Detections
Analytics

Unity Linux 20.1050e Security Update: kernel (UTSA-2026-099967)

medium Nessus Plugin ID 336683

Synopsis

The Unity Linux host is missing one or more security updates.

Description

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-099967 advisory.

 In the Linux kernel, the following vulnerability has been resolved:

 net: usb: catc: enable basic endpoint checking

 catc_probe() fills three URBs with hardcoded endpoint pipes without verifying the endpoint descriptors:

 - usb_sndbulkpipe(usbdev, 1) and usb_rcvbulkpipe(usbdev, 1) for TX/RX
 - usb_rcvintpipe(usbdev, 2) for interrupt status

 A malformed USB device can present these endpoints with transfer types that differ from what the driver assumes.

 Add a catc_usb_ep enum for endpoint numbers, replacing magic constants throughout. Add usb_check_bulk_endpoints() and usb_check_int_endpoints() calls after usb_set_interface() to verify endpoint types before use, rejecting devices with mismatched descriptors at probe time.

 Similar to
 - commit 90b7f2961798 (net: usb: rtl8150: enable basic endpoint checking) which fixed the issue in rtl8150.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected kernel package.

See Also

https://nvd.nist.gov/vuln/detail/CVE-2026-45923

http://www.nessus.org/u?ac71ac0a

http://www.nessus.org/u?df1423a5

Plugin Details

Severity: Medium

ID: 336683

File Name: unity_linux_UTSA-2026-099967.nasl

Version: 1.1

Type: Local

Published: 8/17/2026

Updated: 8/17/2026

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 5.7

Percentile: 96.26

CVSS v2

Risk Factor: Medium

Base Score: 5.2

Temporal Score: 3.8

Vector: CVSS2#AV:L/AC:L/Au:S/C:N/I:P/A:C

CVSS Score Source: CVE-2026-45923

CVSS v3

Risk Factor: Medium

Base Score: 5.5

Temporal Score: 4.8

Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Required KB Items: Host/local_checks_enabled, Host/cpu, Host/UOS-Server/release, Host/UOS-Server/rpm-list

Exploit Ease: No known exploits are available

Patch Publication Date: 8/13/2026

Vulnerability Publication Date: 4/1/2026

Reference Information

CVE: CVE-2026-45923