Detections
Analytics

Google: sys-kernel/cchost-kernel-6_12, sys-kernel/csql-kernel-6_12: security update to 19506.0.98

medium Tenable Cloud Security Plugin ID 471832

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - In the Linux kernel, the following vulnerability has been resolved: ipvlan: Make the addrs_lock be per
 port Make the addrs_lock be per port, not per ipvlan dev. Initial code seems to be written in the
 assumption, that any address change must occur under RTNL. But it is not so for the case of IPv6. So 1)
 Introduce per-port addrs_lock. 2) It was needed to fix places where it was forgotten to take lock
 (ipvlan_open/ipvlan_close) This appears to be a very minor problem though. Since it's highly unlikely that
 ipvlan_add_addr() will be called on 2 CPU simultaneously. But nevertheless, this could cause: 1) False-
 negative of ipvlan_addr_busy(): one interface iterated through all port->ipvlans + ipvlan->addrs under
 some ipvlan spinlock, and another added IP under its own lock. Though this is only possible for IPv6,
 since looks like only ipvlan_addr6_event() can be called without rtnl_lock. 2) Race since
 ipvlan_ht_addr_add(port) is called under different ipvlan->addrs_lock locks This should not affect
 performance, since add/remove IP is a rare situation and spinlock is not taken on fast paths.
 (CVE-2026-23103)

Solution

Update the sys-kernel/cchost-kernel-6_12 library and its related packages to version 19506.0.98 or later.

See Also

https://storage.googleapis.com/cos-oval-vulnerability-feed/cos-129.oval.xml.tar.gz

Plugin Details

Severity: Medium

ID: 471832

Version: Revision 1.3

Type: Local

Published: 10/3/2026

Updated: 10/6/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Medium

Score: 5

Percentile: 94.12

Vendor

Vendor Severity: MEDIUM

CVSS v2

Risk Factor: Medium

Base Score: 4.6

Temporal Score: 3.4

Vector: CVSS2#AV:L/AC:L/Au:S/C:N/I:N/A:C

CVSS Score Source: CVE-2026-23103

CVSS v3

Risk Factor: Medium

Base Score: 5.5

Temporal Score: 4.8

Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Vulnerability Publication Date: 2/4/2026

Reference Information

CVE: CVE-2026-23103