Google: sys-kernel/csql-kernel-6_6: security update to 19165.0.0

medium Tenable Cloud Security Plugin ID 453789

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

- In the Linux kernel, the following vulnerability has been resolved: x86/fpu: Ensure shadow stack is active
before "getting" registers The x86 shadow stack support has its own set of registers. Those registers are
XSAVE-managed, but they are "supervisor state components" which means that userspace can not touch them
with XSAVE/XRSTOR. It also means that they are not accessible from the existing ptrace ABI for XSAVE
state. Thus, there is a new ptrace get/set interface for it. The regset code that ptrace uses provides an
->active() handler in addition to the get/set ones. For shadow stack this ->active() handler verifies that
shadow stack is enabled via the ARCH_SHSTK_SHSTK bit in the thread struct. The ->active() handler is
checked from some call sites of the regset get/set handlers, but not the ptrace ones. This was not
understood when shadow stack support was put in place. As a result, both the set/get handlers can be
called with XFEATURE_CET_USER in its init state, which would cause get_xsave_addr() to return NULL and
trigger a WARN_ON(). The ssp_set() handler luckily has an ssp_active() check to avoid surprising the
kernel with shadow stack behavior when the kernel is not ready for it (ARCH_SHSTK_SHSTK==0). That check
just happened to avoid the warning. But the ->get() side wasn't so lucky. It can be called with shadow
stacks disabled, triggering the warning in practice, as reported by Christina Schimpe: WARNING: CPU: 5
PID: 1773 at arch/x86/kernel/fpu/regset.c:198 ssp_get+0x89/0xa0 [...] Call Trace: <TASK> ?
show_regs+0x6e/0x80 ? ssp_get+0x89/0xa0 ? __warn+0x91/0x150 ? ssp_get+0x89/0xa0 ? report_bug+0x19d/0x1b0 ?
handle_bug+0x46/0x80 ? exc_invalid_op+0x1d/0x80 ? asm_exc_invalid_op+0x1f/0x30 ? __pfx_ssp_get+0x10/0x10 ?
ssp_get+0x89/0xa0 ? ssp_get+0x52/0xa0 __regset_get+0xad/0xf0 copy_regset_to_user+0x52/0xc0
ptrace_regset+0x119/0x140 ptrace_request+0x13c/0x850 ? wait_task_inactive+0x142/0x1d0 ?
do_syscall_64+0x6d/0x90 arch_ptrace+0x102/0x300 [...] Ensure that shadow stacks are active in a thread
before looking them up in the XSAVE buffer. Since ARCH_SHSTK_SHSTK and user_ssp[SHSTK_EN] are set at the
same time, the active check ensures that there will be something to find in the XSAVE buffer. [ dhansen:
changelog/subject tweaks ] (CVE-2025-21632)

Solution

Update the sys-kernel/csql-kernel-6_6 library and its related packages to version 19165.0.0 or later.

Plugin Details

Severity: Medium

ID: 453789

Version: Revision 1.1

Type: Local

Family: Google COS Security Checks

Published: 10/1/2026

Updated: 10/1/2026

Risk Information

VPR

Risk Factor: Low

Score: 3

Percentile: 23.15

Vendor

Vendor Severity: MEDIUM

CVSS v2

Risk Factor: Medium

Base Score: 4.6

Temporal Score: 3.4

Vector: CVSS2#AV:L/AC:L/Au:S/C:N/I:N/A:C

CVSS Score Source: CVE-2025-21632

CVSS v3

Risk Factor: Medium

Base Score: 5.5

Temporal Score: 4.8

Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Vulnerability Publication Date: 1/19/2025

Reference Information

CVE: CVE-2025-21632

Detections

Analytics