Detections
Analytics

Google: sys-kernel/cchost-kernel-6_12, sys-kernel/csql-kernel-6_12: security update to 19506.0.140

medium Tenable Cloud Security Plugin ID 472255

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - In the Linux kernel, the following vulnerability has been resolved: ACPI: processor: Fix NULL-pointer
 dereference in acpi_processor_errata_piix4() In acpi_processor_errata_piix4(), the pointer dev is first
 assigned an IDE device and then reassigned an ISA device: dev = pci_get_subsys(...,
 PCI_DEVICE_ID_INTEL_82371AB, ...); dev = pci_get_subsys(..., PCI_DEVICE_ID_INTEL_82371AB_0, ...); If the
 first lookup succeeds but the second fails, dev becomes NULL. This leads to a potential null-pointer
 dereference when dev_dbg() is called: if (errata.piix4.bmisx) dev_dbg(&dev->dev, ...); To prevent this,
 use two temporary pointers and retrieve each device independently, avoiding overwriting dev with a
 possible NULL value. [ rjw: Subject adjustment, added an empty code line ] (CVE-2026-43313)

Solution

Update the sys-kernel/cchost-kernel-6_12 library and its related packages to version 19506.0.140 or later.

See Also

https://storage.googleapis.com/cos-oval-vulnerability-feed/cos-129.oval.xml.tar.gz

Plugin Details

Severity: Medium

ID: 472255

Version: Revision 1.1

Type: Local

Published: 10/3/2026

Updated: 10/3/2026

Risk Information

VPR

Risk Factor: Low

Score: 3

Percentile: 23.75

Vendor

Vendor Severity: LOW

CVSS v2

Risk Factor: Medium

Base Score: 4.6

Temporal Score: 3.4

Vector: CVSS2#AV:L/AC:L/Au:S/C:N/I:N/A:C

CVSS Score Source: CVE-2026-43313

CVSS v3

Risk Factor: Medium

Base Score: 5.5

Temporal Score: 4.8

Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Vulnerability Publication Date: 4/7/2026

Reference Information

CVE: CVE-2026-43313