Unity Linux 20.1050a Security Update: kernel (UTSA-2026-100305)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(336076);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/08/17");

  script_cve_id("CVE-2026-43232");

  script_name(english:"Unity Linux 20.1050a Security Update: kernel (UTSA-2026-100305)");

  script_set_attribute(attribute:"synopsis", value:
"The Unity Linux host is missing one or more security updates.");
  script_set_attribute(attribute:"description", value:
"The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the
UTSA-2026-100305 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    net: wan: farsync: Fix use-after-free bugs caused by unfinished tasklets

    When the FarSync T-series card is being detached, the fst_card_info is
    deallocated in fst_remove_one(). However, the fst_tx_task or fst_int_task
    may still be running or pending, leading to use-after-free bugs when the
    already freed fst_card_info is accessed in fst_process_tx_work_q() or
    fst_process_int_work_q().

    A typical race condition is depicted below:

    CPU 0 (cleanup)           | CPU 1 (tasklet)
                              | fst_start_xmit()
    fst_remove_one()          |   tasklet_schedule()
      unregister_hdlc_device()|
                              | fst_process_tx_work_q() //handler
      kfree(card) //free      |   do_bottom_half_tx()
                              |     card-> //use

    The following KASAN trace was captured:

    ==================================================================
     BUG: KASAN: slab-use-after-free in do_bottom_half_tx+0xb88/0xd00
     Read of size 4 at addr ffff88800aad101c by task ksoftirqd/3/32
     ...
     Call Trace:
      <IRQ>
      dump_stack_lvl+0x55/0x70
      print_report+0xcb/0x5d0
      ? do_bottom_half_tx+0xb88/0xd00
      kasan_report+0xb8/0xf0
      ? do_bottom_half_tx+0xb88/0xd00
      do_bottom_half_tx+0xb88/0xd00
      ? _raw_spin_lock_irqsave+0x85/0xe0
      ? __pfx__raw_spin_lock_irqsave+0x10/0x10
      ? __pfx___hrtimer_run_queues+0x10/0x10
      fst_process_tx_work_q+0x67/0x90
      tasklet_action_common+0x1fa/0x720
      ? hrtimer_interrupt+0x31f/0x780
      handle_softirqs+0x176/0x530
      __irq_exit_rcu+0xab/0xe0
      sysvec_apic_timer_interrupt+0x70/0x80
     ...

     Allocated by task 41 on cpu 3 at 72.330843s:
      kasan_save_stack+0x24/0x50
      kasan_save_track+0x17/0x60
      __kasan_kmalloc+0x7f/0x90
      fst_add_one+0x1a5/0x1cd0
      local_pci_probe+0xdd/0x190
      pci_device_probe+0x341/0x480
      really_probe+0x1c6/0x6a0
      __driver_probe_device+0x248/0x310
      driver_probe_device+0x48/0x210
      __device_attach_driver+0x160/0x320
      bus_for_each_drv+0x101/0x190
      __device_attach+0x198/0x3a0
      device_initial_probe+0x78/0xa0
      pci_bus_add_device+0x81/0xc0
      pci_bus_add_devices+0x7e/0x190
      enable_slot+0x9b9/0x1130
      acpiphp_check_bridge.part.0+0x2e1/0x460
      acpiphp_hotplug_notify+0x36c/0x3c0
      acpi_device_hotplug+0x203/0xb10
      acpi_hotplug_work_fn+0x59/0x80
     ...

     Freed by task 41 on cpu 1 at 75.138639s:
      kasan_save_stack+0x24/0x50
      kasan_save_track+0x17/0x60
      kasan_save_free_info+0x3b/0x60
      __kasan_slab_free+0x43/0x70
      kfree+0x135/0x410
      fst_remove_one+0x2ca/0x540
      pci_device_remove+0xa6/0x1d0
      device_release_driver_internal+0x364/0x530
      pci_stop_bus_device+0x105/0x150
      pci_stop_and_remove_bus_device+0xd/0x20
      disable_slot+0x116/0x260
      acpiphp_disable_and_eject_slot+0x4b/0x190
      acpiphp_hotplug_notify+0x230/0x3c0
      acpi_device_hotplug+0x203/0xb10
      acpi_hotplug_work_fn+0x59/0x80
     ...

     The buggy address belongs to the object at ffff88800aad1000
      which belongs to the cache kmalloc-1k of size 1024
     The buggy address is located 28 bytes inside of
      freed 1024-byte region
     The buggy address belongs to the physical page:
     page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0xaad0
     head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
     flags: 0x100000000000040(head|node=0|zone=1)
     page_type: f5(slab)
     raw: 0100000000000040 ffff888007042dc0 dead000000000122 0000000000000000
     raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000
     head: 0100000000000040 ffff888007042dc0 dead000000000122 0000000000000000
     head: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000
     head: 0100000000000003 ffffea00002ab401 00000000ffffffff 00000000ffffffff
     head: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000
     page dumped because: kasan: bad access detected

     Memory state around the buggy address:
      ffff88800aad0f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
      ffff88800aad0f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
     >ffff88800aad1000: fa fb
    ---truncated---

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  # https://src.uniontech.com/#/security_advisory_detail?utsa_id=UTSA-2026-100305
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?d384c828");
  # https://lore.kernel.org/linux-cve-announce/2026050656-CVE-2026-43232-5dff@gregkh
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?f6d8473d");
  script_set_attribute(attribute:"see_also", value:"https://nvd.nist.gov/vuln/detail/CVE-2026-43232");
  script_set_attribute(attribute:"solution", value:
"Update the affected kernel package.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-43232");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/05/06");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/08/13");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/08/17");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Unity Linux Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info2.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/UOS-Server/release", "Host/UOS-Server/rpm-list", "Host/cpu");

  exit(0);
}
include('rpm2.inc');

if (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
var os_product = get_kb_item('installed_os/local/SSH/0/product');
if (isnull(os_product) || 'UOS Server' >!< os_product) audit(AUDIT_OS_NOT, 'UOS Server');
var os_version = get_kb_item('installed_os/local/SSH/0/version');
if (isnull(os_version)) audit(AUDIT_UNKNOWN_APP_VER, 'UOS Server');
if (! preg(pattern:"^20.1050a([^0-9]|$)", string:os_version)) audit(AUDIT_OS_NOT, 'UOS Server 20.1050a', 'UOS Server ' + os_version);

if (!get_kb_item('Host/UOS-Server/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('aarch64' >!< cpu && 'amd64' >!< cpu && 'x86_64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'UOS Server', cpu);


var constraints = [
  {
    'release': '20',
    'sp': '1050a',
    'pkgs': [
      {'reference':'kernel-5.10.0-27.18.uelc20', 'sp':'1050a', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-5.10.0-27.18.uelc20', 'sp':'1050a', 'cpu':'amd64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-5.10.0-27.18.uelc20', 'sp':'1050a', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE}
    ]
  }
];

var os_release = get_one_kb_item('installed_os/local/SSH/0/release');
var os_sp = get_one_kb_item('Host/*/minor_release');

var flag = 0;
var reference;
var sp;
var _cpu;
var el_string;
var rpm_spec_vers_cmp;
var epoch;
var allowmaj;
var exists_check;
var cves;
foreach var constraint ( constraints ) {
  # Check that the target release is equal to the affected release
  if (!empty_or_null(constraint['release'])){
    if (constraint['release'] != os_release) continue;
  }
  if (!empty_or_null(constraint['sp'])){
    if (constraint['sp'] != os_sp) continue;
  }
  foreach var pkg ( constraint['pkgs'] ) {
    reference = NULL;
    sp = NULL;
    _cpu = NULL;
    el_string = NULL;
    rpm_spec_vers_cmp = NULL;
    epoch = NULL;
    allowmaj = NULL;
    exists_check = NULL;
    cves = NULL;
    if (!empty_or_null(pkg['reference'])) reference = pkg['reference'];
    if (!empty_or_null(pkg['sp'])) sp = pkg['sp'];
    if (!empty_or_null(pkg['cpu'])) _cpu = pkg['cpu'];
    if (!empty_or_null(pkg['el_string'])) el_string = pkg['el_string'];
    if (!empty_or_null(pkg['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = pkg['rpm_spec_vers_cmp'];
    if (!empty_or_null(pkg['epoch'])) epoch = pkg['epoch'];
    if (!empty_or_null(pkg['allowmaj'])) allowmaj = pkg['allowmaj'];
    if (!empty_or_null(pkg['exists_check'])) exists_check = pkg['exists_check'];
    if (!empty_or_null(pkg['cves'])) cves = pkg['cves'];
    if (reference &&
        ## (no known rpm to check OR known rpm_exists)
        (!exists_check || rpm_exists(rpm:exists_check)) &&
        rpm_check(sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj, cves:cves)) flag++;
  }
}


if (flag)
{
  security_report_v4(
      port       : 0,
      severity   : SECURITY_HOLE,
      extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'kernel');
}