Google: sys-kernel/csql-kernel-6_1, sys-kernel/csql-kernel-6_6: security update to 18613.339.11

medium Tenable Cloud Security Plugin ID 466724

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

- In the Linux kernel, the following vulnerability has been resolved: ptp: remove ptp->n_vclocks check logic
in ptp_vclock_in_use() There is no disagreement that we should check both ptp->is_virtual_clock and
ptp->n_vclocks to check if the ptp virtual clock is in use. However, when we acquire ptp->n_vclocks_mux to
read ptp->n_vclocks in ptp_vclock_in_use(), we observe a recursive lock in the call trace starting from
n_vclocks_store(). ============================================ WARNING: possible recursive locking
detected 6.15.0-rc6 #1 Not tainted -------------------------------------------- syz.0.1540/13807 is trying
to acquire lock: ffff888035a24868 (&ptp->n_vclocks_mux){+.+.}-{4:4}, at: ptp_vclock_in_use
drivers/ptp/ptp_private.h:103 [inline] ffff888035a24868 (&ptp->n_vclocks_mux){+.+.}-{4:4}, at:
ptp_clock_unregister+0x21/0x250 drivers/ptp/ptp_clock.c:415 but task is already holding lock:
ffff888030704868 (&ptp->n_vclocks_mux){+.+.}-{4:4}, at: n_vclocks_store+0xf1/0x6d0
drivers/ptp/ptp_sysfs.c:215 other info that might help us debug this: Possible unsafe locking scenario:
CPU0 ---- lock(&ptp->n_vclocks_mux); lock(&ptp->n_vclocks_mux); *** DEADLOCK *** ....
============================================ The best way to solve this is to remove the logic that checks
ptp->n_vclocks in ptp_vclock_in_use(). The reason why this is appropriate is that any path that uses
ptp->n_vclocks must unconditionally check if ptp->n_vclocks is greater than 0 before unregistering
vclocks, and all functions are already written this way. And in the function that uses ptp->n_vclocks, we
already get ptp->n_vclocks_mux before unregistering vclocks. Therefore, we need to remove the redundant
check for ptp->n_vclocks in ptp_vclock_in_use() to prevent recursive locking. (CVE-2025-38305)

Solution

Update the sys-kernel/csql-kernel-6_1 library and its related packages to version 18613.339.11 or later.

Plugin Details

Severity: Medium

ID: 466724

Version: Revision 1.3

Type: Local

Family: Google COS Security Checks

Published: 10/2/2026

Updated: 10/3/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Low

Score: 3

Percentile: 23.18

Vendor

Vendor Severity: LOW

CVSS v2

Risk Factor: Medium

Base Score: 4.6

Temporal Score: 3.4

Vector: CVSS2#AV:L/AC:L/Au:S/C:N/I:N/A:C

CVSS Score Source: CVE-2025-38305

CVSS v3

Risk Factor: Medium

Base Score: 5.5

Temporal Score: 4.8

Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Vulnerability Publication Date: 7/10/2025

Reference Information

CVE: CVE-2025-38305

Detections

Analytics