Unity Linux 20.1020e / 20.1050e / 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-142492)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(370728);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/10/22");

  script_cve_id("CVE-2026-74289");

  script_name(english:"Unity Linux 20.1020e / 20.1050e / 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-142492)");

  script_set_attribute(attribute:"synopsis", value:
"The Unity Linux host is missing one or more security updates.");
  script_set_attribute(attribute:"description", value:
"The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the
UTSA-2026-142492 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    ipv4: fib: Don't dump dying fib_info in fib_leaf_notify().

    syzbot reported use-after-free in nsim_fib4_prepare_event(). [0]

    The problem is that the following functions call fib_info_hold() /
    refcount_inc() while dumping fib_info under RCU, which is unsafe.

      * mlxsw_sp_router_fib4_event()
      * rocker_router_fib_event()
      * nsim_fib4_prepare_event()

    refcount_inc_not_zero() must be used, but it would be too late
    there.

    Let's guarantee the lifetime of fib_info in fib_leaf_notify().

    Note that IPv6 does not need the corresponding change since
    fib6_table_dump() holds fib6_table.tb6_lock.

    [0]:
    refcount_t: addition on 0; use-after-free.
    WARNING: lib/refcount.c:25 at refcount_warn_saturate+0x9f/0x110 lib/refcount.c:25, CPU#0:
    kworker/u8:15/3420
    Modules linked in:
    CPU: 0 UID: 0 PID: 3420 Comm: kworker/u8:15 Not tainted syzkaller #0 PREEMPT_{RT,(full)}
    Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026
    Workqueue: netns cleanup_net
    RIP: 0010:refcount_warn_saturate+0x9f/0x110 lib/refcount.c:25
    Code: eb 66 85 db 74 3e 83 fb 01 75 4c e8 1b f1 22 fd 48 8d 3d 84 cb f1 0a 67 48 0f b9 3a eb 4a e8 08 f1
    22 fd 48 8d 3d 81 cb f1 0a <67> 48 0f b9 3a eb 37 e8 f5 f0 22 fd 48 8d 3d 7e cb f1 0a 67 48 0f
    RSP: 0018:ffffc9000f2c7270 EFLAGS: 00010293
    RAX: ffffffff84a18858 RBX: 0000000000000002 RCX: ffff888032ff9ec0
    RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffffffff8f9353e0
    RBP: 0000000000000000 R08: ffff888032ff9ec0 R09: 0000000000000005
    R10: 0000000000000100 R11: 0000000000000004 R12: ffff8880570cc000
    R13: dffffc0000000000 R14: ffff88802b40563c R15: ffff8880570cc000
    FS:  0000000000000000(0000) GS:ffff888126173000(0000) knlGS:0000000000000000
    CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
    CR2: 00007fb1f4d5d000 CR3: 000000006072a000 CR4: 00000000003526f0
    Call Trace:
     <TASK>
     __refcount_add include/linux/refcount.h:-1 [inline]
     __refcount_inc include/linux/refcount.h:366 [inline]
     refcount_inc include/linux/refcount.h:383 [inline]
     fib_info_hold include/net/ip_fib.h:629 [inline]
     nsim_fib4_prepare_event drivers/net/netdevsim/fib.c:930 [inline]
     nsim_fib_event_schedule_work drivers/net/netdevsim/fib.c:1000 [inline]
     nsim_fib_event_nb+0x1055/0x1240 drivers/net/netdevsim/fib.c:1043
     call_fib_notifier+0x45/0x80 net/core/fib_notifier.c:25
     call_fib_entry_notifier net/ipv4/fib_trie.c:90 [inline]
     fib_leaf_notify net/ipv4/fib_trie.c:2176 [inline]
     fib_table_notify net/ipv4/fib_trie.c:2194 [inline]
     fib_notify+0x36b/0x5e0 net/ipv4/fib_trie.c:2217
     fib_net_dump net/core/fib_notifier.c:70 [inline]
     register_fib_notifier+0x184/0x360 net/core/fib_notifier.c:108
     nsim_fib_create+0x85d/0x9f0 drivers/net/netdevsim/fib.c:1596
     nsim_dev_reload_create drivers/net/netdevsim/dev.c:1604 [inline]
     nsim_dev_reload_up+0x374/0x7c0 drivers/net/netdevsim/dev.c:1058
     devlink_reload+0x501/0x8d0 net/devlink/dev.c:475
     devlink_pernet_pre_exit+0x1ff/0x420 net/devlink/core.c:558
     ops_pre_exit_list net/core/net_namespace.c:161 [inline]
     ops_undo_list+0x187/0x940 net/core/net_namespace.c:234
     cleanup_net+0x56e/0x800 net/core/net_namespace.c:702
     process_one_work kernel/workqueue.c:3314 [inline]
     process_scheduled_works+0xb5d/0x1860 kernel/workqueue.c:3397
     worker_thread+0xa53/0xfc0 kernel/workqueue.c:3478
     kthread+0x388/0x470 kernel/kthread.c:436
     ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
     ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
     </TASK>

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  # https://src.uniontech.com/#/security_advisory_detail?utsa_id=UTSA-2026-142492
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?c4fd693a");
  script_set_attribute(attribute:"see_also", value:"https://atomgit.com/src-openeuler/kernel/issues/17956");
  # https://lore.kernel.org/linux-cve-announce/2026081547-CVE-2026-74289-b40e@gregkh
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?b7c7347c");
  script_set_attribute(attribute:"see_also", value:"https://nvd.nist.gov/vuln/detail/CVE-2026-74289");
  script_set_attribute(attribute:"solution", value:
"Update the affected kernel package.");
  script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:S/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-74289");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/08/15");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/10/22");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/10/22");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Unity Linux Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info2.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/UOS-Server/release", "Host/UOS-Server/rpm-list", "Host/cpu");

  exit(0);
}
include('rpm2.inc');

if (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
var os_product = get_kb_item('installed_os/local/SSH/0/product');
if (isnull(os_product) || 'UOS Server' >!< os_product) audit(AUDIT_OS_NOT, 'UOS Server');
var os_version = get_kb_item('installed_os/local/SSH/0/version');
if (isnull(os_version)) audit(AUDIT_UNKNOWN_APP_VER, 'UOS Server');
if (! preg(pattern:"^(20.1020e|20.1050e|20.1060e|20.1070e)([^0-9]|$)", string:os_version)) audit(AUDIT_OS_NOT, 'UOS Server 20.1020e / 20.1050e / 20.1060e / 20.1070e', 'UOS Server ' + os_version);

if (!get_kb_item('Host/UOS-Server/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('aarch64' >!< cpu && 'amd64' >!< cpu && 'sw_64' >!< cpu && 'x86_64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'UOS Server', cpu);


var constraints = [
  {
    'release': '20',
    'sp': '1020e',
    'pkgs': [
      {'reference':'kernel-4.19.90-2211.5.0.0178.68.uel20', 'sp':'1020e', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-4.19.90-2211.5.0.0178.68.uel20', 'sp':'1020e', 'cpu':'amd64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-4.19.90-2211.5.0.0178.68.uel20', 'sp':'1020e', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE}
    ]
  },
  {
    'release': '20',
    'sp': '1050e',
    'pkgs': [
      {'reference':'kernel-4.19.90-2305.1.0.0199.123.uel20', 'sp':'1050e', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-4.19.90-2305.1.0.0199.123.uel20', 'sp':'1050e', 'cpu':'amd64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-4.19.90-2305.1.0.0199.123.uel20', 'sp':'1050e', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE}
    ]
  },
  {
    'release': '20',
    'sp': '1060e',
    'pkgs': [
      {'reference':'kernel-4.19.90-2311.4.0.0227.123.uel20', 'sp':'1060e', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-4.19.90-2311.4.0.0227.123.uel20', 'sp':'1060e', 'cpu':'amd64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-4.19.90-2311.4.0.0227.123.uel20', 'sp':'1060e', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE}
    ]
  },
  {
    'release': '20',
    'sp': '1070e',
    'pkgs': [
      {'reference':'kernel-4.19.90-2601.1.0.0024.uel20', 'sp':'1070e', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-4.19.90-2601.1.0.0024.uel20', 'sp':'1070e', 'cpu':'amd64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-4.19.90-2601.1.0.0024.uel20', 'sp':'1070e', 'cpu':'sw_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-4.19.90-2601.1.0.0024.uel20', 'sp':'1070e', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE}
    ]
  }
];

var os_release = get_one_kb_item('installed_os/local/SSH/0/release');
var os_sp = get_one_kb_item('Host/*/minor_release');

var flag = 0;
var reference;
var sp;
var _cpu;
var el_string;
var rpm_spec_vers_cmp;
var epoch;
var allowmaj;
var exists_check;
var cves;
foreach var constraint ( constraints ) {
  # Check that the target release is equal to the affected release
  if (!empty_or_null(constraint['release'])){
    if (constraint['release'] != os_release) continue;
  }
  if (!empty_or_null(constraint['sp'])){
    if (constraint['sp'] != os_sp) continue;
  }
  foreach var pkg ( constraint['pkgs'] ) {
    reference = NULL;
    sp = NULL;
    _cpu = NULL;
    el_string = NULL;
    rpm_spec_vers_cmp = NULL;
    epoch = NULL;
    allowmaj = NULL;
    exists_check = NULL;
    cves = NULL;
    if (!empty_or_null(pkg['reference'])) reference = pkg['reference'];
    if (!empty_or_null(pkg['sp'])) sp = pkg['sp'];
    if (!empty_or_null(pkg['cpu'])) _cpu = pkg['cpu'];
    if (!empty_or_null(pkg['el_string'])) el_string = pkg['el_string'];
    if (!empty_or_null(pkg['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = pkg['rpm_spec_vers_cmp'];
    if (!empty_or_null(pkg['epoch'])) epoch = pkg['epoch'];
    if (!empty_or_null(pkg['allowmaj'])) allowmaj = pkg['allowmaj'];
    if (!empty_or_null(pkg['exists_check'])) exists_check = pkg['exists_check'];
    if (!empty_or_null(pkg['cves'])) cves = pkg['cves'];
    if (reference &&
        ## (no known rpm to check OR known rpm_exists)
        (!exists_check || rpm_exists(rpm:exists_check)) &&
        rpm_check(sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj, cves:cves)) flag++;
  }
}


if (flag)
{
  security_report_v4(
      port       : 0,
      severity   : SECURITY_WARNING,
      extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'kernel');
}