Unity Linux 20.1050e Security Update: kernel (UTSA-2026-101964)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(337282);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/08/18");

  script_cve_id("CVE-2025-71183");

  script_name(english:"Unity Linux 20.1050e Security Update: kernel (UTSA-2026-101964)");

  script_set_attribute(attribute:"synopsis", value:
"The Unity Linux host is missing one or more security updates.");
  script_set_attribute(attribute:"description", value:
"The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the
UTSA-2026-101964 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    btrfs: always detect conflicting inodes when logging inode refs

    After rename exchanging (either with the rename exchange operation or
    regular renames in multiple non-atomic steps) two inodes and at least
    one of them is a directory, we can end up with a log tree that contains
    only of the inodes and after a power failure that can result in an attempt
    to delete the other inode when it should not because it was not deleted
    before the power failure. In some case that delete attempt fails when
    the target inode is a directory that contains a subvolume inside it, since
    the log replay code is not prepared to deal with directory entries that
    point to root items (only inode items).

    1) We have directories dir1 (inode A) and dir2 (inode B) under the
       same parent directory;

    2) We have a file (inode C) under directory dir1 (inode A);

    3) We have a subvolume inside directory dir2 (inode B);

    4) All these inodes were persisted in a past transaction and we are
       currently at transaction N;

    5) We rename the file (inode C), so at btrfs_log_new_name() we update
       inode C's last_unlink_trans to N;

    6) We get a rename exchange for dir1 (inode A) and dir2 (inode B),
       so after the exchange dir1 is inode B and dir2 is inode A.
       During the rename exchange we call btrfs_log_new_name() for inodes
       A and B, but because they are directories, we don't update their
       last_unlink_trans to N;

    7) An fsync against the file (inode C) is done, and because its inode
       has a last_unlink_trans with a value of N we log its parent directory
       (inode A) (through btrfs_log_all_parents(), called from
       btrfs_log_inode_parent()).

    8) So we end up with inode B not logged, which now has the old name
       of inode A. At copy_inode_items_to_log(), when logging inode A, we
       did not check if we had any conflicting inode to log because inode
       A has a generation lower than the current transaction (created in
       a past transaction);

    9) After a power failure, when replaying the log tree, since we find that
       inode A has a new name that conflicts with the name of inode B in the
       fs tree, we attempt to delete inode B... this is wrong since that
       directory was never deleted before the power failure, and because there
       is a subvolume inside that directory, attempting to delete it will fail
       since replay_dir_deletes() and btrfs_unlink_inode() are not prepared
       to deal with dir items that point to roots instead of inodes.

       When that happens the mount fails and we get a stack trace like the
       following:

       [87.2314] BTRFS info (device dm-0): start tree-log replay
       [87.2318] BTRFS critical (device dm-0): failed to delete reference to subvol, root 5 inode 256 parent
    259
       [87.2332] ------------[ cut here ]------------
       [87.2338] BTRFS: Transaction aborted (error -2)
       [87.2346] WARNING: CPU: 1 PID: 638968 at fs/btrfs/inode.c:4345 __btrfs_unlink_inode+0x416/0x440 [btrfs]
       [87.2368] Modules linked in: btrfs loop dm_thin_pool (...)
       [87.2470] CPU: 1 UID: 0 PID: 638968 Comm: mount Tainted: G        W           6.18.0-rc7-btrfs-
    next-218+ #2 PREEMPT(full)
       [87.2489] Tainted: [W]=WARN
       [87.2494] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS
    rel-1.16.2-0-gea1b7a073390-prebuilt.qemu.org 04/01/2014
       [87.2514] RIP: 0010:__btrfs_unlink_inode+0x416/0x440 [btrfs]
       [87.2538] Code: c0 89 04 24 (...)
       [87.2568] RSP: 0018:ffffc0e741f4b9b8 EFLAGS: 00010286
       [87.2574] RAX: 0000000000000000 RBX: ffff9d3ec8a6cf60 RCX: 0000000000000000
       [87.2582] RDX: 0000000000000002 RSI: ffffffff84ab45a1 RDI: 00000000ffffffff
       [87.2591] RBP: ffff9d3ec8a6ef20 R08: 0000000000000000 R09: ffffc0e741f4b840
       [87.2599] R10: ffff9d45dc1fffa8 R11: 0000000000000003 R12: ffff9d3ee26d77e0
       [87.2608] R13: ffffc0e741f4ba98 R14: ffff9d4458040800 R15: ffff9d44b6b7ca10
       [87.2618] FS:  00007f7b9603a840(0000) GS:ffff9d4658982000(0000) knlGS:0000000000000000
       [87.
    ---truncated---

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  # https://src.uniontech.com/#/security_advisory_detail?utsa_id=UTSA-2026-101964
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?0ab7dc03");
  # https://git.kernel.org/stable/c/0c2413c69129f6ce60157f7b53d9ba880260400b
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?b48f3ce0");
  # https://git.kernel.org/stable/c/7ba0b6461bc4edb3005ea6e00cdae189bcf908a5
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?2cfafcea");
  # https://git.kernel.org/stable/c/a63998cd6687c14b160dccb0bbcf281b2eb0dab3
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?f78dfcc0");
  # https://git.kernel.org/stable/c/c7f0207db68d5a1b4af23acbef1a8e8ddc431ebb
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?e53ec7a6");
  # https://git.kernel.org/stable/c/d52af58dd463821c5c516aebb031a58934f696ea
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?6f81ee40");
  # https://lore.kernel.org/linux-cve-announce/2026013134-CVE-2025-71183-8bb4@gregkh
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?f71ba243");
  script_set_attribute(attribute:"see_also", value:"https://nvd.nist.gov/vuln/detail/CVE-2025-71183");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2025-71183");
  script_set_attribute(attribute:"solution", value:
"Update the affected kernel package.");
  script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:S/C:N/I:N/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2025-71183");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/01/31");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/08/17");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/08/18");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Unity Linux Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info2.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/UOS-Server/release", "Host/UOS-Server/rpm-list", "Host/cpu");

  exit(0);
}
include('rpm2.inc');

if (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
var os_product = get_kb_item('installed_os/local/SSH/0/product');
if (isnull(os_product) || 'UOS Server' >!< os_product) audit(AUDIT_OS_NOT, 'UOS Server');
var os_version = get_kb_item('installed_os/local/SSH/0/version');
if (isnull(os_version)) audit(AUDIT_UNKNOWN_APP_VER, 'UOS Server');
if (! preg(pattern:"^20.1050e([^0-9]|$)", string:os_version)) audit(AUDIT_OS_NOT, 'UOS Server 20.1050e', 'UOS Server ' + os_version);

if (!get_kb_item('Host/UOS-Server/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('aarch64' >!< cpu && 'amd64' >!< cpu && 'x86_64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'UOS Server', cpu);


var constraints = [
  {
    'release': '20',
    'sp': '1050e',
    'pkgs': [
      {'reference':'kernel-4.19.90-2211.5.0.0178.67.uel20', 'sp':'1050e', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-4.19.90-2211.5.0.0178.67.uel20', 'sp':'1050e', 'cpu':'amd64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-4.19.90-2211.5.0.0178.67.uel20', 'sp':'1050e', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE}
    ]
  }
];

var os_release = get_one_kb_item('installed_os/local/SSH/0/release');
var os_sp = get_one_kb_item('Host/*/minor_release');

var flag = 0;
var reference;
var sp;
var _cpu;
var el_string;
var rpm_spec_vers_cmp;
var epoch;
var allowmaj;
var exists_check;
var cves;
foreach var constraint ( constraints ) {
  # Check that the target release is equal to the affected release
  if (!empty_or_null(constraint['release'])){
    if (constraint['release'] != os_release) continue;
  }
  if (!empty_or_null(constraint['sp'])){
    if (constraint['sp'] != os_sp) continue;
  }
  foreach var pkg ( constraint['pkgs'] ) {
    reference = NULL;
    sp = NULL;
    _cpu = NULL;
    el_string = NULL;
    rpm_spec_vers_cmp = NULL;
    epoch = NULL;
    allowmaj = NULL;
    exists_check = NULL;
    cves = NULL;
    if (!empty_or_null(pkg['reference'])) reference = pkg['reference'];
    if (!empty_or_null(pkg['sp'])) sp = pkg['sp'];
    if (!empty_or_null(pkg['cpu'])) _cpu = pkg['cpu'];
    if (!empty_or_null(pkg['el_string'])) el_string = pkg['el_string'];
    if (!empty_or_null(pkg['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = pkg['rpm_spec_vers_cmp'];
    if (!empty_or_null(pkg['epoch'])) epoch = pkg['epoch'];
    if (!empty_or_null(pkg['allowmaj'])) allowmaj = pkg['allowmaj'];
    if (!empty_or_null(pkg['exists_check'])) exists_check = pkg['exists_check'];
    if (!empty_or_null(pkg['cves'])) cves = pkg['cves'];
    if (reference &&
        ## (no known rpm to check OR known rpm_exists)
        (!exists_check || rpm_exists(rpm:exists_check)) &&
        rpm_check(sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj, cves:cves)) flag++;
  }
}


if (flag)
{
  security_report_v4(
      port       : 0,
      severity   : SECURITY_WARNING,
      extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'kernel');
}