Google: sys-kernel/csql-kernel-6_1, sys-kernel/csql-kernel-6_6, sys-kernel/lakitu-kernel-6_1, sys-kernel/lakitu-kernel-6_6, sys-kernel/lakitu-nc-kernel-6_6, sys-kernel/lakitu-vgpu-kernel-6_6, sys-kernel/tpusev-kernel-6_6: security update to 18613.731.2

medium Tenable Cloud Security Plugin ID 467164

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

- In the Linux kernel, the following vulnerability has been resolved: firmware_loader: Fix recursive lock in
device_cache_fw_images() A recursive locking deadlock can occur in the firmware loader's power management
notification handler. During system suspend or hibernation preparation, fw_pm_notify() calls
device_cache_fw_images(). This function acquires fw_lock to set the firmware cache state to
FW_LOADER_START_CACHE and then iterates over all devices using dpm_for_each_dev() while still holding the
lock. For each device, dev_cache_fw_image() schedules asynchronous work to cache the firmware. If memory
allocation for the async work entry fails (e.g., in out-of-memory conditions),
async_schedule_node_domain() falls back to executing the work function synchronously in the current
thread. The synchronous execution path (__async_dev_cache_fw_image() -> cache_firmware() ->
request_firmware() -> assign_fw()) attempts to acquire fw_lock again. Since the current thread already
holds fw_lock, this results in a recursive locking deadlock. Fix this by releasing fw_lock immediately
after updating the cache state and before calling dpm_for_each_dev(). The lock is only needed to protect
the state update. Concurrent firmware requests will correctly see the FW_LOADER_START_CACHE state and use
the piggyback mechanism, which is independently protected by its own fwc->name_lock. (CVE-2026-74331)

Solution

Update the sys-kernel/csql-kernel-6_1 library and its related packages to version 18613.731.2 or later.

Plugin Details

Severity: Medium

ID: 467164

Version: Revision 1.1

Type: Local

Family: Google COS Security Checks

Published: 10/2/2026

Updated: 10/2/2026

Risk Information

VPR

Risk Factor: Low

Score: 3

Percentile: 23.66

Vendor

Vendor Severity: LOW

CVSS v2

Risk Factor: Medium

Base Score: 4.9

Temporal Score: 3.6

Vector: CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C

CVSS Score Source: CVE-2026-74331

CVSS v3

Risk Factor: Medium

Base Score: 5.5

Temporal Score: 4.8

Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Vulnerability Publication Date: 8/11/2026

Reference Information

CVE: CVE-2026-74331

Detections

Analytics