Detections
Analytics

Unity Linux 20.1060e / 20.1070e Security Update: kernel (UTSA-2025-992569)

medium Nessus Plugin ID 280202

Synopsis

The Unity Linux host is missing one or more security updates.

Description

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-992569 advisory.

 In the Linux kernel, the following vulnerability has been resolved:

 usb: dwc2: fix a devres leak in hw_enable upon suspend resume

 Each time the platform goes to low power, PM suspend / resume routines call: __dwc2_lowlevel_hw_enable -> devm_add_action_or_reset().
 This adds a new devres each time.
 This may also happen at runtime, as dwc2_lowlevel_hw_enable() can be called from udc_start().

 This can be seen with tracing:
 - echo 1 > /sys/kernel/debug/tracing/events/dev/devres_log/enable
 - go to low power
 - cat /sys/kernel/debug/tracing/trace

 A new ADD entry is found upon each low power cycle:
 ... devres_log: 49000000.usb-otg ADD 82a13bba devm_action_release (8 bytes) ... devres_log: 49000000.usb-otg ADD 49889daf devm_action_release (8 bytes) ...

 A second issue is addressed here:
 - regulator_bulk_enable() is called upon each PM cycle (suspend/resume).
 - regulator_bulk_disable() never gets called.

 So the reference count for these regulators constantly increase, by one upon each low power cycle, due to missing regulator_bulk_disable() call in __dwc2_lowlevel_hw_disable().

 The original fix that introduced the devm_add_action_or_reset() call, fixed an issue during probe, that happens due to other errors in dwc2_driver_probe() -> dwc2_core_reset(). Then the probe fails without disabling regulators, when dr_mode == USB_DR_MODE_PERIPHERAL.

 Rather fix the error path: disable all the low level hardware in the error path, by using the hsotg->ll_hw_enabled flag. Checking dr_mode has been introduced to avoid a dual call to dwc2_lowlevel_hw_disable().
 ll_hw_enabled should achieve the same (and is used currently in the remove() routine).

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected kernel package.

See Also

http://www.nessus.org/u?f9f96b94

http://www.nessus.org/u?f9bf0b8e

https://nvd.nist.gov/vuln/detail/CVE-2023-53054

Plugin Details

Severity: Medium

ID: 280202

File Name: unity_linux_UTSA-2025-992569.nasl

Version: 1.1

Type: local

Published: 12/30/2025

Updated: 12/30/2025

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 4.4

CVSS v2

Risk Factor: Medium

Base Score: 4.6

Temporal Score: 3.4

Vector: CVSS2#AV:L/AC:L/Au:S/C:N/I:N/A:C

CVSS Score Source: CVE-2023-53054

CVSS v3

Risk Factor: Medium

Base Score: 5.5

Temporal Score: 4.8

Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Required KB Items: Host/local_checks_enabled, Host/UOS-Server/release, Host/UOS-Server/rpm-list, Host/cpu

Exploit Ease: No known exploits are available

Patch Publication Date: 12/30/2025

Vulnerability Publication Date: 5/2/2025

Reference Information

CVE: CVE-2023-53054