Google: sys-kernel/cchost-kernel-6_12, sys-kernel/csql-kernel-6_12: security update to 19506.0.17

high Tenable Cloud Security Plugin ID 472133

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

- In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: fix inverted
genmask check in nft_map_catchall_activate() nft_map_catchall_activate() has an inverted element activity
check compared to its non-catchall counterpart nft_mapelem_activate() and compared to what is logically
required. nft_map_catchall_activate() is called from the abort path to re-activate catchall map elements
that were deactivated during a failed transaction. It should skip elements that are already active (they
don't need re-activation) and process elements that are inactive (they need to be restored). Instead, the
current code does the opposite: it skips inactive elements and processes active ones. Compare the non-
catchall activate callback, which is correct: nft_mapelem_activate(): if (nft_set_elem_active(ext,
iter->genmask)) return 0; /* skip active, process inactive */ With the buggy catchall version:
nft_map_catchall_activate(): if (!nft_set_elem_active(ext, genmask)) continue; /* skip inactive, process
active */ The consequence is that when a DELSET operation is aborted, nft_setelem_data_activate() is never
called for the catchall element. For NFT_GOTO verdict elements, this means nft_data_hold() is never called
to restore the chain->use reference count. Each abort cycle permanently decrements chain->use. Once
chain->use reaches zero, DELCHAIN succeeds and frees the chain while catchall verdict elements still
reference it, resulting in a use-after-free. This is exploitable for local privilege escalation from an
unprivileged user via user namespaces + nftables on distributions that enable CONFIG_USER_NS and
CONFIG_NF_TABLES. Fix by removing the negation so the check matches nft_mapelem_activate(): skip active
elements, process inactive ones. (CVE-2026-23111)

Solution

Update the sys-kernel/cchost-kernel-6_12 library and its related packages to version 19506.0.17 or later.

Plugin Details

Severity: High

ID: 472133

Version: Revision 1.2

Type: Local

Family: Google COS Security Checks

Published: 10/3/2026

Updated: 10/3/2026

Risk Information

VPR

Risk Factor: High

Score: 7.9

Percentile: 99.36

Vendor

Vendor Severity: LOW

CVSS v2

Risk Factor: Medium

Base Score: 6.8

Temporal Score: 5.3

Vector: CVSS2#AV:L/AC:L/Au:S/C:C/I:C/A:C

CVSS Score Source: CVE-2026-23111

CVSS v3

Risk Factor: High

Base Score: 7.8

Temporal Score: 7

Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

Vulnerability Information

Exploit Available: true

Exploit Ease: Exploits are available

Vulnerability Publication Date: 2/13/2026

Reference Information

CVE: CVE-2026-23111

Detections

Analytics