Google: sys-kernel/cchost-kernel-6_12, sys-kernel/csql-kernel-6_12, sys-kernel/csql-kernel-6_6, sys-kernel/lakitu-kernel-6_12, sys-kernel/lakitu-kernel-6_6, sys-kernel/lakitu-nc-kernel-6_12, sys-kernel/lakitu-nc-kernel-6_6, sys-kernel/lakitu-vgpu-kernel-6_6: security update to 19216.739.5

medium Tenable Cloud Security Plugin ID 475133

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

- In the Linux kernel, the following vulnerability has been resolved: vlan: fix skb_under_panic and races
when toggling HW VLAN offload Toggling hardware VLAN TX offload (NETIF_F_HW_VLAN_CTAG_TX or
NETIF_F_HW_VLAN_STAG_TX) on a lower device invokes vlan_transfer_features(), which dynamically changed
vlandev->hard_header_len. This causes two issues: 1. Lockless TX paths (e.g. packet_snd in af_packet.c,
ip6_finish_output2) read dev->hard_header_len without holding RTNL lock. Mutating hard_header_len
dynamically under RTNL creates a data race where upper layers reserve insufficient headroom based on a
stale hard_header_len, resulting in skb_under_panic when vlan_dev_hard_header() is called. 2. In addition,
vlan_transfer_features() updated hard_header_len without updating header_ops, causing a mismatch between
allocated headroom and header creation. Always setting dev->hard_header_len = real_dev->hard_header_len
and dev->needed_headroom = real_dev->needed_headroom + VLAN_HLEN unconditionally ensures: -
dev->hard_header_len remains 100% static and immutable at real_dev->hard_header_len, eliminating all
dynamic runtime updates and data races on hard_header_len. - Upper layers allocating skbs via
LL_RESERVED_SPACE() will always reserve sufficient headroom for software VLAN tag insertion
(real_dev->hard_header_len + real_dev->needed_headroom + VLAN_HLEN). - vlandev inherits
real_dev->needed_tailroom so underlying trailer/padding/ICV requirements are honored. - AF_PACKET SOCK_RAW
network header offsets remain correctly aligned at real_dev->hard_header_len. - vlan_header_ops is used
unconditionally. Note to stable teams: Make sure to backport these commits: e16e960d55a4 ("ipvlan: inherit
needed_headroom and needed_tailroom from phy_dev") cef51860becd ("macvlan: inherit needed_headroom and
needed_tailroom from lowerdev") (CVE-2026-80925)

Solution

Update the sys-kernel/cchost-kernel-6_12 library and its related packages to version 19216.739.5 or later.

Plugin Details

Severity: Medium

ID: 475133

Version: Revision 1.1

Type: Local

Family: Google COS Security Checks

Published: 10/16/2026

Updated: 10/16/2026

Risk Information

VPR

Risk Factor: Low

Score: 3

Percentile: 23.74

Vendor

Vendor Severity: LOW

CVSS v2

Risk Factor: High

Base Score: 7.2

Temporal Score: 5.3

Vector: CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C

CVSS Score Source: CVE-2026-80925

CVSS v3

Risk Factor: Medium

Base Score: 5.5

Temporal Score: 4.8

Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Vulnerability Publication Date: 9/9/2026

Reference Information

CVE: CVE-2026-80925

Detections

Analytics