Google: sys-kernel/cchost-kernel-6_18, sys-kernel/csql-kernel-6_18, sys-kernel/lakitu-kernel-6_18, sys-kernel/lakitu-nc-kernel-6_18: security update to 19862.0.0

high Tenable Cloud Security Plugin ID 470777

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

- In the Linux kernel, the following vulnerability has been resolved: mm/rmap: initialize nr_pages to 1 at
loop start in try_to_unmap_one Initialize nr_pages to 1 at the start of each loop iteration, like
folio_referenced_one() does. Without this, nr_pages computed by a previous folio_unmap_pte_batch() call
can be reused on a later iteration that does not run folio_unmap_pte_batch() again. mmap a 64K large folio
with MAP_ANONYMOUS | MAP_DROPPABLE, then call madvise(MADV_FREE), then make the last page device-exclusive
via HMM_DMIRROR_EXCLUSIVE. Trigger node reclaim through sysfs. Now, in try_to_unmap_one(), we will first
clear the first 15 out of 16 entries mapping the lazyfree folio. This will set nr_pages to 15. In the next
pvmw walk, this nr_pages gets reused on a device-exclusive pte, thus potentially corrupting folio
refcount/mapcount. At the moment, I have a userspace program which can make the kernel spit out a trace,
but the blow up is in folio_referenced_one(), because there are existing bugs in the interaction between
device-private and rmap (which too I am investigating). I did a one liner kernel change to avoid going
into folio_referenced_one(), and the kernel blows up at folio_remove_rmap_ptes in try_to_unmap_one which
is what I wanted. Note that the bug is there not since file folio batching but lazyfree folio batching,
since device-exclusive only works for anonymous folios. Userspace visible effect is simply kernel crashing
somewhere due to refcount/mapcount corruption. (CVE-2026-63950)

Solution

Update the sys-kernel/cchost-kernel-6_18 library and its related packages to version 19862.0.0 or later.

Plugin Details

Severity: High

ID: 470777

Version: Revision 1.6

Type: Local

Family: Google COS Security Checks

Published: 10/3/2026

Updated: 10/6/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Medium

Score: 4.9

Percentile: 58.15

Vendor

Vendor Severity: LOW

CVSS v2

Risk Factor: Medium

Base Score: 6.8

Temporal Score: 5

Vector: CVSS2#AV:L/AC:L/Au:S/C:C/I:C/A:C

CVSS Score Source: CVE-2026-63950

CVSS v3

Risk Factor: High

Base Score: 7.8

Temporal Score: 6.8

Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Vulnerability Publication Date: 6/22/2026

Reference Information

CVE: CVE-2026-63950

Detections

Analytics