Google: sys-kernel/csql-kernel-6_1, sys-kernel/csql-kernel-6_6, sys-kernel/lakitu-kernel-6_1, sys-kernel/lakitu-kernel-6_6, sys-kernel/lakitu-nc-kernel-6_6, sys-kernel/lakitu-vgpu-kernel-6_6, sys-kernel/tpusev-kernel-6_6: security update to 18613.675.48

high Tenable Cloud Security Plugin ID 466255

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

- In the Linux kernel, the following vulnerability has been resolved: bpf: Allow LPM map access from
sleepable BPF programs trie_lookup_elem() annotates its rcu_dereference_check() walks with only
rcu_read_lock_bh_held(). Because rcu_dereference_check(p, c) resolves to "c || rcu_read_lock_held()", this
passes for XDP/NAPI and classic RCU readers but fails for sleepable BPF programs, which enter via
__bpf_prog_enter_sleepable() and hold only rcu_read_lock_trace(). trie_update_elem() and
trie_delete_elem() have the same problem in a different form: they walk the trie with plain
rcu_dereference(), which asserts rcu_read_lock_held() unconditionally. Both are reachable from sleepable
BPF programs via the bpf_map_update_elem / bpf_map_delete_elem helpers, and from the syscall path under
classic rcu_read_lock(). In the writer paths the trie is actually protected by trie->lock (an rqspinlock
taken across the walk); we never relied on the RCU read-side lock to keep nodes alive there. A sleepable
LSM hook that ends up touching an LPM trie therefore triggers lockdep on debug kernels:
============================= WARNING: suspicious RCU usage 7.1.0-... Tainted: G E
----------------------------- kernel/bpf/lpm_trie.c:249 suspicious rcu_dereference_check() usage! 1 lock
held by net_tests/540: #0: (rcu_tasks_trace_srcu_struct){....}-{0:0}, at:
__bpf_prog_enter_sleepable+0x26/0x280 Call Trace: dump_stack_lvl lockdep_rcu_suspicious trie_lookup_elem
bpf_prog_..._enforce_security_socket_connect bpf_trampoline_... security_socket_connect __sys_connect
do_syscall_64 This is lockdep-only -- no UAF, since Tasks Trace RCU does serialize against the trie's
reclaim path -- but it spams the console once per distinct callsite on every debug kernel running a
sleepable BPF LSM that touches an LPM trie, which is increasingly common. For the lookup path, switch the
rcu_dereference_check() annotation from rcu_read_lock_bh_held() to bpf_rcu_lock_held(), which accepts all
three contexts (classic, BH, Tasks Trace). Other map types already follow this convention. For
trie_update_elem() and trie_delete_elem(), annotate the walks as rcu_dereference_protected(*p, 1) --
matching trie_free() in the same file -- since trie->lock is held across the walk. rqspinlock has no
lockdep_map, so the predicate degenerates to '1' rather than lockdep_is_held(&trie->lock); the protection
is real but not machine-verifiable. trie_get_next_key() also uses bare rcu_dereference() but is reachable
only from the BPF syscall, which holds classic rcu_read_lock() before dispatching, so it is left
untouched. (CVE-2026-64352)

Solution

Update the sys-kernel/csql-kernel-6_1 library and its related packages to version 18613.675.48 or later.

Plugin Details

Severity: High

ID: 466255

Version: Revision 1.1

Type: Local

Family: Google COS Security Checks

Published: 10/2/2026

Updated: 10/2/2026

Risk Information

VPR

Risk Factor: Medium

Score: 4.9

Percentile: 58.19

Vendor

Vendor Severity: HIGH

CVSS v2

Risk Factor: Medium

Base Score: 6.8

Temporal Score: 5

Vector: CVSS2#AV:L/AC:L/Au:S/C:C/I:C/A:C

CVSS Score Source: CVE-2026-64352

CVSS v3

Risk Factor: High

Base Score: 7.8

Temporal Score: 6.8

Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Vulnerability Publication Date: 7/25/2026

Reference Information

CVE: CVE-2026-64352

Detections

Analytics