Unity Linux 20.1050e Security Update: kernel (UTSA-2026-099760)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(336443);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/08/17");

  script_cve_id("CVE-2026-43449");

  script_name(english:"Unity Linux 20.1050e Security Update: kernel (UTSA-2026-099760)");

  script_set_attribute(attribute:"synopsis", value:
"The Unity Linux host is missing one or more security updates.");
  script_set_attribute(attribute:"description", value:
"The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the
UTSA-2026-099760 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    nvme-pci: Fix slab-out-of-bounds in nvme_dbbuf_set

    dev->online_queues is a count incremented in nvme_init_queue. Thus,
    valid indices are 0 through dev->online_queues  1.

    This patch fixes the loop condition to ensure the index stays within the
    valid range. Index 0 is excluded because it is the admin queue.

    KASAN splat:

    ==================================================================
    BUG: KASAN: slab-out-of-bounds in nvme_dbbuf_free drivers/nvme/host/pci.c:377 [inline]
    BUG: KASAN: slab-out-of-bounds in nvme_dbbuf_set+0x39c/0x400 drivers/nvme/host/pci.c:404
    Read of size 2 at addr ffff88800592a574 by task kworker/u8:5/74

    CPU: 0 UID: 0 PID: 74 Comm: kworker/u8:5 Not tainted 6.19.0-dirty #10 PREEMPT(voluntary)
    Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org
    04/01/2014
    Workqueue: nvme-reset-wq nvme_reset_work
    Call Trace:
     <TASK>
     __dump_stack lib/dump_stack.c:94 [inline]
     dump_stack_lvl+0xea/0x150 lib/dump_stack.c:120
     print_address_description mm/kasan/report.c:378 [inline]
     print_report+0xce/0x5d0 mm/kasan/report.c:482
     kasan_report+0xdc/0x110 mm/kasan/report.c:595
     __asan_report_load2_noabort+0x18/0x20 mm/kasan/report_generic.c:379
     nvme_dbbuf_free drivers/nvme/host/pci.c:377 [inline]
     nvme_dbbuf_set+0x39c/0x400 drivers/nvme/host/pci.c:404
     nvme_reset_work+0x36b/0x8c0 drivers/nvme/host/pci.c:3252
     process_one_work+0x956/0x1aa0 kernel/workqueue.c:3257
     process_scheduled_works kernel/workqueue.c:3340 [inline]
     worker_thread+0x65c/0xe60 kernel/workqueue.c:3421
     kthread+0x41a/0x930 kernel/kthread.c:463
     ret_from_fork+0x6f8/0x8c0 arch/x86/kernel/process.c:158
     ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246
     </TASK>

    Allocated by task 34 on cpu 1 at 4.241550s:
     kasan_save_stack+0x2c/0x60 mm/kasan/common.c:57
     kasan_save_track+0x1c/0x70 mm/kasan/common.c:78
     kasan_save_alloc_info+0x3c/0x50 mm/kasan/generic.c:570
     poison_kmalloc_redzone mm/kasan/common.c:398 [inline]
     __kasan_kmalloc+0xb5/0xc0 mm/kasan/common.c:415
     kasan_kmalloc include/linux/kasan.h:263 [inline]
     __do_kmalloc_node mm/slub.c:5657 [inline]
     __kmalloc_node_noprof+0x2bf/0x8d0 mm/slub.c:5663
     kmalloc_array_node_noprof include/linux/slab.h:1075 [inline]
     nvme_pci_alloc_dev drivers/nvme/host/pci.c:3479 [inline]
     nvme_probe+0x2f1/0x1820 drivers/nvme/host/pci.c:3534
     local_pci_probe+0xef/0x1c0 drivers/pci/pci-driver.c:324
     pci_call_probe drivers/pci/pci-driver.c:392 [inline]
     __pci_device_probe drivers/pci/pci-driver.c:417 [inline]
     pci_device_probe+0x743/0x920 drivers/pci/pci-driver.c:451
     call_driver_probe drivers/base/dd.c:583 [inline]
     really_probe+0x29b/0xb70 drivers/base/dd.c:661
     __driver_probe_device+0x3b0/0x4a0 drivers/base/dd.c:803
     driver_probe_device+0x56/0x1f0 drivers/base/dd.c:833
     __driver_attach_async_helper+0x155/0x340 drivers/base/dd.c:1159
     async_run_entry_fn+0xa6/0x4b0 kernel/async.c:129
     process_one_work+0x956/0x1aa0 kernel/workqueue.c:3257
     process_scheduled_works kernel/workqueue.c:3340 [inline]
     worker_thread+0x65c/0xe60 kernel/workqueue.c:3421
     kthread+0x41a/0x930 kernel/kthread.c:463
     ret_from_fork+0x6f8/0x8c0 arch/x86/kernel/process.c:158
     ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246

    The buggy address belongs to the object at ffff88800592a000
     which belongs to the cache kmalloc-2k of size 2048
    The buggy address is located 244 bytes to the right of
     allocated 1152-byte region [ffff88800592a000, ffff88800592a480)

    The buggy address belongs to the physical page:
    page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x5928
    head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
    anon flags: 0xfffffc0000040(head|node=0|zone=1|lastcpupid=0x1fffff)
    page_type: f5(slab)
    raw: 000fffffc0000040 ffff888001042000 0000000000000000 dead000000000001
    raw: 0000000000000000 0000000000080008 00000000f5000000 0000000000000000
    head: 000fffffc0000040 ffff888001042000 00000
    ---truncated---

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  # https://src.uniontech.com/#/security_advisory_detail?utsa_id=UTSA-2026-099760
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?14df54d3");
  # https://lore.kernel.org/linux-cve-announce/2026050857-CVE-2026-43449-d2ed@gregkh
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?4e8e3889");
  script_set_attribute(attribute:"see_also", value:"https://nvd.nist.gov/vuln/detail/CVE-2026-43449");
  script_set_attribute(attribute:"solution", value:
"Update the affected kernel package.");
  script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:S/C:C/I:N/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-43449");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/05/08");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/08/13");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/08/17");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Unity Linux Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info2.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/UOS-Server/release", "Host/UOS-Server/rpm-list", "Host/cpu");

  exit(0);
}
include('rpm2.inc');

if (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
var os_product = get_kb_item('installed_os/local/SSH/0/product');
if (isnull(os_product) || 'UOS Server' >!< os_product) audit(AUDIT_OS_NOT, 'UOS Server');
var os_version = get_kb_item('installed_os/local/SSH/0/version');
if (isnull(os_version)) audit(AUDIT_UNKNOWN_APP_VER, 'UOS Server');
if (! preg(pattern:"^20.1050e([^0-9]|$)", string:os_version)) audit(AUDIT_OS_NOT, 'UOS Server 20.1050e', 'UOS Server ' + os_version);

if (!get_kb_item('Host/UOS-Server/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('aarch64' >!< cpu && 'amd64' >!< cpu && 'x86_64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'UOS Server', cpu);


var constraints = [
  {
    'release': '20',
    'sp': '1050e',
    'pkgs': [
      {'reference':'kernel-5.10.0-27.18.uel20', 'sp':'1050e', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-5.10.0-27.18.uel20', 'sp':'1050e', 'cpu':'amd64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-5.10.0-27.18.uel20', 'sp':'1050e', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE}
    ]
  }
];

var os_release = get_one_kb_item('installed_os/local/SSH/0/release');
var os_sp = get_one_kb_item('Host/*/minor_release');

var flag = 0;
var reference;
var sp;
var _cpu;
var el_string;
var rpm_spec_vers_cmp;
var epoch;
var allowmaj;
var exists_check;
var cves;
foreach var constraint ( constraints ) {
  # Check that the target release is equal to the affected release
  if (!empty_or_null(constraint['release'])){
    if (constraint['release'] != os_release) continue;
  }
  if (!empty_or_null(constraint['sp'])){
    if (constraint['sp'] != os_sp) continue;
  }
  foreach var pkg ( constraint['pkgs'] ) {
    reference = NULL;
    sp = NULL;
    _cpu = NULL;
    el_string = NULL;
    rpm_spec_vers_cmp = NULL;
    epoch = NULL;
    allowmaj = NULL;
    exists_check = NULL;
    cves = NULL;
    if (!empty_or_null(pkg['reference'])) reference = pkg['reference'];
    if (!empty_or_null(pkg['sp'])) sp = pkg['sp'];
    if (!empty_or_null(pkg['cpu'])) _cpu = pkg['cpu'];
    if (!empty_or_null(pkg['el_string'])) el_string = pkg['el_string'];
    if (!empty_or_null(pkg['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = pkg['rpm_spec_vers_cmp'];
    if (!empty_or_null(pkg['epoch'])) epoch = pkg['epoch'];
    if (!empty_or_null(pkg['allowmaj'])) allowmaj = pkg['allowmaj'];
    if (!empty_or_null(pkg['exists_check'])) exists_check = pkg['exists_check'];
    if (!empty_or_null(pkg['cves'])) cves = pkg['cves'];
    if (reference &&
        ## (no known rpm to check OR known rpm_exists)
        (!exists_check || rpm_exists(rpm:exists_check)) &&
        rpm_check(sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj, cves:cves)) flag++;
  }
}


if (flag)
{
  security_report_v4(
      port       : 0,
      severity   : SECURITY_WARNING,
      extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'kernel');
}