Detections
Analytics
Unity Linux 20.1070e Security Update: kernel (UTSA-2026-013292)
medium Nessus Plugin ID 308089
Synopsis
The Unity Linux host is missing one or more security updates.Description
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-013292 advisory.In the Linux kernel, the following vulnerability has been resolved:
bpf: Reject narrower access to pointer ctx fields
The following BPF program, simplified from a syzkaller repro, causes a kernel warning:
r0 = *(u8 *)(r1 + 169);
exit;
With pointer field sk being at offset 168 in __sk_buff. This access is detected as a narrower read in bpf_skb_is_valid_access because it doesn't match offsetof(struct __sk_buff, sk). It is therefore allowed and later proceeds to bpf_convert_ctx_access. Note that for the is_narrower_load case in the convert_ctx_accesses(), the insn->off is aligned, so the cnt may not be 0 because it matches the offsetof(struct __sk_buff, sk) in the bpf_convert_ctx_access. However, the target_size stays 0 and the verifier errors with a kernel warning:
verifier bug: error during ctx access conversion(1)
This patch fixes that to return a proper invalid bpf_context access off=X size=Y error on the load instruction.
The same issue affects multiple other fields in context structures that allow narrow access. Some other non-affected fields (for sk_msg, sk_lookup, and sockopt) were also changed to use bpf_ctx_range_ptr for consistency.
Note this syzkaller crash was reported in the Closes link below, which used to be about a different bug, fixed in commit fce7bd8e385a (bpf/verifier: Handle BPF_LOAD_ACQ instructions in insn_def_regno()). Because syzbot somehow confused the two bugs, the new crash and repro didn't get reported to the mailing list.
Tenable has extracted the preceding description block directly from the Unity Linux security advisory.
Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.
Solution
Update the affected kernel package.See Also
http://www.nessus.org/u?10ef9e34
Plugin Details
Severity: Medium
ID: 308089
File Name: unity_linux_UTSA-2026-013292.nasl
Version: 1.1
Type: Local
Published: 4/21/2026
Updated: 4/21/2026
Supported Sensors: Nessus
Risk Information
VPR
Risk Factor: Medium
Score: 4.4
CVSS v2
Risk Factor: Medium
Base Score: 4.6
Temporal Score: 3.4
Vector: CVSS2#AV:L/AC:L/Au:S/C:N/I:N/A:C
CVSS Score Source: CVE-2025-38591
CVSS v3
Risk Factor: Medium
Base Score: 5.5
Temporal Score: 4.8
Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
Vulnerability Information
Required KB Items: Host/local_checks_enabled, Host/cpu, Host/UOS-Server/release, Host/UOS-Server/rpm-list
Exploit Ease: No known exploits are available
Patch Publication Date: 4/21/2026
Vulnerability Publication Date: 8/19/2025
Reference Information
CVE: CVE-2025-38591