Linux Distros Unpatched Vulnerability : CVE-2026-100290

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(379380);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/11/12");

  script_cve_id("CVE-2026-100290");

  script_name(english:"Linux Distros Unpatched Vulnerability : CVE-2026-100290");

  script_set_attribute(attribute:"synopsis", value:
"The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be
patched.");
  script_set_attribute(attribute:"description", value:
"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied
patch available.

  - The regcomp and regexec functions in the GNU C Library version 2.3 to version 2.44 may read freed memory
    and free the same heap block twice when a memory allocation fails while a regular expression is compiled
    or matched. The re_dfa_add_node (the NFA node table) and build_range_exp (bracket ranges) grow several
    arrays with consecutive realloc calls and store the new pointers only after all of them succeed. When a
    later call fails, the pattern buffer keeps pointers to blocks that were already freed, and the error
    cleanup frees them again. In regexec, the back-reference cache (match_ctx_add_entry) frees its array when
    a realloc fails but keeps the pointer, which is freed again on the error path. An attacker does not need
    to supply a crafted regular expression: patterns large enough to grow these arrays are common. The failure
    has to hit a specific allocation, though, so the issue can only be reached when the system is already
    under memory pressure. An attacker who supplies the pattern or the subject string has little control over
    which allocation fails, so the expected impact is a crash of the process. This issue affects all
    architectures and ABIs supported by the GNU C Library. (CVE-2026-100290)

Note that Nessus relies on the presence of the package as reported by the vendor.");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2026-100290");
  script_set_attribute(attribute:"solution", value:
"There is no known solution at this time.");
  script_set_attribute(attribute:"agent", value:"unix");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:U/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:U/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-100290");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");
  script_set_attribute(attribute:"vendor_unpatched", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/11/11");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/11/12");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:debian:debian_linux:12.0");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:debian:debian_linux:13.0");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:debian:debian_linux:14.0");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:glibc");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Misc.");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info2.nasl", "set_linux_os_id.nasl");
  script_require_keys("Host/cpu", "Host/local_checks_enabled", "global_settings/vendor_unpatched", "Host/OS/identifier");
  script_require_ports("Host/OS/Debian Linux-12", "Host/OS/Debian Linux-13", "Host/OS/Debian Linux-14");

  exit(0);
}

if (!get_kb_item("global_settings/vendor_unpatched")) exit(0, "Unpatched Vulnerabilities Detection not active.");
if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
if (empty_or_null(get_one_kb_item("Host/Debian/dpkg-l"))) audit(AUDIT_PACKAGE_LIST_MISSING);

include('linux_unpatched.inc');

var distro_constraints_array = {
  "Debian Linux-12": {
    "package_manager": "dpkg-l",
    "constraints": [
      {
        "release": "12",
        "pkgs": [
          {"reference": "glibc-doc"},
          {"reference": "glibc-source"},
          {"reference": "libc-bin"},
          {"reference": "libc-dev-bin"},
          {"reference": "libc-devtools"},
          {"reference": "libc-l10n"},
          {"reference": "libc0.1"},
          {"reference": "libc0.1-dbg"},
          {"reference": "libc0.1-dev"},
          {"reference": "libc0.1-dev-i386"},
          {"reference": "libc0.1-i386"},
          {"reference": "libc0.1-udeb"},
          {"reference": "libc0.3"},
          {"reference": "libc0.3-dbg"},
          {"reference": "libc0.3-dev"},
          {"reference": "libc0.3-udeb"},
          {"reference": "libc6"},
          {"reference": "libc6-amd64"},
          {"reference": "libc6-dbg"},
          {"reference": "libc6-dev"},
          {"reference": "libc6-dev-amd64"},
          {"reference": "libc6-dev-i386"},
          {"reference": "libc6-dev-mips32"},
          {"reference": "libc6-dev-mips64"},
          {"reference": "libc6-dev-mipsn32"},
          {"reference": "libc6-dev-powerpc"},
          {"reference": "libc6-dev-ppc64"},
          {"reference": "libc6-dev-s390"},
          {"reference": "libc6-dev-sparc"},
          {"reference": "libc6-dev-sparc64"},
          {"reference": "libc6-dev-x32"},
          {"reference": "libc6-i386"},
          {"reference": "libc6-mips32"},
          {"reference": "libc6-mips64"},
          {"reference": "libc6-mipsn32"},
          {"reference": "libc6-powerpc"},
          {"reference": "libc6-ppc64"},
          {"reference": "libc6-s390"},
          {"reference": "libc6-sparc"},
          {"reference": "libc6-sparc64"},
          {"reference": "libc6-udeb"},
          {"reference": "libc6-x32"},
          {"reference": "libc6.1"},
          {"reference": "libc6.1-alphaev67"},
          {"reference": "libc6.1-dbg"},
          {"reference": "libc6.1-dev"},
          {"reference": "libc6.1-udeb"},
          {"reference": "locales"},
          {"reference": "locales-all"},
          {"reference": "nscd"}
        ]
      }
    ]
  },
  "Debian Linux-14": {
    "package_manager": "dpkg-l",
    "constraints": [
      {
        "release": "14",
        "pkgs": [
          {"reference": "glibc-doc"},
          {"reference": "glibc-source"},
          {"reference": "libc-bin"},
          {"reference": "libc-dev-bin"},
          {"reference": "libc-devtools"},
          {"reference": "libc-gconv-modules-extra"},
          {"reference": "libc-l10n"},
          {"reference": "libc0.3"},
          {"reference": "libc0.3-dbg"},
          {"reference": "libc0.3-dev"},
          {"reference": "libc0.3-udeb"},
          {"reference": "libc6"},
          {"reference": "libc6-amd64"},
          {"reference": "libc6-dbg"},
          {"reference": "libc6-dev"},
          {"reference": "libc6-dev-amd64"},
          {"reference": "libc6-dev-i386"},
          {"reference": "libc6-dev-mips32"},
          {"reference": "libc6-dev-mips64"},
          {"reference": "libc6-dev-mipsn32"},
          {"reference": "libc6-dev-powerpc"},
          {"reference": "libc6-dev-ppc64"},
          {"reference": "libc6-dev-sparc"},
          {"reference": "libc6-dev-sparc64"},
          {"reference": "libc6-dev-x32"},
          {"reference": "libc6-i386"},
          {"reference": "libc6-mips32"},
          {"reference": "libc6-mips64"},
          {"reference": "libc6-mipsn32"},
          {"reference": "libc6-powerpc"},
          {"reference": "libc6-ppc64"},
          {"reference": "libc6-sparc"},
          {"reference": "libc6-sparc64"},
          {"reference": "libc6-udeb"},
          {"reference": "libc6-x32"},
          {"reference": "libc6.1"},
          {"reference": "libc6.1-dbg"},
          {"reference": "libc6.1-dev"},
          {"reference": "libc6.1-udeb"},
          {"reference": "locales"},
          {"reference": "locales-all"},
          {"reference": "nscd"}
        ]
      }
    ]
  },
  "Debian Linux-13": {
    "package_manager": "dpkg-l",
    "constraints": [
      {
        "release": "13",
        "pkgs": [
          {"reference": "glibc-doc"},
          {"reference": "glibc-source"},
          {"reference": "libc-bin"},
          {"reference": "libc-dev-bin"},
          {"reference": "libc-devtools"},
          {"reference": "libc-l10n"},
          {"reference": "libc0.3"},
          {"reference": "libc0.3-dbg"},
          {"reference": "libc0.3-dev"},
          {"reference": "libc0.3-udeb"},
          {"reference": "libc6"},
          {"reference": "libc6-amd64"},
          {"reference": "libc6-dbg"},
          {"reference": "libc6-dev"},
          {"reference": "libc6-dev-amd64"},
          {"reference": "libc6-dev-i386"},
          {"reference": "libc6-dev-mips32"},
          {"reference": "libc6-dev-mips64"},
          {"reference": "libc6-dev-mipsn32"},
          {"reference": "libc6-dev-powerpc"},
          {"reference": "libc6-dev-ppc64"},
          {"reference": "libc6-dev-s390"},
          {"reference": "libc6-dev-sparc"},
          {"reference": "libc6-dev-sparc64"},
          {"reference": "libc6-dev-x32"},
          {"reference": "libc6-i386"},
          {"reference": "libc6-mips32"},
          {"reference": "libc6-mips64"},
          {"reference": "libc6-mipsn32"},
          {"reference": "libc6-powerpc"},
          {"reference": "libc6-ppc64"},
          {"reference": "libc6-s390"},
          {"reference": "libc6-sparc"},
          {"reference": "libc6-sparc64"},
          {"reference": "libc6-udeb"},
          {"reference": "libc6-x32"},
          {"reference": "libc6.1"},
          {"reference": "libc6.1-dbg"},
          {"reference": "libc6.1-dev"},
          {"reference": "libc6.1-udeb"},
          {"reference": "locales"},
          {"reference": "locales-all"},
          {"reference": "nscd"}
        ]
      }
    ]
  }
};

var distro_constraints_values = linux_unpatched::get_distro_constraints(distro_constraints_arr:distro_constraints_array);
if (empty_or_null(distro_constraints_values)) audit(AUDIT_HOST_NOT, 'affected');

var third_party_support = get_kb_item('Host/OS/extended-third-party');
if (!empty_or_null(third_party_support)) {
    var third_party_vendors = distro_constraints_values['third_party'];
    if (!empty_or_null(third_party_vendors)) {
        var vendor;
        foreach vendor (third_party_vendors) {
            if (vendor == third_party_support) exit(0, 'A third party management patch is available for this vulnerability from ' + vendor + '.\n');
        }
    }
}

var report = linux_unpatched::check_unpatched_constraints(distro_constraints_values:distro_constraints_values);

if (!empty_or_null(report))
{
  security_report_v4(
      port       : 0,
      severity   : SECURITY_WARNING,
      extra      : report
  );
  exit(0);
}
else
{
  audit(AUDIT_HOST_NOT, 'affected');
}