Google: sys-kernel/csql-kernel-6_1, sys-kernel/csql-kernel-6_6, sys-kernel/lakitu-kernel-6_1, sys-kernel/lakitu-kernel-6_6, sys-kernel/lakitu-nc-kernel-6_6, sys-kernel/lakitu-vgpu-kernel-6_6, sys-kernel/tpusev-kernel-6_6: security update to 18613.613.5

medium Tenable Cloud Security Plugin ID 466360

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

- In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Ignore -EBUSY when checking
nested events from vcpu_block() Ignore -EBUSY when checking nested events after exiting a blocking state
while L2 is active, as exiting to userspace will generate a spurious userspace exit, usually with
KVM_EXIT_UNKNOWN, and likely lead to the VM's demise. Continuing with the wakeup isn't perfect either, as
*something* has gone sideways if a vCPU is awakened in L2 with an injected event (or worse, a nested run
pending), but continuing on gives the VM a decent chance of surviving without any major side effects. As
explained in the Fixes commits, it _should_ be impossible for a vCPU to be put into a blocking state with
an already-injected event (exception, IRQ, or NMI). Unfortunately, userspace can stuff MP_STATE and/or
injected events, and thus put the vCPU into what should be an impossible state. Don't bother trying to
preserve the WARN, e.g. with an anti-syzkaller Kconfig, as WARNs can (hopefully) be added in paths where
_KVM_ would be violating x86 architecture, e.g. by WARNing if KVM attempts to inject an exception or
interrupt while the vCPU isn't running. (CVE-2026-43265)

Solution

Update the sys-kernel/csql-kernel-6_1 library and its related packages to version 18613.613.5 or later.

Plugin Details

Severity: Medium

ID: 466360

Version: Revision 1.2

Type: Local

Family: Google COS Security Checks

Published: 10/2/2026

Updated: 10/3/2026

Risk Information

VPR

Risk Factor: Low

Score: 3

Percentile: 23.72

Vendor

Vendor Severity: LOW

CVSS v2

Risk Factor: Medium

Base Score: 4.6

Temporal Score: 3.4

Vector: CVSS2#AV:L/AC:L/Au:S/C:N/I:N/A:C

CVSS Score Source: CVE-2026-43265

CVSS v3

Risk Factor: Medium

Base Score: 5.5

Temporal Score: 4.8

Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Vulnerability Publication Date: 4/7/2026

Reference Information

CVE: CVE-2026-43265

Detections

Analytics