Unity Linux 20.1050a Security Update: kernel (UTSA-2026-146811)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(373157);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/10/28");

  script_cve_id("CVE-2026-97612");

  script_name(english:"Unity Linux 20.1050a Security Update: kernel (UTSA-2026-146811)");

  script_set_attribute(attribute:"synopsis", value:
"The Unity Linux host is missing one or more security updates.");
  script_set_attribute(attribute:"description", value:
"The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the
UTSA-2026-146811 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    net: mpls: clear inner_protocol when the last label is popped

    skb_mpls_push() records the pre-encapsulation network header once, gated
    on !skb->inner_protocol. skb_mpls_pop() never clears that record, so it
    outlives the encapsulation it describes.

    Open vSwitch can then re-push MPLS onto a packet whose
    inner_network_header still points at the older, deeper offset: push a
    label, pop every label, recirculate (ovs_flow_key_update() re-derives
    key->eth.type and resets network_header, but leaves inner_*), then push
    again. ovs_fragment() trusts the record:

            skb->network_header = skb->inner_network_header;

    so skb_network_offset() goes negative. The bound check is signed:

            if (skb_network_offset(skb) > MAX_L2_LEN)

    a negative offset passes it, and prepare_frag() widens the value:

            unsigned int hlen = skb_network_offset(skb);
            memcpy(&data->l2_data, skb->data, hlen);

    which is a ~4GiB memcpy out of a 30-byte per-CPU buffer.

    Reproduced on v7.3-rc1. RDX is the truncated length, (unsigned int)(-8):

      BUG: unable to handle page fault for address: ffffe8ffffc16000
      #PF: supervisor write access in kernel mode
      Oops: 0002 [#1] SMP KASAN NOPTI
      RIP: 0010:memcpy+0x8/0x20
      RDX: 00000000fffffff8 RSI: ffff888105d732db RDI: ffffe8ffffc16000
       prepare_frag+0x3df/0x4e0
       ovs_fragment+0x589/0x7e0
       do_output+0x4ce/0x5e0
       do_execute_actions+0x55d2/0x7b30
       ovs_execute_actions+0xea/0x450

    Same root-cause shape as commit 975b5b067f52 (ipv6: sr: restore network
    header before routing and forwarding): a stale network header offset
    reaching a consumer that widens it. Here it originates in the MPLS
    push/pop path.

    Clear inner_protocol once the packet is no longer MPLS, so a later push
    re-records the current header. net/sched/act_mpls.c is the only other
    skb_mpls_pop() caller and gets the same fix; sch_frag.c saves and
    restores inner_protocol around fragmentation in the same way OVS does.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  # https://src.uniontech.com/#/security_advisory_detail?utsa_id=UTSA-2026-146811
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?6078c446");
  # https://lore.kernel.org/linux-cve-announce/2026092502-CVE-2026-97612-6fbc@gregkh
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?3fcdf7d6");
  script_set_attribute(attribute:"see_also", value:"https://nvd.nist.gov/vuln/detail/CVE-2026-97612");
  script_set_attribute(attribute:"solution", value:
"Update the affected kernel package.");
  script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:S/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-97612");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/09/25");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/10/28");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/10/28");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Unity Linux Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info2.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/UOS-Server/release", "Host/UOS-Server/rpm-list", "Host/cpu");

  exit(0);
}
include('rpm2.inc');

if (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
var os_product = get_kb_item('installed_os/local/SSH/0/product');
if (isnull(os_product) || 'UOS Server' >!< os_product) audit(AUDIT_OS_NOT, 'UOS Server');
var os_version = get_kb_item('installed_os/local/SSH/0/version');
if (isnull(os_version)) audit(AUDIT_UNKNOWN_APP_VER, 'UOS Server');
if (! preg(pattern:"^(20.1050a)([^0-9]|$)", string:os_version)) audit(AUDIT_OS_NOT, 'UOS Server 20.1050a', 'UOS Server ' + os_version);

if (!get_kb_item('Host/UOS-Server/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('aarch64' >!< cpu && 'amd64' >!< cpu && 'loongarch64' >!< cpu && 'x86_64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'UOS Server', cpu);


var constraints = [
  {
    'release': '20',
    'sp': '1050a',
    'pkgs': [
      {'reference':'kernel-4.19.0-91.82.132.24.uelc20', 'sp':'1050a', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-4.19.0-91.82.132.24.uelc20', 'sp':'1050a', 'cpu':'amd64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-4.19.0-91.82.132.24.uelc20', 'sp':'1050a', 'cpu':'loongarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-4.19.0-91.82.132.24.uelc20', 'sp':'1050a', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE}
    ]
  }
];

var os_release = get_one_kb_item('installed_os/local/SSH/0/release');
var os_sp = get_one_kb_item('Host/*/minor_release');

var flag = 0;
var reference;
var sp;
var _cpu;
var el_string;
var rpm_spec_vers_cmp;
var epoch;
var allowmaj;
var exists_check;
var cves;
foreach var constraint ( constraints ) {
  # Check that the target release is equal to the affected release
  if (!empty_or_null(constraint['release'])){
    if (constraint['release'] != os_release) continue;
  }
  if (!empty_or_null(constraint['sp'])){
    if (constraint['sp'] != os_sp) continue;
  }
  foreach var pkg ( constraint['pkgs'] ) {
    reference = NULL;
    sp = NULL;
    _cpu = NULL;
    el_string = NULL;
    rpm_spec_vers_cmp = NULL;
    epoch = NULL;
    allowmaj = NULL;
    exists_check = NULL;
    cves = NULL;
    if (!empty_or_null(pkg['reference'])) reference = pkg['reference'];
    if (!empty_or_null(pkg['sp'])) sp = pkg['sp'];
    if (!empty_or_null(pkg['cpu'])) _cpu = pkg['cpu'];
    if (!empty_or_null(pkg['el_string'])) el_string = pkg['el_string'];
    if (!empty_or_null(pkg['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = pkg['rpm_spec_vers_cmp'];
    if (!empty_or_null(pkg['epoch'])) epoch = pkg['epoch'];
    if (!empty_or_null(pkg['allowmaj'])) allowmaj = pkg['allowmaj'];
    if (!empty_or_null(pkg['exists_check'])) exists_check = pkg['exists_check'];
    if (!empty_or_null(pkg['cves'])) cves = pkg['cves'];
    if (reference &&
        ## (no known rpm to check OR known rpm_exists)
        (!exists_check || rpm_exists(rpm:exists_check)) &&
        rpm_check(sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj, cves:cves)) flag++;
  }
}


if (flag)
{
  security_report_v4(
      port       : 0,
      severity   : SECURITY_WARNING,
      extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'kernel');
}