Google: sys-kernel/cchost-kernel-6_18, sys-kernel/csql-kernel-6_18, sys-kernel/lakitu-kernel-6_18, sys-kernel/lakitu-nc-kernel-6_18: security update to 19862.0.0

medium Tenable Cloud Security Plugin ID 469892

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

- In the Linux kernel, the following vulnerability has been resolved: dma-mapping: move dma_map_resource()
sanity check into debug code dma_map_resource() uses pfn_valid() to ensure the range is not RAM. However,
pfn_valid() only checks for availability of the memory map for a PFN but it does not ensure that the PFN
is actually backed by RAM. On ARM64 with SPARSEMEM (128MB section granularity), MMIO addresses that share
a section with RAM will falsely trigger the WARN_ON_ONCE and cause dma_map_resource() to return
DMA_MAPPING_ERROR. This causes a WARNING on Raspberry Pi 4 during spi_bcm2835 probe because the SPI FIFO
register (0xfe204004) falls in the same sparsemem section as the end of RAM (0xf8000000-0xfbffffff), both
in section 31 (0xf8000000-0xffffffff). Move the sanity check from dma_map_resource() into
debug_dma_map_phys() and replace the unreliable pfn_valid() with pfn_valid() && !PageReserved(), which
correctly identifies actual usable RAM without false positives for MMIO regions that happen to have struct
pages. Since dma_map_resource() is dma_map_phys(DMA_ATTR_MMIO), the check applies equally to both APIs.
Any non-reserved page represents kernel memory to a sufficient degree that using DMA_ATTR_MMIO on it is
almost certainly wrong and risks breaking coherency on non-coherent platforms. ZONE_DEVICE pages used for
PCI P2P DMA (MEMORY_DEVICE_PCI_P2PDMA) have PageReserved set, so they will not trigger a false positive.
The check no longer blocks the mapping and uses err_printk() to integrate with dma-debug filtering.
(CVE-2026-64149)

Solution

Update the sys-kernel/cchost-kernel-6_18 library and its related packages to version 19862.0.0 or later.

Plugin Details

Severity: Medium

ID: 469892

Version: Revision 1.6

Type: Local

Family: Google COS Security Checks

Published: 10/3/2026

Updated: 10/6/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Low

Score: 3

Percentile: 23.67

Vendor

Vendor Severity: MEDIUM

CVSS v2

Risk Factor: Medium

Base Score: 4.6

Temporal Score: 3.4

Vector: CVSS2#AV:L/AC:L/Au:S/C:N/I:N/A:C

CVSS Score Source: CVE-2026-64149

CVSS v3

Risk Factor: Medium

Base Score: 5.5

Temporal Score: 4.8

Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Vulnerability Publication Date: 6/22/2026

Reference Information

CVE: CVE-2026-64149

Detections

Analytics