Unity Linux 20.1070e Security Update: kernel (UTSA-2026-142759)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(370779);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/10/22");

  script_cve_id("CVE-2026-89482");

  script_name(english:"Unity Linux 20.1070e Security Update: kernel (UTSA-2026-142759)");

  script_set_attribute(attribute:"synopsis", value:
"The Unity Linux host is missing one or more security updates.");
  script_set_attribute(attribute:"description", value:
"The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the
UTSA-2026-142759 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    nvme-tcp: do not accept C2HData based on blk_rq_payload_bytes() alone

    Commit 25e5cb780e62 (nvme-tcp: fix possible crash in write_zeroes
    processing) established that blk_rq_payload_bytes() must not be read
    without first checking blk_rq_nr_phys_segments(), and recorded the
    result in nvme_tcp_setup_cmd_pdu() as req->data_len. The receive side
    was left as it was.

    The two differ for REQ_OP_WRITE_ZEROES, which has no physical segments
    but a non-zero blk_rq_bytes(), so setup leaves req->iter untouched
    while the receive gate lets a C2HData through and nvme_tcp_recv_data()
    copies into whatever the previous command on that tag left there. The
    driver-private area is zeroed only when the tag set is allocated.

    Reproduced with a test target that leaves a residual iterator on a tag
    and then sends a C2HData for a WRITE_ZEROES command on the same tag:

    BUG: KASAN: wild-memory-access in _copy_to_iter+0x642/0x1330
    Write of size 512 at addr ffe728c2175dfa81 by task kworker/0:1H/103

    CPU: 0 UID: 0 PID: 103 Comm: kworker/0:1H Not tainted 7.2.0-rc5-NVMETCP-gf5098b6bae76 #1 PREEMPT(lazy)
    Hardware name: QEMU Ubuntu 24.04 PC v2 (i440FX + PIIX, arch_caps fix, 1996), BIOS 1.16.3-debian-1.16.3-2
    04/01/2014
    Workqueue: nvme_tcp_wq nvme_tcp_io_work
    Call Trace:
     <TASK>
     dump_stack_lvl+0x53/0x70
     kasan_report+0xce/0x100
     ? _copy_to_iter+0x642/0x1330
     kasan_check_range+0x105/0x1b0
     __asan_memcpy+0x3c/0x60
     _copy_to_iter+0x642/0x1330
     ? __pfx_sock_has_perm+0x10/0x10
     ? worker_thread+0x45b/0xd10
     ? __pfx__copy_to_iter+0x10/0x10
     ? _raw_spin_lock_bh+0x83/0xe0
     ? __pfx__raw_spin_lock_bh+0x10/0x10
     __skb_datagram_iter+0xf3/0x820
     ? __pfx_simple_copy_to_iter+0x10/0x10
     ? __asan_memcpy+0x3c/0x60
     ? skb_copy_bits+0x58d/0x830
     skb_copy_datagram_iter+0x37/0x120
     nvme_tcp_recv_skb+0xa07/0x4320
     ? __pfx_nvme_tcp_recv_skb+0x10/0x10
     __tcp_read_sock+0x1ab/0x810
     ? __pfx_nvme_tcp_recv_skb+0x10/0x10
     ? __pfx_lock_sock_nested+0x10/0x10
     ? __pfx___tcp_read_sock+0x10/0x10
     nvme_tcp_try_recv+0x152/0x1e0
     ? __pfx_nvme_tcp_try_recv+0x10/0x10
     ? __pfx_mutex_unlock+0x10/0x10
     nvme_tcp_io_work+0x1e4/0x6c0
     ? __schedule+0x181a/0x49f0
     ? __pfx_nvme_tcp_io_work+0x10/0x10
     process_one_work+0x633/0x1030

    Keep the blk_rq_payload_bytes() test and add req->data_len to it. The
    old test is what rejects a C2HData naming a tag that is no longer in
    flight, because blk_update_request() zeroes rq->__data_len on
    completion; req->data_len and req->curr_bio are driver-private and
    survive completion, so they cannot stand in for it. Setup initialises
    the iterator only when both req->curr_bio and req->data_len are set, so
    the gate now tests the same two.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  # https://src.uniontech.com/#/security_advisory_detail?utsa_id=UTSA-2026-142759
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?aa532085");
  # https://lore.kernel.org/linux-cve-announce/2026091105-CVE-2026-89482-f473@gregkh
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?edf39919");
  script_set_attribute(attribute:"see_also", value:"https://nvd.nist.gov/vuln/detail/CVE-2026-89482");
  script_set_attribute(attribute:"solution", value:
"Update the affected kernel package.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-89482");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/09/11");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/10/22");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/10/22");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Unity Linux Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info2.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/UOS-Server/release", "Host/UOS-Server/rpm-list", "Host/cpu");

  exit(0);
}
include('rpm2.inc');

if (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
var os_product = get_kb_item('installed_os/local/SSH/0/product');
if (isnull(os_product) || 'UOS Server' >!< os_product) audit(AUDIT_OS_NOT, 'UOS Server');
var os_version = get_kb_item('installed_os/local/SSH/0/version');
if (isnull(os_version)) audit(AUDIT_UNKNOWN_APP_VER, 'UOS Server');
if (! preg(pattern:"^(20.1070e)([^0-9]|$)", string:os_version)) audit(AUDIT_OS_NOT, 'UOS Server 20.1070e', 'UOS Server ' + os_version);

if (!get_kb_item('Host/UOS-Server/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('aarch64' >!< cpu && 'amd64' >!< cpu && 'sw_64' >!< cpu && 'x86_64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'UOS Server', cpu);


var constraints = [
  {
    'release': '20',
    'sp': '1070e',
    'pkgs': [
      {'reference':'kernel-5.10.0-79.27.uel20', 'sp':'1070e', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-5.10.0-79.27.uel20', 'sp':'1070e', 'cpu':'amd64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-5.10.0-79.27.uel20', 'sp':'1070e', 'cpu':'sw_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-5.10.0-79.27.uel20', 'sp':'1070e', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE}
    ]
  }
];

var os_release = get_one_kb_item('installed_os/local/SSH/0/release');
var os_sp = get_one_kb_item('Host/*/minor_release');

var flag = 0;
var reference;
var sp;
var _cpu;
var el_string;
var rpm_spec_vers_cmp;
var epoch;
var allowmaj;
var exists_check;
var cves;
foreach var constraint ( constraints ) {
  # Check that the target release is equal to the affected release
  if (!empty_or_null(constraint['release'])){
    if (constraint['release'] != os_release) continue;
  }
  if (!empty_or_null(constraint['sp'])){
    if (constraint['sp'] != os_sp) continue;
  }
  foreach var pkg ( constraint['pkgs'] ) {
    reference = NULL;
    sp = NULL;
    _cpu = NULL;
    el_string = NULL;
    rpm_spec_vers_cmp = NULL;
    epoch = NULL;
    allowmaj = NULL;
    exists_check = NULL;
    cves = NULL;
    if (!empty_or_null(pkg['reference'])) reference = pkg['reference'];
    if (!empty_or_null(pkg['sp'])) sp = pkg['sp'];
    if (!empty_or_null(pkg['cpu'])) _cpu = pkg['cpu'];
    if (!empty_or_null(pkg['el_string'])) el_string = pkg['el_string'];
    if (!empty_or_null(pkg['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = pkg['rpm_spec_vers_cmp'];
    if (!empty_or_null(pkg['epoch'])) epoch = pkg['epoch'];
    if (!empty_or_null(pkg['allowmaj'])) allowmaj = pkg['allowmaj'];
    if (!empty_or_null(pkg['exists_check'])) exists_check = pkg['exists_check'];
    if (!empty_or_null(pkg['cves'])) cves = pkg['cves'];
    if (reference &&
        ## (no known rpm to check OR known rpm_exists)
        (!exists_check || rpm_exists(rpm:exists_check)) &&
        rpm_check(sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj, cves:cves)) flag++;
  }
}


if (flag)
{
  security_report_v4(
      port       : 0,
      severity   : SECURITY_HOLE,
      extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'kernel');
}