Unity Linux 20.1020e / 20.1050e / 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-142565)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(370694);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/10/22");

  script_cve_id("CVE-2026-68096");

  script_name(english:"Unity Linux 20.1020e / 20.1050e / 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-142565)");

  script_set_attribute(attribute:"synopsis", value:
"The Unity Linux host is missing one or more security updates.");
  script_set_attribute(attribute:"description", value:
"The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the
UTSA-2026-142565 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    audit: fix recursive locking deadlock in audit_dupe_exe()

    A deadlock occurs in the audit subsystem when duplicating
    executable-related rules.

    When a file is moved (e.g., via do_renameat2()), the VFS layer locks
    the parent directory (I_MUTEX_PARENT), which synchronously triggers an
    fsnotify_move event. If an existing executable audit rule matches the
    file being moved, the audit subsystem catches this event and calls
    audit_dupe_exe() to duplicate the watch and update the rule. Then,
    audit_alloc_mark() would call kern_path_parent() to resolve the path,
    leading to a blind attempt to acquire the exact same I_MUTEX_PARENT lock
    already held by the task, resulting in the following recursive locking
    deadlock:

     ============================================
     WARNING: possible recursive locking detected
     6.12.0-55.27.1.el10_0.x86_64+debug #1 Not tainted
     --------------------------------------------
     mv/5099 is trying to acquire lock:
     ffff888132845358 (&inode->i_sb->s_type->i_mutex_dir_key/1){+.+.}-{3:3},
     at: __kern_path_locked+0x10a/0x2f0

     but task is already holding lock:
     ffff888132846b58 (&inode->i_sb->s_type->i_mutex_dir_key/1){+.+.}-{3:3},
     at: lock_two_directories+0x13f/0x2b0

     other info that might help us debug this:
      Possible unsafe locking scenario:

            CPU0
            ----
       lock(&inode->i_sb->s_type->i_mutex_dir_key/1);
       lock(&inode->i_sb->s_type->i_mutex_dir_key/1);

      *** DEADLOCK ***

      May be due to missing lock nesting notation

      6 locks held by mv/5099:
      #0: ffff888112a9c440 (sb_writers#13)
      at: do_renameat2+0x34c/0xbc0
      #1: ffff888112a9c790 (&type->s_vfs_rename_key#3)
      at: do_renameat2+0x415/0xbc0
      #2: ffff888132846b58 (&inode->i_sb->s_type->i_mutex_dir_key/1)
      at: lock_two_directories+0x13f/0x2b0
      #3: ffff888132845358 (&inode->i_sb->s_type->i_mutex_dir_key/5)
      at: lock_two_directories+0x175/0x2b0
      #4: ffffffffb3a1fb10 (&fsnotify_mark_srcu)
      at: fsnotify+0x454/0x28a0
      #5: ffffffffaf886230 (audit_filter_mutex)
      at: audit_update_watch+0x36/0x11e0

     stack backtrace:
     Call Trace:
      <TASK>
      dump_stack_lvl+0x6f/0xb0
      print_deadlock_bug.cold+0xbd/0xca
      validate_chain+0x83a/0xf00
      __lock_acquire+0xcac/0x1d20
      lock_acquire.part.0+0x11b/0x360
      down_write_nested+0x9f/0x230
      __kern_path_locked+0x10a/0x2f0
      kern_path_locked+0x26/0x40
      audit_alloc_mark+0xfb/0x4f0
      audit_dupe_exe+0x6c/0xe0
      audit_dupe_rule+0x6c2/0xc00
      audit_update_watch+0x4cc/0x11e0
      audit_watch_handle_event+0x12c/0x1b0
      send_to_group+0x5d0/0x8b0
      fsnotify+0x615/0x28a0
      fsnotify_move+0x1d8/0x630
      vfs_rename+0xdcd/0x1df0
      do_renameat2+0x9d4/0xbc0
      __x64_sys_renameat+0x192/0x260
      do_syscall_64+0x92/0x180
      entry_SYSCALL_64_after_hwframe+0x76/0x7e
     RIP: 0033:0x7f0491fe8c4e
     Code: 0f 1f 40 00 48 8b 15 c1 e1 16 00 f7 d8 64 89 02 b8 ff ff ff ff
     c3 66 0f 1f 44 00 00 f3 0f 1e fa 49 89 ca b8 08 01 00 00 0f 05 <48>
     3d 00 f0 ff ff 77 0a c3 66 0f 1f 84 00 00 00 00 00 48 8b 15 89
     RSP: 002b:00007ffc7210bf38 EFLAGS: 00000246 ORIG_RAX: 0000000000000108
     RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f0491fe8c4e
     RDX: 0000000000000003 RSI: 00007ffc7210e6c8 RDI: 00000000ffffff9c
     RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000001
     R10: 00005575eb2dae2a R11: 0000000000000246 R12: 00005575eb2dae2a
     R13: 00007ffc7210e6c8 R14: 0000000000000003 R15: 00000000ffffff9c
      </TASK>

    The aforementioned deadlock can be consistently reproduced by running
    the script below:

     audit-dupe-exe-deadlock.sh
     --------------------------
     #!/bin/bash
     auditctl -D
     mkdir -p /tmp/foo
     touch /tmp/file
     auditctl -a always,exit -F exe=/tmp/file -F path=/tmp/file -S all -k dr
     mv /tmp/file /tmp/foo/file
     rm -Rf /tmp/foo

    This patch fixes the issue by introducing struct audit_watch_ctx to pass
    the fsnotify event context down to audit_alloc_mark(). By utilizing the
    already-resolved directory inode provided by the event, we bypass the
    kern_path_parent() path resol
    ---truncated---

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  # https://src.uniontech.com/#/security_advisory_detail?utsa_id=UTSA-2026-142565
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?e3f04ab1");
  # https://lore.kernel.org/linux-cve-announce/2026081051-CVE-2026-68096-5480@gregkh
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?ff68186e");
  script_set_attribute(attribute:"see_also", value:"https://nvd.nist.gov/vuln/detail/CVE-2026-68096");
  script_set_attribute(attribute:"solution", value:
"Update the affected kernel package.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-68096");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/08/10");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/10/22");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/10/22");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Unity Linux Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info2.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/UOS-Server/release", "Host/UOS-Server/rpm-list", "Host/cpu");

  exit(0);
}
include('rpm2.inc');

if (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
var os_product = get_kb_item('installed_os/local/SSH/0/product');
if (isnull(os_product) || 'UOS Server' >!< os_product) audit(AUDIT_OS_NOT, 'UOS Server');
var os_version = get_kb_item('installed_os/local/SSH/0/version');
if (isnull(os_version)) audit(AUDIT_UNKNOWN_APP_VER, 'UOS Server');
if (! preg(pattern:"^(20.1020e|20.1050e|20.1060e|20.1070e)([^0-9]|$)", string:os_version)) audit(AUDIT_OS_NOT, 'UOS Server 20.1020e / 20.1050e / 20.1060e / 20.1070e', 'UOS Server ' + os_version);

if (!get_kb_item('Host/UOS-Server/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('aarch64' >!< cpu && 'amd64' >!< cpu && 'sw_64' >!< cpu && 'x86_64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'UOS Server', cpu);


var constraints = [
  {
    'release': '20',
    'sp': '1020e',
    'pkgs': [
      {'reference':'kernel-4.19.90-2211.5.0.0178.68.uel20', 'sp':'1020e', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-4.19.90-2211.5.0.0178.68.uel20', 'sp':'1020e', 'cpu':'amd64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-4.19.90-2211.5.0.0178.68.uel20', 'sp':'1020e', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE}
    ]
  },
  {
    'release': '20',
    'sp': '1050e',
    'pkgs': [
      {'reference':'kernel-4.19.90-2305.1.0.0199.123.uel20', 'sp':'1050e', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-4.19.90-2305.1.0.0199.123.uel20', 'sp':'1050e', 'cpu':'amd64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-4.19.90-2305.1.0.0199.123.uel20', 'sp':'1050e', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE}
    ]
  },
  {
    'release': '20',
    'sp': '1060e',
    'pkgs': [
      {'reference':'kernel-4.19.90-2311.4.0.0227.123.uel20', 'sp':'1060e', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-4.19.90-2311.4.0.0227.123.uel20', 'sp':'1060e', 'cpu':'amd64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-4.19.90-2311.4.0.0227.123.uel20', 'sp':'1060e', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE}
    ]
  },
  {
    'release': '20',
    'sp': '1070e',
    'pkgs': [
      {'reference':'kernel-4.19.90-2601.1.0.0024.uel20', 'sp':'1070e', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-4.19.90-2601.1.0.0024.uel20', 'sp':'1070e', 'cpu':'amd64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-4.19.90-2601.1.0.0024.uel20', 'sp':'1070e', 'cpu':'sw_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-4.19.90-2601.1.0.0024.uel20', 'sp':'1070e', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE}
    ]
  }
];

var os_release = get_one_kb_item('installed_os/local/SSH/0/release');
var os_sp = get_one_kb_item('Host/*/minor_release');

var flag = 0;
var reference;
var sp;
var _cpu;
var el_string;
var rpm_spec_vers_cmp;
var epoch;
var allowmaj;
var exists_check;
var cves;
foreach var constraint ( constraints ) {
  # Check that the target release is equal to the affected release
  if (!empty_or_null(constraint['release'])){
    if (constraint['release'] != os_release) continue;
  }
  if (!empty_or_null(constraint['sp'])){
    if (constraint['sp'] != os_sp) continue;
  }
  foreach var pkg ( constraint['pkgs'] ) {
    reference = NULL;
    sp = NULL;
    _cpu = NULL;
    el_string = NULL;
    rpm_spec_vers_cmp = NULL;
    epoch = NULL;
    allowmaj = NULL;
    exists_check = NULL;
    cves = NULL;
    if (!empty_or_null(pkg['reference'])) reference = pkg['reference'];
    if (!empty_or_null(pkg['sp'])) sp = pkg['sp'];
    if (!empty_or_null(pkg['cpu'])) _cpu = pkg['cpu'];
    if (!empty_or_null(pkg['el_string'])) el_string = pkg['el_string'];
    if (!empty_or_null(pkg['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = pkg['rpm_spec_vers_cmp'];
    if (!empty_or_null(pkg['epoch'])) epoch = pkg['epoch'];
    if (!empty_or_null(pkg['allowmaj'])) allowmaj = pkg['allowmaj'];
    if (!empty_or_null(pkg['exists_check'])) exists_check = pkg['exists_check'];
    if (!empty_or_null(pkg['cves'])) cves = pkg['cves'];
    if (reference &&
        ## (no known rpm to check OR known rpm_exists)
        (!exists_check || rpm_exists(rpm:exists_check)) &&
        rpm_check(sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj, cves:cves)) flag++;
  }
}


if (flag)
{
  security_report_v4(
      port       : 0,
      severity   : SECURITY_HOLE,
      extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'kernel');
}