Google: sys-kernel/cchost-kernel-6_12, sys-kernel/csql-kernel-6_12, sys-kernel/lakitu-kernel-6_12, sys-kernel/lakitu-nc-kernel-6_12: security update to 19506.224.7

medium Tenable Cloud Security Plugin ID 469002

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

- In the Linux kernel, the following vulnerability has been resolved: md/raid10: fix deadlock with check
operation and nowait requests When an array check is running it will raise the barrier at which point
normal requests will become blocked and increment the nr_pending value to signal there is work pending
inside of wait_barrier(). NOWAIT requests do not block and so will return immediately with an error, and
additionally do not increment nr_pending in wait_barrier(). Upstream change commit 43806c3d5b9b ("raid10:
cleanup memleak at raid10_make_request") added a call to raid_end_bio_io() to fix a memory leak when
NOWAIT requests hit this condition. raid_end_bio_io() eventually calls allow_barrier() and it will
unconditionally do an atomic_dec_and_test(&conf->nr_pending) even though the corresponding increment on
nr_pending didn't happen in the NOWAIT case. This can be easily seen by starting a check operation while
an application is doing nowait IO on the same array. This results in a deadlocked state due to nr_pending
value underflowing and so the md resync thread gets stuck waiting for nr_pending to == 0. Output of
r10conf state of the array when we hit this condition: crash> struct r10conf barrier = 1, nr_pending = {
counter = -41 }, nr_waiting = 15, nr_queued = 0, Example of md_sync thread stuck waiting on
raise_barrier() and other requests stuck in wait_barrier(): md1_resync [<0>] raise_barrier+0xce/0x1c0
[<0>] raid10_sync_request+0x1ca/0x1ed0 [<0>] md_do_sync+0x779/0x1110 [<0>] md_thread+0x90/0x160 [<0>]
kthread+0xbe/0xf0 [<0>] ret_from_fork+0x34/0x50 [<0>] ret_from_fork_asm+0x1a/0x30
kworker/u1040:2+flush-253:4 [<0>] wait_barrier+0x1de/0x220 [<0>] regular_request_wait+0x30/0x180 [<0>]
raid10_make_request+0x261/0x1000 [<0>] md_handle_request+0x13b/0x230 [<0>] __submit_bio+0x107/0x1f0 [<0>]
submit_bio_noacct_nocheck+0x16f/0x390 [<0>] ext4_io_submit+0x24/0x40 [<0>] ext4_do_writepages+0x254/0xc80
[<0>] ext4_writepages+0x84/0x120 [<0>] do_writepages+0x7a/0x260 [<0>] __writeback_single_inode+0x3d/0x300
[<0>] writeback_sb_inodes+0x1dd/0x470 [<0>] __writeback_inodes_wb+0x4c/0xe0 [<0>] wb_writeback+0x18b/0x2d0
[<0>] wb_workfn+0x2a1/0x400 [<0>] process_one_work+0x149/0x330 [<0>] worker_thread+0x2d2/0x410 [<0>]
kthread+0xbe/0xf0 [<0>] ret_from_fork+0x34/0x50 [<0>] ret_from_fork_asm+0x1a/0x30 (CVE-2026-46050)

Solution

Update the sys-kernel/cchost-kernel-6_12 library and its related packages to version 19506.224.7 or later.

Plugin Details

Severity: Medium

ID: 469002

Version: Revision 1.5

Type: Local

Family: Google COS Security Checks

Published: 10/3/2026

Updated: 10/6/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Low

Score: 3

Percentile: 23.75

Vendor

Vendor Severity: LOW

CVSS v2

Risk Factor: Medium

Base Score: 4.6

Temporal Score: 3.4

Vector: CVSS2#AV:L/AC:L/Au:S/C:N/I:N/A:C

CVSS Score Source: CVE-2026-46050

CVSS v3

Risk Factor: Medium

Base Score: 5.5

Temporal Score: 4.8

Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Vulnerability Publication Date: 5/26/2026

Reference Information

CVE: CVE-2026-46050

Detections

Analytics