Detections
Analytics

Google: sys-kernel/cchost-kernel-6_12, sys-kernel/csql-kernel-6_12: security update to 19506.120.64

medium Tenable Cloud Security Plugin ID 469069

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - In the Linux kernel, the following vulnerability has been resolved: sched_ext: Fix stale direct dispatch
 state in ddsp_dsq_id @p->scx.ddsp_dsq_id can be left set (non-SCX_DSQ_INVALID) triggering a spurious
 warning in mark_direct_dispatch() when the next wakeup's ops.select_cpu() calls scx_bpf_dsq_insert(), such
 as: WARNING: kernel/sched/ext.c:1273 at scx_dsq_insert_commit+0xcd/0x140 The root cause is that
 ddsp_dsq_id was only cleared in dispatch_enqueue(), which is not reached in all paths that consume or
 cancel a direct dispatch verdict. Fix it by clearing it at the right places: - direct_dispatch(): cache
 the direct dispatch state in local variables and clear it before dispatch_enqueue() on the synchronous
 path. For the deferred path, the direct dispatch state must remain set until
 process_ddsp_deferred_locals() consumes them. - process_ddsp_deferred_locals(): cache the dispatch state
 in local variables and clear it before calling dispatch_to_local_dsq(), which may migrate the task to
 another rq. - do_enqueue_task(): clear the dispatch state on the enqueue path (local/global/bypass
 fallbacks), where the direct dispatch verdict is ignored. - dequeue_task_scx(): clear the dispatch state
 after dispatch_dequeue() to handle both the deferred dispatch cancellation and the holding_cpu race,
 covering all cases where a pending direct dispatch is cancelled. - scx_disable_task(): clear the direct
 dispatch state when transitioning a task out of the current scheduler. Waking tasks may have had the
 direct dispatch state set by the outgoing scheduler's ops.select_cpu() and then been queued on a wake_list
 via ttwu_queue_wakelist(), when SCX_OPS_ALLOW_QUEUED_WAKEUP is set. Such tasks are not on the runqueue and
 are not iterated by scx_bypass(), so their direct dispatch state won't be cleared. Without this clear, any
 subsequent SCX scheduler that tries to direct dispatch the task will trigger the WARN_ON_ONCE() in
 mark_direct_dispatch(). (CVE-2026-31733)

Solution

Update the sys-kernel/cchost-kernel-6_12 library and its related packages to version 19506.120.64 or later.

See Also

https://storage.googleapis.com/cos-oval-vulnerability-feed/cos-129.oval.xml.tar.gz

Plugin Details

Severity: Medium

ID: 469069

Version: Revision 1.3

Type: Local

Published: 10/3/2026

Updated: 10/3/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Medium

Score: 5

Percentile: 93.2

Vendor

Vendor Severity: LOW

CVSS v2

Risk Factor: Medium

Base Score: 4.6

Temporal Score: 3.4

Vector: CVSS2#AV:L/AC:L/Au:S/C:N/I:N/A:C

CVSS Score Source: CVE-2026-31733

CVSS v3

Risk Factor: Medium

Base Score: 5.5

Temporal Score: 4.8

Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Vulnerability Publication Date: 5/1/2026

Reference Information

CVE: CVE-2026-31733