Linux Distros Unpatched Vulnerability : CVE-2026-74576

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(335827);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/08/15");

  script_cve_id("CVE-2026-74576");

  script_name(english:"Linux Distros Unpatched Vulnerability : CVE-2026-74576");

  script_set_attribute(attribute:"synopsis", value:
"The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be
patched.");
  script_set_attribute(attribute:"description", value:
"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied
patch available.

  - mm/slab: prevent unbounded recursion in free path with new kmalloc type Commit 280ea9c3154b (mm/slab:
    avoid allocating slabobj_ext array from its own slab) avoided recursive allocation of obj_exts from
    kmalloc caches of the same size, by bumping the obj_exts array's allocation size whenever the array size
    equals the size of the object being allocated. However, as reported by Danielle Costantino and Shakeel
    Butt, even slabs from kmalloc caches of different sizes can form a cycle by allocating obj_exts arrays
    from each other [1]: What happened: a KMALLOC_NORMAL slab's obj_exts array (used by allocation profiling /
    memcg accounting) is itself kmalloc()'d from a KMALLOC_NORMAL cache, so the slab holds another slab's
    obj_exts array relation can form cycles. With sizeof(struct slabobj_ext) == 16 and the host's geometry: -
    kmalloc-512 has 64 objects/slab -> array is 64*16 == 1024 bytes, served from kmalloc-1k; - kmalloc-1k has
    32 objects/slab -> array is 32*16 == 512 bytes, served from kmalloc-512. A kmalloc-512 slab and a
    kmalloc-1k slab therefore hold each other's obj_exts array. Discarding one frees the other's array, which
    empties and discards that slab, which frees the first's array, and so on: __free_slab() ->
    free_slab_obj_exts() -> kfree() -> discard_slab() -> __free_slab() recurses along the cycle until the
    stack is exhausted. With memory allocation profiling, this allows unbounded recursion in the free path and
    led to a stack overflow on a production host in the Meta fleet [1]: BUG: TASK stack guard page was hit
    Oops: stack guard page RIP: 0010:kfree+0x8/0x5d0 Call Trace: __free_slab+0x66/0xc0 kfree+0x3f0/0x5d0 ... (
    ~125x __free_slab <-> kfree ) ... <kernel driver freeing a resource> do_syscall_64 It is proposed [1] to
    resolve this issue by always serving the obj_exts array allocation from kmalloc caches (or large kmalloc)
    of sizes larger than the object size. However, as pointed out by Vlastimil Babka [2], this can waste an
    excessive amount of memory as slabs from large kmalloc sizes (e.g. kmalloc-8k) generally need obj_exts
    arrays much smaller than the object size. Therefore, rather than bumping the size, let us take a different
    approach; disallow formation of cycles between kmalloc types when allocating obj_exts arrays. Currently,
    all obj_exts arrays are served from normal kmalloc caches. Cycles cannot be created if obj_exts arrays of
    normal kmalloc caches are served from a special kmalloc type that can never have obj_exts arrays. To
    achieve this, create a new kmalloc type called KMALLOC_NO_OBJ_EXT. KMALLOC_NO_OBJ_EXT caches are created
    with SLAB_NO_OBJ_EXT flag when either 1) memory allocation profiling is not permanently disabled, or 2)
    kmalloc types with a priority higher than KMALLOC_CGROUP are aliased with KMALLOC_NORMAL. Sheaf
    bootstrapping for KMALLOC_NO_OBJ_EXT caches now must be deferred because allocation of a barn can trigger
    obj_exts array allocation of normal kmalloc caches when the KMALLOC_NO_OBJ_EXT cache for that size is not
    ready yet. For simplicity, perform bootstrapping of sheaves for all kmalloc caches later. Introduce a new
    slab alloc flag, SLAB_ALLOC_NO_OBJ_EXT, to prevent allocation of obj_exts arrays, and let kmalloc_slab()
    override the type to KMALLOC_NO_OBJ_EXT when specified. Note that kmalloc_type() remains unchanged because
    kmalloc_flags() bypasses the kmalloc fastpath. Do not pass SLAB_ALLOC_NO_RECURSE to kmalloc_flags() in
    alloc_slab_obj_exts() and instead use SLAB_ALLOC_NO_OBJ_EXT only when the objects are allocated from
    normal kmalloc caches. While this prevents unbounded recursive allocation of obj_exts, it allows
    KMALLOC_NO_OBJ_EXT caches to have sheaves. Since sheaf allocations specify SLAB_ALLOC_NO_RECURSE that
    prevents allocation of both sheaves and obj_exts arrays, the recursion depth is bounded. obj_exts arrays
    for non- ---truncated--- (CVE-2026-74576)

Note that Nessus relies on the presence of the package as reported by the vendor.");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2026-74576");
  script_set_attribute(attribute:"solution", value:
"There is no known solution at this time.");
  script_set_attribute(attribute:"agent", value:"unix");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:U/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:U/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-74576");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");
  script_set_attribute(attribute:"vendor_unpatched", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/08/15");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/08/15");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:debian:debian_linux:13.0");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:debian:debian_linux:14.0");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:linux");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Misc.");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info2.nasl", "set_linux_os_id.nasl");
  script_require_keys("Host/cpu", "Host/local_checks_enabled", "global_settings/vendor_unpatched", "Host/OS/identifier");
  script_require_ports("Host/OS/Debian Linux-13", "Host/OS/Debian Linux-14");

  exit(0);
}

if (!get_kb_item("global_settings/vendor_unpatched")) exit(0, "Unpatched Vulnerabilities Detection not active.");
if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
if (empty_or_null(get_one_kb_item("Host/Debian/dpkg-l"))) audit(AUDIT_PACKAGE_LIST_MISSING);

include('linux_unpatched.inc');

var distro_constraints_array = {
  "Debian Linux-14": {
    "package_manager": "dpkg-l",
    "constraints": [
      {
        "release": "14",
        "pkgs": [
          {"reference": "bpftool"},
          {"reference": "hyperv-daemons"},
          {"reference": "intel-sdsi"},
          {"reference": "libcpupower-dev"},
          {"reference": "libcpupower1"},
          {"reference": "linux-base-7.1.7+deb14-alpha-generic"},
          {"reference": "linux-base-7.1.7+deb14-alpha-smp"},
          {"reference": "linux-base-7.1.7+deb14-amd64"},
          {"reference": "linux-base-7.1.7+deb14-arm64"},
          {"reference": "linux-base-7.1.7+deb14-arm64-16k"},
          {"reference": "linux-base-7.1.7+deb14-armmp"},
          {"reference": "linux-base-7.1.7+deb14-armmp-lpae"},
          {"reference": "linux-base-7.1.7+deb14-cloud-amd64"},
          {"reference": "linux-base-7.1.7+deb14-cloud-arm64"},
          {"reference": "linux-base-7.1.7+deb14-loong64"},
          {"reference": "linux-base-7.1.7+deb14-m68k"},
          {"reference": "linux-base-7.1.7+deb14-parisc"},
          {"reference": "linux-base-7.1.7+deb14-parisc64"},
          {"reference": "linux-base-7.1.7+deb14-powerpc"},
          {"reference": "linux-base-7.1.7+deb14-powerpc-smp"},
          {"reference": "linux-base-7.1.7+deb14-powerpc64"},
          {"reference": "linux-base-7.1.7+deb14-powerpc64-64k"},
          {"reference": "linux-base-7.1.7+deb14-powerpc64le"},
          {"reference": "linux-base-7.1.7+deb14-powerpc64le-64k"},
          {"reference": "linux-base-7.1.7+deb14-riscv64"},
          {"reference": "linux-base-7.1.7+deb14-rt-amd64"},
          {"reference": "linux-base-7.1.7+deb14-rt-arm64"},
          {"reference": "linux-base-7.1.7+deb14-s390x"},
          {"reference": "linux-base-7.1.7+deb14-sh7751r"},
          {"reference": "linux-base-7.1.7+deb14-sparc64"},
          {"reference": "linux-base-7.1.7+deb14-sparc64-smp"},
          {"reference": "linux-base-7.1.7+deb14-test"}
        ]
      }
    ]
  },
  "Debian Linux-13": {
    "package_manager": "dpkg-l",
    "constraints": [
      {
        "release": "13",
        "pkgs": [
          {"reference": "bpftool"},
          {"reference": "hyperv-daemons"},
          {"reference": "intel-sdsi"},
          {"reference": "libcpupower-dev"},
          {"reference": "libcpupower1"},
          {"reference": "linux-bpf-dev"},
          {"reference": "linux-config-6.12"},
          {"reference": "linux-cpupower"},
          {"reference": "linux-doc"},
          {"reference": "linux-doc-6.12"},
          {"reference": "linux-headers-4kc-malta"},
          {"reference": "linux-headers-5kc-malta"},
          {"reference": "linux-headers-6.12.94+deb13-4kc-malta"},
          {"reference": "linux-headers-6.12.94+deb13-5kc-malta"},
          {"reference": "linux-headers-6.12.94+deb13-alpha-generic"},
          {"reference": "linux-headers-6.12.94+deb13-alpha-smp"},
          {"reference": "linux-headers-6.12.94+deb13-amd64"},
          {"reference": "linux-headers-6.12.94+deb13-arm64"},
          {"reference": "linux-headers-6.12.94+deb13-arm64-16k"},
          {"reference": "linux-headers-6.12.94+deb13-armmp"},
          {"reference": "linux-headers-6.12.94+deb13-armmp-lpae"},
          {"reference": "linux-headers-6.12.94+deb13-cloud-amd64"},
          {"reference": "linux-headers-6.12.94+deb13-cloud-arm64"},
          {"reference": "linux-headers-6.12.94+deb13-common"},
          {"reference": "linux-headers-6.12.94+deb13-common-rt"},
          {"reference": "linux-headers-6.12.94+deb13-loong64"},
          {"reference": "linux-headers-6.12.94+deb13-loongson-3"},
          {"reference": "linux-headers-6.12.94+deb13-m68k"},
          {"reference": "linux-headers-6.12.94+deb13-mips32r2eb"},
          {"reference": "linux-headers-6.12.94+deb13-mips32r2el"},
          {"reference": "linux-headers-6.12.94+deb13-mips64r2eb"},
          {"reference": "linux-headers-6.12.94+deb13-mips64r2el"}
        ]
      }
    ]
  }
};

var distro_constraints_values = linux_unpatched::get_distro_constraints(distro_constraints_arr:distro_constraints_array);
if (empty_or_null(distro_constraints_values)) audit(AUDIT_HOST_NOT, 'affected');

var third_party_support = get_kb_item('Host/OS/extended-third-party');
if (!empty_or_null(third_party_support)) {
    var third_party_vendors = distro_constraints_values['third_party'];
    if (!empty_or_null(third_party_vendors)) {
        var vendor;
        foreach vendor (third_party_vendors) {
            if (vendor == third_party_support) exit(0, 'A third party management patch is available for this vulnerability from ' + vendor + '.\n');
        }
    }
}

var report = linux_unpatched::check_unpatched_constraints(distro_constraints_values:distro_constraints_values);

if (!empty_or_null(report))
{
  security_report_v4(
      port       : 0,
      severity   : SECURITY_WARNING,
      extra      : report
  );
  exit(0);
}
else
{
  audit(AUDIT_HOST_NOT, 'affected');
}