Google: sys-kernel/csql-kernel-6_1, sys-kernel/csql-kernel-6_6: security update to 18613.339.70

medium Tenable Cloud Security Plugin ID 471335

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

- In the Linux kernel, the following vulnerability has been resolved: mm: move page table sync declarations
to linux/pgtable.h During our internal testing, we started observing intermittent boot failures when the
machine uses 4-level paging and has a large amount of persistent memory: BUG: unable to handle page fault
for address: ffffe70000000034 #PF: supervisor write access in kernel mode #PF: error_code(0x0002) - not-
present page PGD 0 P4D 0 Oops: 0002 [#1] SMP NOPTI RIP: 0010:__init_single_page+0x9/0x6d Call Trace:
<TASK> __init_zone_device_page+0x17/0x5d memmap_init_zone_device+0x154/0x1bb pagemap_range+0x2e0/0x40f
memremap_pages+0x10b/0x2f0 devm_memremap_pages+0x1e/0x60 dev_dax_probe+0xce/0x2ec [device_dax]
dax_bus_probe+0x6d/0xc9 [... snip ...] </TASK> It turns out that the kernel panics while initializing
vmemmap (struct page array) when the vmemmap region spans two PGD entries, because the new PGD entry is
only installed in init_mm.pgd, but not in the page tables of other tasks. And looking at
__populate_section_memmap(): if (vmemmap_can_optimize(altmap, pgmap)) // does not sync top level page
tables r = vmemmap_populate_compound_pages(pfn, start, end, nid, pgmap); else // sync top level page
tables in x86 r = vmemmap_populate(start, end, nid, altmap); In the normal path, vmemmap_populate() in
arch/x86/mm/init_64.c synchronizes the top level page table (See commit 9b861528a801 ("x86-64, mem: Update
all PGDs for direct mapping and vmemmap mapping changes")) so that all tasks in the system can see the new
vmemmap area. However, when vmemmap_can_optimize() returns true, the optimized path skips synchronization
of top-level page tables. This is because vmemmap_populate_compound_pages() is implemented in core MM
code, which does not handle synchronization of the top-level page tables. Instead, the core MM has
historically relied on each architecture to perform this synchronization manually. We're not the first
party to encounter a crash caused by not-sync'd top level page tables: earlier this year, Gwan-gyeong Mun
attempted to address the issue [1] [2] after hitting a kernel panic when x86 code accessed the vmemmap
area before the corresponding top-level entries were synced. At that time, the issue was believed to be
triggered only when struct page was enlarged for debugging purposes, and the patch did not get further
updates. It turns out that current approach of relying on each arch to handle the page table sync manually
is fragile because 1) it's easy to forget to sync the top level page table, and 2) it's also easy to
overlook that the kernel should not access the vmemmap and direct mapping areas before the sync. # The
solution: Make page table sync more code robust and harder to miss To address this, Dave Hansen suggested
[3] [4] introducing {pgd,p4d}_populate_kernel() for updating kernel portion of the page tables and allow
each architecture to explicitly perform synchronization when installing top-level entries. With this
approach, we no longer need to worry about missing the sync step, reducing the risk of future regressions.
The new interface reuses existing ARCH_PAGE_TABLE_SYNC_MASK, PGTBL_P*D_MODIFIED and
arch_sync_kernel_mappings() facility used by vmalloc and ioremap to synchronize page tables.
pgd_populate_kernel() looks like this: static inline void pgd_populate_kernel(unsigned long addr, pgd_t
*pgd, p4d_t *p4d) { pgd_populate(&init_mm, pgd, p4d); if (ARCH_PAGE_TABLE_SYNC_MASK & PGTBL_PGD_MODIFIED)
arch_sync_kernel_mappings(addr, addr); } It is worth noting that vmalloc() and apply_to_range() carefully
synchronizes page tables by calling p*d_alloc_track() and arch_sync_kernel_mappings(), and thus they are
not affected by ---truncated--- (CVE-2025-39844)

Solution

Update the sys-kernel/csql-kernel-6_1 library and its related packages to version 18613.339.70 or later.

Plugin Details

Severity: Medium

ID: 471335

Version: Revision 1.1

Type: Local

Family: Google COS Security Checks

Published: 10/3/2026

Updated: 10/3/2026

Risk Information

VPR

Risk Factor: Low

Score: 3

Percentile: 23.15

Vendor

Vendor Severity: LOW

CVSS v2

Risk Factor: Medium

Base Score: 4.6

Temporal Score: 3.4

Vector: CVSS2#AV:L/AC:L/Au:S/C:N/I:N/A:C

CVSS Score Source: CVE-2025-39844

CVSS v3

Risk Factor: Medium

Base Score: 5.5

Temporal Score: 4.8

Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Vulnerability Publication Date: 9/19/2025

Reference Information

CVE: CVE-2025-39844

Detections

Analytics