Google: sys-kernel/cchost-kernel-6_12, sys-kernel/cchost-kernel-6_18, sys-kernel/csql-kernel-6_12, sys-kernel/csql-kernel-6_18, sys-kernel/lakitu-kernel-6_12, sys-kernel/lakitu-kernel-6_18, sys-kernel/lakitu-nc-kernel-6_12, sys-kernel/lakitu-nc-kernel-6_18: security update to 19907.0.0

medium Tenable Cloud Security Plugin ID 471419

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

- In the Linux kernel, the following vulnerability has been resolved: sched_ext: Don't warn on NULL
cgrp_moving_from in scx_cgroup_move_task() A WARN fires when systemd's user manager writes "+cpu +memory
+pids" to its own subtree_control while a sched_ext scheduler is loaded: WARNING: at
kernel/sched/ext.c:3227 scx_cgroup_move_task+0xa8/0xb0 scx_cgroup_move_task+0xa8/0xb0
sched_move_task+0x134/0x290 cpu_cgroup_attach+0x39/0x70 cgroup_migrate_execute+0x37d/0x450
cgroup_update_dfl_csses+0x1e3/0x270 cgroup_subtree_control_write+0x3e7/0x440 scx_cgroup_can_attach() arms
cgrp_moving_from only when a task's cpu cgroup changes. It can still be NULL when scx_cgroup_move_task()
runs, through this sequence: Step Result ---------------------------------
---------------------------------- 1. cpu enabled on cgroup G cpu css = A 2. cpu toggled off then on for G
A killed, B created (same cgroup) 3. an exiting task keeps A alive migration skips it, A now stale 4.
+memory migrates G stale A vs current B pulls cpu in 5. cpu attach runs for all tasks hits a live, cpu-
unchanged task 6. scx_cgroup_move_task() on it cgrp_moving_from NULL -> WARN The mismatch is that
scx_cgroup_can_attach() keys on cgroup identity while migration drives the move on css identity, so a NULL
cgrp_moving_from here is a legitimate css-only migration, not a missing prep. The call is already gated on
cgrp_moving_from, so just drop the warning. ops.cgroup_prep_move() and ops.cgroup_move() stay paired.
(CVE-2026-53328)

Solution

Update the sys-kernel/cchost-kernel-6_12 library and its related packages to version 19907.0.0 or later.

Plugin Details

Severity: Medium

ID: 471419

Version: Revision 1.6

Type: Local

Family: Google COS Security Checks

Published: 10/3/2026

Updated: 10/6/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Low

Score: 3

Percentile: 23.75

Vendor

Vendor Severity: MEDIUM

CVSS v2

Risk Factor: Medium

Base Score: 4.6

Temporal Score: 3.4

Vector: CVSS2#AV:L/AC:L/Au:S/C:N/I:N/A:C

CVSS Score Source: CVE-2026-53328

CVSS v3

Risk Factor: Medium

Base Score: 5.5

Temporal Score: 4.8

Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Vulnerability Publication Date: 6/25/2026

Reference Information

CVE: CVE-2026-53328

Detections

Analytics