Detections
Analytics

Google: sys-kernel/lakitu-kernel-6_1: security update to 17819.0.0

medium Tenable Cloud Security Plugin ID 450562

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - In the Linux kernel, the following vulnerability has been resolved: ovl: fix null pointer dereference in
 ovl_permission() Following process: P1 P2 path_lookupat link_path_walk inode_permission ovl_permission
 ovl_i_path_real(inode, &realpath) path->dentry = ovl_i_dentry_upper(inode) drop_cache
 __dentry_kill(ovl_dentry) iput(ovl_inode) ovl_destroy_inode(ovl_inode) dput(oi->__upperdentry)
 dentry_kill(upperdentry) dentry_unlink_inode upperdentry->d_inode = NULL realinode =
 d_inode(realpath.dentry) // return NULL inode_permission(realinode) inode->i_sb // NULL pointer
 dereference , will trigger an null pointer dereference at realinode: [ 335.664979] BUG: kernel NULL
 pointer dereference, address: 0000000000000002 [ 335.668032] CPU: 0 PID: 2592 Comm: ls Not tainted 6.3.0 [
 335.669956] RIP: 0010:inode_permission+0x33/0x2c0 [ 335.678939] Call Trace: [ 335.679165] <TASK> [
 335.679371] ovl_permission+0xde/0x320 [ 335.679723] inode_permission+0x15e/0x2c0 [ 335.680090]
 link_path_walk+0x115/0x550 [ 335.680771] path_lookupat.isra.0+0xb2/0x200 [ 335.681170]
 filename_lookup+0xda/0x240 [ 335.681922] vfs_statx+0xa6/0x1f0 [ 335.682233] vfs_fstatat+0x7b/0xb0 Fetch a
 reproducer in [Link]. Use the helper ovl_i_path_realinode() to get realinode and then do non-nullptr
 checking. (CVE-2023-53260)

Solution

Update the sys-kernel/lakitu-kernel-6_1 library and its related packages to version 17819.0.0 or later.

See Also

https://storage.googleapis.com/cos-oval-vulnerability-feed/cos-113.oval.xml.tar.gz

Plugin Details

Severity: Medium

ID: 450562

Version: Revision 1.1

Type: Local

Published: 10/1/2026

Updated: 10/1/2026

Risk Information

VPR

Risk Factor: Low

Score: 3

Percentile: 23.15

Vendor

Vendor Severity: LOW

CVSS v2

Risk Factor: Medium

Base Score: 4.6

Temporal Score: 3.4

Vector: CVSS2#AV:L/AC:L/Au:S/C:N/I:N/A:C

CVSS Score Source: CVE-2023-53260

CVSS v3

Risk Factor: Medium

Base Score: 5.5

Temporal Score: 4.8

Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Vulnerability Publication Date: 9/7/2023

Reference Information

CVE: CVE-2023-53260