Google: sys-kernel/cchost-kernel-6_12, sys-kernel/csql-kernel-6_12, sys-kernel/lakitu-kernel-6_12, sys-kernel/lakitu-nc-kernel-6_12: security update to 19216.739.5

high Tenable Cloud Security Plugin ID 475025

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

- In the Linux kernel, the following vulnerability has been resolved: smb: client: fix busy dentry warning
on unmount after DIO Commit c68337442f03 ("cifs: Fix busy dentry used after unmounting") fixed the issue
in cifs where deferred close of a file led to a dentry reference count not being released in umount, by
flushing deferredclose_wq in cifs_kill_sb() to solve it. However, the cifs DIO path suffers from the same
busy-dentry problem caused by a delayed dentry reference-count release: [dio] [cifsd] [close + umount]
netfs_unbuffered_write_iter_locked ... cifs_demultiplex_thread netfs_unbuffered_write cifs_issue_write
netfs_wait_for_in_progress_stream [1] ... netfs_write_subrequest_terminated netfs_subreq_clear_in_progress
netfs_wake_collector // wake [1] netfs_put_subrequest netfs_put_request queue_work(system_dfl_wq, xxx) [2]
// dio write return cifs_close _cifsFileInfo_put // cfile->count 2->1 --cfile->count [3] // umount
cifs_kill_sb kill_anon_super // warning triggered! shrink_dcache_for_umount [4] [system_dfl_wq] [5]
netfs_free_request ... _cifsFileInfo_put // cfile->count 1->0 --cfile->count queue_work(fileinfo_put_wq,
xxx) [fileinfo_put_wq] [6] cifsFileInfo_put_work cifsFileInfo_put_final dput If the umount path is
triggered before [5], it results warning: BUG: Dentry 00000000eab1f070{i=9a917b66ae404fec,n=test} still in
use (1) [unmount of cifs cifs] The existing per-inode ictx->io_count wait in cifs_evict_inode() does not
help: it lives in the inode eviction path, which runs after shrink_dcache_for_umount() has already warned
about the busy dentries. Fix it by adding a per-superblock outstanding-rreq counter that is incremented in
cifs_init_request() and decremented in cifs_free_request(). In cifs_kill_sb(), before kill_anon_super(),
wait for this counter to reach 0 - which guarantees that all cleanup_work for this sb have run and thus
all relevant cfile puts are queued on fileinfo_put_wq or serverclose_wq. Then drain the workqueue so the
dentry refs are dropped. This is a targeted wait, not a flush of the system-wide system_dfl_wq.
(CVE-2026-72315)

Solution

Update the sys-kernel/cchost-kernel-6_12 library and its related packages to version 19216.739.5 or later.

Plugin Details

Severity: High

ID: 475025

Version: Revision 1.1

Type: Local

Family: Google COS Security Checks

Published: 10/16/2026

Updated: 10/16/2026

Risk Information

VPR

Risk Factor: Medium

Score: 4.9

Percentile: 58.13

Vendor

Vendor Severity: LOW

CVSS v2

Risk Factor: Medium

Base Score: 6.8

Temporal Score: 5

Vector: CVSS2#AV:L/AC:L/Au:S/C:C/I:C/A:C

CVSS Score Source: CVE-2026-72315

CVSS v3

Risk Factor: High

Base Score: 7.8

Temporal Score: 6.8

Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Vulnerability Publication Date: 8/15/2026

Reference Information

CVE: CVE-2026-72315

Detections

Analytics