Google: sys-kernel/csql-kernel-6_6, sys-kernel/lakitu-kernel-6_6, sys-kernel/lakitu-nc-kernel-6_6, sys-kernel/lakitu-vgpu-kernel-6_6: security update to 18867.584.3

critical Tenable Cloud Security Plugin ID 467281

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

- In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: vgic: Check the interrupt
is still ours before migrating it vgic_prune_ap_list() drops both ap_list_lock and irq_lock while
migrating an interrupt to another vCPU. After reacquiring the locks it only checks that the affinity is
unchanged (target_vcpu == vgic_target_oracle(irq)) before moving the interrupt, which assumes that an
interrupt whose affinity is preserved is still queued on this vCPU's ap_list. That assumption no longer
holds if the interrupt is taken off the ap_list while the locks are dropped. vgic_flush_pending_lpis()
removes the interrupt from the list and sets irq->vcpu to NULL, but leaves enabled/pending/target_vcpu
untouched. As the interrupt is still enabled and pending, vgic_target_oracle() returns the same
target_vcpu, so the affinity check passes and list_del() is run a second time on an entry that has already
been removed. Also check that the interrupt is still assigned to this vCPU (irq->vcpu == vcpu) before
moving it. (CVE-2026-72289)

Solution

Update the sys-kernel/csql-kernel-6_6 library and its related packages to version 18867.584.3 or later.

Plugin Details

Severity: Critical

ID: 467281

Version: Revision 1.2

Type: Local

Family: Google COS Security Checks

Published: 10/2/2026

Updated: 10/3/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Medium

Score: 5

Percentile: 93.3

Vendor

Vendor Severity: LOW

CVSS v2

Risk Factor: High

Base Score: 7.2

Temporal Score: 5.3

Vector: CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C

CVSS Score Source: CVE-2026-72289

CVSS v3

Risk Factor: Critical

Base Score: 9.3

Temporal Score: 8.1

Vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Vulnerability Publication Date: 8/11/2026

Reference Information

CVE: CVE-2026-72289

Detections

Analytics