Linux Distros Unpatched Vulnerability : CVE-2026-99084

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(371578);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/10/23");

  script_cve_id("CVE-2026-99084");

  script_name(english:"Linux Distros Unpatched Vulnerability : CVE-2026-99084");

  script_set_attribute(attribute:"synopsis", value:
"The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be
patched.");
  script_set_attribute(attribute:"description", value:
"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied
patch available.

  - readdir: take no inode lock on an immutable directory iterate_dir() takes the directory's i_rwsem shared
    and holds it across ->iterate_shared(). For a directory that never has an entry and is never removed the
    lock keeps nothing still, it only orders every reader and every writer of that inode behind each other.
    For the directory of a nullfs instance that matters. The instance of the initial mount namespace is the
    root of every empty mount namespace and the private instance is the root of every kernel thread, so one
    inode is shared across users who have nothing else in common. And a reader can hold the lock for as long
    as it likes: back the getdents() buffer with a mapping of a file on a FUSE mount of your own, let the copy
    of . and .. fault and let the server wait. Queue an exclusive taker behind it, a mkdir() in that
    directory goes through start_dirop() before the read-only mount is reported, and from then on every lookup
    that misses the dcache in that directory, every create and every mount on it waits until the server
    answers. One user of an empty mount namespace stalls all the others. Add FOP_IMMUTABLE for the file
    operations of a directory that never changes and is never removed and let iterate_dir() skip the lock for
    it. The flag never changes for a file, ->f_pos is protected by f_pos_lock since directories are
    FMODE_ATOMIC_POS, IS_DEADDIR can't be set on such a directory and neither touch_atime() nor fsnotify take
    i_rwsem. Set it on the nullfs directory. The placeholder directories of libfs never have an entry either
    but their owners remove them, so they keep the lock. (CVE-2026-99084)

Note that Nessus relies on the presence of the package as reported by the vendor.");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2026-99084");
  script_set_attribute(attribute:"solution", value:
"There is no known solution at this time.");
  script_set_attribute(attribute:"agent", value:"unix");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:U/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:U/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-99084");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");
  script_set_attribute(attribute:"vendor_unpatched", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/10/23");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/10/23");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:debian:debian_linux:14.0");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:linux");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Misc.");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info2.nasl", "set_linux_os_id.nasl");
  script_require_keys("Host/cpu", "Host/local_checks_enabled", "global_settings/vendor_unpatched", "Host/OS/identifier");
  script_require_ports("Host/OS/Debian Linux-14");

  exit(0);
}

if (!get_kb_item("global_settings/vendor_unpatched")) exit(0, "Unpatched Vulnerabilities Detection not active.");
if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
if (empty_or_null(get_one_kb_item("Host/Debian/dpkg-l"))) audit(AUDIT_PACKAGE_LIST_MISSING);

include('linux_unpatched.inc');

var distro_constraints_array = {
  "Debian Linux-14": {
    "package_manager": "dpkg-l",
    "constraints": [
      {
        "release": "14",
        "pkgs": [
          {"reference": "bpftool"},
          {"reference": "hyperv-daemons"},
          {"reference": "intel-sdsi"},
          {"reference": "libcpupower-dev"},
          {"reference": "libcpupower1"},
          {"reference": "linux-base-7.2.11+deb14-alpha-generic"},
          {"reference": "linux-base-7.2.11+deb14-amd64"},
          {"reference": "linux-base-7.2.11+deb14-arm64"},
          {"reference": "linux-base-7.2.11+deb14-arm64-16k"},
          {"reference": "linux-base-7.2.11+deb14-armmp"},
          {"reference": "linux-base-7.2.11+deb14-armmp-lpae"},
          {"reference": "linux-base-7.2.11+deb14-cloud-amd64"},
          {"reference": "linux-base-7.2.11+deb14-cloud-arm64"},
          {"reference": "linux-base-7.2.11+deb14-loong64"},
          {"reference": "linux-base-7.2.11+deb14-m68k"},
          {"reference": "linux-base-7.2.11+deb14-parisc"},
          {"reference": "linux-base-7.2.11+deb14-parisc64"},
          {"reference": "linux-base-7.2.11+deb14-powerpc"},
          {"reference": "linux-base-7.2.11+deb14-powerpc64"},
          {"reference": "linux-base-7.2.11+deb14-powerpc64-64k"},
          {"reference": "linux-base-7.2.11+deb14-powerpc64le"},
          {"reference": "linux-base-7.2.11+deb14-powerpc64le-64k"},
          {"reference": "linux-base-7.2.11+deb14-riscv64"},
          {"reference": "linux-base-7.2.11+deb14-rt-amd64"},
          {"reference": "linux-base-7.2.11+deb14-rt-arm64"},
          {"reference": "linux-base-7.2.11+deb14-s390x"},
          {"reference": "linux-base-7.2.11+deb14-sh7751r"},
          {"reference": "linux-base-7.2.11+deb14-sparc64"},
          {"reference": "linux-base-7.2.11+deb14-test"},
          {"reference": "linux-base-alpha-generic"},
          {"reference": "linux-base-armmp"},
          {"reference": "linux-base-armmp-lpae"},
          {"reference": "linux-base-loong64"}
        ]
      }
    ]
  }
};

var distro_constraints_values = linux_unpatched::get_distro_constraints(distro_constraints_arr:distro_constraints_array);
if (empty_or_null(distro_constraints_values)) audit(AUDIT_HOST_NOT, 'affected');

var third_party_support = get_kb_item('Host/OS/extended-third-party');
if (!empty_or_null(third_party_support)) {
    var third_party_vendors = distro_constraints_values['third_party'];
    if (!empty_or_null(third_party_vendors)) {
        var vendor;
        foreach vendor (third_party_vendors) {
            if (vendor == third_party_support) exit(0, 'A third party management patch is available for this vulnerability from ' + vendor + '.\n');
        }
    }
}

var report = linux_unpatched::check_unpatched_constraints(distro_constraints_values:distro_constraints_values);

if (!empty_or_null(report))
{
  security_report_v4(
      port       : 0,
      severity   : SECURITY_WARNING,
      extra      : report
  );
  exit(0);
}
else
{
  audit(AUDIT_HOST_NOT, 'affected');
}