Google: sys-kernel/csql-kernel-6_1, sys-kernel/csql-kernel-6_6, sys-kernel/lakitu-kernel-6_1, sys-kernel/lakitu-kernel-6_6, sys-kernel/lakitu-nc-kernel-6_6, sys-kernel/lakitu-vgpu-kernel-6_6, sys-kernel/tpusev-kernel-6_6: security update to 18613.675.2

critical Tenable Cloud Security Plugin ID 467160

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

- In the Linux kernel, the following vulnerability has been resolved: scsi: target: iscsi: Fix CRC overread
and double-free in iscsit_handle_text_cmd() Two latent bugs in the Text-phase handler, both present since
the original LIO integration in commit e48354ce078c ("iscsi-target: Add iSCSI fabric support for target
v4.1"): 1) DataDigest CRC buffer overread (4 bytes past text_in). text_in is kzalloc()'d at
ALIGN(payload_length, 4). rx_size is then incremented by ISCSI_CRC_LEN to make room for the received
DataDigest in the iovec, but the same (now-bumped) rx_size is passed as the buffer length to
iscsit_crc_buf(): if (conn->conn_ops->DataDigest) { ... rx_size += ISCSI_CRC_LEN; } ... if
(conn->conn_ops->DataDigest) { data_crc = iscsit_crc_buf(text_in, rx_size, 0, NULL); iscsit_crc_buf()
walks rx_size bytes of text_in with crc32c(), so when DataDigest is negotiated it reads 4 bytes past the
end of the text_in allocation. KASAN reproduces this directly on the unpatched mainline tree as slab-out-
of-bounds in crc32c() called from the Text PDU path. The OOB bytes feed crc32c() and are then compared
against the initiator-supplied checksum, so the value does not flow back to the attacker, but the kernel
does read past the buffer on every Text PDU with DataDigest=CRC32C. Fix by passing the actual padded
payload length (ALIGN(payload_length, 4)) that was used for the kzalloc(). 2) Stale cmd->text_in_ptr re-
free (double-free) on ERL>0 bad DataDigest drop. On DataDigest mismatch with ErrorRecoveryLevel > 0 the
handler silently drops the PDU and lets the initiator plug the CmdSN gap: kfree(text_in); return 0;
cmd->text_in_ptr still points at the freed buffer. The next Text Request on the same ITT re-enters
iscsit_setup_text_cmd(), which unconditionally does kfree(cmd->text_in_ptr); cmd->text_in_ptr = NULL;
freeing the same pointer a second time. Session teardown via iscsit_release_cmd() has the same shape and
hits the same double-free if the connection is dropped before a second Text Request arrives. On an
unmodified mainline tree the bug-1 CRC overread fires first on the initial valid Text Request and perturbs
the subsequent state, so #4 was isolated by building a kernel with only the bug-1 hunk of this patch
applied plus temporary printk() observability around the three relevant kfree() sites. The observability
prints are not part of this patch. On that build, a three-PDU Text Request sequence after login produces
two back-to-back splats: BUG: KASAN: double-free in iscsit_setup_text_cmd+0x?? BUG: KASAN: double-free in
iscsit_release_cmd+0x?? showing the same pointer freed in the ERL>0 drop path and again in
iscsit_setup_text_cmd() (next Text Request on the same ITT) and once more in iscsit_release_cmd() (session
teardown). On distro kernels with CONFIG_SLAB_FREELIST_HARDENED=y (default) the double-free becomes a
remote kernel BUG(); on non-hardened kernels it corrupts the slab freelist. Fix by clearing
cmd->text_in_ptr after the kfree() in the ERL>0 drop path. With both hunks applied #4 is directly
observable on the stock tree without observability printks; fixing bug-1 alone would mask #4 less, not
more, so the hunks are submitted together. Both fixes are one-liners. The Text PDU state machine is
unchanged and the wire protocol is unaffected. (CVE-2026-63888)

Solution

Update the sys-kernel/csql-kernel-6_1 library and its related packages to version 18613.675.2 or later.

Plugin Details

Severity: Critical

ID: 467160

Version: Revision 1.1

Type: Local

Family: Google COS Security Checks

Published: 10/2/2026

Updated: 10/2/2026

Risk Information

VPR

Risk Factor: Medium

Score: 4.9

Percentile: 58.27

Vendor

Vendor Severity: LOW

CVSS v2

Risk Factor: Critical

Base Score: 10

Temporal Score: 7.4

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS Score Source: CVE-2026-63888

CVSS v3

Risk Factor: Critical

Base Score: 9.8

Temporal Score: 8.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Vulnerability Publication Date: 6/22/2026

Reference Information

CVE: CVE-2026-63888

Detections

Analytics