Google: sys-kernel/csql-kernel-6_6, sys-kernel/lakitu-kernel-6_6, sys-kernel/lakitu-nc-kernel-6_6, sys-kernel/lakitu-vgpu-kernel-6_6: security update to 18867.528.3

high Tenable Cloud Security Plugin ID 467358

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

- In the Linux kernel, the following vulnerability has been resolved: ipv4: raw: reject IP_HDRINCL packets
with ihl < 5 raw_send_hdrinc() validates that the caller-supplied IPv4 header fits within the message
length: iphlen = iph->ihl * 4; err = -EINVAL; if (iphlen > length) goto error_free; if (iphlen >=
sizeof(*iph)) { /* fix up saddr, tot_len, id, csum, transport_header */ } It does not, however, reject ihl
< 5. For such a packet the "if (iphlen >= sizeof(*iph))" branch is skipped, leaving the crafted iphdr
untouched, but the packet is still handed to __ip_local_out() and onward. Downstream consumers that read
iph->ihl assume a sane value: net/ipv4/ah4.c:ah_output() in particular subtracts sizeof(struct iphdr) from
top_iph->ihl * 4 and passes the (signed-int-negative, then cast to size_t) result to memcpy(), producing
an OOB access of length close to SIZE_MAX and a host kernel panic. An IPv4 header with ihl < 5 is
malformed by definition (RFC 791: "Internet Header Length is the length of the internet header in 32 bit
words ... Note that the minimum value for a correct header is 5."). The kernel should not be willing to
inject such a packet into its own output path. Reject "iphlen < sizeof(*iph)" alongside the existing
"iphlen > length" check. This matches the principle that locally constructed packets that re-enter the IP
stack must pass the same basic sanity tests that a foreign packet would be subjected to. Once this lands,
the "if (iphlen >= sizeof(*iph))" wrapper around the fixup branch becomes redundant; left in place to keep
the patch minimal and backport-friendly. A follow-up can unwrap it. Note that commit 86f4c90a1c5c ("ipv4,
ipv6: ensure raw socket message is big enough to hold an IP header") ensures the message buffer is large
enough to hold an iphdr, but does not constrain the self-reported iph->ihl. Reachability: the malformed
packet source is any caller with CAP_NET_RAW, including an unprivileged process in a user+net namespace on
a kernel with CONFIG_USER_NS=y. The reproduced AH crash also requires a matching xfrm AH policy on the
outgoing route; a container granted CAP_NET_ADMIN can install that state and policy in its netns. Loopback
bypasses xfrm_output, so the trigger uses a real netdev. Reproduced on UML + KASAN: kernel-mode fault at
addr 0x0 with memcpy_orig at the crash site. Same shape reproduces inside a rootless Docker container with
--cap-add NET_ADMIN on a stock distro kernel. (CVE-2026-64114)

Solution

Update the sys-kernel/csql-kernel-6_6 library and its related packages to version 18867.528.3 or later.

Plugin Details

Severity: High

ID: 467358

Version: Revision 1.2

Type: Local

Family: Google COS Security Checks

Published: 10/2/2026

Updated: 10/3/2026

Risk Information

VPR

Risk Factor: High

Score: 7.6

Percentile: 98.28

Vendor

Vendor Severity: HIGH

CVSS v2

Risk Factor: Medium

Base Score: 6.8

Temporal Score: 5

Vector: CVSS2#AV:L/AC:L/Au:S/C:C/I:C/A:C

CVSS Score Source: CVE-2026-64114

CVSS v3

Risk Factor: High

Base Score: 7.8

Temporal Score: 6.8

Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Vulnerability Publication Date: 6/4/2026

Reference Information

CVE: CVE-2026-64114

Detections

Analytics