Linux Distros Unpatched Vulnerability : CVE-2026-99005

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(371487);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/10/23");

  script_cve_id("CVE-2026-99005");

  script_name(english:"Linux Distros Unpatched Vulnerability : CVE-2026-99005");

  script_set_attribute(attribute:"synopsis", value:
"The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be
patched.");
  script_set_attribute(attribute:"description", value:
"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied
patch available.

  - drm/i915/gt: Unmask interrupts only when ACTIVE is true There is a small race window between
    intel_rps_boost() reading a stale ACTIVE state and queuing rps->work, where ACTIVE may be changed via
    asynchronous calls triggered by wakeref drop. This means that rps_work() could be triggered after the GT
    has been parked, so unmasking RPS PM interrupts would happen without holding PM wakelock. This sequence of
    events may be observed during live_rc6_ctx_wa() selftest: 1) live_rc6_ctx_wa() -> intel_engine_pm_put() ->
    wakeref_put() ASYNC1) wakeref_put() callback -> __engine_park() -> intel_gt_pm_put_async() ->
    intel_gt_pm_put_async_untracked() -> intel_wakeref_put_async() ASYNC2) wakeref_put_async() callback ->
    __gt_park() -> intel_rps_park() -> intel_rps_clear_active() [clear ACTIVE] WITH INTERRUPTS: ->
    rps_disable_interrupts() -> cancel_work_sync(rps->work) -> rps_reset_interrupts() [rps->pm_iir = 0]
    WITHOUT INTERRUPTS (TIMER mode): -> rps_stop_timer() -> cancel_work_sync(rps->work) 2) live_rc6_ctx_wa()
    -> intel_gt_wait_for_idle() -> intel_gt_retire_requests_timeout() -> dma_fence_wait_timeout() ->
    ops->wait() [i915_fence_wait()] -> i915_request_wait_timeout() -> intel_rps_boost() ->
    intel_rps_is_active() [check ACTIVE] [OPEN RACE WINDOW] -> queue_work(rps->work) -> retire_requests() ->
    i915_request_retire() -> intel_rps_dec_waiters() [from 1 to 0] If ASYNC1 and ASYNC2 would execute during
    [OPEN RACE WINDOW], then: 3) rps_work() executes from the workqueue and may satisfy (!pm_iir &&
    !client_boost) test (in TIMER mode rps->pm_iir is zeroed by an earlier rps_work() call or never gets a
    new value after previous intel_rps_unpark() event), so it jumps to out label, bypassing
    intel_rps_is_active() guard and executes gen6_gt_pm_unmask_irq(); 4) GT is parked and runtime PM wakelock
    is dropped, so only a raw reference in __gt_park() -> intel_display_power_put_async() remains for 100ms,
    then the MMIO write in gen6_gt_pm_unmask_irq() detects missing wakelock via assert_rpm_wakelock_held() and
    emits RPM wakelock ref not held during HW access tainting kernel. Commit 3e7abf814193 (drm/i915:
    Extract GT render power state management) dropped the if (rps->interrupts_enabled) guard that
    gen6_pm_rps_work() had around this unmask in i915_irq.c. INTEL_RPS_ACTIVE brackets the same window, since
    it is set in intel_rps_unpark() before rps_enable_interrupts() and rps_start_timer() and cleared in
    intel_rps_park() before rps_stop_timer() and rps_disable_interrupts(). Skip unmasking when RPS is no
    longer active (reaching unmask operation is independent of INTERRUPT mode). This does not prevent RPS
    operation from resuming on the next unpark. In interrupt mode, intel_rps_unpark() calls
    rps_enable_interrupts(), which enables and unmasks the PM interrupts. In timer mode, it calls
    rps_start_timer(), restarting periodic engine-busyness evaluation. The timer generates software RPS events
    and queues rps_work() directly, independently of PM interrupt delivery. Neither mode requires the late
    worker to unmask interrupts while the GT is parked (cherry picked from commit
    ca4a6deadad15b91ee083afe445fa6bdbfb68206) (CVE-2026-99005)

Note that Nessus relies on the presence of the package as reported by the vendor.");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2026-99005");
  script_set_attribute(attribute:"solution", value:
"There is no known solution at this time.");
  script_set_attribute(attribute:"agent", value:"unix");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:U/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:U/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-99005");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");
  script_set_attribute(attribute:"vendor_unpatched", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/10/23");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/10/23");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:debian:debian_linux:12.0");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:linux");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Misc.");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info2.nasl", "set_linux_os_id.nasl");
  script_require_keys("Host/cpu", "Host/local_checks_enabled", "global_settings/vendor_unpatched", "Host/OS/identifier");
  script_require_ports("Host/OS/Debian Linux-12");

  exit(0);
}

if (!get_kb_item("global_settings/vendor_unpatched")) exit(0, "Unpatched Vulnerabilities Detection not active.");
if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
if (empty_or_null(get_one_kb_item("Host/Debian/dpkg-l"))) audit(AUDIT_PACKAGE_LIST_MISSING);

include('linux_unpatched.inc');

var distro_constraints_array = {
  "Debian Linux-12": {
    "package_manager": "dpkg-l",
    "constraints": [
      {
        "release": "12",
        "pkgs": [
          {"reference": "btrfs-modules-6.1.0-50-alpha-generic-di"},
          {"reference": "cdrom-core-modules-6.1.0-50-alpha-generic-di"},
          {"reference": "ext4-modules-6.1.0-50-alpha-generic-di"},
          {"reference": "fat-modules-6.1.0-50-alpha-generic-di"},
          {"reference": "isofs-modules-6.1.0-50-alpha-generic-di"},
          {"reference": "jfs-modules-6.1.0-50-alpha-generic-di"},
          {"reference": "kernel-image-6.1.0-50-alpha-generic-di"},
          {"reference": "linux-doc"},
          {"reference": "linux-doc-6.1"},
          {"reference": "linux-headers-6.1.0"},
          {"reference": "linux-source"},
          {"reference": "linux-source-6.1"},
          {"reference": "linux-support-6.1.0"},
          {"reference": "loop-modules-6.1.0-50-alpha-generic-di"},
          {"reference": "nic-modules-6.1.0-50-alpha-generic-di"},
          {"reference": "nic-shared-modules-6.1.0-50-alpha-generic-di"},
          {"reference": "nic-wireless-modules-6.1.0-50-alpha-generic-di"},
          {"reference": "pata-modules-6.1.0-50-alpha-generic-di"},
          {"reference": "ppp-modules-6.1.0-50-alpha-generic-di"},
          {"reference": "scsi-core-modules-6.1.0-50-alpha-generic-di"},
          {"reference": "scsi-modules-6.1.0-50-alpha-generic-di"},
          {"reference": "scsi-nic-modules-6.1.0-50-alpha-generic-di"},
          {"reference": "serial-modules-6.1.0-50-alpha-generic-di"},
          {"reference": "usb-serial-modules-6.1.0-50-alpha-generic-di"},
          {"reference": "xfs-modules-6.1.0-50-alpha-generic-di"}
        ]
      }
    ]
  }
};

var distro_constraints_values = linux_unpatched::get_distro_constraints(distro_constraints_arr:distro_constraints_array);
if (empty_or_null(distro_constraints_values)) audit(AUDIT_HOST_NOT, 'affected');

var third_party_support = get_kb_item('Host/OS/extended-third-party');
if (!empty_or_null(third_party_support)) {
    var third_party_vendors = distro_constraints_values['third_party'];
    if (!empty_or_null(third_party_vendors)) {
        var vendor;
        foreach vendor (third_party_vendors) {
            if (vendor == third_party_support) exit(0, 'A third party management patch is available for this vulnerability from ' + vendor + '.\n');
        }
    }
}

var report = linux_unpatched::check_unpatched_constraints(distro_constraints_values:distro_constraints_values);

if (!empty_or_null(report))
{
  security_report_v4(
      port       : 0,
      severity   : SECURITY_WARNING,
      extra      : report
  );
  exit(0);
}
else
{
  audit(AUDIT_HOST_NOT, 'affected');
}