Linux Distros Unpatched Vulnerability : CVE-2026-74599

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(338955);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/08/22");

  script_cve_id("CVE-2026-74599");

  script_name(english:"Linux Distros Unpatched Vulnerability : CVE-2026-74599");

  script_set_attribute(attribute:"synopsis", value:
"The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be
patched.");
  script_set_attribute(attribute:"description", value:
"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied
patch available.

  - mm/ptdump: always stabilise against page table freeing using init_mm Previous commits have established the
    invariant that kernel page table freeing is performed while an mmap read lock on init_mm is held, which
    fixes races between ptdump and kernel page table freeing over init_mm. However, x86 and arm64 can perform
    a ptdump over an mm other than init_mm via ptdump_walk_pgd() and since kernel memory ranges are shared
    across non-kernel mm's, this means that the race still exists for these cases. Fix this by acquiring a
    nested mmap write lock for init_mm in ptdump_walk_pgd(). This is safe as we take this after mmap write
    locking the mm, and nothing acquires the init_mm lock first before locking an arbitrary mm, so no deadlock
    is possible. Also update walk_page_range_debug() to assert that init_mm is write locked, add a comment
    explaining why and remove some redundant code, and eliminate the unnecessary and confusing invocation of
    walk_kernel_page_table_range(). We can safely remove the non-NULL check for walk.mm, as the mmap lock
    asserts would NULL pointer deref if it was (and of course no callers do this). The first point at which
    ptdump can race kernel page table freeing is commit b6bdb7517c3d (mm/vmalloc: add interfaces to free
    unmapped page table), so we target this in the Fixes tag. (CVE-2026-74599)

Note that Nessus relies on the presence of the package as reported by the vendor.");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2026-74599");
  script_set_attribute(attribute:"solution", value:
"There is no known solution at this time.");
  script_set_attribute(attribute:"agent", value:"unix");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:U/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:U/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-74599");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");
  script_set_attribute(attribute:"vendor_unpatched", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/08/22");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/08/22");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:debian:debian_linux:11.0");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:debian:debian_linux:12.0");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:debian:debian_linux:13.0");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:debian:debian_linux:14.0");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:linux");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Misc.");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info2.nasl", "set_linux_os_id.nasl");
  script_require_keys("Host/cpu", "Host/local_checks_enabled", "global_settings/vendor_unpatched", "Host/OS/identifier");
  script_require_ports("Host/OS/Debian Linux-11", "Host/OS/Debian Linux-12", "Host/OS/Debian Linux-13", "Host/OS/Debian Linux-14");

  exit(0);
}

if (!get_kb_item("global_settings/vendor_unpatched")) exit(0, "Unpatched Vulnerabilities Detection not active.");
if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
if (empty_or_null(get_one_kb_item("Host/Debian/dpkg-l"))) audit(AUDIT_PACKAGE_LIST_MISSING);

include('linux_unpatched.inc');

var distro_constraints_array = {
  "Debian Linux-12": {
    "package_manager": "dpkg-l",
    "constraints": [
      {
        "release": "12",
        "pkgs": [
          {"reference": "btrfs-modules-6.1.0-50-alpha-generic-di"},
          {"reference": "cdrom-core-modules-6.1.0-50-alpha-generic-di"},
          {"reference": "ext4-modules-6.1.0-50-alpha-generic-di"},
          {"reference": "fat-modules-6.1.0-50-alpha-generic-di"},
          {"reference": "isofs-modules-6.1.0-50-alpha-generic-di"},
          {"reference": "jfs-modules-6.1.0-50-alpha-generic-di"},
          {"reference": "kernel-image-6.1.0-50-alpha-generic-di"},
          {"reference": "linux-doc"},
          {"reference": "linux-doc-6.1"},
          {"reference": "linux-headers-6.1.0"},
          {"reference": "linux-source"},
          {"reference": "linux-source-6.1"},
          {"reference": "linux-support-6.1.0"},
          {"reference": "loop-modules-6.1.0-50-alpha-generic-di"},
          {"reference": "nic-modules-6.1.0-50-alpha-generic-di"},
          {"reference": "nic-shared-modules-6.1.0-50-alpha-generic-di"},
          {"reference": "nic-wireless-modules-6.1.0-50-alpha-generic-di"},
          {"reference": "pata-modules-6.1.0-50-alpha-generic-di"},
          {"reference": "ppp-modules-6.1.0-50-alpha-generic-di"},
          {"reference": "scsi-core-modules-6.1.0-50-alpha-generic-di"},
          {"reference": "scsi-modules-6.1.0-50-alpha-generic-di"},
          {"reference": "scsi-nic-modules-6.1.0-50-alpha-generic-di"},
          {"reference": "serial-modules-6.1.0-50-alpha-generic-di"},
          {"reference": "usb-serial-modules-6.1.0-50-alpha-generic-di"},
          {"reference": "xfs-modules-6.1.0-50-alpha-generic-di"}
        ]
      }
    ]
  },
  "Debian Linux-11": {
    "package_manager": "dpkg-l",
    "constraints": [
      {
        "release": "11",
        "pkgs": [
          {"reference": "bpftool"},
          {"reference": "btrfs-modules-5.10.0-32-alpha-generic-di"},
          {"reference": "cdrom-core-modules-5.10.0-32-alpha-generic-di"},
          {"reference": "hyperv-daemons"},
          {"reference": "kernel-image-5.10.0-32-alpha-generic-di"},
          {"reference": "libcpupower-dev"},
          {"reference": "libcpupower1"},
          {"reference": "linux-bootwrapper-5.10.0"},
          {"reference": "linux-config-5.10"},
          {"reference": "linux-cpupower"},
          {"reference": "linux-doc"},
          {"reference": "linux-doc-5.10"},
          {"reference": "linux-headers-5.10.0"},
          {"reference": "linux-kbuild-5.10"},
          {"reference": "linux-libc-dev"},
          {"reference": "linux-perf"},
          {"reference": "linux-perf-5.10"},
          {"reference": "linux-source"},
          {"reference": "linux-source-5.10"},
          {"reference": "linux-support-5.10.0"},
          {"reference": "loop-modules-5.10.0-32-alpha-generic-di"},
          {"reference": "nic-modules-5.10.0-32-alpha-generic-di"},
          {"reference": "nic-shared-modules-5.10.0-32-alpha-generic-di"},
          {"reference": "nic-wireless-modules-5.10.0-32-alpha-generic-di"},
          {"reference": "pata-modules-5.10.0-32-alpha-generic-di"},
          {"reference": "ppp-modules-5.10.0-32-alpha-generic-di"},
          {"reference": "scsi-core-modules-5.10.0-32-alpha-generic-di"},
          {"reference": "scsi-modules-5.10.0-32-alpha-generic-di"},
          {"reference": "scsi-nic-modules-5.10.0-32-alpha-generic-di"},
          {"reference": "serial-modules-5.10.0-32-alpha-generic-di"},
          {"reference": "usb-serial-modules-5.10.0-32-alpha-generic-di"},
          {"reference": "usbip"}
        ]
      }
    ]
  },
  "Debian Linux-14": {
    "package_manager": "dpkg-l",
    "constraints": [
      {
        "release": "14",
        "pkgs": [
          {"reference": "bpftool"},
          {"reference": "hyperv-daemons"},
          {"reference": "intel-sdsi"},
          {"reference": "libcpupower-dev"},
          {"reference": "libcpupower1"},
          {"reference": "linux-base-7.1.8+deb14.1-alpha-generic"},
          {"reference": "linux-base-7.1.8+deb14.1-alpha-smp"},
          {"reference": "linux-base-7.1.8+deb14.1-amd64"},
          {"reference": "linux-base-7.1.8+deb14.1-arm64"},
          {"reference": "linux-base-7.1.8+deb14.1-arm64-16k"},
          {"reference": "linux-base-7.1.8+deb14.1-armmp"},
          {"reference": "linux-base-7.1.8+deb14.1-armmp-lpae"},
          {"reference": "linux-base-7.1.8+deb14.1-cloud-amd64"},
          {"reference": "linux-base-7.1.8+deb14.1-cloud-arm64"},
          {"reference": "linux-base-7.1.8+deb14.1-loong64"},
          {"reference": "linux-base-7.1.8+deb14.1-m68k"},
          {"reference": "linux-base-7.1.8+deb14.1-parisc"},
          {"reference": "linux-base-7.1.8+deb14.1-parisc64"},
          {"reference": "linux-base-7.1.8+deb14.1-powerpc"},
          {"reference": "linux-base-7.1.8+deb14.1-powerpc-smp"},
          {"reference": "linux-base-7.1.8+deb14.1-powerpc64"},
          {"reference": "linux-base-7.1.8+deb14.1-powerpc64-64k"},
          {"reference": "linux-base-7.1.8+deb14.1-powerpc64le"},
          {"reference": "linux-base-7.1.8+deb14.1-powerpc64le-64k"},
          {"reference": "linux-base-7.1.8+deb14.1-riscv64"},
          {"reference": "linux-base-7.1.8+deb14.1-rt-amd64"},
          {"reference": "linux-base-7.1.8+deb14.1-rt-arm64"},
          {"reference": "linux-base-7.1.8+deb14.1-s390x"},
          {"reference": "linux-base-7.1.8+deb14.1-sh7751r"},
          {"reference": "linux-base-7.1.8+deb14.1-sparc64"}
        ]
      }
    ]
  },
  "Debian Linux-13": {
    "package_manager": "dpkg-l",
    "constraints": [
      {
        "release": "13",
        "pkgs": [
          {"reference": "bpftool"},
          {"reference": "hyperv-daemons"},
          {"reference": "intel-sdsi"},
          {"reference": "libcpupower-dev"},
          {"reference": "libcpupower1"},
          {"reference": "linux-bpf-dev"},
          {"reference": "linux-config-6.12"},
          {"reference": "linux-cpupower"},
          {"reference": "linux-doc"},
          {"reference": "linux-doc-6.12"},
          {"reference": "linux-headers-4kc-malta"},
          {"reference": "linux-headers-5kc-malta"},
          {"reference": "linux-headers-6.12.94+deb13-4kc-malta"},
          {"reference": "linux-headers-6.12.94+deb13-5kc-malta"},
          {"reference": "linux-headers-6.12.94+deb13-alpha-generic"},
          {"reference": "linux-headers-6.12.94+deb13-alpha-smp"},
          {"reference": "linux-headers-6.12.94+deb13-amd64"},
          {"reference": "linux-headers-6.12.94+deb13-arm64"},
          {"reference": "linux-headers-6.12.94+deb13-arm64-16k"},
          {"reference": "linux-headers-6.12.94+deb13-armmp"},
          {"reference": "linux-headers-6.12.94+deb13-armmp-lpae"},
          {"reference": "linux-headers-6.12.94+deb13-cloud-amd64"},
          {"reference": "linux-headers-6.12.94+deb13-cloud-arm64"},
          {"reference": "linux-headers-6.12.94+deb13-common"},
          {"reference": "linux-headers-6.12.94+deb13-common-rt"},
          {"reference": "linux-headers-6.12.94+deb13-loong64"},
          {"reference": "linux-headers-6.12.94+deb13-loongson-3"},
          {"reference": "linux-headers-6.12.94+deb13-m68k"},
          {"reference": "linux-headers-6.12.94+deb13-mips32r2eb"},
          {"reference": "linux-headers-6.12.94+deb13-mips32r2el"},
          {"reference": "linux-headers-6.12.94+deb13-mips64r2eb"},
          {"reference": "linux-headers-6.12.94+deb13-mips64r2el"}
        ]
      }
    ]
  }
};

var distro_constraints_values = linux_unpatched::get_distro_constraints(distro_constraints_arr:distro_constraints_array);
if (empty_or_null(distro_constraints_values)) audit(AUDIT_HOST_NOT, 'affected');

var third_party_support = get_kb_item('Host/OS/extended-third-party');
if (!empty_or_null(third_party_support)) {
    var third_party_vendors = distro_constraints_values['third_party'];
    if (!empty_or_null(third_party_vendors)) {
        var vendor;
        foreach vendor (third_party_vendors) {
            if (vendor == third_party_support) exit(0, 'A third party management patch is available for this vulnerability from ' + vendor + '.\n');
        }
    }
}

var report = linux_unpatched::check_unpatched_constraints(distro_constraints_values:distro_constraints_values);

if (!empty_or_null(report))
{
  security_report_v4(
      port       : 0,
      severity   : SECURITY_WARNING,
      extra      : report
  );
  exit(0);
}
else
{
  audit(AUDIT_HOST_NOT, 'affected');
}