Google: sys-kernel/cchost-kernel-6_12, sys-kernel/csql-kernel-6_12: security update to 19506.0.140

medium Tenable Cloud Security Plugin ID 471976

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

- In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Skip dev-iotlb flush for
inaccessible PCIe device without scalable mode PCIe endpoints with ATS enabled and passed through to
userspace (e.g., QEMU, DPDK) can hard-lock the host when their link drops, either by surprise removal or
by a link fault. Commit 4fc82cd907ac ("iommu/vt-d: Don't issue ATS Invalidation request when device is
disconnected") adds pci_dev_is_disconnected() to devtlb_invalidation_with_pasid() so ATS invalidation is
skipped only when the device is being safely removed, but it applies only when Intel IOMMU scalable mode
is enabled. With scalable mode disabled or unsupported, a system hard-lock occurs when a PCIe endpoint's
link drops because the Intel IOMMU waits indefinitely for an ATS invalidation that cannot complete. Call
Trace: qi_submit_sync qi_flush_dev_iotlb __context_flush_dev_iotlb.part.0 domain_context_clear_one_cb
pci_for_each_dma_alias device_block_translation blocking_domain_attach_dev iommu_deinit_device
__iommu_group_remove_device iommu_release_device iommu_bus_notifier blocking_notifier_call_chain
bus_notify device_del pci_remove_bus_device pci_stop_and_remove_bus_device pciehp_unconfigure_device
pciehp_disable_slot pciehp_handle_presence_or_link_change pciehp_ist Commit 81e921fd3216 ("iommu/vt-d: Fix
NULL domain on device release") adds intel_pasid_teardown_sm_context() to intel_iommu_release_device(),
which calls qi_flush_dev_iotlb() and can also hard-lock the system when a PCIe endpoint's link drops. Call
Trace: qi_submit_sync qi_flush_dev_iotlb __context_flush_dev_iotlb.part.0 intel_context_flush_no_pasid
device_pasid_table_teardown pci_pasid_table_teardown pci_for_each_dma_alias
intel_pasid_teardown_sm_context intel_iommu_release_device iommu_deinit_device __iommu_group_remove_device
iommu_release_device iommu_bus_notifier blocking_notifier_call_chain bus_notify device_del
pci_remove_bus_device pci_stop_and_remove_bus_device pciehp_unconfigure_device pciehp_disable_slot
pciehp_handle_presence_or_link_change pciehp_ist Sometimes the endpoint loses connection without a link-
down event (e.g., due to a link fault); killing the process (virsh destroy) then hard-locks the host. Call
Trace: qi_submit_sync qi_flush_dev_iotlb __context_flush_dev_iotlb.part.0 domain_context_clear_one_cb
pci_for_each_dma_alias device_block_translation blocking_domain_attach_dev __iommu_attach_device
__iommu_device_set_domain __iommu_group_set_domain_internal iommu_detach_group
vfio_iommu_type1_detach_group vfio_group_detach_container vfio_group_fops_release __fput
pci_dev_is_disconnected() only covers safe-removal paths; pci_device_is_present() tests accessibility by
reading vendor/device IDs and internally calls pci_dev_is_disconnected(). On a ConnectX-5 (8 GT/s, x2)
this costs ~70 µs. Since __context_flush_dev_iotlb() is only called on {attach,release}_dev paths (not
hot), add pci_device_is_present() there to skip inaccessible devices and avoid the hard-lock.
(CVE-2026-43161)

Solution

Update the sys-kernel/cchost-kernel-6_12 library and its related packages to version 19506.0.140 or later.

Plugin Details

Severity: Medium

ID: 471976

Version: Revision 1.1

Type: Local

Family: Google COS Security Checks

Published: 10/3/2026

Updated: 10/3/2026

Risk Information

VPR

Risk Factor: Low

Score: 3

Percentile: 23.63

Vendor

Vendor Severity: LOW

CVSS v2

Risk Factor: Medium

Base Score: 4.6

Temporal Score: 3.4

Vector: CVSS2#AV:L/AC:L/Au:S/C:N/I:N/A:C

CVSS Score Source: CVE-2026-43161

CVSS v3

Risk Factor: Medium

Base Score: 5.5

Temporal Score: 4.8

Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Vulnerability Publication Date: 4/7/2026

Reference Information

CVE: CVE-2026-43161

Detections

Analytics