Google: sys-kernel/csql-kernel-6_1, sys-kernel/csql-kernel-6_6: security update to 18613.439.108

medium Tenable Cloud Security Plugin ID 466356

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

- In the Linux kernel, the following vulnerability has been resolved: ipv4: Fix reference count leak when
using error routes with nexthop objects When a nexthop object is deleted, it is marked as dead and then
fib_table_flush() is called to flush all the routes that are using the dead nexthop. The current logic in
fib_table_flush() is to only flush error routes (e.g., blackhole) when it is called as part of network
namespace dismantle (i.e., with flush_all=true). Therefore, error routes are not flushed when their
nexthop object is deleted: # ip link add name dummy1 up type dummy # ip nexthop add id 1 dev dummy1 # ip
route add 198.51.100.1/32 nhid 1 # ip route add blackhole 198.51.100.2/32 nhid 1 # ip nexthop del id 1 #
ip route show blackhole 198.51.100.2 nhid 1 dev dummy1 As such, they keep holding a reference on the
nexthop object which in turn holds a reference on the nexthop device, resulting in a reference count leak:
# ip link del dev dummy1 [ 70.516258] unregister_netdevice: waiting for dummy1 to become free. Usage count
= 2 Fix by flushing error routes when their nexthop is marked as dead. IPv6 does not suffer from this
problem. (CVE-2025-71097)

Solution

Update the sys-kernel/csql-kernel-6_1 library and its related packages to version 18613.439.108 or later.

Plugin Details

Severity: Medium

ID: 466356

Version: Revision 1.1

Type: Local

Family: Google COS Security Checks

Published: 10/2/2026

Updated: 10/2/2026

Risk Information

VPR

Risk Factor: Low

Score: 3

Percentile: 23.43

Vendor

Vendor Severity: LOW

CVSS v2

Risk Factor: Medium

Base Score: 4.6

Temporal Score: 3.4

Vector: CVSS2#AV:L/AC:L/Au:S/C:N/I:N/A:C

CVSS Score Source: CVE-2025-71097

CVSS v3

Risk Factor: Medium

Base Score: 5.5

Temporal Score: 4.8

Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Vulnerability Publication Date: 1/13/2026

Reference Information

CVE: CVE-2025-71097

Detections

Analytics