Unity Linux 20.1050e Security Update: kernel (UTSA-2026-102025)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(338550);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/08/21");

  script_cve_id("CVE-2025-68358");

  script_name(english:"Unity Linux 20.1050e Security Update: kernel (UTSA-2026-102025)");

  script_set_attribute(attribute:"synopsis", value:
"The Unity Linux host is missing one or more security updates.");
  script_set_attribute(attribute:"description", value:
"The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the
UTSA-2026-102025 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    btrfs: fix racy bitfield write in btrfs_clear_space_info_full()

    From the memory-barriers.txt document regarding memory barrier ordering
    guarantees:

     (*) These guarantees do not apply to bitfields, because compilers often
         generate code to modify these using non-atomic read-modify-write
         sequences.  Do not attempt to use bitfields to synchronize parallel
         algorithms.

     (*) Even in cases where bitfields are protected by locks, all fields
         in a given bitfield must be protected by one lock.  If two fields
         in a given bitfield are protected by different locks, the compiler's
         non-atomic read-modify-write sequences can cause an update to one
         field to corrupt the value of an adjacent field.

    btrfs_space_info has a bitfield sharing an underlying word consisting of
    the fields full, chunk_alloc, and flush:

    struct btrfs_space_info {
            struct btrfs_fs_info *     fs_info;              /*     0     8 */
            struct btrfs_space_info *  parent;               /*     8     8 */
            ...
            int                        clamp;                /*   172     4 */
            unsigned int               full:1;               /*   176: 0  4 */
            unsigned int               chunk_alloc:1;        /*   176: 1  4 */
            unsigned int               flush:1;              /*   176: 2  4 */
            ...

    Therefore, to be safe from parallel read-modify-writes losing a write to
    one of the bitfield members protected by a lock, all writes to all the
    bitfields must use the lock. They almost universally do, except for
    btrfs_clear_space_info_full() which iterates over the space_infos and
    writes out found->full = 0 without a lock.

    Imagine that we have one thread completing a transaction in which we
    finished deleting a block_group and are thus calling
    btrfs_clear_space_info_full() while simultaneously the data reclaim
    ticket infrastructure is running do_async_reclaim_data_space():

              T1                                             T2
    btrfs_commit_transaction
      btrfs_clear_space_info_full
      data_sinfo->full = 0
      READ: full:0, chunk_alloc:0, flush:1
                                                  do_async_reclaim_data_space(data_sinfo)
                                                  spin_lock(&space_info->lock);
                                                  if(list_empty(tickets))
                                                    space_info->flush = 0;
                                                    READ: full: 0, chunk_alloc:0, flush:1
                                                    MOD/WRITE: full: 0, chunk_alloc:0, flush:0
                                                    spin_unlock(&space_info->lock);
                                                    return;
      MOD/WRITE: full:0, chunk_alloc:0, flush:1

    and now data_sinfo->flush is 1 but the reclaim worker has exited. This
    breaks the invariant that flush is 0 iff there is no work queued or
    running. Once this invariant is violated, future allocations that go
    into __reserve_bytes() will add tickets to space_info->tickets but will
    see space_info->flush is set to 1 and not queue the work. After this,
    they will block forever on the resulting ticket, as it is now impossible
    to kick the worker again.

    I also confirmed by looking at the assembly of the affected kernel that
    it is doing RMW operations. For example, to set the flush (3rd) bit to 0,
    the assembly is:
      andb    $0xfb,0x60(%rbx)
    and similarly for setting the full (1st) bit to 0:
      andb    $0xfe,-0x20(%rax)

    So I think this is really a bug on practical systems.  I have observed
    a number of systems in this exact state, but am currently unable to
    reproduce it.

    Rather than leaving this footgun lying around for the future, take
    advantage of the fact that there is room in the struct anyway, and that
    it is already quite large and simply change the three bitfield members to
    bools. This avoids writes to space_info->full having any effect on
    ---truncated---

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  # https://src.uniontech.com/#/security_advisory_detail?utsa_id=UTSA-2026-102025
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?bfc9ebf3");
  # https://git.kernel.org/stable/c/38e818718c5e04961eea0fa8feff3f100ce40408
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?9bdce1fe");
  # https://git.kernel.org/stable/c/55835646da78e83e7ad06abd741ca8fd8c0b0ea7
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?0d1370e6");
  # https://git.kernel.org/stable/c/6f442808a86eef847ee10afa9e6459494ed85bb3
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?26d82109");
  # https://git.kernel.org/stable/c/742b90eaf394f0018352c0e10dc89763b2dd5267
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?04fcbbba");
  # https://git.kernel.org/stable/c/b0bb67385480a3aa4c54b139e4f371ddd06b5150
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?3816fdce");
  # https://git.kernel.org/stable/c/d4a81b8ec639895999275ea2472c69825cd67ea4
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?7723f814");
  # https://git.kernel.org/stable/c/db4ae18e1b31e0421fb5312e56aefa382bbc6ece
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?1460fdb1");
  # https://lore.kernel.org/linux-cve-announce/2025122456-CVE-2025-68358-4efc@gregkh
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?c1518e6c");
  script_set_attribute(attribute:"see_also", value:"https://nvd.nist.gov/vuln/detail/CVE-2025-68358");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2025-68358");
  script_set_attribute(attribute:"solution", value:
"Update the affected kernel package.");
  script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:S/C:N/I:N/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2025-68358");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2025/12/24");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/08/17");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/08/21");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Unity Linux Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info2.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/UOS-Server/release", "Host/UOS-Server/rpm-list", "Host/cpu");

  exit(0);
}
include('rpm2.inc');

if (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
var os_product = get_kb_item('installed_os/local/SSH/0/product');
if (isnull(os_product) || 'UOS Server' >!< os_product) audit(AUDIT_OS_NOT, 'UOS Server');
var os_version = get_kb_item('installed_os/local/SSH/0/version');
if (isnull(os_version)) audit(AUDIT_UNKNOWN_APP_VER, 'UOS Server');
if (! preg(pattern:"^(20.1050e)([^0-9]|$)", string:os_version)) audit(AUDIT_OS_NOT, 'UOS Server 20.1050e', 'UOS Server ' + os_version);

if (!get_kb_item('Host/UOS-Server/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('aarch64' >!< cpu && 'amd64' >!< cpu && 'x86_64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'UOS Server', cpu);


var constraints = [
  {
    'release': '20',
    'sp': '1050e',
    'pkgs': [
      {'reference':'kernel-4.19.90-2211.5.0.0178.67.uel20', 'sp':'1050e', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-4.19.90-2211.5.0.0178.67.uel20', 'sp':'1050e', 'cpu':'amd64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-4.19.90-2211.5.0.0178.67.uel20', 'sp':'1050e', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE}
    ]
  }
];

var os_release = get_one_kb_item('installed_os/local/SSH/0/release');
var os_sp = get_one_kb_item('Host/*/minor_release');

var flag = 0;
var reference;
var sp;
var _cpu;
var el_string;
var rpm_spec_vers_cmp;
var epoch;
var allowmaj;
var exists_check;
var cves;
foreach var constraint ( constraints ) {
  # Check that the target release is equal to the affected release
  if (!empty_or_null(constraint['release'])){
    if (constraint['release'] != os_release) continue;
  }
  if (!empty_or_null(constraint['sp'])){
    if (constraint['sp'] != os_sp) continue;
  }
  foreach var pkg ( constraint['pkgs'] ) {
    reference = NULL;
    sp = NULL;
    _cpu = NULL;
    el_string = NULL;
    rpm_spec_vers_cmp = NULL;
    epoch = NULL;
    allowmaj = NULL;
    exists_check = NULL;
    cves = NULL;
    if (!empty_or_null(pkg['reference'])) reference = pkg['reference'];
    if (!empty_or_null(pkg['sp'])) sp = pkg['sp'];
    if (!empty_or_null(pkg['cpu'])) _cpu = pkg['cpu'];
    if (!empty_or_null(pkg['el_string'])) el_string = pkg['el_string'];
    if (!empty_or_null(pkg['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = pkg['rpm_spec_vers_cmp'];
    if (!empty_or_null(pkg['epoch'])) epoch = pkg['epoch'];
    if (!empty_or_null(pkg['allowmaj'])) allowmaj = pkg['allowmaj'];
    if (!empty_or_null(pkg['exists_check'])) exists_check = pkg['exists_check'];
    if (!empty_or_null(pkg['cves'])) cves = pkg['cves'];
    if (reference &&
        ## (no known rpm to check OR known rpm_exists)
        (!exists_check || rpm_exists(rpm:exists_check)) &&
        rpm_check(sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj, cves:cves)) flag++;
  }
}


if (flag)
{
  security_report_v4(
      port       : 0,
      severity   : SECURITY_WARNING,
      extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'kernel');
}