Unity Linux 20.1070a Security Update: kernel (UTSA-2026-143086)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(370773);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/10/22");

  script_cve_id("CVE-2025-40261");

  script_name(english:"Unity Linux 20.1070a Security Update: kernel (UTSA-2026-143086)");

  script_set_attribute(attribute:"synopsis", value:
"The Unity Linux host is missing one or more security updates.");
  script_set_attribute(attribute:"description", value:
"The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the
UTSA-2026-143086 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    nvme: nvme-fc: Ensure ->ioerr_work is cancelled in nvme_fc_delete_ctrl()

    nvme_fc_delete_assocation() waits for pending I/O to complete before
    returning, and an error can cause ->ioerr_work to be queued after
    cancel_work_sync() had been called.  Move the call to cancel_work_sync() to
    be after nvme_fc_delete_association() to ensure ->ioerr_work is not running
    when the nvme_fc_ctrl object is freed.  Otherwise the following can occur:

    [ 1135.911754] list_del corruption, ff2d24c8093f31f8->next is NULL
    [ 1135.917705] ------------[ cut here ]------------
    [ 1135.922336] kernel BUG at lib/list_debug.c:52!
    [ 1135.926784] Oops: invalid opcode: 0000 [#1] SMP NOPTI
    [ 1135.931851] CPU: 48 UID: 0 PID: 726 Comm: kworker/u449:23 Kdump: loaded Not tainted 6.12.0 #1
    PREEMPT(voluntary)
    [ 1135.943490] Hardware name: Dell Inc. PowerEdge R660/0HGTK9, BIOS 2.5.4 01/16/2025
    [ 1135.950969] Workqueue:  0x0 (nvme-wq)
    [ 1135.954673] RIP: 0010:__list_del_entry_valid_or_report.cold+0xf/0x6f
    [ 1135.961041] Code: c7 c7 98 68 72 94 e8 26 45 fe ff 0f 0b 48 c7 c7 70 68 72 94 e8 18 45 fe ff 0f 0b 48
    89 fe 48 c7 c7 80 69 72 94 e8 07 45 fe ff <0f> 0b 48 89 d1 48 c7 c7 a0 6a 72 94 48 89 c2 e8 f3 44 fe ff 0f
    0b
    [ 1135.979788] RSP: 0018:ff579b19482d3e50 EFLAGS: 00010046
    [ 1135.985015] RAX: 0000000000000033 RBX: ff2d24c8093f31f0 RCX: 0000000000000000
    [ 1135.992148] RDX: 0000000000000000 RSI: ff2d24d6bfa1d0c0 RDI: ff2d24d6bfa1d0c0
    [ 1135.999278] RBP: ff2d24c8093f31f8 R08: 0000000000000000 R09: ffffffff951e2b08
    [ 1136.006413] R10: ffffffff95122ac8 R11: 0000000000000003 R12: ff2d24c78697c100
    [ 1136.013546] R13: fffffffffffffff8 R14: 0000000000000000 R15: ff2d24c78697c0c0
    [ 1136.020677] FS:  0000000000000000(0000) GS:ff2d24d6bfa00000(0000) knlGS:0000000000000000
    [ 1136.028765] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
    [ 1136.034510] CR2: 00007fd207f90b80 CR3: 000000163ea22003 CR4: 0000000000f73ef0
    [ 1136.041641] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
    [ 1136.048776] DR3: 0000000000000000 DR6: 00000000fffe07f0 DR7: 0000000000000400
    [ 1136.055910] PKRU: 55555554
    [ 1136.058623] Call Trace:
    [ 1136.061074]  <TASK>
    [ 1136.063179]  ? show_trace_log_lvl+0x1b0/0x2f0
    [ 1136.067540]  ? show_trace_log_lvl+0x1b0/0x2f0
    [ 1136.071898]  ? move_linked_works+0x4a/0xa0
    [ 1136.075998]  ? __list_del_entry_valid_or_report.cold+0xf/0x6f
    [ 1136.081744]  ? __die_body.cold+0x8/0x12
    [ 1136.085584]  ? die+0x2e/0x50
    [ 1136.088469]  ? do_trap+0xca/0x110
    [ 1136.091789]  ? do_error_trap+0x65/0x80
    [ 1136.095543]  ? __list_del_entry_valid_or_report.cold+0xf/0x6f
    [ 1136.101289]  ? exc_invalid_op+0x50/0x70
    [ 1136.105127]  ? __list_del_entry_valid_or_report.cold+0xf/0x6f
    [ 1136.110874]  ? asm_exc_invalid_op+0x1a/0x20
    [ 1136.115059]  ? __list_del_entry_valid_or_report.cold+0xf/0x6f
    [ 1136.120806]  move_linked_works+0x4a/0xa0
    [ 1136.124733]  worker_thread+0x216/0x3a0
    [ 1136.128485]  ? __pfx_worker_thread+0x10/0x10
    [ 1136.132758]  kthread+0xfa/0x240
    [ 1136.135904]  ? __pfx_kthread+0x10/0x10
    [ 1136.139657]  ret_from_fork+0x31/0x50
    [ 1136.143236]  ? __pfx_kthread+0x10/0x10
    [ 1136.146988]  ret_from_fork_asm+0x1a/0x30
    [ 1136.150915]  </TASK>

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  # https://src.uniontech.com/#/security_advisory_detail?utsa_id=UTSA-2026-143086
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?df916328");
  script_set_attribute(attribute:"see_also", value:"https://cert-portal.siemens.com/productcert/html/ssa-019113.html");
  script_set_attribute(attribute:"see_also", value:"https://cert-portal.siemens.com/productcert/html/ssa-082556.html");
  script_set_attribute(attribute:"see_also", value:"https://cert-portal.siemens.com/productcert/html/ssa-253495.html");
  # https://git.kernel.org/stable/c/0a2c5495b6d1ecb0fa18ef6631450f391a888256
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?29dbe636");
  # https://git.kernel.org/stable/c/33f64600a12055219bda38b55320c62cdeda9167
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?e991a752");
  # https://git.kernel.org/stable/c/3f48cd7f35da07fc067cef926bb7f6f4735de37b
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?1e963231");
  # https://git.kernel.org/stable/c/48ae433c6cc6985f647b1b37d8bb002972cf9bdb
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?57809d2a");
  # https://git.kernel.org/stable/c/9610a2c162ef729a3988213a4604376e492f6f44
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?e83ebad0");
  # https://git.kernel.org/stable/c/a9b1315ed428239612601e9e188329e7cefa32fd
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?2abcc04c");
  # https://git.kernel.org/stable/c/fbd5741a556eaaa63d0908132ca79d335b58b1cd
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?8e529408");
  # https://lore.kernel.org/linux-cve-announce/2025120434-CVE-2025-40261-0531@gregkh
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?8b7c539c");
  script_set_attribute(attribute:"see_also", value:"https://nvd.nist.gov/vuln/detail/CVE-2025-40261");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2025-40261");
  script_set_attribute(attribute:"solution", value:
"Update the affected kernel package.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2025-40261");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2025/12/04");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/10/23");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/10/22");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Unity Linux Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info2.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/UOS-Server/release", "Host/UOS-Server/rpm-list", "Host/cpu");

  exit(0);
}
include('rpm2.inc');

if (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
var os_product = get_kb_item('installed_os/local/SSH/0/product');
if (isnull(os_product) || 'UOS Server' >!< os_product) audit(AUDIT_OS_NOT, 'UOS Server');
var os_version = get_kb_item('installed_os/local/SSH/0/version');
if (isnull(os_version)) audit(AUDIT_UNKNOWN_APP_VER, 'UOS Server');
if (! preg(pattern:"^(20.1070a)([^0-9]|$)", string:os_version)) audit(AUDIT_OS_NOT, 'UOS Server 20.1070a', 'UOS Server ' + os_version);

if (!get_kb_item('Host/UOS-Server/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('aarch64' >!< cpu && 'amd64' >!< cpu && 'loongarch64' >!< cpu && 'x86_64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'UOS Server', cpu);


var constraints = [
  {
    'release': '20',
    'sp': '1070a',
    'pkgs': [
      {'reference':'kernel-5.10.0-79.27.uelc20', 'sp':'1070a', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-5.10.0-79.27.uelc20', 'sp':'1070a', 'cpu':'amd64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-5.10.0-79.27.uelc20', 'sp':'1070a', 'cpu':'loongarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-5.10.0-79.27.uelc20', 'sp':'1070a', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE}
    ]
  }
];

var os_release = get_one_kb_item('installed_os/local/SSH/0/release');
var os_sp = get_one_kb_item('Host/*/minor_release');

var flag = 0;
var reference;
var sp;
var _cpu;
var el_string;
var rpm_spec_vers_cmp;
var epoch;
var allowmaj;
var exists_check;
var cves;
foreach var constraint ( constraints ) {
  # Check that the target release is equal to the affected release
  if (!empty_or_null(constraint['release'])){
    if (constraint['release'] != os_release) continue;
  }
  if (!empty_or_null(constraint['sp'])){
    if (constraint['sp'] != os_sp) continue;
  }
  foreach var pkg ( constraint['pkgs'] ) {
    reference = NULL;
    sp = NULL;
    _cpu = NULL;
    el_string = NULL;
    rpm_spec_vers_cmp = NULL;
    epoch = NULL;
    allowmaj = NULL;
    exists_check = NULL;
    cves = NULL;
    if (!empty_or_null(pkg['reference'])) reference = pkg['reference'];
    if (!empty_or_null(pkg['sp'])) sp = pkg['sp'];
    if (!empty_or_null(pkg['cpu'])) _cpu = pkg['cpu'];
    if (!empty_or_null(pkg['el_string'])) el_string = pkg['el_string'];
    if (!empty_or_null(pkg['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = pkg['rpm_spec_vers_cmp'];
    if (!empty_or_null(pkg['epoch'])) epoch = pkg['epoch'];
    if (!empty_or_null(pkg['allowmaj'])) allowmaj = pkg['allowmaj'];
    if (!empty_or_null(pkg['exists_check'])) exists_check = pkg['exists_check'];
    if (!empty_or_null(pkg['cves'])) cves = pkg['cves'];
    if (reference &&
        ## (no known rpm to check OR known rpm_exists)
        (!exists_check || rpm_exists(rpm:exists_check)) &&
        rpm_check(sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj, cves:cves)) flag++;
  }
}


if (flag)
{
  security_report_v4(
      port       : 0,
      severity   : SECURITY_HOLE,
      extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'kernel');
}