Detections
Analytics

Chainguard: linux-qemu-melange: security update to 6.18.49-r2

high Tenable Cloud Security Plugin ID 472546

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - In the Linux kernel, the following vulnerability has been resolved: net: pull headers in
 qdisc_pkt_len_segs_init() Most ndo_start_xmit() methods expects headers of gso packets to be already in
 skb->head. net/core/tso.c users are particularly at risk, because tso_build_hdr() does a memcpy(hdr,
 skb->data, hdr_len); qdisc_pkt_len_segs_init() already does a dissection of gso packets. Use
 pskb_may_pull() instead of skb_header_pointer() to make sure drivers do not have to reimplement this. Some
 malicious packets could be fed, detect them so that we can drop them sooner with a new
 SKB_DROP_REASON_SKB_BAD_GSO drop_reason. (CVE-2026-53091)

Solution

Update the linux-qemu-melange library and its related packages to version 6.18.49-r2 or later.

Plugin Details

Severity: High

ID: 472546

Version: Revision 1.1

Type: Local

Published: 10/3/2026

Updated: 10/3/2026

Risk Information

VPR

Risk Factor: Medium

Score: 4.9

Percentile: 58.27

CVSS v2

Risk Factor: Medium

Base Score: 6.2

Temporal Score: 4.6

Vector: CVSS2#AV:L/AC:L/Au:S/C:C/I:N/A:C

CVSS Score Source: CVE-2026-53091

CVSS v3

Risk Factor: High

Base Score: 7

Temporal Score: 6.1

Vector: CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Vulnerability Publication Date: 6/24/2026

Reference Information

CVE: CVE-2026-53091