Unity Linux 20.1050e Security Update: kernel (UTSA-2026-101979)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(337323);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/08/18");

  script_cve_id("CVE-2025-39885");

  script_name(english:"Unity Linux 20.1050e Security Update: kernel (UTSA-2026-101979)");

  script_set_attribute(attribute:"synopsis", value:
"The Unity Linux host is missing one or more security updates.");
  script_set_attribute(attribute:"description", value:
"The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the
UTSA-2026-101979 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    ocfs2: fix recursive semaphore deadlock in fiemap call

    syzbot detected a OCFS2 hang due to a recursive semaphore on a
    FS_IOC_FIEMAP of the extent list on a specially crafted mmap file.

    context_switch kernel/sched/core.c:5357 [inline]
       __schedule+0x1798/0x4cc0 kernel/sched/core.c:6961
       __schedule_loop kernel/sched/core.c:7043 [inline]
       schedule+0x165/0x360 kernel/sched/core.c:7058
       schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7115
       rwsem_down_write_slowpath+0x872/0xfe0 kernel/locking/rwsem.c:1185
       __down_write_common kernel/locking/rwsem.c:1317 [inline]
       __down_write kernel/locking/rwsem.c:1326 [inline]
       down_write+0x1ab/0x1f0 kernel/locking/rwsem.c:1591
       ocfs2_page_mkwrite+0x2ff/0xc40 fs/ocfs2/mmap.c:142
       do_page_mkwrite+0x14d/0x310 mm/memory.c:3361
       wp_page_shared mm/memory.c:3762 [inline]
       do_wp_page+0x268d/0x5800 mm/memory.c:3981
       handle_pte_fault mm/memory.c:6068 [inline]
       __handle_mm_fault+0x1033/0x5440 mm/memory.c:6195
       handle_mm_fault+0x40a/0x8e0 mm/memory.c:6364
       do_user_addr_fault+0x764/0x1390 arch/x86/mm/fault.c:1387
       handle_page_fault arch/x86/mm/fault.c:1476 [inline]
       exc_page_fault+0x76/0xf0 arch/x86/mm/fault.c:1532
       asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:623
    RIP: 0010:copy_user_generic arch/x86/include/asm/uaccess_64.h:126 [inline]
    RIP: 0010:raw_copy_to_user arch/x86/include/asm/uaccess_64.h:147 [inline]
    RIP: 0010:_inline_copy_to_user include/linux/uaccess.h:197 [inline]
    RIP: 0010:_copy_to_user+0x85/0xb0 lib/usercopy.c:26
    Code: e8 00 bc f7 fc 4d 39 fc 72 3d 4d 39 ec 77 38 e8 91 b9 f7 fc 4c 89
    f7 89 de e8 47 25 5b fd 0f 01 cb 4c 89 ff 48 89 d9 4c 89 f6 <f3> a4 0f
    1f 00 48 89 cb 0f 01 ca 48 89 d8 5b 41 5c 41 5d 41 5e 41
    RSP: 0018:ffffc9000403f950 EFLAGS: 00050256
    RAX: ffffffff84c7f101 RBX: 0000000000000038 RCX: 0000000000000038
    RDX: 0000000000000000 RSI: ffffc9000403f9e0 RDI: 0000200000000060
    RBP: ffffc9000403fa90 R08: ffffc9000403fa17 R09: 1ffff92000807f42
    R10: dffffc0000000000 R11: fffff52000807f43 R12: 0000200000000098
    R13: 00007ffffffff000 R14: ffffc9000403f9e0 R15: 0000200000000060
       copy_to_user include/linux/uaccess.h:225 [inline]
       fiemap_fill_next_extent+0x1c0/0x390 fs/ioctl.c:145
       ocfs2_fiemap+0x888/0xc90 fs/ocfs2/extent_map.c:806
       ioctl_fiemap fs/ioctl.c:220 [inline]
       do_vfs_ioctl+0x1173/0x1430 fs/ioctl.c:532
       __do_sys_ioctl fs/ioctl.c:596 [inline]
       __se_sys_ioctl+0x82/0x170 fs/ioctl.c:584
       do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
       do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94
       entry_SYSCALL_64_after_hwframe+0x77/0x7f
    RIP: 0033:0x7f5f13850fd9
    RSP: 002b:00007ffe3b3518b8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
    RAX: ffffffffffffffda RBX: 0000200000000000 RCX: 00007f5f13850fd9
    RDX: 0000200000000040 RSI: 00000000c020660b RDI: 0000000000000004
    RBP: 6165627472616568 R08: 0000000000000000 R09: 0000000000000000
    R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffe3b3518f0
    R13: 00007ffe3b351b18 R14: 431bde82d7b634db R15: 00007f5f1389a03b

    ocfs2_fiemap() takes a read lock of the ip_alloc_sem semaphore (since
    v2.6.22-527-g7307de80510a) and calls fiemap_fill_next_extent() to read the
    extent list of this running mmap executable.  The user supplied buffer to
    hold the fiemap information page faults calling ocfs2_page_mkwrite() which
    will take a write lock (since v2.6.27-38-g00dc417fa3e7) of the same
    semaphore.  This recursive semaphore will hold filesystem locks and causes
    a hang of the fileystem.

    The ip_alloc_sem protects the inode extent list and size.  Release the
    read semphore before calling fiemap_fill_next_extent() in ocfs2_fiemap()
    and ocfs2_fiemap_inline().  This does an unnecessary semaphore lock/unlock
    on the last extent but simplifies the error path.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  # https://src.uniontech.com/#/security_advisory_detail?utsa_id=UTSA-2026-101979
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?cbef614d");
  # https://git.kernel.org/stable/c/04100f775c2ea501927f508f17ad824ad1f23c8d
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?75effc10");
  # https://git.kernel.org/stable/c/0709bc11b942870fc0a7be150e42aea42321093a
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?d2189e01");
  # https://git.kernel.org/stable/c/16e518ca84dfe860c20a62f3615e14e8af0ace57
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?f12801df");
  # https://git.kernel.org/stable/c/1d3c96547ee2ddeaddf8f19a3ef99ea06cc8115e
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?0b797e86");
  # https://git.kernel.org/stable/c/36054554772f95d090eb45793faf6aa3c0254b02
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?783531f1");
  # https://git.kernel.org/stable/c/7e1514bd44ef68007703c752c99ff7319f35bce6
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?cd2d6278");
  # https://git.kernel.org/stable/c/9efcb7a8b97310efed995397941a292cf89fa94f
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?9700141c");
  # https://git.kernel.org/stable/c/ef30404980e4c832ef9bba1b10c08f67fa77a9ec
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?c62dae66");
  # https://lore.kernel.org/linux-cve-announce/2025092302-CVE-2025-39885-7e13@gregkh
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?4d961e4f");
  script_set_attribute(attribute:"see_also", value:"https://nvd.nist.gov/vuln/detail/CVE-2025-39885");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2025-39885");
  script_set_attribute(attribute:"solution", value:
"Update the affected kernel package.");
  script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:S/C:N/I:N/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2025-39885");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2025/09/23");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/08/17");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/08/18");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Unity Linux Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info2.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/UOS-Server/release", "Host/UOS-Server/rpm-list", "Host/cpu");

  exit(0);
}
include('rpm2.inc');

if (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
var os_product = get_kb_item('installed_os/local/SSH/0/product');
if (isnull(os_product) || 'UOS Server' >!< os_product) audit(AUDIT_OS_NOT, 'UOS Server');
var os_version = get_kb_item('installed_os/local/SSH/0/version');
if (isnull(os_version)) audit(AUDIT_UNKNOWN_APP_VER, 'UOS Server');
if (! preg(pattern:"^20.1050e([^0-9]|$)", string:os_version)) audit(AUDIT_OS_NOT, 'UOS Server 20.1050e', 'UOS Server ' + os_version);

if (!get_kb_item('Host/UOS-Server/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('aarch64' >!< cpu && 'amd64' >!< cpu && 'x86_64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'UOS Server', cpu);


var constraints = [
  {
    'release': '20',
    'sp': '1050e',
    'pkgs': [
      {'reference':'kernel-4.19.90-2211.5.0.0178.67.uel20', 'sp':'1050e', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-4.19.90-2211.5.0.0178.67.uel20', 'sp':'1050e', 'cpu':'amd64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-4.19.90-2211.5.0.0178.67.uel20', 'sp':'1050e', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE}
    ]
  }
];

var os_release = get_one_kb_item('installed_os/local/SSH/0/release');
var os_sp = get_one_kb_item('Host/*/minor_release');

var flag = 0;
var reference;
var sp;
var _cpu;
var el_string;
var rpm_spec_vers_cmp;
var epoch;
var allowmaj;
var exists_check;
var cves;
foreach var constraint ( constraints ) {
  # Check that the target release is equal to the affected release
  if (!empty_or_null(constraint['release'])){
    if (constraint['release'] != os_release) continue;
  }
  if (!empty_or_null(constraint['sp'])){
    if (constraint['sp'] != os_sp) continue;
  }
  foreach var pkg ( constraint['pkgs'] ) {
    reference = NULL;
    sp = NULL;
    _cpu = NULL;
    el_string = NULL;
    rpm_spec_vers_cmp = NULL;
    epoch = NULL;
    allowmaj = NULL;
    exists_check = NULL;
    cves = NULL;
    if (!empty_or_null(pkg['reference'])) reference = pkg['reference'];
    if (!empty_or_null(pkg['sp'])) sp = pkg['sp'];
    if (!empty_or_null(pkg['cpu'])) _cpu = pkg['cpu'];
    if (!empty_or_null(pkg['el_string'])) el_string = pkg['el_string'];
    if (!empty_or_null(pkg['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = pkg['rpm_spec_vers_cmp'];
    if (!empty_or_null(pkg['epoch'])) epoch = pkg['epoch'];
    if (!empty_or_null(pkg['allowmaj'])) allowmaj = pkg['allowmaj'];
    if (!empty_or_null(pkg['exists_check'])) exists_check = pkg['exists_check'];
    if (!empty_or_null(pkg['cves'])) cves = pkg['cves'];
    if (reference &&
        ## (no known rpm to check OR known rpm_exists)
        (!exists_check || rpm_exists(rpm:exists_check)) &&
        rpm_check(sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj, cves:cves)) flag++;
  }
}


if (flag)
{
  security_report_v4(
      port       : 0,
      severity   : SECURITY_WARNING,
      extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'kernel');
}