Unity Linux 20.1070a Security Update: kernel (UTSA-2026-143036)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(370624);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/10/22");

  script_cve_id("CVE-2026-80527");

  script_name(english:"Unity Linux 20.1070a Security Update: kernel (UTSA-2026-143036)");

  script_set_attribute(attribute:"synopsis", value:
"The Unity Linux host is missing one or more security updates.");
  script_set_attribute(attribute:"description", value:
"The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the
UTSA-2026-143036 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    ceph: fix hanging __ceph_get_caps() with stale mds_wanted

    A reader can hang forever in __ceph_get_caps() when the client no
    longer holds `FILE_RD`, but local cap state still says that the
    capability is already wanted (via `mds_wanted`).

    One way to trigger this is through MDS cap revocation.  If another
    client performs a conflicting operation, the MDS can revoke `FILE_RD`
    from the reader; the next read then has to reacquire `FILE_RD`.  If
    the cap update that should request `FILE_RD` never reaches the MDS
    after `cap->mds_wanted` was raised, the reader is left holding only
    non-file caps while local `mds_wanted` still includes the file read
    caps.

    In that state, try_get_cap_refs() sees `need <= mds_wanted` and
    returns 0, so __ceph_get_caps() just waits on `i_cap_wq`.  If the cap
    update that was supposed to request `FILE_RD never reaches the MDS
    after `cap->mds_wanted was` raised, no further request is sent and the
    waiter can sleep indefinitely until unrelated cap traffic happens to
    wake it up.

    The ordering issue is that `cap->mds_wanted` is updated in
    __prep_cap() before the `CEPH_MSG_CLIENT_CAPS message` is actually
    queued for send.  That makes one field serve two different meanings at
    once: what this client wants, and what the client believes the MDS
    already knows it wants.

    A proper fix would be to split those states and track whether a cap
    update is actually in flight or has been observed by the MDS.
    However, simply moving the `cap->mds_wanted assignment` later would
    not be sufficient: queueing the message in the messenger does not
    guarantee that the MDS processed that specific wanted set, and
    reconnect or message loss can still invalidate that assumption.
    Fixing that properly would require a larger rework of the cap state
    machine.

    To allow simpler backports to stable kernels, this patch implements a
    simpler workaround:

    - stop waiting forever in __ceph_get_caps(); after a bounded wait,
      fall back to the renew path

    - make ceph_renew_caps() issue a synchronous `OPEN` request whenever
      the inode still does not actually hold the wanted caps, instead of
      only calling ceph_check_caps()

    The extra issued-vs-wanted check in ceph_renew_caps() is necessary
    because the previous test only checked whether the inode still had any
    real caps at all.  That is not enough after revocation: the client can
    still hold something like `pLs` and yet be missing `FILE_RD`
    completely.  In that case, falling back to ceph_check_caps() is not
    sufficient, because it still trusts `cap->mds_wanted` and may resend
    nothing.  By requiring `(issued & wanted) == wanted` before taking the
    asynchronous path, the code only uses ceph_check_caps() when the
    `wanted caps` are already actually issued.  Otherwise, it sends the
    synchronous `OPEN` renew.

    This preserves the existing asynchronous fast path when the wanted
    caps are already issued, avoids changing cap-state semantics, and
    fixes the hang by guaranteeing that a stalled waiter eventually
    retries through a path that does not rely on the stale `mds_wanted`
    state.

    [ idryomov: move CEPH_GET_CAPS_WAIT_TIMEOUT from libceph.h to
      mds_client.h, formatting ]

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  # https://src.uniontech.com/#/security_advisory_detail?utsa_id=UTSA-2026-143036
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?7b6d9b13");
  # https://lore.kernel.org/linux-cve-announce/2026082602-CVE-2026-80527-449e@gregkh
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?305f2155");
  script_set_attribute(attribute:"see_also", value:"https://nvd.nist.gov/vuln/detail/CVE-2026-80527");
  script_set_attribute(attribute:"solution", value:
"Update the affected kernel package.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-80527");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/08/26");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/10/23");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/10/22");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Unity Linux Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info2.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/UOS-Server/release", "Host/UOS-Server/rpm-list", "Host/cpu");

  exit(0);
}
include('rpm2.inc');

if (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
var os_product = get_kb_item('installed_os/local/SSH/0/product');
if (isnull(os_product) || 'UOS Server' >!< os_product) audit(AUDIT_OS_NOT, 'UOS Server');
var os_version = get_kb_item('installed_os/local/SSH/0/version');
if (isnull(os_version)) audit(AUDIT_UNKNOWN_APP_VER, 'UOS Server');
if (! preg(pattern:"^(20.1070a)([^0-9]|$)", string:os_version)) audit(AUDIT_OS_NOT, 'UOS Server 20.1070a', 'UOS Server ' + os_version);

if (!get_kb_item('Host/UOS-Server/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('aarch64' >!< cpu && 'amd64' >!< cpu && 'loongarch64' >!< cpu && 'x86_64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'UOS Server', cpu);


var constraints = [
  {
    'release': '20',
    'sp': '1070a',
    'pkgs': [
      {'reference':'kernel-5.10.0-79.27.uelc20', 'sp':'1070a', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-5.10.0-79.27.uelc20', 'sp':'1070a', 'cpu':'amd64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-5.10.0-79.27.uelc20', 'sp':'1070a', 'cpu':'loongarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-5.10.0-79.27.uelc20', 'sp':'1070a', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE}
    ]
  }
];

var os_release = get_one_kb_item('installed_os/local/SSH/0/release');
var os_sp = get_one_kb_item('Host/*/minor_release');

var flag = 0;
var reference;
var sp;
var _cpu;
var el_string;
var rpm_spec_vers_cmp;
var epoch;
var allowmaj;
var exists_check;
var cves;
foreach var constraint ( constraints ) {
  # Check that the target release is equal to the affected release
  if (!empty_or_null(constraint['release'])){
    if (constraint['release'] != os_release) continue;
  }
  if (!empty_or_null(constraint['sp'])){
    if (constraint['sp'] != os_sp) continue;
  }
  foreach var pkg ( constraint['pkgs'] ) {
    reference = NULL;
    sp = NULL;
    _cpu = NULL;
    el_string = NULL;
    rpm_spec_vers_cmp = NULL;
    epoch = NULL;
    allowmaj = NULL;
    exists_check = NULL;
    cves = NULL;
    if (!empty_or_null(pkg['reference'])) reference = pkg['reference'];
    if (!empty_or_null(pkg['sp'])) sp = pkg['sp'];
    if (!empty_or_null(pkg['cpu'])) _cpu = pkg['cpu'];
    if (!empty_or_null(pkg['el_string'])) el_string = pkg['el_string'];
    if (!empty_or_null(pkg['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = pkg['rpm_spec_vers_cmp'];
    if (!empty_or_null(pkg['epoch'])) epoch = pkg['epoch'];
    if (!empty_or_null(pkg['allowmaj'])) allowmaj = pkg['allowmaj'];
    if (!empty_or_null(pkg['exists_check'])) exists_check = pkg['exists_check'];
    if (!empty_or_null(pkg['cves'])) cves = pkg['cves'];
    if (reference &&
        ## (no known rpm to check OR known rpm_exists)
        (!exists_check || rpm_exists(rpm:exists_check)) &&
        rpm_check(sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj, cves:cves)) flag++;
  }
}


if (flag)
{
  security_report_v4(
      port       : 0,
      severity   : SECURITY_HOLE,
      extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'kernel');
}