Google: sys-kernel/cchost-kernel-6_12, sys-kernel/csql-kernel-6_12, sys-kernel/lakitu-kernel-6_12, sys-kernel/lakitu-nc-kernel-6_12: security update to 19506.299.3

high Tenable Cloud Security Plugin ID 469832

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

- In the Linux kernel, the following vulnerability has been resolved: io_uring/net: inherit
IORING_CQE_F_BUF_MORE across bundle recv retries When a bundle recv retries inside io_recv_finish(), the
merge logic OR the saved cflags from the previous iteration with the cflags returned by the new iteration:
cflags = req->cqe.flags | (cflags & CQE_F_MASK); Bits listed in CQE_F_MASK are inherited from the new
iteration, and all other bits (notably IORING_CQE_F_BUFFER and the buffer ID) come from the saved cflags.
Before this change CQE_F_MASK covered only IORING_CQE_F_SOCK_NONEMPTY and IORING_CQE_F_MORE. When using
provided buffer rings (IOU_PBUF_RING_INC) with incremental mode, and bundle recv, io_kbuf_inc_commit() can
leave the head ring entry partially consumed, __io_put_kbufs() then sets IORING_CQE_F_BUF_MORE on the
returned cflags so userspace knows the buffer ID will be reused for subsequent completions. Because
IORING_CQE_F_BUF_MORE was not in CQE_F_MASK, the merge above silently dropped it whenever the final retry
iteration partially consumed the buffer, and the subsequent req->cqe.flags = cflags & ~CQE_F_MASK save
would have left a stale IORING_CQE_F_BUF_MORE in the carried-over cflags had one been present. Userspace
would then wrongfully advance it ring head past an entry the kernel still uses. Add IORING_CQE_F_BUF_MORE
to CQE_F_MASK so it is both inherited from the new iteration into the user-visible CQE and stripped from
the saved cflags between iterations. (CVE-2026-53191)

Solution

Update the sys-kernel/cchost-kernel-6_12 library and its related packages to version 19506.299.3 or later.

Plugin Details

Severity: High

ID: 469832

Version: Revision 1.6

Type: Local

Family: Google COS Security Checks

Published: 10/3/2026

Updated: 10/6/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Medium

Score: 4.9

Percentile: 58.02

Vendor

Vendor Severity: HIGH

CVSS v2

Risk Factor: Medium

Base Score: 6.8

Temporal Score: 5

Vector: CVSS2#AV:L/AC:L/Au:S/C:C/I:C/A:C

CVSS Score Source: CVE-2026-53191

CVSS v3

Risk Factor: High

Base Score: 7.8

Temporal Score: 6.8

Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Vulnerability Publication Date: 6/25/2026

Reference Information

CVE: CVE-2026-53191

Detections

Analytics