var os_product = get_kb_item('installed_os/local/SSH/0/product');
if (isnull(os_product) || 'UOS Server' >!< os_product) audit(AUDIT_OS_NOT, 'UOS Server');
var os_version = get_kb_item('installed_os/local/SSH/0/version');
if (isnull(os_version)) audit(AUDIT_UNKNOWN_APP_VER, 'UOS Server');
if (! preg(pattern:"^20.1050a([^0-9]|$)", string:os_version)) audit(AUDIT_OS_NOT, 'UOS Server 20.1050a', 'UOS Server ' + os_version);

if (!get_kb_item('Host/UOS-Server/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('aarch64' >!< cpu && 'amd64' >!< cpu && 'loongarch64' >!< cpu && 'x86_64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'UOS Server', cpu);


var constraints = [
  {
    'release': '20',
    'sp': '1050a',
    'pkgs': [
      {'reference':'kernel-4.19.0-91.82.132.24.uelc20', 'sp':'1050a', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-4.19.0-91.82.132.24.uelc20', 'sp':'1050a', 'cpu':'amd64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-4.19.0-91.82.132.24.uelc20', 'sp':'1050a', 'cpu':'loongarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-4.19.0-91.82.132.24.uelc20', 'sp':'1050a', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE}
    ]
  }
];

var os_release = get_one_kb_item('installed_os/local/SSH/0/release');
var os_sp = get_one_kb_item('Host/*/minor_release');

var flag = 0;
var reference;
var sp;
var _cpu;
var el_string;
var rpm_spec_vers_cmp;
var epoch;
var allowmaj;
var exists_check;
var cves;
foreach var constraint ( constraints ) {
  # Check that the target release is equal to the affected release
  if (!empty_or_null(constraint['release'])){
    if (constraint['release'] != os_release) continue;
  }
  if (!empty_or_null(constraint['sp'])){
    if (constraint['sp'] != os_sp) continue;
  }
  foreach var pkg ( constraint['pkgs'] ) {
    reference = NULL;
    sp = NULL;
    _cpu = NULL;
    el_string = NULL;
    rpm_spec_vers_cmp = NULL;
    epoch = NULL;
    allowmaj = NULL;
    exists_check = NULL;
    cves = NULL;
    if (!empty_or_null(pkg['reference'])) reference = pkg['reference'];
    if (!empty_or_null(pkg['sp'])) sp = pkg['sp'];
    if (!empty_or_null(pkg['cpu'])) _cpu = pkg['cpu'];
    if (!empty_or_null(pkg['el_string'])) el_string = pkg['el_string'];
    if (!empty_or_null(pkg['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = pkg['rpm_spec_vers_cmp'];
    if (!empty_or_null(pkg['epoch'])) epoch = pkg['epoch'];
    if (!empty_or_null(pkg['allowmaj'])) allowmaj = pkg['allowmaj'];
    if (!empty_or_null(pkg['exists_check'])) exists_check = pkg['exists_check'];
    if (!empty_or_null(pkg['cves'])) cves = pkg['cves'];
    if (reference &&
        ## (no known rpm to check OR known rpm_exists)
        (!exists_check || rpm_exists(rpm:exists_check)) &&
        rpm_check(sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj, cves:cves)) flag++;
  }
}


if (flag)
{
  security_report_v4(
      port       : 0,
      severity   : SECURITY_WARNING,
      extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'kernel');
}