An issue was discovered in fs/io_uring.c in the Linux kernel before 5.6. It unsafely handles the root directory during path lookups, and thus a process inside a mount namespace can escape to unintended filesystem locations, aka CID-ff002b30181d.

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-001402 advisory.

    An issue was discovered in fs/io_uring.c in the Linux kernel before 5.6. It unsafely handles the root     directory during path lookups, and thus a process inside a mount namespace can escape to unintended     filesystem locations, aka CID-ff002b30181d.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-004447 advisory.

    An issue was discovered in fs/io_uring.c in the Linux kernel before 5.6. It unsafely handles the root     directory during path lookups, and thus a process inside a mount namespace can escape to unintended     filesystem locations, aka CID-ff002b30181d.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-003827 advisory.

    An issue was discovered in fs/io_uring.c in the Linux kernel before 5.6. It unsafely handles the root     directory during path lookups, and thus a process inside a mount namespace can escape to unintended     filesystem locations, aka CID-ff002b30181d.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - An issue was discovered in fs/io_uring.c in the Linux kernel before 5.6. It unsafely handles the root     directory during path lookups, and thus a process inside a mount namespace can escape to unintended     filesystem locations, aka CID-ff002b30181d. (CVE-2020-29373)

Note that Nessus relies on the presence of the package as reported by the vendor.

This update syncs the RT kernel from the SUSE Linux Enterprise 15-SP2 codestream. This update was imported from the SUSE:SLE-15-SP2:Update update project.

The SUSE Linux Enterprise 15 SP2 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed :

CVE-2020-28374: Fixed a Linux SCSI target issue (bsc#1178372).

CVE-2020-36158: Fixed a potential remote code execution in the Marvell mwifiex driver (bsc#1180559).

CVE-2020-27825: Fixed a race in the trace_open and buffer resize calls (bsc#1179960).

CVE-2020-0466: Fixed a use-after-free due to a logic error in do_epoll_ctl and ep_loop_check_proc of eventpoll.c (bnc#1180031).

CVE-2020-27068: Fixed an out-of-bounds read due to a missing bounds check in the nl80211_policy policy of nl80211.c (bnc#1180086).

CVE-2020-0444: Fixed a bad kfree due to a logic error in audit_data_to_entry (bnc#1180027).

CVE-2020-0465: Fixed multiple missing bounds checks in hid-multitouch.c that could have led to local privilege escalation (bnc#1180029).

CVE-2020-29661: Fixed a locking issue in the tty subsystem that allowed a use-after-free attack against TIOCSPGRP (bsc#1179745).

CVE-2020-29660: Fixed a locking inconsistency in the tty subsystem that may have allowed a read-after-free attack against TIOCGSID (bnc#1179745).

CVE-2020-27777: Fixed a privilege escalation in the Run-Time Abstraction Services (RTAS) interface, affecting guests running on top of PowerVM or KVM hypervisors (bnc#1179107).

CVE-2020-29373: Fixed an unsafe handling of the root directory during path lookups in fs/io_uring.c (bnc#1179434).

CVE-2020-11668: Fixed the mishandling of invalid descriptors in the Xirlink camera USB driver (bnc#1168952).

CVE-2020-27830: Fixed a NULL pointer dereference in speakup (bsc#1179656).

CVE-2020-29370: Fixed a race condition in kmem_cache_alloc_bulk (bnc#1179435).

CVE-2020-27786: Fixed a use after free in kernel midi subsystem snd_rawmidi_kernel_read1() (bsc#1179601).

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The SUSE Linux Enterprise 15 SP2 RT kernel was updated to receive various security and bugfixes.

The following security bugs were fixed :

CVE-2020-36158: Fixed a potential remote code execution in the Marvell mwifiex driver (bsc#1180559).

CVE-2020-27825: Fixed a race in the trace_open and buffer resize calls (bsc#1179960).

CVE-2020-0466: Fixed a use-after-free due to a logic error in do_epoll_ctl and ep_loop_check_proc of eventpoll.c (bnc#1180031).

CVE-2020-27068: Fixed an out-of-bounds read due to a missing bounds check in the nl80211_policy policy of nl80211.c (bnc#1180086).

CVE-2020-0444: Fixed a bad kfree due to a logic error in audit_data_to_entry (bnc#1180027).

CVE-2020-0465: Fixed multiple missing bounds checks in hid-multitouch.c that could have led to local privilege escalation (bnc#1180029).

CVE-2020-29661: Fixed a locking issue in the tty subsystem that allowed a use-after-free attack against TIOCSPGRP (bsc#1179745).

CVE-2020-29660: Fixed a locking inconsistency in the tty subsystem that may have allowed a read-after-free attack against TIOCGSID (bnc#1179745).

CVE-2020-27777: Fixed a privilege escalation in the Run-Time Abstraction Services (RTAS) interface, affecting guests running on top of PowerVM or KVM hypervisors (bnc#1179107).

CVE-2020-29373: Fixed an unsafe handling of the root directory during path lookups in fs/io_uring.c (bnc#1179434).

CVE-2020-11668: Fixed the mishandling of invalid descriptors in the Xirlink camera USB driver (bnc#1168952).

CVE-2020-27830: Fixed a NULL pointer dereference in speakup (bsc#1179656).

CVE-2020-29370: Fixed a race condition in kmem_cache_alloc_bulk (bnc#1179435).

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
290641	Unity Linux 20.1070e Security Update: kernel (UTSA-2026-001402)	Nessus	Unity Linux Local Security Checks	medium
290147	Unity Linux 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-004447)	Nessus	Unity Linux Local Security Checks	medium
288275	Unity Linux 20.1060a / 20.1070a Security Update: kernel (UTSA-2026-003827)	Nessus	Unity Linux Local Security Checks	medium
245148	Linux Distros Unpatched Vulnerability : CVE-2020-29373	Nessus	Misc.	medium
146282	openSUSE Security Update : RT kernel (openSUSE-2021-242)	Nessus	SuSE Local Security Checks	critical
145320	openSUSE Security Update : the Linux Kernel (openSUSE-2021-60)	Nessus	SuSE Local Security Checks	critical
145025	SUSE SLED15 / SLES15 Security Update : kernel (SUSE-SU-2021:0117-1)	Nessus	SuSE Local Security Checks	critical
144959	SUSE SLES15 Security Update : kernel (SUSE-SU-2021:0108-1)	Nessus	SuSE Local Security Checks	critical

Detections

Analytics

CVE-2020-29373

medium

Tenable Plugins

medium

medium

medium

medium

critical

critical

critical

critical