Google: sys-kernel/cchost-kernel-6_12, sys-kernel/cchost-kernel-6_18, sys-kernel/csql-kernel-6_12, sys-kernel/csql-kernel-6_18, sys-kernel/lakitu-kernel-6_12, sys-kernel/lakitu-kernel-6_18, sys-kernel/lakitu-nc-kernel-6_12, sys-kernel/lakitu-nc-kernel-6_18: security update to 19999.0.46

medium Tenable Cloud Security Plugin ID 471182

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

- In the Linux kernel, the following vulnerability has been resolved: KVM: nVMX: Put vmcs12 pages if nested
VM-Enter fails due to invalid guest state Put all vmcs12 pages if KVM synthesizes a nested VM-Exit due to
invalid guest while emulating VMLAUNCH or VMRESUME. The invalid guest state path doesn't use
nested_vmx_vmexit() as that API is intended to be used if and only if L2 is active, and the open coded
equivalent neglects to put the vmcs12 pages. Failure to put the vmcs12 pages leaks any pinned pages
(and/or mappings) if L1 retries VMLAUNCH/VMRESUME. Note, the !from_vmenter scenario doesn't suffer the
same problem, as vmx_get_nested_state_pages() only gets/pins/maps the vmcs12 pages if L2 is active, i.e.
if a "full" VM-Exit is guaranteed before KVM will retry getting vmcs12 pages. (CVE-2026-68081)

Solution

Update the sys-kernel/cchost-kernel-6_12 library and its related packages to version 19999.0.46 or later.

Plugin Details

Severity: Medium

ID: 471182

Version: Revision 1.6

Type: Local

Family: Google COS Security Checks

Published: 10/3/2026

Updated: 10/6/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Low

Score: 3.3

Percentile: 50.58

Vendor

Vendor Severity: LOW

CVSS v2

Risk Factor: Medium

Base Score: 5.9

Temporal Score: 4.4

Vector: CVSS2#AV:L/AC:H/Au:M/C:C/I:C/A:C

CVSS Score Source: CVE-2026-68081

CVSS v3

Risk Factor: Medium

Base Score: 6

Temporal Score: 5.2

Vector: CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Vulnerability Publication Date: 8/8/2026

Reference Information

CVE: CVE-2026-68081

Detections

Analytics