Google: sys-kernel/cchost-kernel-6_12, sys-kernel/csql-kernel-6_12: security update to 19506.120.64

high Tenable Cloud Security Plugin ID 472213

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

- In the Linux kernel, the following vulnerability has been resolved: smb: client: fix off-by-8 bounds check
in check_wsl_eas() The bounds check uses (u8 *)ea + nlen + 1 + vlen as the end of the EA name and value,
but ea_data sits at offset sizeof(struct smb2_file_full_ea_info) = 8 from ea, not at offset 0. The
strncmp() later reads ea->ea_data[0..nlen-1] and the value bytes follow at ea_data[nlen+1..nlen+vlen], so
the actual end is ea->ea_data + nlen + 1 + vlen. Isn't pointer math fun? The earlier check (u8 *)ea > end
- sizeof(*ea) only guarantees the 8-byte header is in bounds, but since the last EA is placed within 8
bytes of the end of the response, the name and value bytes are read past the end of iov. Fix this mess all
up by using ea->ea_data as the base for the bounds check. An "untrusted" server can use this to leak up to
8 bytes of kernel heap into the EA name comparison and influence which WSL xattr the data is interpreted
as. (CVE-2026-31614)

Solution

Update the sys-kernel/cchost-kernel-6_12 library and its related packages to version 19506.120.64 or later.

Plugin Details

Severity: High

ID: 472213

Version: Revision 1.1

Type: Local

Family: Google COS Security Checks

Published: 10/3/2026

Updated: 10/3/2026

Risk Information

VPR

Risk Factor: Medium

Score: 6.3

Percentile: 96.78

Vendor

Vendor Severity: LOW

CVSS v2

Risk Factor: Medium

Base Score: 6.2

Temporal Score: 4.6

Vector: CVSS2#AV:L/AC:L/Au:S/C:C/I:N/A:C

CVSS Score Source: CVE-2026-31614

CVSS v3

Risk Factor: High

Base Score: 7.1

Temporal Score: 6.2

Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Vulnerability Publication Date: 4/24/2026

Reference Information

CVE: CVE-2026-31614

Detections

Analytics