Detections
Analytics

Google: sys-kernel/cchost-kernel-6_18, sys-kernel/csql-kernel-6_18, sys-kernel/lakitu-kernel-6_18, sys-kernel/lakitu-nc-kernel-6_18: security update to 20085.0.0

medium Tenable Cloud Security Plugin ID 471045

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - In the Linux kernel, the following vulnerability has been resolved: mm/ptdump: always stabilise against
 page table freeing using init_mm Previous commits have established the invariant that kernel page table
 freeing is performed while an mmap read lock on init_mm is held, which fixes races between ptdump and
 kernel page table freeing over init_mm. However, x86 and arm64 can perform a ptdump over an mm other than
 init_mm via ptdump_walk_pgd() and since kernel memory ranges are shared across non-kernel mm's, this means
 that the race still exists for these cases. Fix this by acquiring a nested mmap write lock for init_mm in
 ptdump_walk_pgd(). This is safe as we take this after mmap write locking the mm, and nothing acquires the
 init_mm lock first before locking an arbitrary mm, so no deadlock is possible. Also update
 walk_page_range_debug() to assert that init_mm is write locked, add a comment explaining why and remove
 some redundant code, and eliminate the unnecessary and confusing invocation of
 walk_kernel_page_table_range(). We can safely remove the non-NULL check for walk.mm, as the mmap lock
 asserts would NULL pointer deref if it was (and of course no callers do this). The first point at which
 ptdump can race kernel page table freeing is commit b6bdb7517c3d ("mm/vmalloc: add interfaces to free
 unmapped page table"), so we target this in the Fixes tag. (CVE-2026-74599)

Solution

Update the sys-kernel/cchost-kernel-6_18 library and its related packages to version 20085.0.0 or later.

See Also

https://storage.googleapis.com/cos-oval-vulnerability-feed/cos-138.oval.xml.tar.gz

Plugin Details

Severity: Medium

ID: 471045

Version: Revision 1.3

Type: Local

Published: 10/3/2026

Updated: 10/3/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Medium

Score: 4.3

Percentile: 53.43

Vendor

Vendor Severity: LOW

CVSS v2

Risk Factor: Medium

Base Score: 6.2

Temporal Score: 4.6

Vector: CVSS2#AV:L/AC:H/Au:N/C:C/I:C/A:C

CVSS Score Source: CVE-2026-74599

CVSS v3

Risk Factor: Medium

Base Score: 6.3

Temporal Score: 5.5

Vector: CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Vulnerability Publication Date: 8/22/2026

Reference Information

CVE: CVE-2026-74599