Linux Distros Unpatched Vulnerability : CVE-2026-40170

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(307377);
  script_version("1.7");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/05/26");

  script_cve_id("CVE-2026-40170");

  script_name(english:"Linux Distros Unpatched Vulnerability : CVE-2026-40170");

  script_set_attribute(attribute:"synopsis", value:
"The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be
patched.");
  script_set_attribute(attribute:"description", value:
"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied
patch available.

  - ngtcp2 is a C implementation of the IETF QUIC protocol. In versions prior to 1.22.1,
    ngtcp2_qlog_parameters_set_transport_params() serializes peer transport parameters into a fixed 1024-byte
    stack buffer without bounds checking. When qlog is enabled, a remote peer can send sufficiently large
    transport parameters during the QUIC handshake to cause writes beyond the buffer boundary, resulting in a
    stack buffer overflow. This affects deployments that enable the qlog callback and process untrusted peer
    transport parameters. This issue has been fixed in version 1.22.1. If developers are unable to immediately
    upgrade, they can disable the qlog on client. (CVE-2026-40170)

Note that Nessus relies on the presence of the package as reported by the vendor.");
  script_set_attribute(attribute:"see_also", value:"https://access.redhat.com/security/cve/cve-2026-40170");
  script_set_attribute(attribute:"see_also", value:"https://ubuntu.com/security/CVE-2026-40170");
  script_set_attribute(attribute:"solution", value:
"There is no known solution at this time.");
  script_set_attribute(attribute:"agent", value:"unix");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:N/I:P/A:P");
  script_set_cvss_temporal_vector("CVSS2#E:POC/RL:U/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:U/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-40170");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");
  script_set_attribute(attribute:"vendor_unpatched", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/04/16");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/04/17");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:redhat:enterprise_linux:10");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:redhat:enterprise_linux:9");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:ctdb");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:ldb-tools");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:libldb");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:libldb-devel");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:libnetapi");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:libnetapi-devel");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:libsmbclient");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:libsmbclient-devel");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:libwbclient");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:libwbclient-devel");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:python3-ldb");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:python3-samba");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:python3-samba-dc");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:python3-samba-devel");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:python3-samba-test");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:samba");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:samba-client");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:samba-client-libs");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:samba-common");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:samba-common-libs");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:samba-common-tools");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:samba-dc-libs");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:samba-dcerpc");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:samba-devel");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:samba-gpupdate");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:samba-krb5-printing");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:samba-ldb-ldap-modules");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:samba-libs");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:samba-pidl");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:samba-test");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:samba-test-libs");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:samba-tools");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:samba-usershares");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:samba-vfs-iouring");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:samba-winbind");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:samba-winbind-clients");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:samba-winbind-krb5-locator");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:samba-winbind-modules");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:samba-winexe");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Misc.");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info2.nasl", "set_linux_os_id.nasl");
  script_require_keys("Host/cpu", "Host/local_checks_enabled", "global_settings/vendor_unpatched", "Host/OS/identifier");
  script_require_ports("Host/OS/Red Hat Enterprise Linux-10", "Host/OS/Red Hat Enterprise Linux-9");

  exit(0);
}

if (!get_kb_item("global_settings/vendor_unpatched")) exit(0, "Unpatched Vulnerabilities Detection not active.");
if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
if (empty_or_null(get_one_kb_item("Host/Debian/dpkg-l")) && empty_or_null(get_one_kb_item("Host/RedHat/rpm-list"))) audit(AUDIT_PACKAGE_LIST_MISSING);

include('linux_unpatched.inc');

var distro_constraints_array = {
  "Red Hat Enterprise Linux-10": {
    "package_manager": "rpm-list",
    "constraints": [
      {
        "release": "10",
        "pkgs": [
          {"reference": "ldb-tools"},
          {"reference": "libldb"},
          {"reference": "libldb-devel"},
          {"reference": "libnetapi"},
          {"reference": "libnetapi-devel"},
          {"reference": "libsmbclient"},
          {"reference": "libsmbclient-devel"},
          {"reference": "libwbclient"},
          {"reference": "libwbclient-devel"},
          {"reference": "python3-ldb"},
          {"reference": "python3-samba"},
          {"reference": "python3-samba-dc"},
          {"reference": "python3-samba-test"},
          {"reference": "samba"},
          {"reference": "samba-client"},
          {"reference": "samba-client-libs"},
          {"reference": "samba-common"},
          {"reference": "samba-common-libs"},
          {"reference": "samba-common-tools"},
          {"reference": "samba-dc-libs"},
          {"reference": "samba-dcerpc"},
          {"reference": "samba-devel"},
          {"reference": "samba-gpupdate"},
          {"reference": "samba-krb5-printing"},
          {"reference": "samba-ldb-ldap-modules"},
          {"reference": "samba-libs"},
          {"reference": "samba-pidl"},
          {"reference": "samba-test"},
          {"reference": "samba-test-libs"},
          {"reference": "samba-tools"},
          {"reference": "samba-usershares"},
          {"reference": "samba-vfs-iouring"},
          {"reference": "samba-winbind"},
          {"reference": "samba-winbind-clients"},
          {"reference": "samba-winbind-krb5-locator"},
          {"reference": "samba-winbind-modules"},
          {"reference": "samba-winexe"}
        ]
      }
    ]
  },
  "Red Hat Enterprise Linux-9": {
    "package_manager": "rpm-list",
    "constraints": [
      {
        "release": "9",
        "pkgs": [
          {"reference": "ctdb"},
          {"reference": "libnetapi"},
          {"reference": "libnetapi-devel"},
          {"reference": "libsmbclient"},
          {"reference": "libsmbclient-devel"},
          {"reference": "libwbclient"},
          {"reference": "libwbclient-devel"},
          {"reference": "python3-samba"},
          {"reference": "python3-samba-dc"},
          {"reference": "python3-samba-devel"},
          {"reference": "python3-samba-test"},
          {"reference": "samba"},
          {"reference": "samba-client"},
          {"reference": "samba-client-libs"},
          {"reference": "samba-common"},
          {"reference": "samba-common-libs"},
          {"reference": "samba-common-tools"},
          {"reference": "samba-dc-libs"},
          {"reference": "samba-dcerpc"},
          {"reference": "samba-devel"},
          {"reference": "samba-krb5-printing"},
          {"reference": "samba-ldb-ldap-modules"},
          {"reference": "samba-libs"},
          {"reference": "samba-pidl"},
          {"reference": "samba-test"},
          {"reference": "samba-test-libs"},
          {"reference": "samba-tools"},
          {"reference": "samba-usershares"},
          {"reference": "samba-vfs-iouring"},
          {"reference": "samba-winbind"},
          {"reference": "samba-winbind-clients"},
          {"reference": "samba-winbind-krb5-locator"},
          {"reference": "samba-winbind-modules"},
          {"reference": "samba-winexe"}
        ]
      }
    ]
  }
};

var distro_constraints_values = linux_unpatched::get_distro_constraints(distro_constraints_arr:distro_constraints_array);
if (empty_or_null(distro_constraints_values)) audit(AUDIT_HOST_NOT, 'affected');
var report = linux_unpatched::check_unpatched_constraints(distro_constraints_values:distro_constraints_values);

if (!empty_or_null(report))
{
  security_report_v4(
      port       : 0,
      severity   : SECURITY_WARNING,
      extra      : report
  );
  exit(0);
}
else
{
  audit(AUDIT_HOST_NOT, 'affected');
}