Detections
Analytics

Google: sys-kernel/csql-kernel-6_6, sys-kernel/lakitu-kernel-6_6, sys-kernel/lakitu-nc-kernel-6_6, sys-kernel/lakitu-vgpu-kernel-6_6: security update to 18867.584.3

high Tenable Cloud Security Plugin ID 467163

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - In the Linux kernel, the following vulnerability has been resolved: net/sched: cls_route: fix fastmap use-
 after-free on filter The route4 classifier maintains a 16-slot fastmap cache that stores raw struct
 route4_filter pointers indexed by (id, iif). The reader (route4_classify) populates this cache via
 route4_set_fastmap() for every classified packet that hits a filter. The writer (route4_delete,
 route4_change) clears the cache via route4_reset_fastmap() before RCU-deferred kfree of the filter. This
 creates a UAF race: 1. Reader walks the RCU-protected bucket chain, finds filter f 2. Writer unlinks f,
 calls route4_reset_fastmap(), then tcf_queue_work() 3. Reader calls route4_set_fastmap() and writes f into
 the cache *after* the writer's reset, caching a pointer about to be freed 4. After the RCU grace period,
 kfree(f) executes 5. Next classified packet on the same (id, iif) tuple hits the stale fastmap entry and
 reads f->res from freed memory Reproduced with an mdelay(100) accelerator in route4_set_fastmap() and a
 concurrent add/delete stress test (provided by both zdi and Santosh). Both triggered KASAN slab-use-after-
 free reports in the route4 fastmap paths. Fix: Introduce a per-filter boolean dying flag to suppress stale
 fastmap republishing by in-flight readers. (CVE-2026-74583)

Solution

Update the sys-kernel/csql-kernel-6_6 library and its related packages to version 18867.584.3 or later.

See Also

https://storage.googleapis.com/cos-oval-vulnerability-feed/cos-121.oval.xml.tar.gz

Plugin Details

Severity: High

ID: 467163

Version: Revision 1.1

Type: Local

Published: 10/2/2026

Updated: 10/2/2026

Risk Information

VPR

Risk Factor: High

Score: 7.6

Percentile: 98.35

Vendor

Vendor Severity: LOW

CVSS v2

Risk Factor: Medium

Base Score: 6.8

Temporal Score: 5

Vector: CVSS2#AV:L/AC:L/Au:S/C:C/I:C/A:C

CVSS Score Source: CVE-2026-74583

CVSS v3

Risk Factor: High

Base Score: 7.8

Temporal Score: 6.8

Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Vulnerability Publication Date: 8/21/2026

Reference Information

CVE: CVE-2026-74583