Linux Distros Unpatched Vulnerability : CVE-2026-99231

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(375354);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/11/05");

  script_cve_id("CVE-2026-99231");

  script_name(english:"Linux Distros Unpatched Vulnerability : CVE-2026-99231");

  script_set_attribute(attribute:"synopsis", value:
"The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be
patched.");
  script_set_attribute(attribute:"description", value:
"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied
patch available.

  - io_uring/waitid: own the request before clearing ->head io_waitid_remove_wq() only takes the wait queue
    lock if ->head is set. io_waitid_wait() clears ->head first thing, before it tries to become the owner of
    the request by bumping ->refs. If somebody else owns the request at that point, nothing keeps it from
    completing the request while the wake up handler is still going to touch it: CPU0 (io_waitid_wait) CPU1
    (io_waitid, holds a ref) list_del_init(&wait->entry) smp_store_release(&iw->head, NULL) __do_wait() finds
    another child io_waitid_remove_wq() // ->head == NULL, no locking io_waitid_finish(), IOU_COMPLETE //
    request freed and reused atomic_fetch_inc(&iw->refs) The same goes for __io_waitid_cancel() if it claims
    the request in that window. ->refs is part of the per opcode data of the request, so this increments
    whatever the next user of the request keeps there. If that happens to be zero, the handler concludes that
    it owns the request, and queues io_waitid_cb() for it. With the window held open by a delay, and the
    request reused for a receive that is waiting for data: BUG: KASAN: slab-use-after-free in
    __wake_up_common+0x1ca/0x1f0 __wake_up_sync_key+0x36/0x50 sock_def_readable+0xf1/0x420
    unix_stream_sendmsg+0x60b/0x1110 Allocated by task 87: io_arm_apoll+0x1ed/0x940 Freed by task 87:
    __io_submit_flush_completions+0x118d/0x1a10 tctx_task_work_run+0x327/0x950 Only clear ->head once the
    handler owns the request. If it doesn't, the owner finds ->head set and has to wait for the lock, which is
    held by the caller of the handler. Deleting the already deleted entry again is harmless. (CVE-2026-99231)

Note that Nessus relies on the presence of the package as reported by the vendor.");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2026-99231");
  script_set_attribute(attribute:"solution", value:
"There is no known solution at this time.");
  script_set_attribute(attribute:"agent", value:"unix");
  script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:S/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:U/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:U/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-99231");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");
  script_set_attribute(attribute:"vendor_unpatched", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/11/02");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/11/02");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:debian:debian_linux:14.0");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:linux");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Misc.");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info2.nasl", "set_linux_os_id.nasl");
  script_require_keys("Host/cpu", "Host/local_checks_enabled", "global_settings/vendor_unpatched", "Host/OS/identifier");
  script_require_ports("Host/OS/Debian Linux-14");

  exit(0);
}

if (!get_kb_item("global_settings/vendor_unpatched")) exit(0, "Unpatched Vulnerabilities Detection not active.");
if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
if (empty_or_null(get_one_kb_item("Host/Debian/dpkg-l"))) audit(AUDIT_PACKAGE_LIST_MISSING);

include('linux_unpatched.inc');

var distro_constraints_array = {
  "Debian Linux-14": {
    "package_manager": "dpkg-l",
    "constraints": [
      {
        "release": "14",
        "pkgs": [
          {"reference": "bpftool"},
          {"reference": "hyperv-daemons"},
          {"reference": "intel-sdsi"},
          {"reference": "libcpupower-dev"},
          {"reference": "libcpupower1"},
          {"reference": "linux-base-7.2.12+deb14-alpha-generic"},
          {"reference": "linux-base-7.2.12+deb14-amd64"},
          {"reference": "linux-base-7.2.12+deb14-arm64"},
          {"reference": "linux-base-7.2.12+deb14-arm64-16k"},
          {"reference": "linux-base-7.2.12+deb14-armmp"},
          {"reference": "linux-base-7.2.12+deb14-armmp-lpae"},
          {"reference": "linux-base-7.2.12+deb14-cloud-amd64"},
          {"reference": "linux-base-7.2.12+deb14-cloud-arm64"},
          {"reference": "linux-base-7.2.12+deb14-loong64"},
          {"reference": "linux-base-7.2.12+deb14-m68k"},
          {"reference": "linux-base-7.2.12+deb14-parisc"},
          {"reference": "linux-base-7.2.12+deb14-parisc64"},
          {"reference": "linux-base-7.2.12+deb14-powerpc"},
          {"reference": "linux-base-7.2.12+deb14-powerpc64"},
          {"reference": "linux-base-7.2.12+deb14-powerpc64-64k"},
          {"reference": "linux-base-7.2.12+deb14-powerpc64le"},
          {"reference": "linux-base-7.2.12+deb14-powerpc64le-64k"},
          {"reference": "linux-base-7.2.12+deb14-riscv64"},
          {"reference": "linux-base-7.2.12+deb14-rt-amd64"},
          {"reference": "linux-base-7.2.12+deb14-rt-arm64"},
          {"reference": "linux-base-7.2.12+deb14-s390x"},
          {"reference": "linux-base-7.2.12+deb14-sh7751r"},
          {"reference": "linux-base-7.2.12+deb14-sparc64"},
          {"reference": "linux-base-7.2.12+deb14-test"},
          {"reference": "linux-base-alpha-generic"},
          {"reference": "linux-base-armmp"},
          {"reference": "linux-base-armmp-lpae"},
          {"reference": "linux-base-loong64"}
        ]
      }
    ]
  }
};

var distro_constraints_values = linux_unpatched::get_distro_constraints(distro_constraints_arr:distro_constraints_array);
if (empty_or_null(distro_constraints_values)) audit(AUDIT_HOST_NOT, 'affected');

var third_party_support = get_kb_item('Host/OS/extended-third-party');
if (!empty_or_null(third_party_support)) {
    var third_party_vendors = distro_constraints_values['third_party'];
    if (!empty_or_null(third_party_vendors)) {
        var vendor;
        foreach vendor (third_party_vendors) {
            if (vendor == third_party_support) exit(0, 'A third party management patch is available for this vulnerability from ' + vendor + '.\n');
        }
    }
}

var report = linux_unpatched::check_unpatched_constraints(distro_constraints_values:distro_constraints_values);

if (!empty_or_null(report))
{
  security_report_v4(
      port       : 0,
      severity   : SECURITY_WARNING,
      extra      : report
  );
  exit(0);
}
else
{
  audit(AUDIT_HOST_NOT, 'affected');
}