Google: sys-kernel/csql-kernel-6_6: security update to 18867.294.17

high Tenable Cloud Security Plugin ID 452231

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

- In the Linux kernel, the following vulnerability has been resolved: ixgbevf: fix mailbox API compatibility
by negotiating supported features There was backward compatibility in the terms of mailbox API. Various
drivers from various OSes supporting 10G adapters from Intel portfolio could easily negotiate mailbox API.
This convention has been broken since introducing API 1.4. Commit 0062e7cc955e ("ixgbevf: add VF IPsec
offload code") added support for IPSec which is specific only for the kernel ixgbe driver. None of the
rest of the Intel 10G PF/VF drivers supports it. And actually lack of support was not included in the
IPSec implementation - there were no such code paths. No possibility to negotiate support for the feature
was introduced along with introduction of the feature itself. Commit 339f28964147 ("ixgbevf: Add support
for new mailbox communication between PF and VF") increasing API version to 1.5 did the same - it
introduced code supported specifically by the PF ESX driver. It altered API version for the VF driver in
the same time not touching the version defined for the PF ixgbe driver. It led to additional
discrepancies, as the code provided within API 1.6 cannot be supported for Linux ixgbe driver as it causes
crashes. The issue was noticed some time ago and mitigated by Jake within the commit d0725312adf5
("ixgbevf: stop attempting IPSEC offload on Mailbox API 1.5"). As a result we have regression for IPsec
support and after increasing API to version 1.6 ixgbevf driver stopped to support ESX MBX. To fix this
mess add new mailbox op asking PF driver about supported features. Basing on a response determine whether
to set support for IPSec and ESX-specific enhanced mailbox. New mailbox op, for compatibility purposes,
must be added within new API revision, as API version of OOT PF & VF drivers is already increased to 1.6
and doesn't incorporate features negotiate op. Features negotiation mechanism gives possibility to be
extended with new features when needed in the future. (CVE-2025-40104)

Solution

Update the sys-kernel/csql-kernel-6_6 library and its related packages to version 18867.294.17 or later.

Plugin Details

Severity: High

ID: 452231

Version: Revision 1.1

Type: Local

Family: Google COS Security Checks

Published: 10/1/2026

Updated: 10/1/2026

Risk Information

VPR

Risk Factor: High

Score: 7.6

Percentile: 98.4

Vendor

Vendor Severity: LOW

CVSS v2

Risk Factor: Medium

Base Score: 6.8

Temporal Score: 5

Vector: CVSS2#AV:L/AC:L/Au:S/C:C/I:C/A:C

CVSS Score Source: CVE-2025-40104

CVSS v3

Risk Factor: High

Base Score: 7.8

Temporal Score: 6.8

Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Vulnerability Publication Date: 10/30/2025

Reference Information

CVE: CVE-2025-40104

Detections

Analytics