Unity Linux 20.1050a Security Update: kernel (UTSA-2026-100548)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(336244);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/08/17");

  script_cve_id("CVE-2026-53080");

  script_name(english:"Unity Linux 20.1050a Security Update: kernel (UTSA-2026-100548)");

  script_set_attribute(attribute:"synopsis", value:
"The Unity Linux host is missing one or more security updates.");
  script_set_attribute(attribute:"description", value:
"The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the
UTSA-2026-100548 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    net/sched: cls_fw: fix NULL dereference of old filters before change()

    Like pointed out by Sashiko [1], since commit ed76f5edccc9 (net: sched:
    protect filter_chain list with filter_chain_lock mutex) TC filters are
    added to a shared block and published to datapath before their ->change()
    function is called. This is a problem for cls_fw: an invalid filter
    created with the old method can still classify some packets before it
    is destroyed by the validation logic added by Xiang.
    Therefore, insisting with repeated runs of the following script:

     # ip link add dev crash0 type dummy
     # ip link set dev crash0 up
     # mausezahn  crash0 -c 100000 -P 10 \
     > -A 4.3.2.1 -B 1.2.3.4 -t udp dp=1234 -q &
     # sleep 1
     # tc qdisc add dev crash0 egress_block 1 clsact
     # tc filter add block 1 protocol ip prio 1 matchall \
     > action skbedit mark 65536 continue
     # tc filter add block 1 protocol ip prio 2 fw
     # ip link del dev crash0

    can still make fw_classify() hit the WARN_ON() in [2]:

     WARNING: ./include/net/pkt_cls.h:88 at fw_classify+0x244/0x250 [cls_fw], CPU#18: mausezahn/1399
     Modules linked in: cls_fw(E) act_skbedit(E)
     CPU: 18 UID: 0 PID: 1399 Comm: mausezahn Tainted: G            E       7.0.0-rc6-virtme #17 PREEMPT(full)
     Tainted: [E]=UNSIGNED_MODULE
     Hardware name: Red Hat KVM, BIOS 1.16.3-2.el9 04/01/2014
     RIP: 0010:fw_classify+0x244/0x250 [cls_fw]
     Code: 5c 49 c7 45 00 00 00 00 00 41 5d 41 5e 41 5f 5d c3 cc cc cc cc 5b b8 ff ff ff ff 41 5c 41 5d 41 5e
    41 5f 5d c3 cc cc cc cc 90 <0f> 0b 90 eb a0 0f 1f 80 00 00 00 00 90 90 90 90 90 90 90 90 90 90
     RSP: 0018:ffffd1b7026bf8a8 EFLAGS: 00010202
     RAX: ffff8c5ac9c60800 RBX: ffff8c5ac99322c0 RCX: 0000000000000004
     RDX: 0000000000000001 RSI: ffff8c5b74d7a000 RDI: ffff8c5ac8284f40
     RBP: ffffd1b7026bf8d0 R08: 0000000000000000 R09: ffffd1b7026bf9b0
     R10: 00000000ffffffff R11: 0000000000000000 R12: 0000000000010000
     R13: ffffd1b7026bf930 R14: ffff8c5ac8284f40 R15: 0000000000000000
     FS:  00007fca40c37740(0000) GS:ffff8c5b74d7a000(0000) knlGS:0000000000000000
     CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
     CR2: 00007fca40e822a0 CR3: 0000000005ca0001 CR4: 0000000000172ef0
     Call Trace:
      <TASK>
      tcf_classify+0x17d/0x5c0
      tc_run+0x9d/0x150
      __dev_queue_xmit+0x2ab/0x14d0
      ip_finish_output2+0x340/0x8f0
      ip_output+0xa4/0x250
      raw_sendmsg+0x147d/0x14b0
      __sys_sendto+0x1cc/0x1f0
      __x64_sys_sendto+0x24/0x30
      do_syscall_64+0x126/0xf80
      entry_SYSCALL_64_after_hwframe+0x77/0x7f
     RIP: 0033:0x7fca40e822ba
     Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb b8 0f 1f 00 f3 0f 1e fa 41 89 ca 64 8b 04 25 18 00 00 00 85 c0
    75 15 b8 2c 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 7e c3 0f 1f 44 00 00 41 54 48 83 ec 30 44 89
     RSP: 002b:00007ffc248a42c8 EFLAGS: 00000246 ORIG_RAX: 000000000000002c
     RAX: ffffffffffffffda RBX: 000055ef233289d0 RCX: 00007fca40e822ba
     RDX: 000000000000001e RSI: 000055ef23328c30 RDI: 0000000000000003
     RBP: 000055ef233289d0 R08: 00007ffc248a42d0 R09: 0000000000000010
     R10: 0000000000000000 R11: 0000000000000246 R12: 000000000000001e
     R13: 00000000000186a0 R14: 0000000000000000 R15: 00007fca41043000
      </TASK>
     irq event stamp: 1045778
     hardirqs last  enabled at (1045784): [<ffffffff864ec042>] __up_console_sem+0x52/0x60
     hardirqs last disabled at (1045789): [<ffffffff864ec027>] __up_console_sem+0x37/0x60
     softirqs last  enabled at (1045426): [<ffffffff874d48c7>] __alloc_skb+0x207/0x260
     softirqs last disabled at (1045434): [<ffffffff874fe8f8>] __dev_queue_xmit+0x78/0x14d0

    Then, because of the value in the packet's mark, dereference on 'q->handle'
    with NULL 'q' occurs:

     BUG: kernel NULL  pointer dereference, address: 0000000000000038
     [...]
     RIP: 0010:fw_classify+0x1fe/0x250 [cls_fw]
     [...]

    Skip old-style classification on shared blocks, so that the NULL
    dereference is fixed and WARN_ON() is not hit anymore in the short
    lifetime of invalid cls_fw old-style filters.

    [1] https://sashiko.dev/#/patchset/2
    ---truncated---

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  # https://src.uniontech.com/#/security_advisory_detail?utsa_id=UTSA-2026-100548
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?36bede99");
  # https://lore.kernel.org/linux-cve-announce/2026062406-CVE-2026-53080-f08e@gregkh
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?12508f9a");
  script_set_attribute(attribute:"see_also", value:"https://nvd.nist.gov/vuln/detail/CVE-2026-53080");
  script_set_attribute(attribute:"solution", value:
"Update the affected kernel package.");
  script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:S/C:N/I:N/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-53080");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/05/26");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/08/13");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/08/17");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Unity Linux Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info2.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/UOS-Server/release", "Host/UOS-Server/rpm-list", "Host/cpu");

  exit(0);
}
include('rpm2.inc');

if (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
var os_product = get_kb_item('installed_os/local/SSH/0/product');
if (isnull(os_product) || 'UOS Server' >!< os_product) audit(AUDIT_OS_NOT, 'UOS Server');
var os_version = get_kb_item('installed_os/local/SSH/0/version');
if (isnull(os_version)) audit(AUDIT_UNKNOWN_APP_VER, 'UOS Server');
if (! preg(pattern:"^20.1050a([^0-9]|$)", string:os_version)) audit(AUDIT_OS_NOT, 'UOS Server 20.1050a', 'UOS Server ' + os_version);

if (!get_kb_item('Host/UOS-Server/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('aarch64' >!< cpu && 'amd64' >!< cpu && 'x86_64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'UOS Server', cpu);


var constraints = [
  {
    'release': '20',
    'sp': '1050a',
    'pkgs': [
      {'reference':'kernel-5.10.0-27.18.uelc20', 'sp':'1050a', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-5.10.0-27.18.uelc20', 'sp':'1050a', 'cpu':'amd64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-5.10.0-27.18.uelc20', 'sp':'1050a', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE}
    ]
  }
];

var os_release = get_one_kb_item('installed_os/local/SSH/0/release');
var os_sp = get_one_kb_item('Host/*/minor_release');

var flag = 0;
var reference;
var sp;
var _cpu;
var el_string;
var rpm_spec_vers_cmp;
var epoch;
var allowmaj;
var exists_check;
var cves;
foreach var constraint ( constraints ) {
  # Check that the target release is equal to the affected release
  if (!empty_or_null(constraint['release'])){
    if (constraint['release'] != os_release) continue;
  }
  if (!empty_or_null(constraint['sp'])){
    if (constraint['sp'] != os_sp) continue;
  }
  foreach var pkg ( constraint['pkgs'] ) {
    reference = NULL;
    sp = NULL;
    _cpu = NULL;
    el_string = NULL;
    rpm_spec_vers_cmp = NULL;
    epoch = NULL;
    allowmaj = NULL;
    exists_check = NULL;
    cves = NULL;
    if (!empty_or_null(pkg['reference'])) reference = pkg['reference'];
    if (!empty_or_null(pkg['sp'])) sp = pkg['sp'];
    if (!empty_or_null(pkg['cpu'])) _cpu = pkg['cpu'];
    if (!empty_or_null(pkg['el_string'])) el_string = pkg['el_string'];
    if (!empty_or_null(pkg['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = pkg['rpm_spec_vers_cmp'];
    if (!empty_or_null(pkg['epoch'])) epoch = pkg['epoch'];
    if (!empty_or_null(pkg['allowmaj'])) allowmaj = pkg['allowmaj'];
    if (!empty_or_null(pkg['exists_check'])) exists_check = pkg['exists_check'];
    if (!empty_or_null(pkg['cves'])) cves = pkg['cves'];
    if (reference &&
        ## (no known rpm to check OR known rpm_exists)
        (!exists_check || rpm_exists(rpm:exists_check)) &&
        rpm_check(sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj, cves:cves)) flag++;
  }
}


if (flag)
{
  security_report_v4(
      port       : 0,
      severity   : SECURITY_WARNING,
      extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'kernel');
}