Google: sys-kernel/cchost-kernel-6_12, sys-kernel/csql-kernel-6_12, sys-kernel/csql-kernel-6_6, sys-kernel/lakitu-kernel-6_12, sys-kernel/lakitu-kernel-6_6, sys-kernel/lakitu-nc-kernel-6_12, sys-kernel/lakitu-nc-kernel-6_6, sys-kernel/lakitu-vgpu-kernel-6_6: security update to 19216.700.7

high Tenable Cloud Security Plugin ID 474975

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

- In the Linux kernel, the following vulnerability has been resolved: nfsd: revoke copy-notify stateids
before dropping their reference Copy-notify stateids live in the s2s_cp_stateids IDR and on their parent
stid's sc_cp_list, pinned by a single membership reference. _free_cpntf_state_locked() only unlinks an
entry once its refcount reaches zero, so any revoke path that runs while a concurrent
find_cpntf_state()/manage_cpntf_state() holder has elevated cs_count drops the reference without
unlinking, leaving the entry discoverable with its membership reference already consumed. A second revoke
or a laundromat tick then frees it while the reader still holds the pointer -- a KASAN-detectable use-
after-free at the reader's nfs4_put_cpntf_state(). This affected all three revoke paths: - The parent-stid
drain (nfs4_free_cpntf_statelist()) repeatedly called _free_cpntf_state_locked() on the first list entry;
a holder that had bumped cs_count made it return early, so the next iteration re-decremented and burned
the holder's reference. - OFFLOAD_CANCEL (manage_cpntf_state()) and laundromat expiry likewise used
_free_cpntf_state_locked() and could drop 2->1 without unlinking. Add revoke_cpntf_state_locked(), which
unhashes the entry from the IDR and sc_cp_list first (deferring the final free to any holder), and use it
from all three revoke paths. The drain now walks with list_for_each_entry_safe() and revokes each entry
unconditionally, so it terminates in one pass per entry regardless of cs_count. The unhash is gated on
!list_empty(&cps->cp_list); the idr_remove() gate matters because idr_alloc_cyclic() may have recycled the
so_id by then. Keep _free_cpntf_state_locked() for the reference-holder put path only, where a concurrent
revoke may already have unlinked the entry (its list_del_init() then a no-op). (CVE-2026-89663)

Solution

Update the sys-kernel/cchost-kernel-6_12 library and its related packages to version 19216.700.7 or later.

Plugin Details

Severity: High

ID: 474975

Version: Revision 1.1

Type: Local

Family: Google COS Security Checks

Published: 10/16/2026

Updated: 10/16/2026

Risk Information

VPR

Risk Factor: Medium

Score: 4.9

Percentile: 58.42

Vendor

Vendor Severity: LOW

CVSS v2

Risk Factor: High

Base Score: 9

Temporal Score: 6.7

Vector: CVSS2#AV:N/AC:L/Au:S/C:C/I:C/A:C

CVSS Score Source: CVE-2026-89663

CVSS v3

Risk Factor: High

Base Score: 8.8

Temporal Score: 7.7

Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Vulnerability Publication Date: 9/11/2026

Reference Information

CVE: CVE-2026-89663

Detections

Analytics