Unity Linux 20.1050a Security Update: kernel (UTSA-2026-146834)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(373191);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/10/28");

  script_cve_id("CVE-2026-98276");

  script_name(english:"Unity Linux 20.1050a Security Update: kernel (UTSA-2026-146834)");

  script_set_attribute(attribute:"synopsis", value:
"The Unity Linux host is missing one or more security updates.");
  script_set_attribute(attribute:"description", value:
"The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the
UTSA-2026-146834 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    net: lock the socket in sock_gettstamp()

    sk->sk_flags must only be changed while holding the socket lock,
    because sock_set_flag() and sock_reset_flag() use non atomic
    operations (__set_bit() and __clear_bit()).

    sock_gettstamp() is one of the last places where a bit of sk->sk_flags
    is changed from a syscall without owning the socket lock, through
    sock_enable_timestamp(sk, SOCK_TIMESTAMP).

    sk_set_memalloc() and sk_clear_memalloc() also change sk->sk_flags
    without the socket lock, but their callers (nbd, iscsi_tcp, nvme-tcp,
    sunrpc, wireguard) need a careful audit, this will be addressed in a
    separate patch.

    Jungwoo Lee and Wongi Lee reported an UDP socket use-after-free
    caused by this bug: a SIOCGSTAMPNS_NEW ioctl racing with bind()
    can cancel the SOCK_RCU_FREE bit that udp_lib_get_port() just set,
    because both threads perform a read-modify-write on the same word.

      CPU 0 (bind)                        CPU 1 (SIOCGSTAMPNS_NEW)
      --------------------------------    ----------------------------
      read sk_flags = F                   read sk_flags = F
      compute F | BIT(SOCK_RCU_FREE)      compute F | BIT(SOCK_TIMESTAMP)
      store F | BIT(SOCK_RCU_FREE)
      sk_add_node_rcu(sk, ...)
                                          store F | BIT(SOCK_TIMESTAMP)

    After the lost update, SOCK_RCU_FREE is clear while the socket is
    visible to lockless UDP receive lookups. sk_destruct() then frees
    the socket immediately instead of waiting for a RCU grace period,
    while the receive path still holds a reference-less pointer to it:

     BUG: KASAN: slab-use-after-free in ipv4_pktinfo_prepare+0x30/0x410
     Read of size 8 at addr ffff888008806610 by task exploit/207
     CPU: 0 UID: 1000 PID: 207 Comm: exploit Not tainted 6.12.95+ #1
      ipv4_pktinfo_prepare+0x30/0x410
      udp_queue_rcv_one_skb+0x51c/0x1180
      udp_unicast_rcv_skb+0x109/0x350
      ip_protocol_deliver_rcu+0x14b/0x310
      ip_local_deliver_finish+0x29d/0x390
      ip_local_deliver+0x24d/0x2a0

    Only grab the socket lock when SOCK_TIMESTAMP has to be set,
    to keep the common case lockless.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  # https://src.uniontech.com/#/security_advisory_detail?utsa_id=UTSA-2026-146834
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?c741ed95");
  # https://lore.kernel.org/linux-cve-announce/2026100604-CVE-2026-98276-9843@gregkh
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?76473657");
  script_set_attribute(attribute:"see_also", value:"https://nvd.nist.gov/vuln/detail/CVE-2026-98276");
  script_set_attribute(attribute:"solution", value:
"Update the affected kernel package.");
  script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:S/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-98276");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/10/06");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/10/28");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/10/28");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Unity Linux Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info2.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/UOS-Server/release", "Host/UOS-Server/rpm-list", "Host/cpu");

  exit(0);
}
include('rpm2.inc');

if (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
var os_product = get_kb_item('installed_os/local/SSH/0/product');
if (isnull(os_product) || 'UOS Server' >!< os_product) audit(AUDIT_OS_NOT, 'UOS Server');
var os_version = get_kb_item('installed_os/local/SSH/0/version');
if (isnull(os_version)) audit(AUDIT_UNKNOWN_APP_VER, 'UOS Server');
if (! preg(pattern:"^(20.1050a)([^0-9]|$)", string:os_version)) audit(AUDIT_OS_NOT, 'UOS Server 20.1050a', 'UOS Server ' + os_version);

if (!get_kb_item('Host/UOS-Server/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('aarch64' >!< cpu && 'amd64' >!< cpu && 'loongarch64' >!< cpu && 'x86_64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'UOS Server', cpu);


var constraints = [
  {
    'release': '20',
    'sp': '1050a',
    'pkgs': [
      {'reference':'kernel-4.19.0-91.82.132.24.uelc20', 'sp':'1050a', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-4.19.0-91.82.132.24.uelc20', 'sp':'1050a', 'cpu':'amd64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-4.19.0-91.82.132.24.uelc20', 'sp':'1050a', 'cpu':'loongarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-4.19.0-91.82.132.24.uelc20', 'sp':'1050a', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE}
    ]
  }
];

var os_release = get_one_kb_item('installed_os/local/SSH/0/release');
var os_sp = get_one_kb_item('Host/*/minor_release');

var flag = 0;
var reference;
var sp;
var _cpu;
var el_string;
var rpm_spec_vers_cmp;
var epoch;
var allowmaj;
var exists_check;
var cves;
foreach var constraint ( constraints ) {
  # Check that the target release is equal to the affected release
  if (!empty_or_null(constraint['release'])){
    if (constraint['release'] != os_release) continue;
  }
  if (!empty_or_null(constraint['sp'])){
    if (constraint['sp'] != os_sp) continue;
  }
  foreach var pkg ( constraint['pkgs'] ) {
    reference = NULL;
    sp = NULL;
    _cpu = NULL;
    el_string = NULL;
    rpm_spec_vers_cmp = NULL;
    epoch = NULL;
    allowmaj = NULL;
    exists_check = NULL;
    cves = NULL;
    if (!empty_or_null(pkg['reference'])) reference = pkg['reference'];
    if (!empty_or_null(pkg['sp'])) sp = pkg['sp'];
    if (!empty_or_null(pkg['cpu'])) _cpu = pkg['cpu'];
    if (!empty_or_null(pkg['el_string'])) el_string = pkg['el_string'];
    if (!empty_or_null(pkg['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = pkg['rpm_spec_vers_cmp'];
    if (!empty_or_null(pkg['epoch'])) epoch = pkg['epoch'];
    if (!empty_or_null(pkg['allowmaj'])) allowmaj = pkg['allowmaj'];
    if (!empty_or_null(pkg['exists_check'])) exists_check = pkg['exists_check'];
    if (!empty_or_null(pkg['cves'])) cves = pkg['cves'];
    if (reference &&
        ## (no known rpm to check OR known rpm_exists)
        (!exists_check || rpm_exists(rpm:exists_check)) &&
        rpm_check(sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj, cves:cves)) flag++;
  }
}


if (flag)
{
  security_report_v4(
      port       : 0,
      severity   : SECURITY_WARNING,
      extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'kernel');
}