Unity Linux 20.1050a Security Update: kernel (UTSA-2026-104558)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(339566);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/08/26");

  script_cve_id("CVE-2026-74384");

  script_name(english:"Unity Linux 20.1050a Security Update: kernel (UTSA-2026-104558)");

  script_set_attribute(attribute:"synopsis", value:
"The Unity Linux host is missing one or more security updates.");
  script_set_attribute(attribute:"description", value:
"The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the
UTSA-2026-104558 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    nvme-multipath: fix flex array size in struct nvme_ns_head

    struct nvme_ns_head contains a flexible array member, current_path[],
    which is indexed using the NUMA node ID:
    head->current_path[numa_node_id()]

    The structure is currently allocated as:
    size = sizeof(struct nvme_ns_head) +
           (num_possible_nodes() * sizeof(struct nvme_ns *));
    head = kzalloc(size, GFP_KERNEL);

    This allocation assumes that NUMA node IDs are sequential and densely
    packed from 0 .. num_possible_nodes() - 1. While this assumption holds
    on many systems, it is not always true on some architectures such as
    powerpc.

    On some powerpc systems, NUMA node IDs can be sparse. For example:
    NUMA:
      NUMA node(s):              6
      NUMA node0 CPU(s):         80-159
      NUMA node8 CPU(s):         0-79
      NUMA node252 CPU(s):
      NUMA node253 CPU(s):
      NUMA node254 CPU(s):
      NUMA node255 CPU(s):

    That is, the possible/online NUMA node IDs are: 0, 8, 252, 253, 254, 255
    In this case: num_possible_nodes() = 6

    So memory is allocated for only 6 entries in current_path[]. However,
    the array is later indexed using the actual NUMA node ID. As a result,
    accesses such as:
    head->current_path[8] or
    head->current_path[252]
    goes out of bounds, leading to the following KASAN splat:

    ==================================================================
    BUG: KASAN: slab-out-of-bounds in nvme_mpath_revalidate_paths+0x22c/0x290 [nvme_core]
    Write of size 8 at addr c00020003bda35b8 by task kworker/u641:2/1997

    CPU: 1 UID: 0 PID: 1997 Comm: kworker/u641:2 Not tainted 7.1.0-rc5-dirty #14 PREEMPT(lazy)
    Hardware name: 8335-GTH POWER9 0x4e1202 opal:skiboot-v6.5.3-35-g1851b2a06 PowerNV
    Workqueue: async async_run_entry_fn
    Call Trace:
    [c000200037fa7510] [c0000000021c23d4] dump_stack_lvl+0x88/0xdc (unreliable)
    [c000200037fa7540] [c0000000009fda90] print_report+0x22c/0x67c
    [c000200037fa7630] [c0000000009fd508] kasan_report+0x108/0x220
    [c000200037fa7740] [c0000000009fff48] __asan_store8+0xe8/0x120
    [c000200037fa7760] [c008000018e76474] nvme_mpath_revalidate_paths+0x22c/0x290 [nvme_core]
    [c000200037fa7800] [c008000018e6556c] nvme_update_ns_info+0x4a4/0x5e0 [nvme_core]
    [c000200037fa7a50] [c008000018e66270] nvme_alloc_ns+0x6d8/0x1a70 [nvme_core]
    [c000200037fa7c20] [c008000018e679fc] nvme_scan_ns+0x3f4/0x630 [nvme_core]
    [c000200037fa7d10] [c00000000031f22c] async_run_entry_fn+0x9c/0x3a0
    [c000200037fa7db0] [c0000000002fa544] process_one_work+0x414/0xa10
    [c000200037fa7ec0] [c0000000002fbf00] worker_thread+0x320/0x640
    [c000200037fa7f80] [c00000000030d0f8] kthread+0x278/0x290
    [c000200037fa7fe0] [c00000000000ded8] start_kernel_thread+0x14/0x18

    Allocated by task 1997 on cpu 1 at 35.928317s:

    The buggy address belongs to the object at c00020003bda3000
     which belongs to the cache kmalloc-rnd-15-2k of size 2048
    The buggy address is located 16 bytes to the right of
     allocated 1448-byte region [c00020003bda3000, c00020003bda35a8)

    The buggy address belongs to the physical page:

    Memory state around the buggy address:
     c00020003bda3480: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
     c00020003bda3500: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
    >c00020003bda3580: 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc fc
                                            ^
     c00020003bda3600: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
     c00020003bda3680: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
    ==================================================================

    Fix this by allocating the flexible array using nr_node_ids instead
    of num_possible_nodes(). Since nr_node_ids represents the maximum
    possible NUMA node IDs, indexing current_path[] using numa_node_id()
    becomes safe even on systems with sparse node IDs.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  # https://src.uniontech.com/#/security_advisory_detail?utsa_id=UTSA-2026-104558
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?bdd72625");
  # https://lore.kernel.org/linux-cve-announce/2026081505-CVE-2026-74384-f743@gregkh
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?37a4b708");
  script_set_attribute(attribute:"see_also", value:"https://nvd.nist.gov/vuln/detail/CVE-2026-74384");
  script_set_attribute(attribute:"solution", value:
"Update the affected kernel package.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-74384");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/08/11");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/08/25");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/08/26");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Unity Linux Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info2.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/UOS-Server/release", "Host/UOS-Server/rpm-list", "Host/cpu");

  exit(0);
}
include('rpm2.inc');

if (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
var os_product = get_kb_item('installed_os/local/SSH/0/product');
if (isnull(os_product) || 'UOS Server' >!< os_product) audit(AUDIT_OS_NOT, 'UOS Server');
var os_version = get_kb_item('installed_os/local/SSH/0/version');
if (isnull(os_version)) audit(AUDIT_UNKNOWN_APP_VER, 'UOS Server');
if (! preg(pattern:"^(20.1050a)([^0-9]|$)", string:os_version)) audit(AUDIT_OS_NOT, 'UOS Server 20.1050a', 'UOS Server ' + os_version);

if (!get_kb_item('Host/UOS-Server/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('aarch64' >!< cpu && 'amd64' >!< cpu && 'x86_64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'UOS Server', cpu);


var constraints = [
  {
    'release': '20',
    'sp': '1050a',
    'pkgs': [
      {'reference':'kernel-5.10.0-27.18.uelc20', 'sp':'1050a', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-5.10.0-27.18.uelc20', 'sp':'1050a', 'cpu':'amd64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-5.10.0-27.18.uelc20', 'sp':'1050a', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE}
    ]
  }
];

var os_release = get_one_kb_item('installed_os/local/SSH/0/release');
var os_sp = get_one_kb_item('Host/*/minor_release');

var flag = 0;
var reference;
var sp;
var _cpu;
var el_string;
var rpm_spec_vers_cmp;
var epoch;
var allowmaj;
var exists_check;
var cves;
foreach var constraint ( constraints ) {
  # Check that the target release is equal to the affected release
  if (!empty_or_null(constraint['release'])){
    if (constraint['release'] != os_release) continue;
  }
  if (!empty_or_null(constraint['sp'])){
    if (constraint['sp'] != os_sp) continue;
  }
  foreach var pkg ( constraint['pkgs'] ) {
    reference = NULL;
    sp = NULL;
    _cpu = NULL;
    el_string = NULL;
    rpm_spec_vers_cmp = NULL;
    epoch = NULL;
    allowmaj = NULL;
    exists_check = NULL;
    cves = NULL;
    if (!empty_or_null(pkg['reference'])) reference = pkg['reference'];
    if (!empty_or_null(pkg['sp'])) sp = pkg['sp'];
    if (!empty_or_null(pkg['cpu'])) _cpu = pkg['cpu'];
    if (!empty_or_null(pkg['el_string'])) el_string = pkg['el_string'];
    if (!empty_or_null(pkg['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = pkg['rpm_spec_vers_cmp'];
    if (!empty_or_null(pkg['epoch'])) epoch = pkg['epoch'];
    if (!empty_or_null(pkg['allowmaj'])) allowmaj = pkg['allowmaj'];
    if (!empty_or_null(pkg['exists_check'])) exists_check = pkg['exists_check'];
    if (!empty_or_null(pkg['cves'])) cves = pkg['cves'];
    if (reference &&
        ## (no known rpm to check OR known rpm_exists)
        (!exists_check || rpm_exists(rpm:exists_check)) &&
        rpm_check(sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj, cves:cves)) flag++;
  }
}


if (flag)
{
  security_report_v4(
      port       : 0,
      severity   : SECURITY_HOLE,
      extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'kernel');
}