Google: sys-kernel/cchost-kernel-6_12, sys-kernel/cchost-kernel-6_18, sys-kernel/csql-kernel-6_12, sys-kernel/csql-kernel-6_18, sys-kernel/lakitu-kernel-6_12, sys-kernel/lakitu-kernel-6_18, sys-kernel/lakitu-nc-kernel-6_12, sys-kernel/lakitu-nc-kernel-6_18: security update to 19999.44.106

high Tenable Cloud Security Plugin ID 475298

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

- In the Linux kernel, the following vulnerability has been resolved: nfsd: fix fcache_disposal UAF by
inlining dispose state into nfsd_net nfsd_file_dispose_list_delayed() defers fput() to nfsd service
threads via a per-net freeme queue, preventing the shrinker and GC worker from bearing the cost of closing
files (see ffb402596147). However, the queue lives in a separately-allocated struct nfsd_fcache_disposal
that is freed by nfsd_free_fcache_disposal_net() during per-net teardown. The global shrinker, laundrette,
and fsnotify callbacks can still be inside nfsd_file_dispose_list_delayed() dereferencing that pointer,
causing a use-after-free. Inline the spinlock and freeme list directly into struct nfsd_net (as
fcache_dispose_lock and fcache_dispose_list), eliminating the separately allocated struct
nfsd_fcache_disposal entirely. These fields now have the same lifetime as the net namespace itself, so
there is no dangling pointer to chase. nfsd_file_cache_start_net() now just initializes the inline fields
and cannot fail due to allocation. nfsd_file_cache_shutdown_net() drains the inline list directly instead
of freeing a separate struct. The alloc/free helpers are removed. (CVE-2026-89682)

Solution

Update the sys-kernel/cchost-kernel-6_12 library and its related packages to version 19999.44.106 or later.

Plugin Details

Severity: High

ID: 475298

Version: Revision 1.1

Type: Local

Family: Google COS Security Checks

Published: 10/16/2026

Updated: 10/16/2026

Risk Information

VPR

Risk Factor: Medium

Score: 4.9

Percentile: 58.47

Vendor

Vendor Severity: LOW

CVSS v2

Risk Factor: High

Base Score: 7.6

Temporal Score: 5.6

Vector: CVSS2#AV:N/AC:H/Au:N/C:C/I:C/A:C

CVSS Score Source: CVE-2026-89682

CVSS v3

Risk Factor: High

Base Score: 8.1

Temporal Score: 7.1

Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Vulnerability Publication Date: 9/11/2026

Reference Information

CVE: CVE-2026-89682

Detections

Analytics