Google: sys-kernel/csql-kernel-6_1, sys-kernel/lakitu-kernel-6_1: security update to 18244.521.98

high Tenable Cloud Security Plugin ID 451206

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

- In the Linux kernel, the following vulnerability has been resolved: nfsd: provide locking for v4_end_grace
Writing to v4_end_grace can race with server shutdown and result in memory being accessed after it was
freed - reclaim_str_hashtbl in particularly. We cannot hold nfsd_mutex across the nfsd4_end_grace() call
as that is held while client_tracking_op->init() is called and that can wait for an upcall to nfsdcltrack
which can write to v4_end_grace, resulting in a deadlock. nfsd4_end_grace() is also called by the
landromat work queue and this doesn't require locking as server shutdown will stop the work and wait for
it before freeing anything that nfsd4_end_grace() might access. However, we must be sure that writing to
v4_end_grace doesn't restart the work item after shutdown has already waited for it. For this we add a new
flag protected with nn->client_lock. It is set only while it is safe to make client tracking calls, and
v4_end_grace only schedules work while the flag is set with the spinlock held. So this patch adds a
nfsd_net field "client_tracking_active" which is set as described. Another field "grace_end_forced", is
set when v4_end_grace is written. After this is set, and providing client_tracking_active is set, the
laundromat is scheduled. This "grace_end_forced" field bypasses other checks for whether the grace period
has finished. This resolves a race which can result in use-after-free. (CVE-2026-22980)

Solution

Update the sys-kernel/csql-kernel-6_1 library and its related packages to version 18244.521.98 or later.

Plugin Details

Severity: High

ID: 451206

Version: Revision 1.1

Type: Local

Family: Google COS Security Checks

Published: 10/1/2026

Updated: 10/1/2026

Risk Information

VPR

Risk Factor: Medium

Score: 4.9

Percentile: 58.11

Vendor

Vendor Severity: LOW

CVSS v2

Risk Factor: Medium

Base Score: 6.8

Temporal Score: 5

Vector: CVSS2#AV:L/AC:L/Au:S/C:C/I:C/A:C

CVSS Score Source: CVE-2026-22980

CVSS v3

Risk Factor: High

Base Score: 7.8

Temporal Score: 6.8

Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Vulnerability Publication Date: 1/23/2026

Reference Information

CVE: CVE-2026-22980

Detections

Analytics