Detections
Analytics

Unity Linux 20.1070e Security Update: kernel (UTSA-2025-987276)

medium Nessus Plugin ID 269075

Synopsis

The Unity Linux host is missing one or more security updates.

Description

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-987276 advisory.

 In the Linux kernel, the following vulnerability has been resolved:

 btrfs: fix memory leak in __add_inode_ref()

 Line 1169 (#3) allocates a memory chunk for victim_name by kmalloc(), but when the function returns in line 1184 (#4) victim_name allocated by line 1169 (#3) is not freed, which will lead to a memory leak.
 There is a similar snippet of code in this function as allocating a memory chunk for victim_name in line 1104 (#1) as well as releasing the memory in line 1116 (#2).

 We should kfree() victim_name when the return value of backref_in_log() is less than zero and before the function returns in line 1184 (#4).

 1057 static inline int __add_inode_ref(struct btrfs_trans_handle *trans, 1058 struct btrfs_root *root, 1059 struct btrfs_path *path, 1060 struct btrfs_root *log_root, 1061 struct btrfs_inode *dir, 1062 struct btrfs_inode *inode, 1063 u64 inode_objectid, u64 parent_objectid, 1064 u64 ref_index, char *name, int namelen, 1065 int *search_done) 1066 {

 1104 victim_name = kmalloc(victim_name_len, GFP_NOFS);
 // #1: kmalloc (victim_name-1) 1105 if (!victim_name) 1106 return -ENOMEM;

 1112 ret = backref_in_log(log_root, &search_key, 1113 parent_objectid, victim_name, 1114 victim_name_len);
 1115 if (ret < 0) { 1116 kfree(victim_name); // #2: kfree (victim_name-1) 1117 return ret;
 1118 } else if (!ret) {

 1169 victim_name = kmalloc(victim_name_len, GFP_NOFS);
 // #3: kmalloc (victim_name-2) 1170 if (!victim_name) 1171 return -ENOMEM;

 1180 ret = backref_in_log(log_root, &search_key, 1181 parent_objectid, victim_name, 1182 victim_name_len);
 1183 if (ret < 0) { 1184 return ret; // #4: missing kfree (victim_name-2) 1185 } else if (!ret) {

 1241 return 0;
 1242 }

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected kernel package.

See Also

http://www.nessus.org/u?8bc47c54

http://www.nessus.org/u?fcc42dfd

https://nvd.nist.gov/vuln/detail/CVE-2021-47585

Plugin Details

Severity: Medium

ID: 269075

File Name: unity_linux_UTSA-2025-987276.nasl

Version: 1.2

Type: local

Published: 10/7/2025

Updated: 10/15/2025

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 4.4

CVSS v2

Risk Factor: Medium

Base Score: 4.6

Temporal Score: 3.4

Vector: CVSS2#AV:L/AC:L/Au:S/C:N/I:N/A:C

CVSS Score Source: CVE-2021-47585

CVSS v3

Risk Factor: Medium

Base Score: 5.5

Temporal Score: 4.8

Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Required KB Items: Host/local_checks_enabled, Host/cpu, Host/UOS-Server/release, Host/UOS-Server/rpm-list

Exploit Ease: No known exploits are available

Patch Publication Date: 9/23/2025

Vulnerability Publication Date: 1/28/2022

Reference Information

CVE: CVE-2021-47585