Unity Linux 20.1050a Security Update: kernel (UTSA-2026-100293)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(336929);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/08/17");

  script_cve_id("CVE-2026-31507");

  script_name(english:"Unity Linux 20.1050a Security Update: kernel (UTSA-2026-100293)");

  script_set_attribute(attribute:"synopsis", value:
"The Unity Linux host is missing one or more security updates.");
  script_set_attribute(attribute:"description", value:
"The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the
UTSA-2026-100293 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    net/smc: fix double-free of smc_spd_priv when tee() duplicates splice pipe buffer

    smc_rx_splice() allocates one smc_spd_priv per pipe_buffer and stores
    the pointer in pipe_buffer.private.  The pipe_buf_operations for these
    buffers used .get = generic_pipe_buf_get, which only increments the page
    reference count when tee(2) duplicates a pipe buffer.  The smc_spd_priv
    pointer itself was not handled, so after tee() both the original and the
    cloned pipe_buffer share the same smc_spd_priv *.

    When both pipes are subsequently released, smc_rx_pipe_buf_release() is
    called twice against the same object:

      1st call: kfree(priv)  sock_put(sk)  smc_rx_update_cons()  [correct]
      2nd call: kfree(priv)  sock_put(sk)  smc_rx_update_cons()  [UAF]

    KASAN reports a slab-use-after-free in smc_rx_pipe_buf_release(), which
    then escalates to a NULL-pointer dereference and kernel panic via
    smc_rx_update_consumer() when it chases the freed priv->smc pointer:

      BUG: KASAN: slab-use-after-free in smc_rx_pipe_buf_release+0x78/0x2a0
      Read of size 8 at addr ffff888004a45740 by task smc_splice_tee_/74
      Call Trace:
       <TASK>
       dump_stack_lvl+0x53/0x70
       print_report+0xce/0x650
       kasan_report+0xc6/0x100
       smc_rx_pipe_buf_release+0x78/0x2a0
       free_pipe_info+0xd4/0x130
       pipe_release+0x142/0x160
       __fput+0x1c6/0x490
       __x64_sys_close+0x4f/0x90
       do_syscall_64+0xa6/0x1a0
       entry_SYSCALL_64_after_hwframe+0x77/0x7f
       </TASK>

      BUG: kernel NULL pointer dereference, address: 0000000000000020
      RIP: 0010:smc_rx_update_consumer+0x8d/0x350
      Call Trace:
       <TASK>
       smc_rx_pipe_buf_release+0x121/0x2a0
       free_pipe_info+0xd4/0x130
       pipe_release+0x142/0x160
       __fput+0x1c6/0x490
       __x64_sys_close+0x4f/0x90
       do_syscall_64+0xa6/0x1a0
       entry_SYSCALL_64_after_hwframe+0x77/0x7f
       </TASK>
      Kernel panic - not syncing: Fatal exception

    Beyond the memory-safety problem, duplicating an SMC splice buffer is
    semantically questionable: smc_rx_update_cons() would advance the
    consumer cursor twice for the same data, corrupting receive-window
    accounting.  A refcount on smc_spd_priv could fix the double-free, but
    the cursor-accounting issue would still need to be addressed separately.

    The .get callback is invoked by both tee(2) and splice_pipe_to_pipe()
    for partial transfers; both will now return -EFAULT.  Users who need
    to duplicate SMC socket data must use a copy-based read path.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  # https://src.uniontech.com/#/security_advisory_detail?utsa_id=UTSA-2026-100293
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?f8119431");
  # https://lore.kernel.org/linux-cve-announce/2026042207-CVE-2026-31507-cbc0@gregkh
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?0297911a");
  script_set_attribute(attribute:"see_also", value:"https://nvd.nist.gov/vuln/detail/CVE-2026-31507");
  script_set_attribute(attribute:"solution", value:
"Update the affected kernel package.");
  script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:S/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-31507");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/04/22");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/08/13");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/08/17");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Unity Linux Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info2.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/UOS-Server/release", "Host/UOS-Server/rpm-list", "Host/cpu");

  exit(0);
}
include('rpm2.inc');

if (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
var os_product = get_kb_item('installed_os/local/SSH/0/product');
if (isnull(os_product) || 'UOS Server' >!< os_product) audit(AUDIT_OS_NOT, 'UOS Server');
var os_version = get_kb_item('installed_os/local/SSH/0/version');
if (isnull(os_version)) audit(AUDIT_UNKNOWN_APP_VER, 'UOS Server');
if (! preg(pattern:"^20.1050a([^0-9]|$)", string:os_version)) audit(AUDIT_OS_NOT, 'UOS Server 20.1050a', 'UOS Server ' + os_version);

if (!get_kb_item('Host/UOS-Server/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('aarch64' >!< cpu && 'amd64' >!< cpu && 'x86_64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'UOS Server', cpu);


var constraints = [
  {
    'release': '20',
    'sp': '1050a',
    'pkgs': [
      {'reference':'kernel-5.10.0-27.18.uelc20', 'sp':'1050a', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-5.10.0-27.18.uelc20', 'sp':'1050a', 'cpu':'amd64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-5.10.0-27.18.uelc20', 'sp':'1050a', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE}
    ]
  }
];

var os_release = get_one_kb_item('installed_os/local/SSH/0/release');
var os_sp = get_one_kb_item('Host/*/minor_release');

var flag = 0;
var reference;
var sp;
var _cpu;
var el_string;
var rpm_spec_vers_cmp;
var epoch;
var allowmaj;
var exists_check;
var cves;
foreach var constraint ( constraints ) {
  # Check that the target release is equal to the affected release
  if (!empty_or_null(constraint['release'])){
    if (constraint['release'] != os_release) continue;
  }
  if (!empty_or_null(constraint['sp'])){
    if (constraint['sp'] != os_sp) continue;
  }
  foreach var pkg ( constraint['pkgs'] ) {
    reference = NULL;
    sp = NULL;
    _cpu = NULL;
    el_string = NULL;
    rpm_spec_vers_cmp = NULL;
    epoch = NULL;
    allowmaj = NULL;
    exists_check = NULL;
    cves = NULL;
    if (!empty_or_null(pkg['reference'])) reference = pkg['reference'];
    if (!empty_or_null(pkg['sp'])) sp = pkg['sp'];
    if (!empty_or_null(pkg['cpu'])) _cpu = pkg['cpu'];
    if (!empty_or_null(pkg['el_string'])) el_string = pkg['el_string'];
    if (!empty_or_null(pkg['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = pkg['rpm_spec_vers_cmp'];
    if (!empty_or_null(pkg['epoch'])) epoch = pkg['epoch'];
    if (!empty_or_null(pkg['allowmaj'])) allowmaj = pkg['allowmaj'];
    if (!empty_or_null(pkg['exists_check'])) exists_check = pkg['exists_check'];
    if (!empty_or_null(pkg['cves'])) cves = pkg['cves'];
    if (reference &&
        ## (no known rpm to check OR known rpm_exists)
        (!exists_check || rpm_exists(rpm:exists_check)) &&
        rpm_check(sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj, cves:cves)) flag++;
  }
}


if (flag)
{
  security_report_v4(
      port       : 0,
      severity   : SECURITY_WARNING,
      extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'kernel');
}