Unity Linux 20.1050e Security Update: kernel (UTSA-2026-102069)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(338527);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/08/21");

  script_cve_id("CVE-2026-43338");

  script_name(english:"Unity Linux 20.1050e Security Update: kernel (UTSA-2026-102069)");

  script_set_attribute(attribute:"synopsis", value:
"The Unity Linux host is missing one or more security updates.");
  script_set_attribute(attribute:"description", value:
"The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the
UTSA-2026-102069 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    btrfs: reserve enough transaction items for qgroup ioctls

    Currently our qgroup ioctls don't reserve any space, they just do a
    transaction join, which does not reserve any space, neither for the quota
    tree updates nor for the delayed refs generated when updating the quota
    tree. The quota root uses the global block reserve, which is fine most of
    the time since we don't expect a lot of updates to the quota root, or to
    be too close to -ENOSPC such that other critical metadata updates need to
    resort to the global reserve.

    However this is not optimal, as not reserving proper space may result in a
    transaction abort due to not reserving space for delayed refs and then
    abusing the use of the global block reserve.

    For example, the following reproducer (which is unlikely to model any
    real world use case, but just to illustrate the problem), triggers such a
    transaction abort due to -ENOSPC when running delayed refs:

      $ cat test.sh
      #!/bin/bash

      DEV=/dev/nullb0
      MNT=/mnt/nullb0

      umount $DEV &> /dev/null
      # Limit device to 1G so that it's much faster to reproduce the issue.
      mkfs.btrfs -f -b 1G $DEV
      mount -o commit=600 $DEV $MNT

      fallocate -l 800M $MNT/filler
      btrfs quota enable $MNT

      for ((i = 1; i <= 400000; i++)); do
          btrfs qgroup create 1/$i $MNT
      done

      umount $MNT

    When running this, we can see in dmesg/syslog that a transaction abort
    happened:

      [436.490] BTRFS error (device nullb0): failed to run delayed ref for logical 30408704 num_bytes 16384
    type 176 action 1 ref_mod 1: -28
      [436.493] ------------[ cut here ]------------
      [436.494] BTRFS: Transaction aborted (error -28)
      [436.495] WARNING: fs/btrfs/extent-tree.c:2247 at btrfs_run_delayed_refs+0xd9/0x110 [btrfs], CPU#4:
    umount/2495372
      [436.497] Modules linked in: btrfs loop (...)
      [436.508] CPU: 4 UID: 0 PID: 2495372 Comm: umount Tainted: G        W           6.19.0-rc8-btrfs-
    next-225+ #1 PREEMPT(full)
      [436.510] Tainted: [W]=WARN
      [436.511] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS
    rel-1.16.2-0-gea1b7a073390-prebuilt.qemu.org 04/01/2014
      [436.513] RIP: 0010:btrfs_run_delayed_refs+0xdf/0x110 [btrfs]
      [436.514] Code: 0f 82 ea (...)
      [436.518] RSP: 0018:ffffd511850b7d78 EFLAGS: 00010292
      [436.519] RAX: 00000000ffffffe4 RBX: ffff8f120dad37e0 RCX: 0000000002040001
      [436.520] RDX: 0000000000000002 RSI: 00000000ffffffe4 RDI: ffffffffc090fd80
      [436.522] RBP: 0000000000000000 R08: 0000000000000001 R09: ffffffffc04d1867
      [436.523] R10: ffff8f18dc1fffa8 R11: 0000000000000003 R12: ffff8f173aa89400
      [436.524] R13: 0000000000000000 R14: ffff8f173aa89400 R15: 0000000000000000
      [436.526] FS:  00007fe59045d840(0000) GS:ffff8f192e22e000(0000) knlGS:0000000000000000
      [436.527] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
      [436.528] CR2: 00007fe5905ff2b0 CR3: 000000060710a002 CR4: 0000000000370ef0
      [436.530] Call Trace:
      [436.530]  <TASK>
      [436.530]  btrfs_commit_transaction+0x73/0xc00 [btrfs]
      [436.531]  ? btrfs_attach_transaction_barrier+0x1e/0x70 [btrfs]
      [436.532]  sync_filesystem+0x7a/0x90
      [436.533]  generic_shutdown_super+0x28/0x180
      [436.533]  kill_anon_super+0x12/0x40
      [436.534]  btrfs_kill_super+0x12/0x20 [btrfs]
      [436.534]  deactivate_locked_super+0x2f/0xb0
      [436.534]  cleanup_mnt+0xea/0x180
      [436.535]  task_work_run+0x58/0xa0
      [436.535]  exit_to_user_mode_loop+0xed/0x480
      [436.536]  ? __x64_sys_umount+0x68/0x80
      [436.536]  do_syscall_64+0x2a5/0xf20
      [436.537]  entry_SYSCALL_64_after_hwframe+0x76/0x7e
      [436.537] RIP: 0033:0x7fe5906b6217
      [436.538] Code: 0d 00 f7 (...)
      [436.540] RSP: 002b:00007ffcd87a61f8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6
      [436.541] RAX: 0000000000000000 RBX: 00005618b9ecadc8 RCX: 00007fe5906b6217
      [436.541] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 00005618b9ecb100
      [436.542] RBP: 0000000000000000 R08: 00007ffcd87a4fe0 R09: 00000000ffffffff
      [436.544] R10: 0000000000000103 R11:
    ---truncated---

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  # https://src.uniontech.com/#/security_advisory_detail?utsa_id=UTSA-2026-102069
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?80872b91");
  # https://git.kernel.org/stable/c/386f5e16a383101a68e195c806b4eedb233cd1d3
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?06662039");
  # https://git.kernel.org/stable/c/bb6eb33c908edbbb4d92abdc0c6c87f21b4952e8
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?dae136e4");
  # https://git.kernel.org/stable/c/cf930a651eef6f8d915bf0ccd60c2045974f870c
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?3d9f0fbe");
  # https://git.kernel.org/stable/c/f9a4e3015db1aeafbef407650eb8555445ca943e
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?53433800");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2026-43338");
  script_set_attribute(attribute:"solution", value:
"Update the affected kernel package.");
  script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:S/C:N/I:N/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-43338");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/05/08");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/08/17");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/08/21");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Unity Linux Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info2.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/UOS-Server/release", "Host/UOS-Server/rpm-list", "Host/cpu");

  exit(0);
}
include('rpm2.inc');

if (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
var os_product = get_kb_item('installed_os/local/SSH/0/product');
if (isnull(os_product) || 'UOS Server' >!< os_product) audit(AUDIT_OS_NOT, 'UOS Server');
var os_version = get_kb_item('installed_os/local/SSH/0/version');
if (isnull(os_version)) audit(AUDIT_UNKNOWN_APP_VER, 'UOS Server');
if (! preg(pattern:"^(20.1050e)([^0-9]|$)", string:os_version)) audit(AUDIT_OS_NOT, 'UOS Server 20.1050e', 'UOS Server ' + os_version);

if (!get_kb_item('Host/UOS-Server/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('aarch64' >!< cpu && 'amd64' >!< cpu && 'x86_64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'UOS Server', cpu);


var constraints = [
  {
    'release': '20',
    'sp': '1050e',
    'pkgs': [
      {'reference':'kernel-4.19.90-2211.5.0.0178.67.uel20', 'sp':'1050e', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-4.19.90-2211.5.0.0178.67.uel20', 'sp':'1050e', 'cpu':'amd64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-4.19.90-2211.5.0.0178.67.uel20', 'sp':'1050e', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE}
    ]
  }
];

var os_release = get_one_kb_item('installed_os/local/SSH/0/release');
var os_sp = get_one_kb_item('Host/*/minor_release');

var flag = 0;
var reference;
var sp;
var _cpu;
var el_string;
var rpm_spec_vers_cmp;
var epoch;
var allowmaj;
var exists_check;
var cves;
foreach var constraint ( constraints ) {
  # Check that the target release is equal to the affected release
  if (!empty_or_null(constraint['release'])){
    if (constraint['release'] != os_release) continue;
  }
  if (!empty_or_null(constraint['sp'])){
    if (constraint['sp'] != os_sp) continue;
  }
  foreach var pkg ( constraint['pkgs'] ) {
    reference = NULL;
    sp = NULL;
    _cpu = NULL;
    el_string = NULL;
    rpm_spec_vers_cmp = NULL;
    epoch = NULL;
    allowmaj = NULL;
    exists_check = NULL;
    cves = NULL;
    if (!empty_or_null(pkg['reference'])) reference = pkg['reference'];
    if (!empty_or_null(pkg['sp'])) sp = pkg['sp'];
    if (!empty_or_null(pkg['cpu'])) _cpu = pkg['cpu'];
    if (!empty_or_null(pkg['el_string'])) el_string = pkg['el_string'];
    if (!empty_or_null(pkg['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = pkg['rpm_spec_vers_cmp'];
    if (!empty_or_null(pkg['epoch'])) epoch = pkg['epoch'];
    if (!empty_or_null(pkg['allowmaj'])) allowmaj = pkg['allowmaj'];
    if (!empty_or_null(pkg['exists_check'])) exists_check = pkg['exists_check'];
    if (!empty_or_null(pkg['cves'])) cves = pkg['cves'];
    if (reference &&
        ## (no known rpm to check OR known rpm_exists)
        (!exists_check || rpm_exists(rpm:exists_check)) &&
        rpm_check(sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj, cves:cves)) flag++;
  }
}


if (flag)
{
  security_report_v4(
      port       : 0,
      severity   : SECURITY_WARNING,
      extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'kernel');
}