Google: sys-kernel/cchost-kernel-6_12, sys-kernel/csql-kernel-6_6: security update to 19216.220.72

high Tenable Cloud Security Plugin ID 472078

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

- In the Linux kernel, the following vulnerability has been resolved: gve: Fix stats report corruption on
queue count change The driver and the NIC share a region in memory for stats reporting. The NIC calculates
its offset into this region based on the total size of the stats region and the size of the NIC's stats.
When the number of queues is changed, the driver's stats region is resized. If the queue count is
increased, the NIC can write past the end of the allocated stats region, causing memory corruption. If the
queue count is decreased, there is a gap between the driver and NIC stats, leading to incorrect stats
reporting. This change fixes the issue by allocating stats region with maximum size, and the offset
calculation for NIC stats is changed to match with the calculation of the NIC. (CVE-2026-23262)

Solution

Update the sys-kernel/cchost-kernel-6_12 library and its related packages to version 19216.220.72 or later.

Plugin Details

Severity: High

ID: 472078

Version: Revision 1.1

Type: Local

Family: Google COS Security Checks

Published: 10/3/2026

Updated: 10/3/2026

Risk Information

VPR

Risk Factor: Medium

Score: 4.9

Percentile: 58.36

Vendor

Vendor Severity: LOW

CVSS v2

Risk Factor: Medium

Base Score: 6.8

Temporal Score: 5

Vector: CVSS2#AV:L/AC:L/Au:S/C:C/I:C/A:C

CVSS Score Source: CVE-2026-23262

CVSS v3

Risk Factor: High

Base Score: 7.8

Temporal Score: 6.8

Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Vulnerability Publication Date: 2/19/2026

Reference Information

CVE: CVE-2026-23262

Detections

Analytics