Unity Linux 20.1050e Security Update: kernel (UTSA-2026-101987)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(337259);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/08/18");

  script_cve_id("CVE-2026-43046");

  script_name(english:"Unity Linux 20.1050e Security Update: kernel (UTSA-2026-101987)");

  script_set_attribute(attribute:"synopsis", value:
"The Unity Linux host is missing one or more security updates.");
  script_set_attribute(attribute:"description", value:
"The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the
UTSA-2026-101987 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    btrfs: reject root items with drop_progress and zero drop_level

    [BUG]
    When recovering relocation at mount time, merge_reloc_root() and
    btrfs_drop_snapshot() both use BUG_ON(level == 0) to guard against
    an impossible state: a non-zero drop_progress combined with a zero
    drop_level in a root_item, which can be triggered:

    ------------[ cut here ]------------
    kernel BUG at fs/btrfs/relocation.c:1545!
    Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI
    CPU: 1 UID: 0 PID: 283 ... Tainted: 6.18.0+ #16 PREEMPT(voluntary)
    Tainted: [O]=OOT_MODULE, [E]=UNSIGNED_MODULE
    Hardware name: QEMU Ubuntu 24.04 PC v2, BIOS 1.16.3-debian-1.16.3-2
    RIP: 0010:merge_reloc_root+0x1266/0x1650 fs/btrfs/relocation.c:1545
    Code: ffff0000 00004589 d7e9acfa ffffe8a1 79bafebe 02000000
    Call Trace:
     merge_reloc_roots+0x295/0x890 fs/btrfs/relocation.c:1861
     btrfs_recover_relocation+0xd6e/0x11d0 fs/btrfs/relocation.c:4195
     btrfs_start_pre_rw_mount+0xa4d/0x1810 fs/btrfs/disk-io.c:3130
     open_ctree+0x5824/0x5fe0 fs/btrfs/disk-io.c:3640
     btrfs_fill_super fs/btrfs/super.c:987 [inline]
     btrfs_get_tree_super fs/btrfs/super.c:1951 [inline]
     btrfs_get_tree_subvol fs/btrfs/super.c:2094 [inline]
     btrfs_get_tree+0x111c/0x2190 fs/btrfs/super.c:2128
     vfs_get_tree+0x9a/0x370 fs/super.c:1758
     fc_mount fs/namespace.c:1199 [inline]
     do_new_mount_fc fs/namespace.c:3642 [inline]
     do_new_mount fs/namespace.c:3718 [inline]
     path_mount+0x5b8/0x1ea0 fs/namespace.c:4028
     do_mount fs/namespace.c:4041 [inline]
     __do_sys_mount fs/namespace.c:4229 [inline]
     __se_sys_mount fs/namespace.c:4206 [inline]
     __x64_sys_mount+0x282/0x320 fs/namespace.c:4206
     ...
    RIP: 0033:0x7f969c9a8fde
    Code: 0f1f4000 48c7c2b0 fffffff7 d8648902 b8ffffff ffc3660f
    ---[ end trace 0000000000000000 ]---

    The bug is reproducible on 7.0.0-rc2-next-20260310 with our dynamic
    metadata fuzzing tool that corrupts btrfs metadata at runtime.

    [CAUSE]
    A non-zero drop_progress.objectid means an interrupted
    btrfs_drop_snapshot() left a resume point on disk, and in that case
    drop_level must be greater than 0 because the checkpoint is only
    saved at internal node levels.

    Although this invariant is enforced when the kernel writes the root
    item, it is not validated when the root item is read back from disk.
    That allows on-disk corruption to provide an invalid state with
    drop_progress.objectid != 0 and drop_level == 0.

    When relocation recovery later processes such a root item,
    merge_reloc_root() reads drop_level and hits BUG_ON(level == 0). The
    same invalid metadata can also trigger the corresponding BUG_ON() in
    btrfs_drop_snapshot().

    [FIX]
    Fix this by validating the root_item invariant in tree-checker when
    reading root items from disk: if drop_progress.objectid is non-zero,
    drop_level must also be non-zero. Reject such malformed metadata with
    -EUCLEAN before it reaches merge_reloc_root() or btrfs_drop_snapshot()
    and triggers the BUG_ON.

    After the fix, the same corruption is correctly rejected by tree-checker
    and the BUG_ON is no longer triggered.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  # https://src.uniontech.com/#/security_advisory_detail?utsa_id=UTSA-2026-101987
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?fb9f2a09");
  # https://lore.kernel.org/linux-cve-announce/2026050105-CVE-2026-43046-0fa9@gregkh
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?747f8428");
  script_set_attribute(attribute:"see_also", value:"https://nvd.nist.gov/vuln/detail/CVE-2026-43046");
  script_set_attribute(attribute:"solution", value:
"Update the affected kernel package.");
  script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:S/C:N/I:N/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-43046");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/04/23");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/08/17");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/08/18");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Unity Linux Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info2.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/UOS-Server/release", "Host/UOS-Server/rpm-list", "Host/cpu");

  exit(0);
}
include('rpm2.inc');

if (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
var os_product = get_kb_item('installed_os/local/SSH/0/product');
if (isnull(os_product) || 'UOS Server' >!< os_product) audit(AUDIT_OS_NOT, 'UOS Server');
var os_version = get_kb_item('installed_os/local/SSH/0/version');
if (isnull(os_version)) audit(AUDIT_UNKNOWN_APP_VER, 'UOS Server');
if (! preg(pattern:"^20.1050e([^0-9]|$)", string:os_version)) audit(AUDIT_OS_NOT, 'UOS Server 20.1050e', 'UOS Server ' + os_version);

if (!get_kb_item('Host/UOS-Server/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('aarch64' >!< cpu && 'amd64' >!< cpu && 'x86_64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'UOS Server', cpu);


var constraints = [
  {
    'release': '20',
    'sp': '1050e',
    'pkgs': [
      {'reference':'kernel-4.19.90-2211.5.0.0178.67.uel20', 'sp':'1050e', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-4.19.90-2211.5.0.0178.67.uel20', 'sp':'1050e', 'cpu':'amd64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-4.19.90-2211.5.0.0178.67.uel20', 'sp':'1050e', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE}
    ]
  }
];

var os_release = get_one_kb_item('installed_os/local/SSH/0/release');
var os_sp = get_one_kb_item('Host/*/minor_release');

var flag = 0;
var reference;
var sp;
var _cpu;
var el_string;
var rpm_spec_vers_cmp;
var epoch;
var allowmaj;
var exists_check;
var cves;
foreach var constraint ( constraints ) {
  # Check that the target release is equal to the affected release
  if (!empty_or_null(constraint['release'])){
    if (constraint['release'] != os_release) continue;
  }
  if (!empty_or_null(constraint['sp'])){
    if (constraint['sp'] != os_sp) continue;
  }
  foreach var pkg ( constraint['pkgs'] ) {
    reference = NULL;
    sp = NULL;
    _cpu = NULL;
    el_string = NULL;
    rpm_spec_vers_cmp = NULL;
    epoch = NULL;
    allowmaj = NULL;
    exists_check = NULL;
    cves = NULL;
    if (!empty_or_null(pkg['reference'])) reference = pkg['reference'];
    if (!empty_or_null(pkg['sp'])) sp = pkg['sp'];
    if (!empty_or_null(pkg['cpu'])) _cpu = pkg['cpu'];
    if (!empty_or_null(pkg['el_string'])) el_string = pkg['el_string'];
    if (!empty_or_null(pkg['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = pkg['rpm_spec_vers_cmp'];
    if (!empty_or_null(pkg['epoch'])) epoch = pkg['epoch'];
    if (!empty_or_null(pkg['allowmaj'])) allowmaj = pkg['allowmaj'];
    if (!empty_or_null(pkg['exists_check'])) exists_check = pkg['exists_check'];
    if (!empty_or_null(pkg['cves'])) cves = pkg['cves'];
    if (reference &&
        ## (no known rpm to check OR known rpm_exists)
        (!exists_check || rpm_exists(rpm:exists_check)) &&
        rpm_check(sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj, cves:cves)) flag++;
  }
}


if (flag)
{
  security_report_v4(
      port       : 0,
      severity   : SECURITY_WARNING,
      extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'kernel');
}