Detections
Analytics

Google: sys-kernel/cchost-kernel-6_12, sys-kernel/csql-kernel-6_6: security update to 19216.220.174

medium Tenable Cloud Security Plugin ID 467654

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - In the Linux kernel, the following vulnerability has been resolved: net: skb: fix cross-cache free of
 KFENCE-allocated skb head SKB_SMALL_HEAD_CACHE_SIZE is intentionally set to a non-power-of-2 value (e.g.
 704 on x86_64) to avoid collisions with generic kmalloc bucket sizes. This ensures that skb_kfree_head()
 can reliably use skb_end_offset to distinguish skb heads allocated from skb_small_head_cache vs. generic
 kmalloc caches. However, when KFENCE is enabled, kfence_ksize() returns the exact requested allocation
 size instead of the slab bucket size. If a caller (e.g. bpf_test_init) allocates skb head data via
 kzalloc() and the requested size happens to equal SKB_SMALL_HEAD_CACHE_SIZE, then slab_build_skb() ->
 ksize() returns that exact value. After subtracting skb_shared_info overhead, skb_end_offset ends up
 matching SKB_SMALL_HEAD_HEADROOM, causing skb_kfree_head() to incorrectly free the object to
 skb_small_head_cache instead of back to the original kmalloc cache, resulting in a slab cross-cache free:
 kmem_cache_free(skbuff_small_head): Wrong slab cache. Expected skbuff_small_head but got kmalloc-1k Fix
 this by always calling kfree(head) in skb_kfree_head(). This keeps the free path generic and avoids
 allocator-specific misclassification for KFENCE objects. (CVE-2026-31429)

Solution

Update the sys-kernel/cchost-kernel-6_12 library and its related packages to version 19216.220.174 or later.

See Also

https://storage.googleapis.com/cos-oval-vulnerability-feed/cos-125.oval.xml.tar.gz

Plugin Details

Severity: Medium

ID: 467654

Version: Revision 1.1

Type: Local

Published: 10/3/2026

Updated: 10/3/2026

Risk Information

VPR

Risk Factor: Medium

Score: 5

Percentile: 94.15

Vendor

Vendor Severity: MEDIUM

CVSS v2

Risk Factor: Medium

Base Score: 4.6

Temporal Score: 3.6

Vector: CVSS2#AV:L/AC:L/Au:S/C:N/I:N/A:C

CVSS Score Source: CVE-2026-31429

CVSS v3

Risk Factor: Medium

Base Score: 5.5

Temporal Score: 5

Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

Vulnerability Information

Exploit Available: true

Exploit Ease: Exploits are available

Vulnerability Publication Date: 4/20/2026

Reference Information

CVE: CVE-2026-31429