Google: sys-kernel/cchost-kernel-6_18, sys-kernel/csql-kernel-6_18, sys-kernel/lakitu-kernel-6_18, sys-kernel/lakitu-nc-kernel-6_18: security update to 19999.44.106

high Tenable Cloud Security Plugin ID 475134

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

- In the Linux kernel, the following vulnerability has been resolved: exit: hold a reference to thread_pid
across proc_flush_pid Commit 0a36bad01731 ("release_task: kill the no longer needed
get/put_pid(thread_pid)") removed the reference around proc_flush_pid(). It assumed that
free_pids(post.pids) at the end of release_task() would keep thread_pid alive until then. That assumption
is wrong. __change_pid() only records a detached PID in post.pids when pid_has_task() is false for every
PIDTYPE. If another task still uses the exiting task's PID as its process group or session ID,
__unhash_process() removes the exiting task's PIDTYPE_PID link but leaves the PID out of post.pids.
release_task() therefore holds no reference to it after dropping tasklist_lock. The other task can then
remove the remaining PIDTYPE links. Its free_pids() call schedules delayed_put_pid(), and the RCU callback
can free the PID before the first release_task() reaches proc_flush_pid(). An unprivileged reproducer
races wait4(-1) against setsid() to trigger this ordering. Three of three fresh v7.2 KASAN boots reported:
BUG: KASAN: slab-use-after-free in proc_invalidate_siblings_dcache+0x3e2/0x3f0 Read of size 8 by task
h7_pid_reaper/1921 Call Trace: proc_invalidate_siblings_dcache release_task wait_consider_task __do_wait
do_wait kernel_wait4 Freed by task 0: kmem_cache_free put_pid delayed_put_pid rcu_core Last potentially
related work creation: __call_rcu_common free_pids ksys_setsid KASAN identified a 144-byte object from the
pid cache and located the bad read 80 bytes into the freed object, matching pid->inodes. With an explicit
reference, three of three fresh boots completed without a KASAN report. The concurrent RCU callback
dropped its reference while proc_flush_pid() was protected, and the balancing put_pid() performed the
final free afterward. Take a reference before __unhash_process() clears p->thread_pid and release it after
proc_flush_pid() completes. A tested source reproducer is available privately on request. No controlled
read or write, information leak, or privilege escalation is claimed. The mainline patch applies directly
to v6.19.y and newer; v6.16.y through v6.18.y need a context-adjusted backport. (CVE-2026-97903)

Solution

Update the sys-kernel/cchost-kernel-6_18 library and its related packages to version 19999.44.106 or later.

Plugin Details

Severity: High

ID: 475134

Version: Revision 1.1

Type: Local

Family: Google COS Security Checks

Published: 10/16/2026

Updated: 10/16/2026

Risk Information

VPR

Risk Factor: Medium

Score: 4.9

Percentile: 58.37

Vendor

Vendor Severity: HIGH

CVSS v2

Risk Factor: Medium

Base Score: 6.8

Temporal Score: 5

Vector: CVSS2#AV:L/AC:L/Au:S/C:C/I:C/A:C

CVSS Score Source: CVE-2026-97903

CVSS v3

Risk Factor: High

Base Score: 7.8

Temporal Score: 6.8

Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Vulnerability Publication Date: 9/25/2026

Reference Information

CVE: CVE-2026-97903

Detections

Analytics