Detections
Analytics

Google: sys-kernel/cchost-kernel-6_18, sys-kernel/csql-kernel-6_18, sys-kernel/lakitu-kernel-6_18, sys-kernel/lakitu-nc-kernel-6_18: security update to 19862.0.0

medium Tenable Cloud Security Plugin ID 470237

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - In the Linux kernel, the following vulnerability has been resolved: net: ethtool: fix NULL pointer
 dereference in phy_reply_size In phy_prepare_data(), several strings such as 'name', 'drvname',
 'upstream_sfp_name', and 'downstream_sfp_name' are allocated using kstrdup(). However, these allocations
 were not checked for failure. If kstrdup() fails for 'name', it returns NULL while the function continues.
 This leads to a kernel NULL pointer dereference and panic later in phy_reply_size() when it
 unconditionally calls strlen() on the NULL pointer. While other strings like 'upstream_sfp_name' might be
 checked before access in certain code paths, failing to handle these allocations consistently can lead to
 incomplete data reporting or hidden bugs. Fix this by adding proper NULL checks for all kstrdup() calls in
 phy_prepare_data() and implement a centralized error handling path using goto labels to ensure all
 previously allocated resources are freed on failure. (CVE-2026-64120)

Solution

Update the sys-kernel/cchost-kernel-6_18 library and its related packages to version 19862.0.0 or later.

See Also

https://storage.googleapis.com/cos-oval-vulnerability-feed/cos-133.oval.xml.tar.gz

Plugin Details

Severity: Medium

ID: 470237

Version: Revision 1.5

Type: Local

Published: 10/3/2026

Updated: 10/6/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Medium

Score: 5

Percentile: 93.82

Vendor

Vendor Severity: MEDIUM

CVSS v2

Risk Factor: Medium

Base Score: 4.6

Temporal Score: 3.4

Vector: CVSS2#AV:L/AC:L/Au:S/C:N/I:N/A:C

CVSS Score Source: CVE-2026-64120

CVSS v3

Risk Factor: Medium

Base Score: 5.5

Temporal Score: 4.8

Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Vulnerability Publication Date: 6/22/2026

Reference Information

CVE: CVE-2026-64120