Google: sys-kernel/cchost-kernel-6_12, sys-kernel/csql-kernel-6_12: security update to 19506.0.140

high Tenable Cloud Security Plugin ID 472499

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

- In the Linux kernel, the following vulnerability has been resolved: net: consume xmit errors of GSO frames
udpgro_frglist.sh and udpgro_bench.sh are the flakiest tests currently in NIPA. They fail in the same
exact way, TCP GRO test stalls occasionally and the test gets killed after 10min. These tests use veth to
simulate GRO. They attach a trivial ("return XDP_PASS;") XDP program to the veth to force TSO off and NAPI
on. Digging into the failure mode we can see that the connection is completely stuck after a burst of
drops. The sender's snd_nxt is at sequence number N [1], but the receiver claims to have received
(rcv_nxt) up to N + 3 * MSS [2]. Last piece of the puzzle is that senders rtx queue is not empty (let's
say the block in the rtx queue is at sequence number N - 4 * MSS [3]). In this state, sender sends a
retransmission from the rtx queue with a single segment, and sequence numbers N-4*MSS:N-3*MSS [3].
Receiver sees it and responds with an ACK all the way up to N + 3 * MSS [2]. But sender will reject this
ack as TCP_ACK_UNSENT_DATA because it has no recollection of ever sending data that far out [1]. And we
are stuck. The root cause is the mess of the xmit return codes. veth returns an error when it can't xmit a
frame. We end up with a loss event like this: ------------------------------------------------- | GSO
super frame 1 | GSO super frame 2 | |-----------------------------------------------| | seg | seg | seg |
seg | seg | seg | seg | seg | | 1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 |
------------------------------------------------- x ok ok <ok>| ok ok ok <x> \\ snd_nxt "x" means packet
lost by veth, and "ok" means it went thru. Since veth has TSO disabled in this test it sees individual
segments. Segment 1 is on the retransmit queue and will be resent. So why did the sender not advance
snd_nxt even tho it clearly did send up to seg 8? tcp_write_xmit() interprets the return code from the
core to mean that data has not been sent at all. Since TCP deals with GSO super frames, not individual
segment the crux of the problem is that loss of a single segment can be interpreted as loss of all. TCP
only sees the last return code for the last segment of the GSO frame (in <> brackets in the diagram
above). Of course for the problem to occur we need a setup or a device without a Qdisc. Otherwise Qdisc
layer disconnects the protocol layer from the device errors completely. We have multiple ways to fix this.
1) make veth not return an error when it lost a packet. While this is what I think we did in the past, the
issue keeps reappearing and it's annoying to debug. The game of whack a mole is not great. 2) fix the damn
return codes We only talk about NETDEV_TX_OK and NETDEV_TX_BUSY in the documentation, so maybe we should
make the return code from ndo_start_xmit() a boolean. I like that the most, but perhaps some ancient, not-
really-networking protocol would suffer. 3) make TCP ignore the errors It is not entirely clear to me what
benefit TCP gets from interpreting the result of ip_queue_xmit()? Specifically once the connection is
established and we're pushing data - packet loss is just packet loss? 4) this fix Ignore the rc in the
Qdisc-less+GSO case, since it's unreliable. We already always return OK in the TCQ_F_CAN_BYPASS case. In
the Qdisc-less case let's be a bit more conservative and only mask the GSO errors. This path is taken by
non-IP-"networks" like CAN, MCTP etc, so we could regress some ancient thing. This is the simplest, but
also maybe the hackiest fix? Similar fix has been proposed by Eric in the past but never committed because
original reporter was working with an OOT driver and wasn't providing feedback (see Link).
(CVE-2026-43194)

Solution

Update the sys-kernel/cchost-kernel-6_12 library and its related packages to version 19506.0.140 or later.

Plugin Details

Severity: High

ID: 472499

Version: Revision 1.1

Type: Local

Family: Google COS Security Checks

Published: 10/3/2026

Updated: 10/3/2026

Risk Information

VPR

Risk Factor: Medium

Score: 5

Percentile: 93.96

Vendor

Vendor Severity: LOW

CVSS v2

Risk Factor: High

Base Score: 7.8

Temporal Score: 5.8

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C

CVSS Score Source: CVE-2026-43194

CVSS v3

Risk Factor: High

Base Score: 7.5

Temporal Score: 6.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Vulnerability Publication Date: 3/12/2026

Reference Information

CVE: CVE-2026-43194

Detections

Analytics