Google: sys-kernel/cchost-kernel-6_12, sys-kernel/csql-kernel-6_12, sys-kernel/lakitu-kernel-6_12, sys-kernel/lakitu-nc-kernel-6_12: security update to 19506.448.8

high Tenable Cloud Security Plugin ID 469514

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

- In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: resize log->one_page_buf
when adopting on-disk page size log_replay() allocates log->one_page_buf using the page size that was
chosen from the host PAGE_SIZE: log->one_page_buf = kmalloc(log->page_size, GFP_NOFS); Later, when a
restart area is found, the log page size recorded on disk is adopted: t32 =
le32_to_cpu(log->rst_info.r_page->sys_page_size); if (log->page_size != t32) { log->l_size =
log->orig_file_size; log->page_size = norm_file_page(t32, &log->l_size, t32 == DefaultLogPageSize); } If
the on-disk page size is larger than the size used for the initial allocation, log->page_size grows but
one_page_buf is left at its original, smaller size. A subsequent unaligned read_log_page() then reads
log->page_size bytes into the undersized scratch buffer: page_buf = page_off ? log->one_page_buf :
*buffer; err = ntfs_read_run_nb_ra(ni->mi.sbi, &ni->file.run, page_vbo, page_buf, log->page_size, NULL,
&log->read_ahead); overflowing the allocation. This is reachable when mounting a dirty NTFS volume whose
log was formatted with a page size larger than the buffer initially allocated on the mounting host (for
example a 64K-log volume mounted on a host that allocated a 4K scratch buffer). Grow one_page_buf when the
adopted on-disk page size exceeds the size used for the initial allocation. On krealloc() failure the
original buffer is left intact and freed by the existing error path. (CVE-2026-72470)

Solution

Update the sys-kernel/cchost-kernel-6_12 library and its related packages to version 19506.448.8 or later.

Plugin Details

Severity: High

ID: 469514

Version: Revision 1.5

Type: Local

Family: Google COS Security Checks

Published: 10/3/2026

Updated: 10/6/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Medium

Score: 4.9

Percentile: 58.13

Vendor

Vendor Severity: LOW

CVSS v2

Risk Factor: Medium

Base Score: 6.8

Temporal Score: 5

Vector: CVSS2#AV:L/AC:L/Au:S/C:C/I:C/A:C

CVSS Score Source: CVE-2026-72470

CVSS v3

Risk Factor: High

Base Score: 7.8

Temporal Score: 6.8

Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Vulnerability Publication Date: 8/11/2026

Reference Information

CVE: CVE-2026-72470

Detections

Analytics