Google: sys-kernel/csql-kernel-6_6, sys-kernel/lakitu-kernel-6_6, sys-kernel/lakitu-nc-kernel-6_6, sys-kernel/lakitu-vgpu-kernel-6_6: security update to 18867.584.3

critical Tenable Cloud Security Plugin ID 472049

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

- In the Linux kernel, the following vulnerability has been resolved: xprtrdma: Decouple req recycling from
RPC completion rl_kref formerly served two distinct lifetimes through a single refcount: it gated when a
Reply could wake its RPC task, and it gated when an rpcrdma_req could return to its free pool. The marshal
path took the Send-side reference only when SGEs needed DMA-unmap (sc_unmap_count > 0), which made a Send
carrying only pre-registered buffers an exception: the Reply handler dropped rl_kref from 1 to 0 and freed
the req while the HCA might still be DMA-reading from its send buffer. Give rl_kref a narrower job. The
RPC layer takes one reference when slot allocation hands a req out. rpcrdma_prepare_send_sges() takes a
Send-side reference unconditionally after WR preparation succeeds. xprt_rdma_free_slot() and
xprt_rdma_bc_free_rqst() drop the RPC-layer reference; rpcrdma_sendctx_unmap() drops the Send-side
reference. The req returns to its free pool only after both owners have signed off. The existing
kref_init(&req->rl_kref) call in rpcrdma_prepare_send_sges() is removed. Initialization moves to the slot-
allocation paths (xprt_rdma_alloc_slot and rpcrdma_bc_rqst_get), and the release callback re-arms rl_kref
before the req returns to a free pool. A re-init in the marshal path would discard the RPC-layer reference
that already exists on entry. Three invariants follow: - Any rpcrdma_req held by an rpc_rqst has rl_kref
>= 1. xprt_rdma_alloc_slot(), rpcrdma_bc_rqst_get(), and the backlog-wake branch in xprt_rdma_alloc_slot()
each kref_init rl_kref before publishing the req. Without this invariant, an RPC task that aborts between
slot allocation and marshal (gss_refresh failure or signal during call_connect, for example) would drive
xprt_release() -> xprt_rdma_free_slot() -> kref_put against a refcount of zero, saturating refcount_t and
stranding the slot. - The Send-side reference is taken only after WR prep succeeds. A mapping failure in
rpcrdma_prepare_send_sges() runs rpcrdma_sendctx_cancel(), which DMA-unmaps the sendctx and clears sc_req
without touching rl_kref. The sendctx ring walks in rpcrdma_sendctx_put_locked() and
rpcrdma_sendctxs_destroy() skip entries with sc_req == NULL, so a burst of -EIO marshal failures cannot
hold reqs off rb_send_bufs. - The release callback re-arms rl_kref so the next consumer enters with the
invariant satisfied. Replies now complete the RPC directly. rpcrdma_reply_handler() calls
rpcrdma_complete_rqst() in place of kref_put on the non-LocalInv branch. The LocalInv branch already
completes the RPC from frwr_unmap_async() and is unaffected. Because Send-side references can now outlive
RPC completion, connection teardown drains sendctx entries whose unsignaled Sends never had a later
signaled completion to walk the ring. rpcrdma_sendctxs_destroy() walks the active range and runs
rpcrdma_sendctx_unmap() on each entry with a non-NULL sc_req before the request buffers are reset, and is
moved ahead of rpcrdma_reqs_reset() in rpcrdma_xprt_disconnect() so the reqs are still in their pre-reset
state when the Send-side refs are released. The drain creates a teardown-ordering hazard on the
backchannel path. With the new lifetime, releasing a bc_prealloc req from rpcrdma_req_release() re-adds it
to bc_pa_list. The disconnect in xprt_rdma_destroy() runs after xprt_destroy_backchannel() has already
emptied bc_pa_list, so the drained reqs would otherwise leak. xprt_rdma_destroy() now runs
xprt_rdma_bc_destroy(xprt, 0) a second time after the disconnect to reclaim them. (CVE-2026-72473)

Solution

Update the sys-kernel/csql-kernel-6_6 library and its related packages to version 18867.584.3 or later.

Plugin Details

Severity: Critical

ID: 472049

Version: Revision 1.1

Type: Local

Family: Google COS Security Checks

Published: 10/3/2026

Updated: 10/3/2026

Risk Information

VPR

Risk Factor: Medium

Score: 4.9

Percentile: 58.27

Vendor

Vendor Severity: LOW

CVSS v2

Risk Factor: Critical

Base Score: 10

Temporal Score: 7.4

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS Score Source: CVE-2026-72473

CVSS v3

Risk Factor: Critical

Base Score: 9.8

Temporal Score: 8.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Vulnerability Publication Date: 8/11/2026

Reference Information

CVE: CVE-2026-72473

Detections

Analytics