Unity Linux 20.1050e Security Update: kernel (UTSA-2026-102099)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(338504);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/08/21");

  script_cve_id("CVE-2026-23089");

  script_name(english:"Unity Linux 20.1050e Security Update: kernel (UTSA-2026-102099)");

  script_set_attribute(attribute:"synopsis", value:
"The Unity Linux host is missing one or more security updates.");
  script_set_attribute(attribute:"description", value:
"The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the
UTSA-2026-102099 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    ALSA: usb-audio: Fix use-after-free in snd_usb_mixer_free()

    When snd_usb_create_mixer() fails, snd_usb_mixer_free() frees
    mixer->id_elems but the controls already added to the card still
    reference the freed memory. Later when snd_card_register() runs,
    the OSS mixer layer calls their callbacks and hits a use-after-free read.

    Call trace:
      get_ctl_value+0x63f/0x820 sound/usb/mixer.c:411
      get_min_max_with_quirks.isra.0+0x240/0x1f40 sound/usb/mixer.c:1241
      mixer_ctl_feature_info+0x26b/0x490 sound/usb/mixer.c:1381
      snd_mixer_oss_build_test+0x174/0x3a0 sound/core/oss/mixer_oss.c:887
      ...
      snd_card_register+0x4ed/0x6d0 sound/core/init.c:923
      usb_audio_probe+0x5ef/0x2a90 sound/usb/card.c:1025

    Fix by calling snd_ctl_remove() for all mixer controls before freeing
    id_elems. We save the next pointer first because snd_ctl_remove()
    frees the current element.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  # https://src.uniontech.com/#/security_advisory_detail?utsa_id=UTSA-2026-102099
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?01448cd4");
  # https://git.kernel.org/stable/c/51b1aa6fe7dc87356ba58df06afb9677c9b841ea
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?2baa1f45");
  # https://git.kernel.org/stable/c/56fb6efd5d04caf6f14994d51ec85393b9a896c6
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?36515d13");
  # https://git.kernel.org/stable/c/7009daeefa945973a530b2f605fe445fc03747af
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?2905c065");
  # https://git.kernel.org/stable/c/7bff0156d13f0ad9436e5178b979b063d59f572a
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?80e3c170");
  # https://git.kernel.org/stable/c/930e69757b74c3ae083b0c3c7419bfe7f0edc7b2
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?13677037");
  # https://git.kernel.org/stable/c/dc1a5dd80af1ee1f29d8375b12dd7625f6294dad
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?750cce6f");
  # https://git.kernel.org/stable/c/e6f103a22b08daf5df2f4aa158081840e5910963
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?018de09f");
  # https://lore.kernel.org/linux-cve-announce/2026020424-CVE-2026-23089-760f@gregkh
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?b7bde287");
  script_set_attribute(attribute:"see_also", value:"https://nvd.nist.gov/vuln/detail/CVE-2026-23089");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2026-23089");
  script_set_attribute(attribute:"solution", value:
"Update the affected kernel package.");
  script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:S/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-23089");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/02/04");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/08/17");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/08/21");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Unity Linux Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info2.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/UOS-Server/release", "Host/UOS-Server/rpm-list", "Host/cpu");

  exit(0);
}
include('rpm2.inc');

if (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
var os_product = get_kb_item('installed_os/local/SSH/0/product');
if (isnull(os_product) || 'UOS Server' >!< os_product) audit(AUDIT_OS_NOT, 'UOS Server');
var os_version = get_kb_item('installed_os/local/SSH/0/version');
if (isnull(os_version)) audit(AUDIT_UNKNOWN_APP_VER, 'UOS Server');
if (! preg(pattern:"^(20.1050e)([^0-9]|$)", string:os_version)) audit(AUDIT_OS_NOT, 'UOS Server 20.1050e', 'UOS Server ' + os_version);

if (!get_kb_item('Host/UOS-Server/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('aarch64' >!< cpu && 'amd64' >!< cpu && 'x86_64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'UOS Server', cpu);


var constraints = [
  {
    'release': '20',
    'sp': '1050e',
    'pkgs': [
      {'reference':'kernel-4.19.90-2211.5.0.0178.67.uel20', 'sp':'1050e', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-4.19.90-2211.5.0.0178.67.uel20', 'sp':'1050e', 'cpu':'amd64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-4.19.90-2211.5.0.0178.67.uel20', 'sp':'1050e', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE}
    ]
  }
];

var os_release = get_one_kb_item('installed_os/local/SSH/0/release');
var os_sp = get_one_kb_item('Host/*/minor_release');

var flag = 0;
var reference;
var sp;
var _cpu;
var el_string;
var rpm_spec_vers_cmp;
var epoch;
var allowmaj;
var exists_check;
var cves;
foreach var constraint ( constraints ) {
  # Check that the target release is equal to the affected release
  if (!empty_or_null(constraint['release'])){
    if (constraint['release'] != os_release) continue;
  }
  if (!empty_or_null(constraint['sp'])){
    if (constraint['sp'] != os_sp) continue;
  }
  foreach var pkg ( constraint['pkgs'] ) {
    reference = NULL;
    sp = NULL;
    _cpu = NULL;
    el_string = NULL;
    rpm_spec_vers_cmp = NULL;
    epoch = NULL;
    allowmaj = NULL;
    exists_check = NULL;
    cves = NULL;
    if (!empty_or_null(pkg['reference'])) reference = pkg['reference'];
    if (!empty_or_null(pkg['sp'])) sp = pkg['sp'];
    if (!empty_or_null(pkg['cpu'])) _cpu = pkg['cpu'];
    if (!empty_or_null(pkg['el_string'])) el_string = pkg['el_string'];
    if (!empty_or_null(pkg['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = pkg['rpm_spec_vers_cmp'];
    if (!empty_or_null(pkg['epoch'])) epoch = pkg['epoch'];
    if (!empty_or_null(pkg['allowmaj'])) allowmaj = pkg['allowmaj'];
    if (!empty_or_null(pkg['exists_check'])) exists_check = pkg['exists_check'];
    if (!empty_or_null(pkg['cves'])) cves = pkg['cves'];
    if (reference &&
        ## (no known rpm to check OR known rpm_exists)
        (!exists_check || rpm_exists(rpm:exists_check)) &&
        rpm_check(sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj, cves:cves)) flag++;
  }
}


if (flag)
{
  security_report_v4(
      port       : 0,
      severity   : SECURITY_WARNING,
      extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'kernel');
}