Linux Distros Unpatched Vulnerability : CVE-2026-99081

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(371489);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/10/23");

  script_cve_id("CVE-2026-99081");

  script_name(english:"Linux Distros Unpatched Vulnerability : CVE-2026-99081");

  script_set_attribute(attribute:"synopsis", value:
"The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be
patched.");
  script_set_attribute(attribute:"description", value:
"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied
patch available.

  - bnxt_en: fix DMA mapping length for padded small packets Stefan Fleischmann reported Intel IOMMU DMA Read
    faults on BCM57412 NetXtreme-E NICs when transmitting packets on VLAN/macvlan interfaces: DMAR: [DMA Read
    NO_PASID] Request device [18:00.0] fault addr 0xfc499000 [fault reason 0x06] PTE Read access is not set
    bnxt_en 0000:18:00.0 eno1np0: Abandoning msg {0xb4 0x41a} len: 0 due to firmware status: 0x2000001 ...
    NETDEV WATCHDOG: eno1np0 (bnxt_en): transmit queue 0 timed out The fault address (0xfc499000) is on an
    exact 4KB page boundary, pointing to a DMA read buffer overrun. In bnxt_start_xmit(), packets smaller than
    BNXT_MIN_PKT_SIZE (52 bytes), such as 42-byte untagged ARP frames, are padded: if (length <
    BNXT_MIN_PKT_SIZE) { pad = BNXT_MIN_PKT_SIZE - length; if (skb_pad(skb, pad)) goto tx_kick_pending; length
    = BNXT_MIN_PKT_SIZE; } mapping = dma_map_single(&pdev->dev, skb->data, len, DMA_TO_DEVICE); ...
    dma_unmap_len_set(tx_buf, len, len); However, 'len' was initialized earlier to skb_headlen(skb) (e.g. 42
    bytes) and is left unadjusted after padding. Consequently, dma_map_single() and dma_unmap_len_set() map
    and track only 42 bytes. Later, the hardware TX buffer descriptor is programmed with the padded length:
    txbd->tx_bd_len_flags_type = cpu_to_le32(((len + pad) << TX_BD_LEN_SHIFT) | flags |
    TX_BD_FLAGS_PACKET_END); The NIC DMA engine is thus instructed to read 52 bytes from a region where only
    42 bytes were DMA-mapped. If skb->data ends near the boundary of a 4KB page (within 'pad' bytes of the
    next page), the hardware DMA read overruns into the unmapped adjacent page, triggering an IOMMU fault.
    This issue was exposed after commit 447cbe95ebb9 (vlan: fix skb_under_panic and races when toggling HW
    VLAN offload) because reserving extra VLAN headroom rounded LL_RESERVED_SPACE from 48 up to 64 bytes,
    shifting skb->data offsets and potentially causing small frames to land right against page boundaries. Fix
    this by using skb_put_padto(skb, BNXT_MIN_PKT_SIZE) in bnxt_start_xmit(), before skb_shinfo(skb)->nr_frags
    is sampled, because padding might linearize the skb. This ensures skb->len and skb_headlen(skb) reflect
    the padded size so that dma_map_single() maps the full buffer and the descriptor length is consistent.
    This also removes the temporary 'pad' variable and masking logic. The padding is done after the SW USO
    branch, otherwise bnxt_sw_udp_gso_xmit() would account the padding as UDP payload and send it in extra
    segments. Note that SW USO segments are still not padded: with IPv4, a segment carrying less than 10 bytes
    of UDP payload (small gso_size, or a short last segment) is sent as a frame shorter than
    BNXT_MIN_PKT_SIZE. This is a separate issue, left for a followup patch. (CVE-2026-99081)

Note that Nessus relies on the presence of the package as reported by the vendor.");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2026-99081");
  script_set_attribute(attribute:"solution", value:
"There is no known solution at this time.");
  script_set_attribute(attribute:"agent", value:"unix");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:U/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:U/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-99081");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");
  script_set_attribute(attribute:"vendor_unpatched", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/10/23");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/10/23");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:debian:debian_linux:12.0");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:linux");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Misc.");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info2.nasl", "set_linux_os_id.nasl");
  script_require_keys("Host/cpu", "Host/local_checks_enabled", "global_settings/vendor_unpatched", "Host/OS/identifier");
  script_require_ports("Host/OS/Debian Linux-12");

  exit(0);
}

if (!get_kb_item("global_settings/vendor_unpatched")) exit(0, "Unpatched Vulnerabilities Detection not active.");
if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
if (empty_or_null(get_one_kb_item("Host/Debian/dpkg-l"))) audit(AUDIT_PACKAGE_LIST_MISSING);

include('linux_unpatched.inc');

var distro_constraints_array = {
  "Debian Linux-12": {
    "package_manager": "dpkg-l",
    "constraints": [
      {
        "release": "12",
        "pkgs": [
          {"reference": "btrfs-modules-6.1.0-50-alpha-generic-di"},
          {"reference": "cdrom-core-modules-6.1.0-50-alpha-generic-di"},
          {"reference": "ext4-modules-6.1.0-50-alpha-generic-di"},
          {"reference": "fat-modules-6.1.0-50-alpha-generic-di"},
          {"reference": "isofs-modules-6.1.0-50-alpha-generic-di"},
          {"reference": "jfs-modules-6.1.0-50-alpha-generic-di"},
          {"reference": "kernel-image-6.1.0-50-alpha-generic-di"},
          {"reference": "linux-doc"},
          {"reference": "linux-doc-6.1"},
          {"reference": "linux-headers-6.1.0"},
          {"reference": "linux-source"},
          {"reference": "linux-source-6.1"},
          {"reference": "linux-support-6.1.0"},
          {"reference": "loop-modules-6.1.0-50-alpha-generic-di"},
          {"reference": "nic-modules-6.1.0-50-alpha-generic-di"},
          {"reference": "nic-shared-modules-6.1.0-50-alpha-generic-di"},
          {"reference": "nic-wireless-modules-6.1.0-50-alpha-generic-di"},
          {"reference": "pata-modules-6.1.0-50-alpha-generic-di"},
          {"reference": "ppp-modules-6.1.0-50-alpha-generic-di"},
          {"reference": "scsi-core-modules-6.1.0-50-alpha-generic-di"},
          {"reference": "scsi-modules-6.1.0-50-alpha-generic-di"},
          {"reference": "scsi-nic-modules-6.1.0-50-alpha-generic-di"},
          {"reference": "serial-modules-6.1.0-50-alpha-generic-di"},
          {"reference": "usb-serial-modules-6.1.0-50-alpha-generic-di"},
          {"reference": "xfs-modules-6.1.0-50-alpha-generic-di"}
        ]
      }
    ]
  }
};

var distro_constraints_values = linux_unpatched::get_distro_constraints(distro_constraints_arr:distro_constraints_array);
if (empty_or_null(distro_constraints_values)) audit(AUDIT_HOST_NOT, 'affected');

var third_party_support = get_kb_item('Host/OS/extended-third-party');
if (!empty_or_null(third_party_support)) {
    var third_party_vendors = distro_constraints_values['third_party'];
    if (!empty_or_null(third_party_vendors)) {
        var vendor;
        foreach vendor (third_party_vendors) {
            if (vendor == third_party_support) exit(0, 'A third party management patch is available for this vulnerability from ' + vendor + '.\n');
        }
    }
}

var report = linux_unpatched::check_unpatched_constraints(distro_constraints_values:distro_constraints_values);

if (!empty_or_null(report))
{
  security_report_v4(
      port       : 0,
      severity   : SECURITY_WARNING,
      extra      : report
  );
  exit(0);
}
else
{
  audit(AUDIT_HOST_NOT, 'affected');
}