Linux Distros Unpatched Vulnerability : CVE-2026-64252

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(329657);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/07/25");

  script_cve_id("CVE-2026-64252");

  script_name(english:"Linux Distros Unpatched Vulnerability : CVE-2026-64252");

  script_set_attribute(attribute:"synopsis", value:
"The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be
patched.");
  script_set_attribute(attribute:"description", value:
"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied
patch available.

  - MIPS: DEC: Prevent initial console buffer from landing in XKPHYS In 64-bit configurations calling the
    initial console output handler from a kernel thread other than the initial one will result in a situation
    where the stack has been placed in the XKPHYS 64-bit memory segment and consequently so has been the
    buffer allocated there that is used as the argument corresponding to the `%s' output conversion specifier
    for the firmware's printf() entry point. This 64-bit address will then be truncated by 32-bit firmware,
    resulting in an attempt to access the wrong memory location, which in turn will cause all kinds of
    unpredictable behaviour, such as a kernel crash: Console: colour dummy device 160x64 Calibrating delay
    loop... 49.36 BogoMIPS (lpj=192512) pid_max: default: 32768 minimum: 301 CPU 0 Unable to handle kernel
    paging request at virtual address 000000000203bd00, epc == ffffffffbfc08364, ra == ffffffffbfc08800
    Oops[#1]: CPU: 0 PID: 0 Comm: swapper Not tainted 5.18.0-rc2-00254-gfb649bda6f56-dirty #121 $ 0 :
    0000000000000000 0000000000000001 0000000000000023 ffffffff80684ba0 $ 4 : 000000000203bd00
    ffffffffbfc0f3b4 ffffffffffffffff 0000000000000073 $ 8 : 0a303d7469000000 0000000000000000
    0000000000000073 ffffffffbfc0f473 $12 : 0000000000000002 0000000000000000 ffffffff80684c1c
    0000000000000000 $16 : 0000000000000000 ffffffff80596dc9 0000000000000000 ffffffffbfc09240 $20 :
    ffffffff80684c40 ffffffffbfc0f400 000000000000002d 000000000000002b $24 : ffffffffffffffbf
    000000000203bd00 $28 : ffffffff805f0000 ffffffff80684b58 0000000000000030 ffffffffbfc08800 Hi :
    0000000000000000 Lo : 0000000000000aa8 epc : ffffffffbfc08364 0xffffffffbfc08364 ra : ffffffffbfc08800
    0xffffffffbfc08800 Status: 140120e2 KX SX UX KERNEL EXL Cause : 00000008 (ExcCode 02) BadVA :
    000000000203bd00 PrId : 00000430 (R4000SC) Modules linked in: Process swapper (pid: 0,
    threadinfo=(____ptrval____), task=(____ptrval____), tls=0000000000000000) Stack : 0000000000000000
    0000000000000000 0000000000000000 0000004d0000004d 80684cc0806a2a40 80596dc80000004d 8061000000000000
    bfc0850c80684c38 0000000000000000 000000000203bd00 0000000000000000 0000000000000000 0000000000000000
    00000000bfc0f3b4 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
    0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000002500000000
    0000000000000000 0000000000000000 802c1a7400000000 0203bd0080596dc8 0203bd4d69000000 6c61632000000018
    5f746567646e6172 6c616320625f6d6f 5f736e5f6d6f7266 206361323778302b 303d74696e726320 806a0a38806b0000
    806a0a38806b0000 00000000806b0000 80683c58806b0000 ... Call Trace: Code: a082ffff 03e00008 00601021
    <80820000> 00001821 10400005 24840001 80820000 24630001 ---[ end trace 0000000000000000 ]--- Kernel panic
    - not syncing: Fatal exception in interrupt KN04 V2.1k (PC: 0xa0026768, SP: 0x806848e8) >> In this case
    the pointer in $4 was truncated from 0x980000000203bd00 to 0x000000000203bd00. This may happen when no
    final console driver has been enabled in the configuration and consequently the initial console continues
    being used late into bootstrap or with an upcoming change that will switch the zs driver to use a platform
    device, which in turn will make the console handover happen only after other kernel threads have already
    been started. Fix the issue by making the buffer static and initdata, and therefore placed in the CKSEG0
    32-bit compatibility segment, observing that the console output handler is called with the console lock
    held, implying no need for this code to be reentrant. Add an assertion to verify the buffer actually has
    been placed in a compatibility segment. (CVE-2026-64252)

Note that Nessus relies on the presence of the package as reported by the vendor.");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2026-64252");
  script_set_attribute(attribute:"solution", value:
"There is no known solution at this time.");
  script_set_attribute(attribute:"agent", value:"unix");
  script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:U/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:U/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-64252");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");
  script_set_attribute(attribute:"vendor_unpatched", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/07/24");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/07/25");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:debian:debian_linux:11.0");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:linux");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Misc.");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info2.nasl", "set_linux_os_id.nasl");
  script_require_keys("Host/cpu", "Host/local_checks_enabled", "global_settings/vendor_unpatched", "Host/OS/identifier");
  script_require_ports("Host/OS/Debian Linux-11");

  exit(0);
}

if (!get_kb_item("global_settings/vendor_unpatched")) exit(0, "Unpatched Vulnerabilities Detection not active.");
if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
if (empty_or_null(get_one_kb_item("Host/Debian/dpkg-l"))) audit(AUDIT_PACKAGE_LIST_MISSING);

include('linux_unpatched.inc');

var distro_constraints_array = {
  "Debian Linux-11": {
    "package_manager": "dpkg-l",
    "constraints": [
      {
        "release": "11",
        "pkgs": [
          {"reference": "bpftool"},
          {"reference": "btrfs-modules-5.10.0-32-alpha-generic-di"},
          {"reference": "cdrom-core-modules-5.10.0-32-alpha-generic-di"},
          {"reference": "hyperv-daemons"},
          {"reference": "kernel-image-5.10.0-32-alpha-generic-di"},
          {"reference": "libcpupower-dev"},
          {"reference": "libcpupower1"},
          {"reference": "linux-bootwrapper-5.10.0"},
          {"reference": "linux-config-5.10"},
          {"reference": "linux-cpupower"},
          {"reference": "linux-doc"},
          {"reference": "linux-doc-5.10"},
          {"reference": "linux-headers-5.10.0"},
          {"reference": "linux-kbuild-5.10"},
          {"reference": "linux-libc-dev"},
          {"reference": "linux-perf"},
          {"reference": "linux-perf-5.10"},
          {"reference": "linux-source"},
          {"reference": "linux-source-5.10"},
          {"reference": "linux-support-5.10.0"},
          {"reference": "loop-modules-5.10.0-32-alpha-generic-di"},
          {"reference": "nic-modules-5.10.0-32-alpha-generic-di"},
          {"reference": "nic-shared-modules-5.10.0-32-alpha-generic-di"},
          {"reference": "nic-wireless-modules-5.10.0-32-alpha-generic-di"},
          {"reference": "pata-modules-5.10.0-32-alpha-generic-di"},
          {"reference": "ppp-modules-5.10.0-32-alpha-generic-di"},
          {"reference": "scsi-core-modules-5.10.0-32-alpha-generic-di"},
          {"reference": "scsi-modules-5.10.0-32-alpha-generic-di"},
          {"reference": "scsi-nic-modules-5.10.0-32-alpha-generic-di"},
          {"reference": "serial-modules-5.10.0-32-alpha-generic-di"},
          {"reference": "usb-serial-modules-5.10.0-32-alpha-generic-di"},
          {"reference": "usbip"}
        ]
      }
    ]
  }
};

var distro_constraints_values = linux_unpatched::get_distro_constraints(distro_constraints_arr:distro_constraints_array);
if (empty_or_null(distro_constraints_values)) audit(AUDIT_HOST_NOT, 'affected');

var third_party_support = get_kb_item('Host/OS/extended-third-party');
if (!empty_or_null(third_party_support)) {
    var third_party_vendors = distro_constraints_values['third_party'];
    if (!empty_or_null(third_party_vendors)) {
        var vendor;
        foreach vendor (third_party_vendors) {
            if (vendor == third_party_support) exit(0, 'A third party management patch is available for this vulnerability from ' + vendor + '.\n');
        }
    }
}

var report = linux_unpatched::check_unpatched_constraints(distro_constraints_values:distro_constraints_values);

if (!empty_or_null(report))
{
  security_report_v4(
      port       : 0,
      severity   : SECURITY_WARNING,
      extra      : report
  );
  exit(0);
}
else
{
  audit(AUDIT_HOST_NOT, 'affected');
}