Unity Linux 20.1070e Security Update: kernel (UTSA-2026-131769)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(366557);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/10/16");

  script_cve_id("CVE-2026-23005");

  script_name(english:"Unity Linux 20.1070e Security Update: kernel (UTSA-2026-131769)");

  script_set_attribute(attribute:"synopsis", value:
"The Unity Linux host is missing one or more security updates.");
  script_set_attribute(attribute:"description", value:
"The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the
UTSA-2026-131769 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    x86/fpu: Clear XSTATE_BV[i] in guest XSAVE state whenever XFD[i]=1

    When loading guest XSAVE state via KVM_SET_XSAVE, and when updating XFD in
    response to a guest WRMSR, clear XFD-disabled features in the saved (or to
    be restored) XSTATE_BV to ensure KVM doesn't attempt to load state for
    features that are disabled via the guest's XFD.  Because the kernel
    executes XRSTOR with the guest's XFD, saving XSTATE_BV[i]=1 with XFD[i]=1
    will cause XRSTOR to #NM and panic the kernel.

    E.g. if fpu_update_guest_xfd() sets XFD without clearing XSTATE_BV:

      ------------[ cut here ]------------
      WARNING: arch/x86/kernel/traps.c:1524 at exc_device_not_available+0x101/0x110, CPU#29: amx_test/848
      Modules linked in: kvm_intel kvm irqbypass
      CPU: 29 UID: 1000 PID: 848 Comm: amx_test Not tainted 6.19.0-rc2-ffa07f7fd437-x86_amx_nm_xfd_non_init-vm
    #171 NONE
      Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015
      RIP: 0010:exc_device_not_available+0x101/0x110
      Call Trace:
       <TASK>
       asm_exc_device_not_available+0x1a/0x20
      RIP: 0010:restore_fpregs_from_fpstate+0x36/0x90
       switch_fpu_return+0x4a/0xb0
       kvm_arch_vcpu_ioctl_run+0x1245/0x1e40 [kvm]
       kvm_vcpu_ioctl+0x2c3/0x8f0 [kvm]
       __x64_sys_ioctl+0x8f/0xd0
       do_syscall_64+0x62/0x940
       entry_SYSCALL_64_after_hwframe+0x4b/0x53
       </TASK>
      ---[ end trace 0000000000000000 ]---

    This can happen if the guest executes WRMSR(MSR_IA32_XFD) to set XFD[18] = 1,
    and a host IRQ triggers kernel_fpu_begin() prior to the vmexit handler's
    call to fpu_update_guest_xfd().

    and if userspace stuffs XSTATE_BV[i]=1 via KVM_SET_XSAVE:

      ------------[ cut here ]------------
      WARNING: arch/x86/kernel/traps.c:1524 at exc_device_not_available+0x101/0x110, CPU#14: amx_test/867
      Modules linked in: kvm_intel kvm irqbypass
      CPU: 14 UID: 1000 PID: 867 Comm: amx_test Not tainted 6.19.0-rc2-2dace9faccd6-x86_amx_nm_xfd_non_init-vm
    #168 NONE
      Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015
      RIP: 0010:exc_device_not_available+0x101/0x110
      Call Trace:
       <TASK>
       asm_exc_device_not_available+0x1a/0x20
      RIP: 0010:restore_fpregs_from_fpstate+0x36/0x90
       fpu_swap_kvm_fpstate+0x6b/0x120
       kvm_load_guest_fpu+0x30/0x80 [kvm]
       kvm_arch_vcpu_ioctl_run+0x85/0x1e40 [kvm]
       kvm_vcpu_ioctl+0x2c3/0x8f0 [kvm]
       __x64_sys_ioctl+0x8f/0xd0
       do_syscall_64+0x62/0x940
       entry_SYSCALL_64_after_hwframe+0x4b/0x53
       </TASK>
      ---[ end trace 0000000000000000 ]---

    The new behavior is consistent with the AMX architecture.  Per Intel's SDM,
    XSAVE saves XSTATE_BV as '0' for components that are disabled via XFD
    (and non-compacted XSAVE saves the initial configuration of the state
    component):

      If XSAVE, XSAVEC, XSAVEOPT, or XSAVES is saving the state component i,
      the instruction does not generate #NM when XCR0[i] = IA32_XFD[i] = 1;
      instead, it operates as if XINUSE[i] = 0 (and the state component was
      in its initial state): it saves bit i of XSTATE_BV field of the XSAVE
      header as 0; in addition, XSAVE saves the initial configuration of the
      state component (the other instructions do not save state component i).

    Alternatively, KVM could always do XRSTOR with XFD=0, e.g. by using
    a constant XFD based on the set of enabled features when XSAVEing for
    a struct fpu_guest.  However, having XSTATE_BV[i]=1 for XFD-disabled
    features can only happen in the above interrupt case, or in similar
    scenarios involving preemption on preemptible kernels, because
    fpu_swap_kvm_fpstate()'s call to save_fpregs_to_fpstate() saves the
    outgoing FPU state with the current XFD; and that is (on all but the
    first WRMSR to XFD) the guest XFD.

    Therefore, XFD can only go out of sync with XSTATE_BV in the above
    interrupt case, or in similar scenarios involving preemption on
    preemptible kernels, and it we can consider it (de facto) part of KVM
    ABI that KVM_GET_XSAVE returns XSTATE_BV[i]=0 for XFD-disabled features.

    [Move clea
    ---truncated---

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  # https://src.uniontech.com/#/security_advisory_detail?utsa_id=UTSA-2026-131769
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?193a283c");
  # https://lore.kernel.org/linux-cve-announce/2026012536-CVE-2026-23005-df15@gregkh
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?e60e2a2d");
  script_set_attribute(attribute:"see_also", value:"https://nvd.nist.gov/vuln/detail/CVE-2026-23005");
  script_set_attribute(attribute:"solution", value:
"Update the affected kernel package.");
  script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:S/C:N/I:N/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-23005");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/01/25");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/10/16");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/10/16");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Unity Linux Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info2.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/UOS-Server/release", "Host/UOS-Server/rpm-list", "Host/cpu");

  exit(0);
}
include('rpm2.inc');

if (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
var os_product = get_kb_item('installed_os/local/SSH/0/product');
if (isnull(os_product) || 'UOS Server' >!< os_product) audit(AUDIT_OS_NOT, 'UOS Server');
var os_version = get_kb_item('installed_os/local/SSH/0/version');
if (isnull(os_version)) audit(AUDIT_UNKNOWN_APP_VER, 'UOS Server');
if (! preg(pattern:"^(20.1070e)([^0-9]|$)", string:os_version)) audit(AUDIT_OS_NOT, 'UOS Server 20.1070e', 'UOS Server ' + os_version);

if (!get_kb_item('Host/UOS-Server/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('aarch64' >!< cpu && 'amd64' >!< cpu && 'sw_64' >!< cpu && 'x86_64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'UOS Server', cpu);


var constraints = [
  {
    'release': '20',
    'sp': '1070e',
    'pkgs': [
      {'reference':'kernel-5.10.0-79.26.uel20', 'sp':'1070e', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-5.10.0-79.26.uel20', 'sp':'1070e', 'cpu':'amd64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-5.10.0-79.26.uel20', 'sp':'1070e', 'cpu':'sw_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-5.10.0-79.26.uel20', 'sp':'1070e', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE}
    ]
  }
];

var os_release = get_one_kb_item('installed_os/local/SSH/0/release');
var os_sp = get_one_kb_item('Host/*/minor_release');

var flag = 0;
var reference;
var sp;
var _cpu;
var el_string;
var rpm_spec_vers_cmp;
var epoch;
var allowmaj;
var exists_check;
var cves;
foreach var constraint ( constraints ) {
  # Check that the target release is equal to the affected release
  if (!empty_or_null(constraint['release'])){
    if (constraint['release'] != os_release) continue;
  }
  if (!empty_or_null(constraint['sp'])){
    if (constraint['sp'] != os_sp) continue;
  }
  foreach var pkg ( constraint['pkgs'] ) {
    reference = NULL;
    sp = NULL;
    _cpu = NULL;
    el_string = NULL;
    rpm_spec_vers_cmp = NULL;
    epoch = NULL;
    allowmaj = NULL;
    exists_check = NULL;
    cves = NULL;
    if (!empty_or_null(pkg['reference'])) reference = pkg['reference'];
    if (!empty_or_null(pkg['sp'])) sp = pkg['sp'];
    if (!empty_or_null(pkg['cpu'])) _cpu = pkg['cpu'];
    if (!empty_or_null(pkg['el_string'])) el_string = pkg['el_string'];
    if (!empty_or_null(pkg['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = pkg['rpm_spec_vers_cmp'];
    if (!empty_or_null(pkg['epoch'])) epoch = pkg['epoch'];
    if (!empty_or_null(pkg['allowmaj'])) allowmaj = pkg['allowmaj'];
    if (!empty_or_null(pkg['exists_check'])) exists_check = pkg['exists_check'];
    if (!empty_or_null(pkg['cves'])) cves = pkg['cves'];
    if (reference &&
        ## (no known rpm to check OR known rpm_exists)
        (!exists_check || rpm_exists(rpm:exists_check)) &&
        rpm_check(sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj, cves:cves)) flag++;
  }
}


if (flag)
{
  security_report_v4(
      port       : 0,
      severity   : SECURITY_WARNING,
      extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'kernel');
}