Unity Linux 20.1050a Security Update: kernel (UTSA-2026-100322)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(336514);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/08/17");

  script_cve_id("CVE-2026-43327");

  script_name(english:"Unity Linux 20.1050a Security Update: kernel (UTSA-2026-100322)");

  script_set_attribute(attribute:"synopsis", value:
"The Unity Linux host is missing one or more security updates.");
  script_set_attribute(attribute:"description", value:
"The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the
UTSA-2026-100322 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    USB: dummy-hcd: Fix locking/synchronization error

    Syzbot testing was able to provoke an addressing exception and crash
    in the usb_gadget_udc_reset() routine in
    drivers/usb/gadgets/udc/core.c, resulting from the fact that the
    routine was called with a second (driver) argument of NULL.  The bad
    caller was set_link_state() in dummy_hcd.c, and the problem arose
    because of a race between a USB reset and driver unbind.

    These sorts of races were not supposed to be possible; commit
    7dbd8f4cabd9 (USB: dummy-hcd: Fix erroneous synchronization change),
    along with a few followup commits, was written specifically to prevent
    them.  As it turns out, there are (at least) two errors remaining in
    the code.  Another patch will address the second error; this one is
    concerned with the first.

    The error responsible for the syzbot crash occurred because the
    stop_activity() routine will sometimes drop and then re-acquire the
    dum->lock spinlock.  A call to stop_activity() occurs in
    set_link_state() when handling an emulated USB reset, after the test
    of dum->ints_enabled and before the increment of dum->callback_usage.
    This allowed another thread (doing a driver unbind) to sneak in and
    grab the spinlock, and then clear dum->ints_enabled and dum->driver.
    Normally this other thread would have to wait for dum->callback_usage
    to go down to 0 before it would clear dum->driver, but in this case it
    didn't have to wait since dum->callback_usage had not yet been
    incremented.

    The fix is to increment dum->callback_usage _before_ calling
    stop_activity() instead of after.  Then the thread doing the unbind
    will not clear dum->driver until after the call to
    usb_gadget_udc_reset() safely returns and dum->callback_usage has been
    decremented again.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  # https://src.uniontech.com/#/security_advisory_detail?utsa_id=UTSA-2026-100322
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?3d21f10f");
  # https://git.kernel.org/stable/c/218886b2ef2dea7627d3700ab0abaf4bf9d1161f
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?c4637d93");
  # https://git.kernel.org/stable/c/616a63ff495df12863692ab3f9f7b84e3fa7a66d
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?e01d6457");
  # https://git.kernel.org/stable/c/6350c7dd33ab481ef41c931a238361490c32d15c
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?7e96d5d4");
  # https://git.kernel.org/stable/c/69ab97a693251d6a6093e630060a3c744fd58524
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?41c5b58f");
  # https://git.kernel.org/stable/c/791966f85b439b261bf19865cf1c07c065ffb4b4
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?6be3ba7e");
  # https://git.kernel.org/stable/c/805b1833d6ed6da5086e610578a28e71bb54fbbb
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?1b18effb");
  # https://git.kernel.org/stable/c/cc97fb5969177cccce2e23b31298df220fc7570d
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?83d7c3ac");
  # https://git.kernel.org/stable/c/efbd9441f1e769a7aae1813d497cec09cbdff031
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?d8cc425c");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2026-43327");
  script_set_attribute(attribute:"solution", value:
"Update the affected kernel package.");
  script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:S/C:N/I:N/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-43327");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/05/08");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/08/13");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/08/17");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Unity Linux Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info2.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/UOS-Server/release", "Host/UOS-Server/rpm-list", "Host/cpu");

  exit(0);
}
include('rpm2.inc');

if (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
var os_product = get_kb_item('installed_os/local/SSH/0/product');
if (isnull(os_product) || 'UOS Server' >!< os_product) audit(AUDIT_OS_NOT, 'UOS Server');
var os_version = get_kb_item('installed_os/local/SSH/0/version');
if (isnull(os_version)) audit(AUDIT_UNKNOWN_APP_VER, 'UOS Server');
if (! preg(pattern:"^20.1050a([^0-9]|$)", string:os_version)) audit(AUDIT_OS_NOT, 'UOS Server 20.1050a', 'UOS Server ' + os_version);

if (!get_kb_item('Host/UOS-Server/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('aarch64' >!< cpu && 'amd64' >!< cpu && 'x86_64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'UOS Server', cpu);


var constraints = [
  {
    'release': '20',
    'sp': '1050a',
    'pkgs': [
      {'reference':'kernel-5.10.0-27.18.uelc20', 'sp':'1050a', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-5.10.0-27.18.uelc20', 'sp':'1050a', 'cpu':'amd64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-5.10.0-27.18.uelc20', 'sp':'1050a', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE}
    ]
  }
];

var os_release = get_one_kb_item('installed_os/local/SSH/0/release');
var os_sp = get_one_kb_item('Host/*/minor_release');

var flag = 0;
var reference;
var sp;
var _cpu;
var el_string;
var rpm_spec_vers_cmp;
var epoch;
var allowmaj;
var exists_check;
var cves;
foreach var constraint ( constraints ) {
  # Check that the target release is equal to the affected release
  if (!empty_or_null(constraint['release'])){
    if (constraint['release'] != os_release) continue;
  }
  if (!empty_or_null(constraint['sp'])){
    if (constraint['sp'] != os_sp) continue;
  }
  foreach var pkg ( constraint['pkgs'] ) {
    reference = NULL;
    sp = NULL;
    _cpu = NULL;
    el_string = NULL;
    rpm_spec_vers_cmp = NULL;
    epoch = NULL;
    allowmaj = NULL;
    exists_check = NULL;
    cves = NULL;
    if (!empty_or_null(pkg['reference'])) reference = pkg['reference'];
    if (!empty_or_null(pkg['sp'])) sp = pkg['sp'];
    if (!empty_or_null(pkg['cpu'])) _cpu = pkg['cpu'];
    if (!empty_or_null(pkg['el_string'])) el_string = pkg['el_string'];
    if (!empty_or_null(pkg['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = pkg['rpm_spec_vers_cmp'];
    if (!empty_or_null(pkg['epoch'])) epoch = pkg['epoch'];
    if (!empty_or_null(pkg['allowmaj'])) allowmaj = pkg['allowmaj'];
    if (!empty_or_null(pkg['exists_check'])) exists_check = pkg['exists_check'];
    if (!empty_or_null(pkg['cves'])) cves = pkg['cves'];
    if (reference &&
        ## (no known rpm to check OR known rpm_exists)
        (!exists_check || rpm_exists(rpm:exists_check)) &&
        rpm_check(sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj, cves:cves)) flag++;
  }
}


if (flag)
{
  security_report_v4(
      port       : 0,
      severity   : SECURITY_WARNING,
      extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'kernel');
}