Google: sys-kernel/csql-kernel-6_1, sys-kernel/csql-kernel-6_6, sys-kernel/lakitu-kernel-6_1, sys-kernel/lakitu-kernel-6_6, sys-kernel/lakitu-nc-kernel-6_6, sys-kernel/lakitu-vgpu-kernel-6_6, sys-kernel/tpusev-kernel-6_6: security update to 18613.613.5

high Tenable Cloud Security Plugin ID 466359

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

- In the Linux kernel, the following vulnerability has been resolved: xfs: fix freemap adjustments when
adding xattrs to leaf blocks xfs/592 and xfs/794 both trip this assertion in the leaf block freemap
adjustment code after ~20 minutes of running on my test VMs: ASSERT(ichdr->firstused >= ichdr->count *
sizeof(xfs_attr_leaf_entry_t) + xfs_attr3_leaf_hdr_size(leaf)); Upon enabling quite a lot more debugging
code, I narrowed this down to fsstress trying to set a local extended attribute with namelen=3 and
valuelen=71. This results in an entry size of 80 bytes. At the start of xfs_attr3_leaf_add_work, the
freemap looks like this: i 0 base 448 size 0 rhs 448 count 46 i 1 base 388 size 132 rhs 448 count 46 i 2
base 2120 size 4 rhs 448 count 46 firstused = 520 where "rhs" is the first byte past the end of the leaf
entry array. This is inconsistent -- the entries array ends at byte 448, but freemap[1] says there's free
space starting at byte 388! By the end of the function, the freemap is in worse shape: i 0 base 456 size 0
rhs 456 count 47 i 1 base 388 size 52 rhs 456 count 47 i 2 base 2120 size 4 rhs 456 count 47 firstused =
440 Important note: 388 is not aligned with the entries array element size of 8 bytes. Based on the
incorrect freemap, the name area starts at byte 440, which is below the end of the entries array! That's
why the assertion triggers and the filesystem shuts down. How did we end up here? First, recall from the
previous patch that the freemap array in an xattr leaf block is not intended to be a comprehensive map of
all free space in the leaf block. In other words, it's perfectly legal to have a leaf block with: * 376
bytes in use by the entries array * freemap[0] has [base = 376, size = 8] * freemap[1] has [base = 388,
size = 1500] * the space between 376 and 388 is free, but the freemap stopped tracking that some time ago
If we add one xattr, the entries array grows to 384 bytes, and freemap[0] becomes [base = 384, size = 0].
So far, so good. But if we add a second xattr, the entries array grows to 392 bytes, and freemap[0] gets
pushed up to [base = 392, size = 0]. This is bad, because freemap[1] hasn't been updated, and now the
entries array and the free space claim the same space. The fix here is to adjust all freemap entries so
that none of them collide with the entries array. Note that this fix relies on commit 2a2b5932db6758
("xfs: fix attr leaf header freemap.size underflow") and the previous patch that resets zero length
freemap entries to have base = 0. (CVE-2026-43158)

Solution

Update the sys-kernel/csql-kernel-6_1 library and its related packages to version 18613.613.5 or later.

Plugin Details

Severity: High

ID: 466359

Version: Revision 1.2

Type: Local

Family: Google COS Security Checks

Published: 10/2/2026

Updated: 10/3/2026

Risk Information

VPR

Risk Factor: Medium

Score: 6.9

Percentile: 96.5

Vendor

Vendor Severity: LOW

CVSS v2

Risk Factor: High

Base Score: 9

Temporal Score: 6.7

Vector: CVSS2#AV:N/AC:L/Au:S/C:C/I:C/A:C

CVSS Score Source: CVE-2026-43158

CVSS v3

Risk Factor: High

Base Score: 8.8

Temporal Score: 7.7

Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Vulnerability Publication Date: 3/12/2026

Reference Information

CVE: CVE-2026-43158

Detections

Analytics