Unity Linux 20.1070e Security Update: kernel (UTSA-2026-131742)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(366567);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/10/16");

  script_cve_id("CVE-2026-23450");

  script_name(english:"Unity Linux 20.1070e Security Update: kernel (UTSA-2026-131742)");

  script_set_attribute(attribute:"synopsis", value:
"The Unity Linux host is missing one or more security updates.");
  script_set_attribute(attribute:"description", value:
"The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the
UTSA-2026-131742 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    net/smc: fix NULL dereference and UAF in smc_tcp_syn_recv_sock()

    Syzkaller reported a panic in smc_tcp_syn_recv_sock() [1].

    smc_tcp_syn_recv_sock() is called in the TCP receive path
    (softirq) via icsk_af_ops->syn_recv_sock on the clcsock (TCP
    listening socket). It reads sk_user_data to get the smc_sock
    pointer. However, when the SMC listen socket is being closed
    concurrently, smc_close_active() sets clcsock->sk_user_data
    to NULL under sk_callback_lock, and then the smc_sock itself
    can be freed via sock_put() in smc_release().

    This leads to two issues:

    1) NULL pointer dereference: sk_user_data is NULL when
       accessed.
    2) Use-after-free: sk_user_data is read as non-NULL, but the
       smc_sock is freed before its fields (e.g., queued_smc_hs,
       ori_af_ops) are accessed.

    The race window looks like this (the syzkaller crash [1]
    triggers via the SYN cookie path: tcp_get_cookie_sock() ->
    smc_tcp_syn_recv_sock(), but the normal tcp_check_req() path
    has the same race):

      CPU A (softirq)              CPU B (process ctx)

      tcp_v4_rcv()
        TCP_NEW_SYN_RECV:
        sk = req->rsk_listener
        sock_hold(sk)
        /* No lock on listener */
                                   smc_close_active():
                                     write_lock_bh(cb_lock)
                                     sk_user_data = NULL
                                     write_unlock_bh(cb_lock)
                                     ...
                                     smc_clcsock_release()
                                     sock_put(smc->sk) x2
                                       -> smc_sock freed!
        tcp_check_req()
          smc_tcp_syn_recv_sock():
            smc = user_data(sk)
              -> NULL or dangling
            smc->queued_smc_hs
              -> crash!

    Note that the clcsock and smc_sock are two independent objects
    with separate refcounts. TCP stack holds a reference on the
    clcsock, which keeps it alive, but this does NOT prevent the
    smc_sock from being freed.

    Fix this by using RCU and refcount_inc_not_zero() to safely
    access smc_sock. Since smc_tcp_syn_recv_sock() is called in
    the TCP three-way handshake path, taking read_lock_bh on
    sk_callback_lock is too heavy and would not survive a SYN
    flood attack. Using rcu_read_lock() is much more lightweight.

    - Set SOCK_RCU_FREE on the SMC listen socket so that
      smc_sock freeing is deferred until after the RCU grace
      period. This guarantees the memory is still valid when
      accessed inside rcu_read_lock().
    - Use rcu_read_lock() to protect reading sk_user_data.
    - Use refcount_inc_not_zero(&smc->sk.sk_refcnt) to pin the
      smc_sock. If the refcount has already reached zero (close
      path completed), it returns false and we bail out safely.

    Note: smc_hs_congested() has a similar lockless read of
    sk_user_data without rcu_read_lock(), but it only checks for
    NULL and accesses the global smc_hs_wq, never dereferencing
    any smc_sock field, so it is not affected.

    Reproducer was verified with mdelay injection and smc_run,
    the issue no longer occurs with this patch applied.

    [1] https://syzkaller.appspot.com/bug?extid=827ae2bfb3a3529333e9

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  # https://src.uniontech.com/#/security_advisory_detail?utsa_id=UTSA-2026-131742
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?0ac69668");
  # https://lore.kernel.org/linux-cve-announce/2026040316-CVE-2026-23450-2437@gregkh
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?a184c1e2");
  script_set_attribute(attribute:"see_also", value:"https://nvd.nist.gov/vuln/detail/CVE-2026-23450");
  script_set_attribute(attribute:"solution", value:
"Update the affected kernel package.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-23450");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/04/03");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/10/16");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/10/16");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Unity Linux Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info2.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/UOS-Server/release", "Host/UOS-Server/rpm-list", "Host/cpu");

  exit(0);
}
include('rpm2.inc');

if (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
var os_product = get_kb_item('installed_os/local/SSH/0/product');
if (isnull(os_product) || 'UOS Server' >!< os_product) audit(AUDIT_OS_NOT, 'UOS Server');
var os_version = get_kb_item('installed_os/local/SSH/0/version');
if (isnull(os_version)) audit(AUDIT_UNKNOWN_APP_VER, 'UOS Server');
if (! preg(pattern:"^(20.1070e)([^0-9]|$)", string:os_version)) audit(AUDIT_OS_NOT, 'UOS Server 20.1070e', 'UOS Server ' + os_version);

if (!get_kb_item('Host/UOS-Server/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('aarch64' >!< cpu && 'amd64' >!< cpu && 'sw_64' >!< cpu && 'x86_64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'UOS Server', cpu);


var constraints = [
  {
    'release': '20',
    'sp': '1070e',
    'pkgs': [
      {'reference':'kernel-5.10.0-79.26.uel20', 'sp':'1070e', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-5.10.0-79.26.uel20', 'sp':'1070e', 'cpu':'amd64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-5.10.0-79.26.uel20', 'sp':'1070e', 'cpu':'sw_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-5.10.0-79.26.uel20', 'sp':'1070e', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE}
    ]
  }
];

var os_release = get_one_kb_item('installed_os/local/SSH/0/release');
var os_sp = get_one_kb_item('Host/*/minor_release');

var flag = 0;
var reference;
var sp;
var _cpu;
var el_string;
var rpm_spec_vers_cmp;
var epoch;
var allowmaj;
var exists_check;
var cves;
foreach var constraint ( constraints ) {
  # Check that the target release is equal to the affected release
  if (!empty_or_null(constraint['release'])){
    if (constraint['release'] != os_release) continue;
  }
  if (!empty_or_null(constraint['sp'])){
    if (constraint['sp'] != os_sp) continue;
  }
  foreach var pkg ( constraint['pkgs'] ) {
    reference = NULL;
    sp = NULL;
    _cpu = NULL;
    el_string = NULL;
    rpm_spec_vers_cmp = NULL;
    epoch = NULL;
    allowmaj = NULL;
    exists_check = NULL;
    cves = NULL;
    if (!empty_or_null(pkg['reference'])) reference = pkg['reference'];
    if (!empty_or_null(pkg['sp'])) sp = pkg['sp'];
    if (!empty_or_null(pkg['cpu'])) _cpu = pkg['cpu'];
    if (!empty_or_null(pkg['el_string'])) el_string = pkg['el_string'];
    if (!empty_or_null(pkg['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = pkg['rpm_spec_vers_cmp'];
    if (!empty_or_null(pkg['epoch'])) epoch = pkg['epoch'];
    if (!empty_or_null(pkg['allowmaj'])) allowmaj = pkg['allowmaj'];
    if (!empty_or_null(pkg['exists_check'])) exists_check = pkg['exists_check'];
    if (!empty_or_null(pkg['cves'])) cves = pkg['cves'];
    if (reference &&
        ## (no known rpm to check OR known rpm_exists)
        (!exists_check || rpm_exists(rpm:exists_check)) &&
        rpm_check(sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj, cves:cves)) flag++;
  }
}


if (flag)
{
  security_report_v4(
      port       : 0,
      severity   : SECURITY_HOLE,
      extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'kernel');
}