Unity Linux 20.1050a Security Update: kernel (UTSA-2026-100512)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(336669);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/08/17");

  script_cve_id("CVE-2026-64378");

  script_name(english:"Unity Linux 20.1050a Security Update: kernel (UTSA-2026-100512)");

  script_set_attribute(attribute:"synopsis", value:
"The Unity Linux host is missing one or more security updates.");
  script_set_attribute(attribute:"description", value:
"The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the
UTSA-2026-100512 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    writeback: fix race between cgroup_writeback_umount() and inode_switch_wbs()

    When a container exits, the following BUG_ON() is occasionally triggered:

    ==================================================================
     VFS: Busy inodes after unmount of sdb (ext4)
     ------------[ cut here ]------------
     kernel BUG at fs/super.c:695!
     CPU: 3 PID: 6 Comm: containerd-shim Tainted: G OE K 6.6 #1
     pstate: 63400009 (nZCv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=--)
     pc : generic_shutdown_super+0xf0/0x100
     lr : generic_shutdown_super+0xf0/0x100
     Call trace:
      generic_shutdown_super+0xf0/0x100
      kill_block_super+0x20/0x48
      ext4_kill_sb+0x28/0x60
      deactivate_locked_super+0x54/0x130
      deactivate_super+0x84/0xa0
      cleanup_mnt+0xa4/0x140
      __cleanup_mnt+0x18/0x28
      task_work_run+0x78/0xe0
      do_notify_resume+0x204/0x240
    ==================================================================

    The root cause is a race between cgroup_writeback_umount() and
    inode_switch_wbs()/cleanup_offline_cgwb(). There is a window between
    inode_prepare_wbs_switch() returning true and the subsequent
    wb_queue_isw() call. Following is the process that triggers the issue:

          CPU A (umount)           |          CPU B (writeback)
    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
                                     inode_switch_wbs/cleanup_offline_cgwb
                                      atomic_inc(&isw_nr_in_flight)
                                      inode_prepare_wbs_switch
                                       -> passes SB_ACTIVE check
                                       __iget(inode)
     generic_shutdown_super
      sb->s_flags &= ~SB_ACTIVE
      cgroup_writeback_umount(sb)
       smp_mb()
       atomic_read(&isw_nr_in_flight)
       rcu_barrier()
        -> no pending RCU callbacks
       flush_workqueue(isw_wq)
        -> nothing queued, returns
      evict_inodes(sb)
       -> Inode skipped as isw still holds a ref.
      sop->put_super(sb)
       /* destroys percpu counters */
      -> VFS: Busy inodes after unmount!
                                      wb_queue_isw()
                                       queue_work(isw_wq, ...)
                                      /* later in work function */
                                      inode_switch_wbs_work_fn
                                       process_inode_switch_wbs
                                        iput() -> evict
                                         percpu_counter_dec() // UAF!

    Fix this by extending the RCU read-side critical section in
    inode_switch_wbs() and cleanup_offline_cgwb() to cover from
    inode_prepare_wbs_switch() through wb_queue_isw().  Since there is
    no sleep in this window, rcu_read_lock() can be used.  Then add a
    synchronize_rcu() in cgroup_writeback_umount() before the existing
    rcu_barrier(), so that all in-flight switchers that have passed the
    SB_ACTIVE check have completed queue_work() before flush_workqueue()
    is called.

    The existing rcu_barrier() is intentionally retained so this fix can
    be backported unchanged to stable kernels (5.10.y, 6.6.y, ...) that
    still queue switches via queue_rcu_work(). It is a no-op on current
    mainline (since commit e1b849cfa6b6 (writeback: Avoid contention on
    wb->list_lock when switching inodes)) and is removed in a follow-up
    patch.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  # https://src.uniontech.com/#/security_advisory_detail?utsa_id=UTSA-2026-100512
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?00778057");
  # https://lore.kernel.org/linux-cve-announce/2026072524-CVE-2026-64378-78c8@gregkh
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?24b2de34");
  script_set_attribute(attribute:"see_also", value:"https://nvd.nist.gov/vuln/detail/CVE-2026-64378");
  script_set_attribute(attribute:"solution", value:
"Update the affected kernel package.");
  script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:S/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-64378");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/07/20");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/08/13");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/08/17");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Unity Linux Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info2.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/UOS-Server/release", "Host/UOS-Server/rpm-list", "Host/cpu");

  exit(0);
}
include('rpm2.inc');

if (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
var os_product = get_kb_item('installed_os/local/SSH/0/product');
if (isnull(os_product) || 'UOS Server' >!< os_product) audit(AUDIT_OS_NOT, 'UOS Server');
var os_version = get_kb_item('installed_os/local/SSH/0/version');
if (isnull(os_version)) audit(AUDIT_UNKNOWN_APP_VER, 'UOS Server');
if (! preg(pattern:"^20.1050a([^0-9]|$)", string:os_version)) audit(AUDIT_OS_NOT, 'UOS Server 20.1050a', 'UOS Server ' + os_version);

if (!get_kb_item('Host/UOS-Server/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('aarch64' >!< cpu && 'amd64' >!< cpu && 'x86_64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'UOS Server', cpu);


var constraints = [
  {
    'release': '20',
    'sp': '1050a',
    'pkgs': [
      {'reference':'kernel-5.10.0-27.18.uelc20', 'sp':'1050a', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-5.10.0-27.18.uelc20', 'sp':'1050a', 'cpu':'amd64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-5.10.0-27.18.uelc20', 'sp':'1050a', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE}
    ]
  }
];

var os_release = get_one_kb_item('installed_os/local/SSH/0/release');
var os_sp = get_one_kb_item('Host/*/minor_release');

var flag = 0;
var reference;
var sp;
var _cpu;
var el_string;
var rpm_spec_vers_cmp;
var epoch;
var allowmaj;
var exists_check;
var cves;
foreach var constraint ( constraints ) {
  # Check that the target release is equal to the affected release
  if (!empty_or_null(constraint['release'])){
    if (constraint['release'] != os_release) continue;
  }
  if (!empty_or_null(constraint['sp'])){
    if (constraint['sp'] != os_sp) continue;
  }
  foreach var pkg ( constraint['pkgs'] ) {
    reference = NULL;
    sp = NULL;
    _cpu = NULL;
    el_string = NULL;
    rpm_spec_vers_cmp = NULL;
    epoch = NULL;
    allowmaj = NULL;
    exists_check = NULL;
    cves = NULL;
    if (!empty_or_null(pkg['reference'])) reference = pkg['reference'];
    if (!empty_or_null(pkg['sp'])) sp = pkg['sp'];
    if (!empty_or_null(pkg['cpu'])) _cpu = pkg['cpu'];
    if (!empty_or_null(pkg['el_string'])) el_string = pkg['el_string'];
    if (!empty_or_null(pkg['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = pkg['rpm_spec_vers_cmp'];
    if (!empty_or_null(pkg['epoch'])) epoch = pkg['epoch'];
    if (!empty_or_null(pkg['allowmaj'])) allowmaj = pkg['allowmaj'];
    if (!empty_or_null(pkg['exists_check'])) exists_check = pkg['exists_check'];
    if (!empty_or_null(pkg['cves'])) cves = pkg['cves'];
    if (reference &&
        ## (no known rpm to check OR known rpm_exists)
        (!exists_check || rpm_exists(rpm:exists_check)) &&
        rpm_check(sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj, cves:cves)) flag++;
  }
}


if (flag)
{
  security_report_v4(
      port       : 0,
      severity   : SECURITY_WARNING,
      extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'kernel');
}