Detections
Analytics

Google: sys-kernel/cchost-kernel-6_12, sys-kernel/csql-kernel-6_12, sys-kernel/csql-kernel-6_6, sys-kernel/lakitu-kernel-6_12, sys-kernel/lakitu-kernel-6_6, sys-kernel/lakitu-nc-kernel-6_12, sys-kernel/lakitu-nc-kernel-6_6, sys-kernel/lakitu-vgpu-kernel-6_6: security update to 19216.655.6

medium Tenable Cloud Security Plugin ID 468761

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - In the Linux kernel, the following vulnerability has been resolved: net: packet: fix wrong
 transport_header when sending VLAN-tagged frame In packet_parse_headers(), when processing a VLAN-tagged
 frame, skb_set_network_header() is called to advance network_header past the VLAN tag to the inner
 protocol header. skb_probe_transport_header() is then called with skb->protocol still set to the outer
 VLAN EtherType (e.g. ETH_P_8021Q), while nhoff (derived from skb_network_offset()) already points past the
 VLAN tag to the inner protocol header. In __skb_flow_dissect(), proto is initialized to ETH_P_8021Q and
 nhoff points past the VLAN tag. When the dissector hits case ETH_P_8021Q, it reads a struct vlan_hdr at
 nhoff via __skb_header_pointer(), but that offset contains the inner protocol header (e.g. an IP header).
 The bytes are misinterpreted as a VLAN header, yielding a garbage encapsulated EtherType that matches no
 known protocol. The dissector returns false, so skb_probe_transport_header() never calls
 skb_set_transport_header(), leaving transport_header at its uninitialized sentinel value (~0U). Move
 skb_probe_transport_header() to before skb_set_network_header(). At the time skb_probe_transport_header()
 is called, network_header still points to the VLAN header, so nhoff correctly points to the VLAN header.
 The flow dissector can then parse the VLAN header, extract the inner EtherType, and advance nhoff to the
 inner protocol header, allowing transport_header to be set correctly. (CVE-2026-80906)

Solution

Update the sys-kernel/cchost-kernel-6_12 library and its related packages to version 19216.655.6 or later.

See Also

https://storage.googleapis.com/cos-oval-vulnerability-feed/cos-125.oval.xml.tar.gz

Plugin Details

Severity: Medium

ID: 468761

Version: Revision 1.5

Type: Local

Published: 10/3/2026

Updated: 10/6/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Low

Score: 3

Percentile: 23.66

Vendor

Vendor Severity: LOW

CVSS v2

Risk Factor: High

Base Score: 7.2

Temporal Score: 5.3

Vector: CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C

CVSS Score Source: CVE-2026-80906

CVSS v3

Risk Factor: Medium

Base Score: 5.5

Temporal Score: 4.8

Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Vulnerability Publication Date: 9/4/2026

Reference Information

CVE: CVE-2026-80906