Linux Distros Unpatched Vulnerability : CVE-2026-74640

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(338964);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/08/22");

  script_cve_id("CVE-2026-74640");

  script_name(english:"Linux Distros Unpatched Vulnerability : CVE-2026-74640");

  script_set_attribute(attribute:"synopsis", value:
"The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be
patched.");
  script_set_attribute(attribute:"description", value:
"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied
patch available.

  - ALSA: FCP: fix OOB write in fcp_meter_ctl_get() fcp_ioctl_set_meter_map() bounds the user-supplied Level
    Meter map size by the driver's own limit of 255 if (map.map_size < 1 || map.map_size > 255 ||
    map.meter_slots < 1 || map.meter_slots > 255) return -EINVAL; and passes it to fcp_add_new_ctl() as the
    control's channel count, where it is stored as elem->channels. Every control read writes into struct
    snd_ctl_elem_value, whose integer array is declared long value[128], so the limit is 128, not 255.
    fcp_meter_ctl_get() stores one 64-bit word per channel into that array with no bound of its own: for (i =
    0; i < elem->channels; i++) { int idx = private->meter_level_map[i]; int value = idx < 0 ? 0 :
    le32_to_cpu(resp[idx]); ucontrol->value.integer.value[i] = value; } snd_ctl_elem_read_user() serves that
    object from memdup_user(_control, sizeof(*control)), 1224 bytes on LP64 out of kmalloc-2048.
    offsetof(struct snd_ctl_elem_value, value) is 72, so element i is written at byte 72 + 8 * i and element
    144 already lands past the allocation. At map_size 255 the last store ends at byte 2112, 888 bytes past
    the object and 64 bytes into the adjacent slab object. The stored words come from the device and
    meter_level_map[] selects which word lands in which slot, so extent and contents are both controlled. The
    core does not catch this. snd_ctl_check_elem_info() is reached only from __snd_ctl_elem_info(), which
    snd_ctl_elem_read() calls under CONFIG_SND_CTL_DEBUG; without that option snd_ctl_skip_validation() is a
    compile-time true. __snd_ctl_add_replace() validates kcontrol->count and never inspects elem->channels.
    Installing an oversized map needs CAP_SYS_RAWIO, but the control outlives the hwdep descriptor that
    created it, so the out-of-bounds stores are issued by any process able to read controls on
    /dev/snd/controlC0. KASAN on 7.2.0-rc5 (arm64), triggered by an unprivileged control read: BUG: KASAN:
    slab-out-of-bounds in fcp_meter_ctl_get Write of size 8 at addr ffff000017af04c8 by task fcp_trigger/185
    __asan_store8 fcp_meter_ctl_get snd_ctl_elem_read snd_ctl_ioctl Allocated by task 185: memdup_user
    snd_ctl_ioctl The buggy address is located 0 bytes to the right of allocated 1224-byte region
    [ffff000017af0000, ffff000017af04c8) Bound the map size by the ABI limit rather than by 255, and bound the
    store loop at the sink so it cannot run past the value array whatever elem->channels holds. Discovered by
    XBOW, triaged by Baul Lee <[email protected]> (CVE-2026-74640)

Note that Nessus relies on the presence of the package as reported by the vendor.");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2026-74640");
  script_set_attribute(attribute:"solution", value:
"There is no known solution at this time.");
  script_set_attribute(attribute:"agent", value:"unix");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:U/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:U/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-74640");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");
  script_set_attribute(attribute:"vendor_unpatched", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/08/22");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/08/22");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:debian:debian_linux:14.0");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:linux");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Misc.");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info2.nasl", "set_linux_os_id.nasl");
  script_require_keys("Host/cpu", "Host/local_checks_enabled", "global_settings/vendor_unpatched", "Host/OS/identifier");
  script_require_ports("Host/OS/Debian Linux-14");

  exit(0);
}

if (!get_kb_item("global_settings/vendor_unpatched")) exit(0, "Unpatched Vulnerabilities Detection not active.");
if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
if (empty_or_null(get_one_kb_item("Host/Debian/dpkg-l"))) audit(AUDIT_PACKAGE_LIST_MISSING);

include('linux_unpatched.inc');

var distro_constraints_array = {
  "Debian Linux-14": {
    "package_manager": "dpkg-l",
    "constraints": [
      {
        "release": "14",
        "pkgs": [
          {"reference": "bpftool"},
          {"reference": "hyperv-daemons"},
          {"reference": "intel-sdsi"},
          {"reference": "libcpupower-dev"},
          {"reference": "libcpupower1"},
          {"reference": "linux-base-7.1.8+deb14.1-alpha-generic"},
          {"reference": "linux-base-7.1.8+deb14.1-alpha-smp"},
          {"reference": "linux-base-7.1.8+deb14.1-amd64"},
          {"reference": "linux-base-7.1.8+deb14.1-arm64"},
          {"reference": "linux-base-7.1.8+deb14.1-arm64-16k"},
          {"reference": "linux-base-7.1.8+deb14.1-armmp"},
          {"reference": "linux-base-7.1.8+deb14.1-armmp-lpae"},
          {"reference": "linux-base-7.1.8+deb14.1-cloud-amd64"},
          {"reference": "linux-base-7.1.8+deb14.1-cloud-arm64"},
          {"reference": "linux-base-7.1.8+deb14.1-loong64"},
          {"reference": "linux-base-7.1.8+deb14.1-m68k"},
          {"reference": "linux-base-7.1.8+deb14.1-parisc"},
          {"reference": "linux-base-7.1.8+deb14.1-parisc64"},
          {"reference": "linux-base-7.1.8+deb14.1-powerpc"},
          {"reference": "linux-base-7.1.8+deb14.1-powerpc-smp"},
          {"reference": "linux-base-7.1.8+deb14.1-powerpc64"},
          {"reference": "linux-base-7.1.8+deb14.1-powerpc64-64k"},
          {"reference": "linux-base-7.1.8+deb14.1-powerpc64le"},
          {"reference": "linux-base-7.1.8+deb14.1-powerpc64le-64k"},
          {"reference": "linux-base-7.1.8+deb14.1-riscv64"},
          {"reference": "linux-base-7.1.8+deb14.1-rt-amd64"},
          {"reference": "linux-base-7.1.8+deb14.1-rt-arm64"},
          {"reference": "linux-base-7.1.8+deb14.1-s390x"},
          {"reference": "linux-base-7.1.8+deb14.1-sh7751r"},
          {"reference": "linux-base-7.1.8+deb14.1-sparc64"}
        ]
      }
    ]
  }
};

var distro_constraints_values = linux_unpatched::get_distro_constraints(distro_constraints_arr:distro_constraints_array);
if (empty_or_null(distro_constraints_values)) audit(AUDIT_HOST_NOT, 'affected');

var third_party_support = get_kb_item('Host/OS/extended-third-party');
if (!empty_or_null(third_party_support)) {
    var third_party_vendors = distro_constraints_values['third_party'];
    if (!empty_or_null(third_party_vendors)) {
        var vendor;
        foreach vendor (third_party_vendors) {
            if (vendor == third_party_support) exit(0, 'A third party management patch is available for this vulnerability from ' + vendor + '.\n');
        }
    }
}

var report = linux_unpatched::check_unpatched_constraints(distro_constraints_values:distro_constraints_values);

if (!empty_or_null(report))
{
  security_report_v4(
      port       : 0,
      severity   : SECURITY_WARNING,
      extra      : report
  );
  exit(0);
}
else
{
  audit(AUDIT_HOST_NOT, 'affected');
}