Detections
Analytics

Google: sys-kernel/cchost-kernel-6_12, sys-kernel/csql-kernel-6_12, sys-kernel/lakitu-kernel-6_12, sys-kernel/lakitu-nc-kernel-6_12: security update to 19506.120.97

medium Tenable Cloud Security Plugin ID 469563

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - In the Linux kernel, the following vulnerability has been resolved: x86-64: rename misleadingly named
 '__copy_user_nocache()' function This function was a masterclass in bad naming, for various historical
 reasons. It claimed to be a non-cached user copy. It is literally _neither_ of those things. It's a
 specialty memory copy routine that uses non-temporal stores for the destination (but not the source), and
 that does exception handling for both source and destination accesses. Also note that while it works for
 unaligned targets, any unaligned parts (whether at beginning or end) will not use non-temporal stores,
 since only words and quadwords can be non-temporal on x86. The exception handling means that it _can_ be
 used for user space accesses, but not on its own - it needs all the normal "start user space access" logic
 around it. But typically the user space access would be the source, not the non-temporal destination. That
 was the original intention of this, where the destination was some fragile persistent memory target that
 needed non-temporal stores in order to catch machine check exceptions synchronously and deal with them
 gracefully. Thus that non-descriptive name: one use case was to copy from user space into a non-cached
 kernel buffer. However, the existing users are a mix of that intended use-case, and a couple of random
 drivers that just did this as a performance tweak. Some of those random drivers then actively misused the
 user copying version (with STAC/CLAC and all) to do kernel copies without ever even caring about the
 exception handling, _just_ for the non-temporal destination. Rename it as a first small step to actually
 make it halfway sane, and change the prototype to be more normal: it doesn't take a user pointer unless
 the caller has done the proper conversion, and the argument size is the full size_t (it still won't
 actually copy more than 4GB in one go, but there's also no reason to silently truncate the size argument
 in the caller). Finally, use this now sanely named function in the NTB code, which mis-used a user copy
 version (with STAC/CLAC and all) of this interface despite it not actually being a user copy at all.
 (CVE-2026-43073)

Solution

Update the sys-kernel/cchost-kernel-6_12 library and its related packages to version 19506.120.97 or later.

See Also

https://storage.googleapis.com/cos-oval-vulnerability-feed/cos-129.oval.xml.tar.gz

Plugin Details

Severity: Medium

ID: 469563

Version: Revision 1.4

Type: Local

Published: 10/3/2026

Updated: 10/6/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Medium

Score: 5

Percentile: 94.32

Vendor

Vendor Severity: LOW

CVSS v2

Risk Factor: Medium

Base Score: 4.6

Temporal Score: 3.4

Vector: CVSS2#AV:L/AC:L/Au:S/C:N/I:N/A:C

CVSS Score Source: CVE-2026-43073

CVSS v3

Risk Factor: Medium

Base Score: 5.5

Temporal Score: 4.8

Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Vulnerability Publication Date: 5/5/2026

Reference Information

CVE: CVE-2026-43073