Unity Linux 20.1050e Security Update: kernel (UTSA-2026-102126)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(337288);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/08/18");

  script_cve_id("CVE-2025-38468");

  script_name(english:"Unity Linux 20.1050e Security Update: kernel (UTSA-2026-102126)");

  script_set_attribute(attribute:"synopsis", value:
"The Unity Linux host is missing one or more security updates.");
  script_set_attribute(attribute:"description", value:
"The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the
UTSA-2026-102126 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    net/sched: Return NULL when htb_lookup_leaf encounters an empty rbtree

    htb_lookup_leaf has a BUG_ON that can trigger with the following:

    tc qdisc del dev lo root
    tc qdisc add dev lo root handle 1: htb default 1
    tc class add dev lo parent 1: classid 1:1 htb rate 64bit
    tc qdisc add dev lo parent 1:1 handle 2: netem
    tc qdisc add dev lo parent 2:1 handle 3: blackhole
    ping -I lo -c1 -W0.001 127.0.0.1

    The root cause is the following:

    1. htb_dequeue calls htb_dequeue_tree which calls the dequeue handler on
       the selected leaf qdisc
    2. netem_dequeue calls enqueue on the child qdisc
    3. blackhole_enqueue drops the packet and returns a value that is not
       just NET_XMIT_SUCCESS
    4. Because of this, netem_dequeue calls qdisc_tree_reduce_backlog, and
       since qlen is now 0, it calls htb_qlen_notify -> htb_deactivate ->
       htb_deactiviate_prios -> htb_remove_class_from_row -> htb_safe_rb_erase
    5. As this is the only class in the selected hprio rbtree,
       __rb_change_child in __rb_erase_augmented sets the rb_root pointer to
       NULL
    6. Because blackhole_dequeue returns NULL, netem_dequeue returns NULL,
       which causes htb_dequeue_tree to call htb_lookup_leaf with the same
       hprio rbtree, and fail the BUG_ON

    The function graph for this scenario is shown here:
     0)               |  htb_enqueue() {
     0) + 13.635 us   |    netem_enqueue();
     0)   4.719 us    |    htb_activate_prios();
     0) # 2249.199 us |  }
     0)               |  htb_dequeue() {
     0)   2.355 us    |    htb_lookup_leaf();
     0)               |    netem_dequeue() {
     0) + 11.061 us   |      blackhole_enqueue();
     0)               |      qdisc_tree_reduce_backlog() {
     0)               |        qdisc_lookup_rcu() {
     0)   1.873 us    |          qdisc_match_from_root();
     0)   6.292 us    |        }
     0)   1.894 us    |        htb_search();
     0)               |        htb_qlen_notify() {
     0)   2.655 us    |          htb_deactivate_prios();
     0)   6.933 us    |        }
     0) + 25.227 us   |      }
     0)   1.983 us    |      blackhole_dequeue();
     0) + 86.553 us   |    }
     0) # 2932.761 us |    qdisc_warn_nonwc();
     0)               |    htb_lookup_leaf() {
     0)               |      BUG_ON();
     ------------------------------------------

    The full original bug report can be seen here [1].

    We can fix this just by returning NULL instead of the BUG_ON,
    as htb_dequeue_tree returns NULL when htb_lookup_leaf returns
    NULL.

    [1] https://lore.kernel.org/netdev/pF5XOOIim0IuEfhI-
    SOxTgRvNoDwuux7UHKnE_Y5-zVd4wmGvNk2ceHjKb8ORnzw0cGwfmVu42g9dL7XyJLf1NEzaztboTWcm0Ogxuojoeo=@willsroot.io/

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  # https://src.uniontech.com/#/security_advisory_detail?utsa_id=UTSA-2026-102126
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?d9789747");
  # https://git.kernel.org/stable/c/0e1d5d9b5c5966e2e42e298670808590db5ed628
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?c66b1943");
  # https://git.kernel.org/stable/c/3691f84269a23f7edd263e9b6edbc27b7ae332f4
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?57a3c088");
  # https://git.kernel.org/stable/c/5c0506cd1b1a3b145bda2612bbf7fe78d186c355
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?db677bd4");
  # https://git.kernel.org/stable/c/7ff2d83ecf2619060f30ecf9fad4f2a700fca344
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?8d83c31b");
  # https://git.kernel.org/stable/c/850226aef8d28a00cf966ef26d2f8f2bff344535
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?59bcda24");
  # https://git.kernel.org/stable/c/890a5d423ef0a7bd13447ceaffad21189f557301
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?3e6f1cac");
  # https://git.kernel.org/stable/c/e5c480dc62a3025b8428d4818e722da30ad6804f
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?0b002c12");
  # https://git.kernel.org/stable/c/fed3570e548a6c9f95c5f4c9e1a7afc1679fd90d
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?6f446546");
  # https://lore.kernel.org/linux-cve-announce/2025072834-CVE-2025-38468-4110@gregkh
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?98aa10f2");
  script_set_attribute(attribute:"see_also", value:"https://nvd.nist.gov/vuln/detail/CVE-2025-38468");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2025-38468");
  script_set_attribute(attribute:"solution", value:
"Update the affected kernel package.");
  script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:S/C:N/I:N/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2025-38468");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2025/07/28");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/08/17");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/08/18");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Unity Linux Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info2.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/UOS-Server/release", "Host/UOS-Server/rpm-list", "Host/cpu");

  exit(0);
}
include('rpm2.inc');

if (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
var os_product = get_kb_item('installed_os/local/SSH/0/product');
if (isnull(os_product) || 'UOS Server' >!< os_product) audit(AUDIT_OS_NOT, 'UOS Server');
var os_version = get_kb_item('installed_os/local/SSH/0/version');
if (isnull(os_version)) audit(AUDIT_UNKNOWN_APP_VER, 'UOS Server');
if (! preg(pattern:"^20.1050e([^0-9]|$)", string:os_version)) audit(AUDIT_OS_NOT, 'UOS Server 20.1050e', 'UOS Server ' + os_version);

if (!get_kb_item('Host/UOS-Server/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('aarch64' >!< cpu && 'amd64' >!< cpu && 'x86_64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'UOS Server', cpu);


var constraints = [
  {
    'release': '20',
    'sp': '1050e',
    'pkgs': [
      {'reference':'kernel-4.19.90-2211.5.0.0178.67.uel20', 'sp':'1050e', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-4.19.90-2211.5.0.0178.67.uel20', 'sp':'1050e', 'cpu':'amd64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-4.19.90-2211.5.0.0178.67.uel20', 'sp':'1050e', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE}
    ]
  }
];

var os_release = get_one_kb_item('installed_os/local/SSH/0/release');
var os_sp = get_one_kb_item('Host/*/minor_release');

var flag = 0;
var reference;
var sp;
var _cpu;
var el_string;
var rpm_spec_vers_cmp;
var epoch;
var allowmaj;
var exists_check;
var cves;
foreach var constraint ( constraints ) {
  # Check that the target release is equal to the affected release
  if (!empty_or_null(constraint['release'])){
    if (constraint['release'] != os_release) continue;
  }
  if (!empty_or_null(constraint['sp'])){
    if (constraint['sp'] != os_sp) continue;
  }
  foreach var pkg ( constraint['pkgs'] ) {
    reference = NULL;
    sp = NULL;
    _cpu = NULL;
    el_string = NULL;
    rpm_spec_vers_cmp = NULL;
    epoch = NULL;
    allowmaj = NULL;
    exists_check = NULL;
    cves = NULL;
    if (!empty_or_null(pkg['reference'])) reference = pkg['reference'];
    if (!empty_or_null(pkg['sp'])) sp = pkg['sp'];
    if (!empty_or_null(pkg['cpu'])) _cpu = pkg['cpu'];
    if (!empty_or_null(pkg['el_string'])) el_string = pkg['el_string'];
    if (!empty_or_null(pkg['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = pkg['rpm_spec_vers_cmp'];
    if (!empty_or_null(pkg['epoch'])) epoch = pkg['epoch'];
    if (!empty_or_null(pkg['allowmaj'])) allowmaj = pkg['allowmaj'];
    if (!empty_or_null(pkg['exists_check'])) exists_check = pkg['exists_check'];
    if (!empty_or_null(pkg['cves'])) cves = pkg['cves'];
    if (reference &&
        ## (no known rpm to check OR known rpm_exists)
        (!exists_check || rpm_exists(rpm:exists_check)) &&
        rpm_check(sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj, cves:cves)) flag++;
  }
}


if (flag)
{
  security_report_v4(
      port       : 0,
      severity   : SECURITY_WARNING,
      extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'kernel');
}