Google: sys-kernel/csql-kernel-6_1, sys-kernel/csql-kernel-6_6: security update to 18613.339.70

medium Tenable Cloud Security Plugin ID 472120

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

- In the Linux kernel, the following vulnerability has been resolved: ppp: fix race conditions in
ppp_fill_forward_path ppp_fill_forward_path() has two race conditions: 1. The ppp->channels list can
change between list_empty() and list_first_entry(), as ppp_lock() is not held. If the only channel is
deleted in ppp_disconnect_channel(), list_first_entry() may access an empty head or a freed entry, and
trigger a panic. 2. pch->chan can be NULL. When ppp_unregister_channel() is called, pch->chan is set to
NULL before pch is removed from ppp->channels. Fix these by using a lockless RCU approach: - Use
list_first_or_null_rcu() to safely test and access the first list entry. - Convert list modifications on
ppp->channels to their RCU variants and add synchronize_net() after removal. - Check for a NULL pch->chan
before dereferencing it. (CVE-2025-39673)

Solution

Update the sys-kernel/csql-kernel-6_1 library and its related packages to version 18613.339.70 or later.

Plugin Details

Severity: Medium

ID: 472120

Version: Revision 1.2

Type: Local

Family: Google COS Security Checks

Published: 10/3/2026

Updated: 10/3/2026

Risk Information

VPR

Risk Factor: Low

Score: 3

Percentile: 23.36

Vendor

Vendor Severity: LOW

CVSS v2

Risk Factor: Low

Base Score: 3.8

Temporal Score: 2.8

Vector: CVSS2#AV:L/AC:H/Au:S/C:N/I:N/A:C

CVSS Score Source: CVE-2025-39673

CVSS v3

Risk Factor: Medium

Base Score: 4.7

Temporal Score: 4.1

Vector: CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Vulnerability Publication Date: 9/5/2025

Reference Information

CVE: CVE-2025-39673

Detections

Analytics