Linux Distros Unpatched Vulnerability : CVE-2026-98878

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(371524);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/10/23");

  script_cve_id("CVE-2026-98878");

  script_name(english:"Linux Distros Unpatched Vulnerability : CVE-2026-98878");

  script_set_attribute(attribute:"synopsis", value:
"The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be
patched.");
  script_set_attribute(attribute:"description", value:
"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied
patch available.

  - irqchip/gic-v5: Immediately exec priority drop following activate With GICv5 an interrupt of equal or
    lower priority cannot be signalled until there has been a priority drop. This is done via the GIC CDEOI
    system instruction. Once this has been executed, the hardware is able to signal the next interrupt if
    there is one. As all interrupts are programmed to have the same priority, no new interrupts can be
    signalled until the priority drop has happened. This can cause issues when, for example, an interrupt
    remains active while a long running process takes place, such as when injecting a physical interrupt into
    a guest VM in software. The GICv5 driver has so far done the priority drop as part of irq_eoi(), i.e., at
    the same time as deactivating the interrupt. This means that any long running process (or VM) could block
    incoming interrupts, effectively causing a denial of service for all other interrupts. Rather than doing
    the EOI as part of irq_eoi() (which the name would suggest would be a good place for it), move it to
    happen immediately after acknowledging an interrupt in the main GICv5 interrupt handler. The deactivation
    of interrupts (GIC CDDI) remains implemented as part of irq_eoi(), which means that the same interrupt
    cannot be signalled a second time until deactivated by software. (CVE-2026-98878)

Note that Nessus relies on the presence of the package as reported by the vendor.");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2026-98878");
  script_set_attribute(attribute:"solution", value:
"There is no known solution at this time.");
  script_set_attribute(attribute:"agent", value:"unix");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:U/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:U/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-98878");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");
  script_set_attribute(attribute:"vendor_unpatched", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/10/23");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/10/23");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:debian:debian_linux:12.0");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:debian:debian_linux:13.0");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:linux");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Misc.");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info2.nasl", "set_linux_os_id.nasl");
  script_require_keys("Host/cpu", "Host/local_checks_enabled", "global_settings/vendor_unpatched", "Host/OS/identifier");
  script_require_ports("Host/OS/Debian Linux-12", "Host/OS/Debian Linux-13");

  exit(0);
}

if (!get_kb_item("global_settings/vendor_unpatched")) exit(0, "Unpatched Vulnerabilities Detection not active.");
if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
if (empty_or_null(get_one_kb_item("Host/Debian/dpkg-l"))) audit(AUDIT_PACKAGE_LIST_MISSING);

include('linux_unpatched.inc');

var distro_constraints_array = {
  "Debian Linux-12": {
    "package_manager": "dpkg-l",
    "constraints": [
      {
        "release": "12",
        "pkgs": [
          {"reference": "btrfs-modules-6.1.0-50-alpha-generic-di"},
          {"reference": "cdrom-core-modules-6.1.0-50-alpha-generic-di"},
          {"reference": "ext4-modules-6.1.0-50-alpha-generic-di"},
          {"reference": "fat-modules-6.1.0-50-alpha-generic-di"},
          {"reference": "isofs-modules-6.1.0-50-alpha-generic-di"},
          {"reference": "jfs-modules-6.1.0-50-alpha-generic-di"},
          {"reference": "kernel-image-6.1.0-50-alpha-generic-di"},
          {"reference": "linux-doc"},
          {"reference": "linux-doc-6.1"},
          {"reference": "linux-headers-6.1.0"},
          {"reference": "linux-source"},
          {"reference": "linux-source-6.1"},
          {"reference": "linux-support-6.1.0"},
          {"reference": "loop-modules-6.1.0-50-alpha-generic-di"},
          {"reference": "nic-modules-6.1.0-50-alpha-generic-di"},
          {"reference": "nic-shared-modules-6.1.0-50-alpha-generic-di"},
          {"reference": "nic-wireless-modules-6.1.0-50-alpha-generic-di"},
          {"reference": "pata-modules-6.1.0-50-alpha-generic-di"},
          {"reference": "ppp-modules-6.1.0-50-alpha-generic-di"},
          {"reference": "scsi-core-modules-6.1.0-50-alpha-generic-di"},
          {"reference": "scsi-modules-6.1.0-50-alpha-generic-di"},
          {"reference": "scsi-nic-modules-6.1.0-50-alpha-generic-di"},
          {"reference": "serial-modules-6.1.0-50-alpha-generic-di"},
          {"reference": "usb-serial-modules-6.1.0-50-alpha-generic-di"},
          {"reference": "xfs-modules-6.1.0-50-alpha-generic-di"}
        ]
      }
    ]
  },
  "Debian Linux-13": {
    "package_manager": "dpkg-l",
    "constraints": [
      {
        "release": "13",
        "pkgs": [
          {"reference": "bpftool"},
          {"reference": "hyperv-daemons"},
          {"reference": "intel-sdsi"},
          {"reference": "libcpupower-dev"},
          {"reference": "libcpupower1"},
          {"reference": "linux-bpf-dev"},
          {"reference": "linux-config-6.12"},
          {"reference": "linux-cpupower"},
          {"reference": "linux-doc"},
          {"reference": "linux-doc-6.12"},
          {"reference": "linux-headers-4kc-malta"},
          {"reference": "linux-headers-5kc-malta"},
          {"reference": "linux-headers-6.12.107+deb13-4kc-malta"},
          {"reference": "linux-headers-6.12.107+deb13-5kc-malta"},
          {"reference": "linux-headers-6.12.107+deb13-alpha-generic"},
          {"reference": "linux-headers-6.12.107+deb13-alpha-smp"},
          {"reference": "linux-headers-6.12.107+deb13-amd64"},
          {"reference": "linux-headers-6.12.107+deb13-arm64"},
          {"reference": "linux-headers-6.12.107+deb13-arm64-16k"},
          {"reference": "linux-headers-6.12.107+deb13-armmp"},
          {"reference": "linux-headers-6.12.107+deb13-armmp-lpae"},
          {"reference": "linux-headers-6.12.107+deb13-cloud-amd64"},
          {"reference": "linux-headers-6.12.107+deb13-cloud-arm64"},
          {"reference": "linux-headers-6.12.107+deb13-common"},
          {"reference": "linux-headers-6.12.107+deb13-common-rt"},
          {"reference": "linux-headers-6.12.107+deb13-loong64"},
          {"reference": "linux-headers-6.12.107+deb13-loongson-3"},
          {"reference": "linux-headers-6.12.107+deb13-m68k"},
          {"reference": "linux-headers-6.12.107+deb13-mips32r2eb"},
          {"reference": "linux-headers-6.12.107+deb13-mips32r2el"},
          {"reference": "linux-headers-6.12.107+deb13-mips64r2eb"}
        ]
      }
    ]
  }
};

var distro_constraints_values = linux_unpatched::get_distro_constraints(distro_constraints_arr:distro_constraints_array);
if (empty_or_null(distro_constraints_values)) audit(AUDIT_HOST_NOT, 'affected');

var third_party_support = get_kb_item('Host/OS/extended-third-party');
if (!empty_or_null(third_party_support)) {
    var third_party_vendors = distro_constraints_values['third_party'];
    if (!empty_or_null(third_party_vendors)) {
        var vendor;
        foreach vendor (third_party_vendors) {
            if (vendor == third_party_support) exit(0, 'A third party management patch is available for this vulnerability from ' + vendor + '.\n');
        }
    }
}

var report = linux_unpatched::check_unpatched_constraints(distro_constraints_values:distro_constraints_values);

if (!empty_or_null(report))
{
  security_report_v4(
      port       : 0,
      severity   : SECURITY_WARNING,
      extra      : report
  );
  exit(0);
}
else
{
  audit(AUDIT_HOST_NOT, 'affected');
}