Google: sys-kernel/cchost-kernel-6_12, sys-kernel/csql-kernel-6_12, sys-kernel/csql-kernel-6_6, sys-kernel/lakitu-kernel-6_12, sys-kernel/lakitu-kernel-6_6, sys-kernel/lakitu-nc-kernel-6_12, sys-kernel/lakitu-nc-kernel-6_6, sys-kernel/lakitu-vgpu-kernel-6_6: security update to 19216.655.6

critical Tenable Cloud Security Plugin ID 468716

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

- In the Linux kernel, the following vulnerability has been resolved: nfs: use nfsi->rwsem to protect
traversal of the file lock list Lingfeng identified a bug and suggested two solutions, but both appear to
have issues. Generally, we cannot release flc_lock while iterating over the file lock list to avoid use-
after-free (UAF) problems with file locks. However, functions like nfs_delegation_claim_locks and
nfs4_reclaim_locks cannot adhere to this rule because recover_lock or nfs4_lock_delegation_recall may take
a long time. To resolve this, NFS switches to using nfsi->rwsem for the same protection, and
nfs_reclaim_locks follows this approach. Although nfs_delegation_claim_locks uses so_delegreturn_mutex
instead, this is inadequate since a single inode can have multiple nfs4_state instances. Therefore, the
fix is to also use nfsi->rwsem in this case. Furthermore, after commit c69899a17ca4 ("NFSv4: Update of VFS
byte range lock must be atomic with the stateid update"), the functions nfs4_locku_done and nfs4_lock_done
also break this rule because they call locks_lock_inode_wait without holding nfsi->rwsem. Simply adding
this protection could cause many deadlocks, so instead, the call to locks_lock_inode_wait is moved into
_nfs4_proc_setlk. Regarding the bug fixed by commit c69899a17ca4 ("NFSv4: Update of VFS byte range lock
must be atomic with the stateid update"), it has been resolved after commit 0460253913e5 ("NFSv4:
nfs4_do_open() is incorrectly triggering state recovery") because all slots are drained before calling
nfs4_do_reclaim, which prevents concurrent stateid changes along this path. Also,
nfs_delegation_claim_locks does not cause this concurrency either since when _nfs4_proc_setlk is called
with NFS_DELEGATED_STATE, no RPC is sent, so nfs4_lock_done is not called. Therefore,
nfs4_lock_delegation_recall from nfs_delegation_claim_locks is the first time the stateid is set.
(CVE-2026-72472)

Solution

Update the sys-kernel/cchost-kernel-6_12 library and its related packages to version 19216.655.6 or later.

Plugin Details

Severity: Critical

ID: 468716

Version: Revision 1.6

Type: Local

Family: Google COS Security Checks

Published: 10/3/2026

Updated: 10/6/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Medium

Score: 4.9

Percentile: 58.13

Vendor

Vendor Severity: LOW

CVSS v2

Risk Factor: Critical

Base Score: 10

Temporal Score: 7.4

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS Score Source: CVE-2026-72472

CVSS v3

Risk Factor: Critical

Base Score: 9.8

Temporal Score: 8.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Vulnerability Publication Date: 8/11/2026

Reference Information

CVE: CVE-2026-72472

Detections

Analytics