Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-107294)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(344912);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/09/11");

  script_cve_id("CVE-2025-21634");

  script_name(english:"Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-107294)");

  script_set_attribute(attribute:"synopsis", value:
"The Unity Linux host is missing one or more security updates.");
  script_set_attribute(attribute:"description", value:
"The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the
UTSA-2026-107294 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    cgroup/cpuset: remove kernfs active break

    A warning was found:

    WARNING: CPU: 10 PID: 3486953 at fs/kernfs/file.c:828
    CPU: 10 PID: 3486953 Comm: rmdir Kdump: loaded Tainted: G
    RIP: 0010:kernfs_should_drain_open_files+0x1a1/0x1b0
    RSP: 0018:ffff8881107ef9e0 EFLAGS: 00010202
    RAX: 0000000080000002 RBX: ffff888154738c00 RCX: dffffc0000000000
    RDX: 0000000000000007 RSI: 0000000000000004 RDI: ffff888154738c04
    RBP: ffff888154738c04 R08: ffffffffaf27fa15 R09: ffffed102a8e7180
    R10: ffff888154738c07 R11: 0000000000000000 R12: ffff888154738c08
    R13: ffff888750f8c000 R14: ffff888750f8c0e8 R15: ffff888154738ca0
    FS:  00007f84cd0be740(0000) GS:ffff8887ddc00000(0000) knlGS:0000000000000000
    CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
    CR2: 0000555f9fbe00c8 CR3: 0000000153eec001 CR4: 0000000000370ee0
    DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
    DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
    Call Trace:
     kernfs_drain+0x15e/0x2f0
     __kernfs_remove+0x165/0x300
     kernfs_remove_by_name_ns+0x7b/0xc0
     cgroup_rm_file+0x154/0x1c0
     cgroup_addrm_files+0x1c2/0x1f0
     css_clear_dir+0x77/0x110
     kill_css+0x4c/0x1b0
     cgroup_destroy_locked+0x194/0x380
     cgroup_rmdir+0x2a/0x140

    It can be explained by:
    rmdir                           echo 1 > cpuset.cpus
                                    kernfs_fop_write_iter // active=0
    cgroup_rm_file
    kernfs_remove_by_name_ns        kernfs_get_active // active=1
    __kernfs_remove                                   // active=0x80000002
    kernfs_drain                    cpuset_write_resmask
    wait_event
    //waiting (active == 0x80000001)
                                    kernfs_break_active_protection
                                    // active = 0x80000001
    // continue
                                    kernfs_unbreak_active_protection
                                    // active = 0x80000002
    ...
    kernfs_should_drain_open_files
    // warning occurs
                                    kernfs_put_active

    This warning is caused by 'kernfs_break_active_protection' when it is
    writing to cpuset.cpus, and the cgroup is removed concurrently.

    The commit 3a5a6d0c2b03 (cpuset: don't nest cgroup_mutex inside
    get_online_cpus()) made cpuset_hotplug_workfn asynchronous, This change
    involves calling flush_work(), which can create a multiple processes
    circular locking dependency that involve cgroup_mutex, potentially leading
    to a deadlock. To avoid deadlock. the commit 76bb5ab8f6e3 (cpuset: break
    kernfs active protection in cpuset_write_resmask()) added
    'kernfs_break_active_protection' in the cpuset_write_resmask. This could
    lead to this warning.

    After the commit 2125c0034c5d (cgroup/cpuset: Make cpuset hotplug
    processing synchronous), the cpuset_write_resmask no longer needs to
    wait the hotplug to finish, which means that concurrent hotplug and cpuset
    operations are no longer possible. Therefore, the deadlock doesn't exist
    anymore and it does not have to 'break active protection' now. To fix this
    warning, just remove kernfs_break_active_protection operation in the
    'cpuset_write_resmask'.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  # https://src.uniontech.com/#/security_advisory_detail?utsa_id=UTSA-2026-107294
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?226889f9");
  # https://git.kernel.org/stable/c/11cb1d643a74665a4e14749414f48f82cbc15c64
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?3c941ab5");
  # https://git.kernel.org/stable/c/3cb97a927fffe443e1e7e8eddbfebfdb062e86ed
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?60d1c06a");
  # https://lore.kernel.org/linux-cve-announce/2025011942-CVE-2025-21634-011f@gregkh
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?8aef042e");
  script_set_attribute(attribute:"see_also", value:"https://nvd.nist.gov/vuln/detail/CVE-2025-21634");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2025-21634");
  script_set_attribute(attribute:"solution", value:
"Update the affected kernel package.");
  script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:S/C:N/I:N/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2025-21634");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2025/01/19");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/09/11");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/09/11");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Unity Linux Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info2.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/UOS-Server/release", "Host/UOS-Server/rpm-list", "Host/cpu");

  exit(0);
}
include('rpm2.inc');

if (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
var os_product = get_kb_item('installed_os/local/SSH/0/product');
if (isnull(os_product) || 'UOS Server' >!< os_product) audit(AUDIT_OS_NOT, 'UOS Server');
var os_version = get_kb_item('installed_os/local/SSH/0/version');
if (isnull(os_version)) audit(AUDIT_UNKNOWN_APP_VER, 'UOS Server');
if (! preg(pattern:"^(20.1050e|20.1060e|20.1070e)([^0-9]|$)", string:os_version)) audit(AUDIT_OS_NOT, 'UOS Server 20.1050e / 20.1060e / 20.1070e', 'UOS Server ' + os_version);

if (!get_kb_item('Host/UOS-Server/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('aarch64' >!< cpu && 'amd64' >!< cpu && 'x86_64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'UOS Server', cpu);


var constraints = [
  {
    'release': '20',
    'sp': '1050e',
    'pkgs': [
      {'reference':'kernel-4.19.90-2305.1.0.0199.122.uel20', 'sp':'1050e', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-4.19.90-2305.1.0.0199.122.uel20', 'sp':'1050e', 'cpu':'amd64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-4.19.90-2305.1.0.0199.122.uel20', 'sp':'1050e', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE}
    ]
  },
  {
    'release': '20',
    'sp': '1060e',
    'pkgs': [
      {'reference':'kernel-4.19.90-2311.4.0.0227.122.uel20', 'sp':'1060e', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-4.19.90-2311.4.0.0227.122.uel20', 'sp':'1060e', 'cpu':'amd64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-4.19.90-2311.4.0.0227.122.uel20', 'sp':'1060e', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE}
    ]
  },
  {
    'release': '20',
    'sp': '1070e',
    'pkgs': [
      {'reference':'kernel-4.19.90-2601.1.0.0023.uel20', 'sp':'1070e', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-4.19.90-2601.1.0.0023.uel20', 'sp':'1070e', 'cpu':'amd64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-4.19.90-2601.1.0.0023.uel20', 'sp':'1070e', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE}
    ]
  }
];

var os_release = get_one_kb_item('installed_os/local/SSH/0/release');
var os_sp = get_one_kb_item('Host/*/minor_release');

var flag = 0;
var reference;
var sp;
var _cpu;
var el_string;
var rpm_spec_vers_cmp;
var epoch;
var allowmaj;
var exists_check;
var cves;
foreach var constraint ( constraints ) {
  # Check that the target release is equal to the affected release
  if (!empty_or_null(constraint['release'])){
    if (constraint['release'] != os_release) continue;
  }
  if (!empty_or_null(constraint['sp'])){
    if (constraint['sp'] != os_sp) continue;
  }
  foreach var pkg ( constraint['pkgs'] ) {
    reference = NULL;
    sp = NULL;
    _cpu = NULL;
    el_string = NULL;
    rpm_spec_vers_cmp = NULL;
    epoch = NULL;
    allowmaj = NULL;
    exists_check = NULL;
    cves = NULL;
    if (!empty_or_null(pkg['reference'])) reference = pkg['reference'];
    if (!empty_or_null(pkg['sp'])) sp = pkg['sp'];
    if (!empty_or_null(pkg['cpu'])) _cpu = pkg['cpu'];
    if (!empty_or_null(pkg['el_string'])) el_string = pkg['el_string'];
    if (!empty_or_null(pkg['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = pkg['rpm_spec_vers_cmp'];
    if (!empty_or_null(pkg['epoch'])) epoch = pkg['epoch'];
    if (!empty_or_null(pkg['allowmaj'])) allowmaj = pkg['allowmaj'];
    if (!empty_or_null(pkg['exists_check'])) exists_check = pkg['exists_check'];
    if (!empty_or_null(pkg['cves'])) cves = pkg['cves'];
    if (reference &&
        ## (no known rpm to check OR known rpm_exists)
        (!exists_check || rpm_exists(rpm:exists_check)) &&
        rpm_check(sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj, cves:cves)) flag++;
  }
}


if (flag)
{
  security_report_v4(
      port       : 0,
      severity   : SECURITY_WARNING,
      extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'kernel');
}