Unity Linux 20.1050e Security Update: kernel (UTSA-2026-102128)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(337302);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/08/18");

  script_cve_id("CVE-2026-23286");

  script_name(english:"Unity Linux 20.1050e Security Update: kernel (UTSA-2026-102128)");

  script_set_attribute(attribute:"synopsis", value:
"The Unity Linux host is missing one or more security updates.");
  script_set_attribute(attribute:"description", value:
"The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the
UTSA-2026-102128 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    atm: lec: fix null-ptr-deref in lec_arp_clear_vccs

    syzkaller reported a null-ptr-deref in lec_arp_clear_vccs().
    This issue can be easily reproduced using the syzkaller reproducer.

    In the ATM LANE (LAN Emulation) module, the same atm_vcc can be shared by
    multiple lec_arp_table entries (e.g., via entry->vcc or entry->recv_vcc).
    When the underlying VCC is closed, lec_vcc_close() iterates over all
    ARP entries and calls lec_arp_clear_vccs() for each matched entry.

    For example, when lec_vcc_close() iterates through the hlists in
    priv->lec_arp_empty_ones or other ARP tables:

    1. In the first iteration, for the first matched ARP entry sharing the VCC,
    lec_arp_clear_vccs() frees the associated vpriv (which is vcc->user_back)
    and sets vcc->user_back to NULL.
    2. In the second iteration, for the next matched ARP entry sharing the same
    VCC, lec_arp_clear_vccs() is called again. It obtains a NULL vpriv from
    vcc->user_back (via LEC_VCC_PRIV(vcc)) and then attempts to dereference it
    via `vcc->pop = vpriv->old_pop`, leading to a null-ptr-deref crash.

    Fix this by adding a null check for vpriv before dereferencing
    it. If vpriv is already NULL, it means the VCC has been cleared
    by a previous call, so we can safely skip the cleanup and just
    clear the entry's vcc/recv_vcc pointers.

    The entire cleanup block (including vcc_release_async()) is placed inside
    the vpriv guard because a NULL vpriv indicates the VCC has already been
    fully released by a prior iteration  repeating the teardown would
    redundantly set flags and trigger callbacks on an already-closing socket.

    The Fixes tag points to the initial commit because the entry->vcc path has
    been vulnerable since the original code. The entry->recv_vcc path was later
    added by commit 8d9f73c0ad2f (atm: fix a memory leak of vcc->user_back)
    with the same pattern, and both paths are fixed here.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  # https://src.uniontech.com/#/security_advisory_detail?utsa_id=UTSA-2026-102128
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?406a1222");
  # https://git.kernel.org/stable/c/101bacb303e89dc2e0640ae6a5e0fb97c4eb45bb
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?94d75c10");
  # https://git.kernel.org/stable/c/2d9f57ea29a1f1772373b98a509b44d49fda609e
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?03c020c9");
  # https://git.kernel.org/stable/c/30c9744a989feb22cfbb84170eb0e038a7a2c1da
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?f0183bb3");
  # https://git.kernel.org/stable/c/5f1cfea7921f5c126a441d973690eeba52677b64
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?c5c212e7");
  # https://git.kernel.org/stable/c/622062f24644b4536d3f437e0cf7a8c4bb421665
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?79b81047");
  # https://git.kernel.org/stable/c/7ea92ab075d809ec8a96669a5ecf00f752057875
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?0aec89e2");
  # https://git.kernel.org/stable/c/8aff65a82b6389ec674d46e5b3d3ae6f07db5e3e
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?6680614f");
  # https://git.kernel.org/stable/c/e9665986eb127290ceb535bd5d04d7a84265d94f
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?4b1bdfbc");
  # https://lore.kernel.org/linux-cve-announce/2026032524-CVE-2026-23286-8a7e@gregkh
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?f33a048d");
  script_set_attribute(attribute:"see_also", value:"https://nvd.nist.gov/vuln/detail/CVE-2026-23286");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2026-23286");
  script_set_attribute(attribute:"solution", value:
"Update the affected kernel package.");
  script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:S/C:N/I:N/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-23286");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/03/25");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/08/17");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/08/18");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Unity Linux Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info2.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/UOS-Server/release", "Host/UOS-Server/rpm-list", "Host/cpu");

  exit(0);
}
include('rpm2.inc');

if (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
var os_product = get_kb_item('installed_os/local/SSH/0/product');
if (isnull(os_product) || 'UOS Server' >!< os_product) audit(AUDIT_OS_NOT, 'UOS Server');
var os_version = get_kb_item('installed_os/local/SSH/0/version');
if (isnull(os_version)) audit(AUDIT_UNKNOWN_APP_VER, 'UOS Server');
if (! preg(pattern:"^20.1050e([^0-9]|$)", string:os_version)) audit(AUDIT_OS_NOT, 'UOS Server 20.1050e', 'UOS Server ' + os_version);

if (!get_kb_item('Host/UOS-Server/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('aarch64' >!< cpu && 'amd64' >!< cpu && 'x86_64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'UOS Server', cpu);


var constraints = [
  {
    'release': '20',
    'sp': '1050e',
    'pkgs': [
      {'reference':'kernel-4.19.90-2211.5.0.0178.67.uel20', 'sp':'1050e', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-4.19.90-2211.5.0.0178.67.uel20', 'sp':'1050e', 'cpu':'amd64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-4.19.90-2211.5.0.0178.67.uel20', 'sp':'1050e', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE}
    ]
  }
];

var os_release = get_one_kb_item('installed_os/local/SSH/0/release');
var os_sp = get_one_kb_item('Host/*/minor_release');

var flag = 0;
var reference;
var sp;
var _cpu;
var el_string;
var rpm_spec_vers_cmp;
var epoch;
var allowmaj;
var exists_check;
var cves;
foreach var constraint ( constraints ) {
  # Check that the target release is equal to the affected release
  if (!empty_or_null(constraint['release'])){
    if (constraint['release'] != os_release) continue;
  }
  if (!empty_or_null(constraint['sp'])){
    if (constraint['sp'] != os_sp) continue;
  }
  foreach var pkg ( constraint['pkgs'] ) {
    reference = NULL;
    sp = NULL;
    _cpu = NULL;
    el_string = NULL;
    rpm_spec_vers_cmp = NULL;
    epoch = NULL;
    allowmaj = NULL;
    exists_check = NULL;
    cves = NULL;
    if (!empty_or_null(pkg['reference'])) reference = pkg['reference'];
    if (!empty_or_null(pkg['sp'])) sp = pkg['sp'];
    if (!empty_or_null(pkg['cpu'])) _cpu = pkg['cpu'];
    if (!empty_or_null(pkg['el_string'])) el_string = pkg['el_string'];
    if (!empty_or_null(pkg['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = pkg['rpm_spec_vers_cmp'];
    if (!empty_or_null(pkg['epoch'])) epoch = pkg['epoch'];
    if (!empty_or_null(pkg['allowmaj'])) allowmaj = pkg['allowmaj'];
    if (!empty_or_null(pkg['exists_check'])) exists_check = pkg['exists_check'];
    if (!empty_or_null(pkg['cves'])) cves = pkg['cves'];
    if (reference &&
        ## (no known rpm to check OR known rpm_exists)
        (!exists_check || rpm_exists(rpm:exists_check)) &&
        rpm_check(sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj, cves:cves)) flag++;
  }
}


if (flag)
{
  security_report_v4(
      port       : 0,
      severity   : SECURITY_WARNING,
      extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'kernel');
}