Detections
Analytics

Google: sys-kernel/csql-kernel-6_1, sys-kernel/tpusev-kernel-6_6: security update to 18613.439.45

high Tenable Cloud Security Plugin ID 466316

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - In the Linux kernel, the following vulnerability has been resolved: blk-mq: check kobject state_in_sysfs
 before deleting in blk_mq_unregister_hctx In __blk_mq_update_nr_hw_queues() the return value of
 blk_mq_sysfs_register_hctxs() is not checked. If sysfs creation for hctx fails, later changing the number
 of hw_queues or removing disk will trigger the following warning: kernfs: can not remove 'nr_tags', no
 directory WARNING: CPU: 2 PID: 637 at fs/kernfs/dir.c:1707 kernfs_remove_by_name_ns+0x13f/0x160 Call
 Trace: remove_files.isra.1+0x38/0xb0 sysfs_remove_group+0x4d/0x100 sysfs_remove_groups+0x31/0x60
 __kobject_del+0x23/0xf0 kobject_del+0x17/0x40 blk_mq_unregister_hctx+0x5d/0x80
 blk_mq_sysfs_unregister_hctxs+0x94/0xd0 blk_mq_update_nr_hw_queues+0x124/0x760
 nullb_update_nr_hw_queues+0x71/0xf0 [null_blk] nullb_device_submit_queues_store+0x92/0x120 [null_blk]
 kobjct_del() was called unconditionally even if sysfs creation failed. Fix it by checkig the kobject
 creation statusbefore deleting it. (CVE-2025-40125)

Solution

Update the sys-kernel/csql-kernel-6_1 library and its related packages to version 18613.439.45 or later.

See Also

https://storage.googleapis.com/cos-oval-vulnerability-feed/cos-117.oval.xml.tar.gz

Plugin Details

Severity: High

ID: 466316

Version: Revision 1.1

Type: Local

Published: 10/2/2026

Updated: 10/2/2026

Risk Information

VPR

Risk Factor: Medium

Score: 4.9

Percentile: 57.29

Vendor

Vendor Severity: LOW

CVSS v2

Risk Factor: High

Base Score: 7.2

Temporal Score: 5.3

Vector: CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C

CVSS Score Source: CVE-2025-40125

CVSS v3

Risk Factor: High

Base Score: 7.8

Temporal Score: 6.8

Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Vulnerability Publication Date: 10/23/2025

Reference Information

CVE: CVE-2025-40125