Unity Linux 20.1050e Security Update: kernel (UTSA-2026-102030)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(338501);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/08/21");

  script_cve_id("CVE-2025-68801");

  script_name(english:"Unity Linux 20.1050e Security Update: kernel (UTSA-2026-102030)");

  script_set_attribute(attribute:"synopsis", value:
"The Unity Linux host is missing one or more security updates.");
  script_set_attribute(attribute:"description", value:
"The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the
UTSA-2026-102030 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    mlxsw: spectrum_router: Fix neighbour use-after-free

    We sometimes observe use-after-free when dereferencing a neighbour [1].
    The problem seems to be that the driver stores a pointer to the
    neighbour, but without holding a reference on it. A reference is only
    taken when the neighbour is used by a nexthop.

    Fix by simplifying the reference counting scheme. Always take a
    reference when storing a neighbour pointer in a neighbour entry. Avoid
    taking a referencing when the neighbour is used by a nexthop as the
    neighbour entry associated with the nexthop already holds a reference.

    Tested by running the test that uncovered the problem over 300 times.
    Without this patch the problem was reproduced after a handful of
    iterations.

    [1]
    BUG: KASAN: slab-use-after-free in mlxsw_sp_neigh_entry_update+0x2d4/0x310
    Read of size 8 at addr ffff88817f8e3420 by task ip/3929

    CPU: 3 UID: 0 PID: 3929 Comm: ip Not tainted 6.18.0-rc4-virtme-g36b21a067510 #3 PREEMPT(full)
    Hardware name: Nvidia SN5600/VMOD0013, BIOS 5.13 05/31/2023
    Call Trace:
     <TASK>
     dump_stack_lvl+0x6f/0xa0
     print_address_description.constprop.0+0x6e/0x300
     print_report+0xfc/0x1fb
     kasan_report+0xe4/0x110
     mlxsw_sp_neigh_entry_update+0x2d4/0x310
     mlxsw_sp_router_rif_gone_sync+0x35f/0x510
     mlxsw_sp_rif_destroy+0x1ea/0x730
     mlxsw_sp_inetaddr_port_vlan_event+0xa1/0x1b0
     __mlxsw_sp_inetaddr_lag_event+0xcc/0x130
     __mlxsw_sp_inetaddr_event+0xf5/0x3c0
     mlxsw_sp_router_netdevice_event+0x1015/0x1580
     notifier_call_chain+0xcc/0x150
     call_netdevice_notifiers_info+0x7e/0x100
     __netdev_upper_dev_unlink+0x10b/0x210
     netdev_upper_dev_unlink+0x79/0xa0
     vrf_del_slave+0x18/0x50
     do_set_master+0x146/0x7d0
     do_setlink.isra.0+0x9a0/0x2880
     rtnl_newlink+0x637/0xb20
     rtnetlink_rcv_msg+0x6fe/0xb90
     netlink_rcv_skb+0x123/0x380
     netlink_unicast+0x4a3/0x770
     netlink_sendmsg+0x75b/0xc90
     __sock_sendmsg+0xbe/0x160
     ____sys_sendmsg+0x5b2/0x7d0
     ___sys_sendmsg+0xfd/0x180
     __sys_sendmsg+0x124/0x1c0
     do_syscall_64+0xbb/0xfd0
     entry_SYSCALL_64_after_hwframe+0x4b/0x53
    [...]

    Allocated by task 109:
     kasan_save_stack+0x30/0x50
     kasan_save_track+0x14/0x30
     __kasan_kmalloc+0x7b/0x90
     __kmalloc_noprof+0x2c1/0x790
     neigh_alloc+0x6af/0x8f0
     ___neigh_create+0x63/0xe90
     mlxsw_sp_nexthop_neigh_init+0x430/0x7e0
     mlxsw_sp_nexthop_type_init+0x212/0x960
     mlxsw_sp_nexthop6_group_info_init.constprop.0+0x81f/0x1280
     mlxsw_sp_nexthop6_group_get+0x392/0x6a0
     mlxsw_sp_fib6_entry_create+0x46a/0xfd0
     mlxsw_sp_router_fib6_replace+0x1ed/0x5f0
     mlxsw_sp_router_fib6_event_work+0x10a/0x2a0
     process_one_work+0xd57/0x1390
     worker_thread+0x4d6/0xd40
     kthread+0x355/0x5b0
     ret_from_fork+0x1d4/0x270
     ret_from_fork_asm+0x11/0x20

    Freed by task 154:
     kasan_save_stack+0x30/0x50
     kasan_save_track+0x14/0x30
     __kasan_save_free_info+0x3b/0x60
     __kasan_slab_free+0x43/0x70
     kmem_cache_free_bulk.part.0+0x1eb/0x5e0
     kvfree_rcu_bulk+0x1f2/0x260
     kfree_rcu_work+0x130/0x1b0
     process_one_work+0xd57/0x1390
     worker_thread+0x4d6/0xd40
     kthread+0x355/0x5b0
     ret_from_fork+0x1d4/0x270
     ret_from_fork_asm+0x11/0x20

    Last potentially related work creation:
     kasan_save_stack+0x30/0x50
     kasan_record_aux_stack+0x8c/0xa0
     kvfree_call_rcu+0x93/0x5b0
     mlxsw_sp_router_neigh_event_work+0x67d/0x860
     process_one_work+0xd57/0x1390
     worker_thread+0x4d6/0xd40
     kthread+0x355/0x5b0
     ret_from_fork+0x1d4/0x270
     ret_from_fork_asm+0x11/0x20

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  # https://src.uniontech.com/#/security_advisory_detail?utsa_id=UTSA-2026-102030
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?d6a99443");
  script_set_attribute(attribute:"see_also", value:"https://atomgit.com/src-openeuler/kernel/issues/13354");
  # https://lore.kernel.org/linux-cve-announce/2026011308-CVE-2025-68801-d3d5@gregkh
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?7451a2eb");
  script_set_attribute(attribute:"see_also", value:"https://nvd.nist.gov/vuln/detail/CVE-2025-68801");
  script_set_attribute(attribute:"solution", value:
"Update the affected kernel package.");
  script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:S/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2025-68801");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/01/13");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/08/17");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/08/21");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Unity Linux Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info2.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/UOS-Server/release", "Host/UOS-Server/rpm-list", "Host/cpu");

  exit(0);
}
include('rpm2.inc');

if (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
var os_product = get_kb_item('installed_os/local/SSH/0/product');
if (isnull(os_product) || 'UOS Server' >!< os_product) audit(AUDIT_OS_NOT, 'UOS Server');
var os_version = get_kb_item('installed_os/local/SSH/0/version');
if (isnull(os_version)) audit(AUDIT_UNKNOWN_APP_VER, 'UOS Server');
if (! preg(pattern:"^(20.1050e)([^0-9]|$)", string:os_version)) audit(AUDIT_OS_NOT, 'UOS Server 20.1050e', 'UOS Server ' + os_version);

if (!get_kb_item('Host/UOS-Server/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('aarch64' >!< cpu && 'amd64' >!< cpu && 'x86_64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'UOS Server', cpu);


var constraints = [
  {
    'release': '20',
    'sp': '1050e',
    'pkgs': [
      {'reference':'kernel-4.19.90-2211.5.0.0178.67.uel20', 'sp':'1050e', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-4.19.90-2211.5.0.0178.67.uel20', 'sp':'1050e', 'cpu':'amd64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-4.19.90-2211.5.0.0178.67.uel20', 'sp':'1050e', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE}
    ]
  }
];

var os_release = get_one_kb_item('installed_os/local/SSH/0/release');
var os_sp = get_one_kb_item('Host/*/minor_release');

var flag = 0;
var reference;
var sp;
var _cpu;
var el_string;
var rpm_spec_vers_cmp;
var epoch;
var allowmaj;
var exists_check;
var cves;
foreach var constraint ( constraints ) {
  # Check that the target release is equal to the affected release
  if (!empty_or_null(constraint['release'])){
    if (constraint['release'] != os_release) continue;
  }
  if (!empty_or_null(constraint['sp'])){
    if (constraint['sp'] != os_sp) continue;
  }
  foreach var pkg ( constraint['pkgs'] ) {
    reference = NULL;
    sp = NULL;
    _cpu = NULL;
    el_string = NULL;
    rpm_spec_vers_cmp = NULL;
    epoch = NULL;
    allowmaj = NULL;
    exists_check = NULL;
    cves = NULL;
    if (!empty_or_null(pkg['reference'])) reference = pkg['reference'];
    if (!empty_or_null(pkg['sp'])) sp = pkg['sp'];
    if (!empty_or_null(pkg['cpu'])) _cpu = pkg['cpu'];
    if (!empty_or_null(pkg['el_string'])) el_string = pkg['el_string'];
    if (!empty_or_null(pkg['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = pkg['rpm_spec_vers_cmp'];
    if (!empty_or_null(pkg['epoch'])) epoch = pkg['epoch'];
    if (!empty_or_null(pkg['allowmaj'])) allowmaj = pkg['allowmaj'];
    if (!empty_or_null(pkg['exists_check'])) exists_check = pkg['exists_check'];
    if (!empty_or_null(pkg['cves'])) cves = pkg['cves'];
    if (reference &&
        ## (no known rpm to check OR known rpm_exists)
        (!exists_check || rpm_exists(rpm:exists_check)) &&
        rpm_check(sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj, cves:cves)) flag++;
  }
}


if (flag)
{
  security_report_v4(
      port       : 0,
      severity   : SECURITY_WARNING,
      extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'kernel');
}