Detections
Analytics

Google: sys-kernel/csql-kernel-6_6, sys-kernel/lakitu-kernel-6_6, sys-kernel/lakitu-nc-kernel-6_6, sys-kernel/lakitu-vgpu-kernel-6_6, sys-kernel/tpusev-kernel-6_6: security update to 18613.731.2

critical Tenable Cloud Security Plugin ID 466309

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - In the Linux kernel, the following vulnerability has been resolved: sunrpc: wait for in-flight TLS
 handshake callback when cancel loses race When wait_for_completion_interruptible_timeout() in
 svc_tcp_handshake() returns 0 (timeout) or -ERESTARTSYS (signal) and tls_handshake_cancel() then returns
 false, handshake_complete() has won the cancellation race: it has set HANDSHAKE_F_REQ_COMPLETED and is
 about to invoke svc_tcp_handshake_done(), but the callback's side effects on xpt_flags and on
 svsk->sk_handshake_done have not yet committed. The current code reads xpt_flags immediately to decide
 whether the session succeeded. Two races result. If the callback has executed set_bit(XPT_TLS_SESSION) but
 not yet clear_bit(XPT_HANDSHAKE), svc_tcp_handshake() sees a session, enqueues the transport, and returns.
 svc_xprt_received() then clears XPT_BUSY, a worker thread picks the transport up, the dispatcher in
 svc_handle_xprt() observes XPT_HANDSHAKE still set, and xpo_handshake is invoked a second time. That
 svc_tcp_handshake() calls init_completion(&svsk->sk_handshake_done) while the original callback
 concurrently calls complete_all() on it, corrupting the embedded swait_queue. If the callback has set
 HANDSHAKE_F_REQ_COMPLETED but not yet entered svc_tcp_handshake_done(), svc_tcp_handshake() reads
 XPT_TLS_SESSION as clear and tears the connection down even though the handshake is about to succeed. Wait
 for the callback to commit before inspecting xpt_flags. The completion is guaranteed to fire because
 handshake_complete() invokes svc_tcp_handshake_done() unconditionally once it has set
 HANDSHAKE_F_REQ_COMPLETED. (CVE-2026-72221)

Solution

Update the sys-kernel/csql-kernel-6_6 library and its related packages to version 18613.731.2 or later.

See Also

https://storage.googleapis.com/cos-oval-vulnerability-feed/cos-117.oval.xml.tar.gz

Plugin Details

Severity: Critical

ID: 466309

Version: Revision 1.1

Type: Local

Published: 10/2/2026

Updated: 10/2/2026

Risk Information

VPR

Risk Factor: Medium

Score: 6.9

Percentile: 96.56

Vendor

Vendor Severity: LOW

CVSS v2

Risk Factor: Critical

Base Score: 10

Temporal Score: 7.4

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS Score Source: CVE-2026-72221

CVSS v3

Risk Factor: Critical

Base Score: 9.8

Temporal Score: 8.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Vulnerability Publication Date: 8/11/2026

Reference Information

CVE: CVE-2026-72221