Unity Linux 20.1050e Security Update: kernel (UTSA-2026-102098)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(338539);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/08/21");

  script_cve_id("CVE-2026-43234");

  script_name(english:"Unity Linux 20.1050e Security Update: kernel (UTSA-2026-102098)");

  script_set_attribute(attribute:"synopsis", value:
"The Unity Linux host is missing one or more security updates.");
  script_set_attribute(attribute:"description", value:
"The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the
UTSA-2026-102098 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    team: avoid NETDEV_CHANGEMTU event when unregistering slave

    syzbot is reporting

      unregister_netdevice: waiting for netdevsim0 to become free. Usage count = 3
      ref_tracker: netdev@ffff88807dcf8618 has 1/2 users at
           __netdev_tracker_alloc include/linux/netdevice.h:4400 [inline]
           netdev_hold include/linux/netdevice.h:4429 [inline]
           inetdev_init+0x201/0x4e0 net/ipv4/devinet.c:286
           inetdev_event+0x251/0x1610 net/ipv4/devinet.c:1600
           notifier_call_chain+0x19d/0x3a0 kernel/notifier.c:85
           call_netdevice_notifiers_mtu net/core/dev.c:2318 [inline]
           netif_set_mtu_ext+0x5aa/0x800 net/core/dev.c:9886
           netif_set_mtu+0xd7/0x1b0 net/core/dev.c:9907
           dev_set_mtu+0x126/0x260 net/core/dev_api.c:248
           team_port_del+0xb07/0xcb0 drivers/net/team/team_core.c:1333
           team_del_slave drivers/net/team/team_core.c:1936 [inline]
           team_device_event+0x207/0x5b0 drivers/net/team/team_core.c:2929
           notifier_call_chain+0x19d/0x3a0 kernel/notifier.c:85
           call_netdevice_notifiers_extack net/core/dev.c:2281 [inline]
           call_netdevice_notifiers net/core/dev.c:2295 [inline]
           __dev_change_net_namespace+0xcb7/0x2050 net/core/dev.c:12592
           do_setlink+0x2ce/0x4590 net/core/rtnetlink.c:3060
           rtnl_changelink net/core/rtnetlink.c:3776 [inline]
           __rtnl_newlink net/core/rtnetlink.c:3935 [inline]
           rtnl_newlink+0x15a9/0x1be0 net/core/rtnetlink.c:4072
           rtnetlink_rcv_msg+0x7d5/0xbe0 net/core/rtnetlink.c:6958
           netlink_rcv_skb+0x232/0x4b0 net/netlink/af_netlink.c:2550
           netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline]
           netlink_unicast+0x80f/0x9b0 net/netlink/af_netlink.c:1344
           netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1894

    problem. Ido Schimmel found steps to reproduce

      ip link add name team1 type team
      ip link add name dummy1 mtu 1499 master team1 type dummy
      ip netns add ns1
      ip link set dev dummy1 netns ns1
      ip -n ns1 link del dev dummy1

    and also found that the same issue was fixed in the bond driver in
    commit f51048c3e07b (bonding: avoid NETDEV_CHANGEMTU event when
    unregistering slave).

    Let's do similar thing for the team driver, with commit ad7c7b2172c3 (net:
    hold netdev instance lock during sysfs operations) and commit 303a8487a657
    (net: s/__dev_set_mtu/__netif_set_mtu/) also applied.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  # https://src.uniontech.com/#/security_advisory_detail?utsa_id=UTSA-2026-102098
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?f96fffbe");
  # https://lore.kernel.org/linux-cve-announce/2026050657-CVE-2026-43234-2acb@gregkh
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?15ca3f56");
  script_set_attribute(attribute:"see_also", value:"https://nvd.nist.gov/vuln/detail/CVE-2026-43234");
  script_set_attribute(attribute:"solution", value:
"Update the affected kernel package.");
  script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:S/C:N/I:N/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-43234");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/05/06");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/08/17");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/08/21");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Unity Linux Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info2.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/UOS-Server/release", "Host/UOS-Server/rpm-list", "Host/cpu");

  exit(0);
}
include('rpm2.inc');

if (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
var os_product = get_kb_item('installed_os/local/SSH/0/product');
if (isnull(os_product) || 'UOS Server' >!< os_product) audit(AUDIT_OS_NOT, 'UOS Server');
var os_version = get_kb_item('installed_os/local/SSH/0/version');
if (isnull(os_version)) audit(AUDIT_UNKNOWN_APP_VER, 'UOS Server');
if (! preg(pattern:"^(20.1050e)([^0-9]|$)", string:os_version)) audit(AUDIT_OS_NOT, 'UOS Server 20.1050e', 'UOS Server ' + os_version);

if (!get_kb_item('Host/UOS-Server/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('aarch64' >!< cpu && 'amd64' >!< cpu && 'x86_64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'UOS Server', cpu);


var constraints = [
  {
    'release': '20',
    'sp': '1050e',
    'pkgs': [
      {'reference':'kernel-4.19.90-2211.5.0.0178.67.uel20', 'sp':'1050e', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-4.19.90-2211.5.0.0178.67.uel20', 'sp':'1050e', 'cpu':'amd64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-4.19.90-2211.5.0.0178.67.uel20', 'sp':'1050e', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE}
    ]
  }
];

var os_release = get_one_kb_item('installed_os/local/SSH/0/release');
var os_sp = get_one_kb_item('Host/*/minor_release');

var flag = 0;
var reference;
var sp;
var _cpu;
var el_string;
var rpm_spec_vers_cmp;
var epoch;
var allowmaj;
var exists_check;
var cves;
foreach var constraint ( constraints ) {
  # Check that the target release is equal to the affected release
  if (!empty_or_null(constraint['release'])){
    if (constraint['release'] != os_release) continue;
  }
  if (!empty_or_null(constraint['sp'])){
    if (constraint['sp'] != os_sp) continue;
  }
  foreach var pkg ( constraint['pkgs'] ) {
    reference = NULL;
    sp = NULL;
    _cpu = NULL;
    el_string = NULL;
    rpm_spec_vers_cmp = NULL;
    epoch = NULL;
    allowmaj = NULL;
    exists_check = NULL;
    cves = NULL;
    if (!empty_or_null(pkg['reference'])) reference = pkg['reference'];
    if (!empty_or_null(pkg['sp'])) sp = pkg['sp'];
    if (!empty_or_null(pkg['cpu'])) _cpu = pkg['cpu'];
    if (!empty_or_null(pkg['el_string'])) el_string = pkg['el_string'];
    if (!empty_or_null(pkg['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = pkg['rpm_spec_vers_cmp'];
    if (!empty_or_null(pkg['epoch'])) epoch = pkg['epoch'];
    if (!empty_or_null(pkg['allowmaj'])) allowmaj = pkg['allowmaj'];
    if (!empty_or_null(pkg['exists_check'])) exists_check = pkg['exists_check'];
    if (!empty_or_null(pkg['cves'])) cves = pkg['cves'];
    if (reference &&
        ## (no known rpm to check OR known rpm_exists)
        (!exists_check || rpm_exists(rpm:exists_check)) &&
        rpm_check(sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj, cves:cves)) flag++;
  }
}


if (flag)
{
  security_report_v4(
      port       : 0,
      severity   : SECURITY_WARNING,
      extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'kernel');
}