Detections
Analytics

Google: sys-kernel/cchost-kernel-6_12, sys-kernel/cchost-kernel-6_18, sys-kernel/csql-kernel-6_12, sys-kernel/csql-kernel-6_18, sys-kernel/lakitu-kernel-6_12, sys-kernel/lakitu-kernel-6_18, sys-kernel/lakitu-nc-kernel-6_12, sys-kernel/lakitu-nc-kernel-6_18: security update to 19999.44.126

high Tenable Cloud Security Plugin ID 475308

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - In the Linux kernel, the following vulnerability has been resolved: net: lock the socket in
 sock_gettstamp() sk->sk_flags must only be changed while holding the socket lock, because sock_set_flag()
 and sock_reset_flag() use non atomic operations (__set_bit() and __clear_bit()). sock_gettstamp() is one
 of the last places where a bit of sk->sk_flags is changed from a syscall without owning the socket lock,
 through sock_enable_timestamp(sk, SOCK_TIMESTAMP). sk_set_memalloc() and sk_clear_memalloc() also change
 sk->sk_flags without the socket lock, but their callers (nbd, iscsi_tcp, nvme-tcp, sunrpc, wireguard) need
 a careful audit, this will be addressed in a separate patch. Jungwoo Lee and Wongi Lee reported an UDP
 socket use-after-free caused by this bug: a SIOCGSTAMPNS_NEW ioctl racing with bind() can cancel the
 SOCK_RCU_FREE bit that udp_lib_get_port() just set, because both threads perform a read-modify-write on
 the same word. CPU 0 (bind) CPU 1 (SIOCGSTAMPNS_NEW) --------------------------------
 ---------------------------- read sk_flags = F read sk_flags = F compute F | BIT(SOCK_RCU_FREE) compute F
 | BIT(SOCK_TIMESTAMP) store F | BIT(SOCK_RCU_FREE) sk_add_node_rcu(sk, ...) store F | BIT(SOCK_TIMESTAMP)
 After the lost update, SOCK_RCU_FREE is clear while the socket is visible to lockless UDP receive lookups.
 sk_destruct() then frees the socket immediately instead of waiting for a RCU grace period, while the
 receive path still holds a reference-less pointer to it: BUG: KASAN: slab-use-after-free in
 ipv4_pktinfo_prepare+0x30/0x410 Read of size 8 at addr ffff888008806610 by task exploit/207 CPU: 0 UID:
 1000 PID: 207 Comm: exploit Not tainted 6.12.95+ #1 ipv4_pktinfo_prepare+0x30/0x410
 udp_queue_rcv_one_skb+0x51c/0x1180 udp_unicast_rcv_skb+0x109/0x350 ip_protocol_deliver_rcu+0x14b/0x310
 ip_local_deliver_finish+0x29d/0x390 ip_local_deliver+0x24d/0x2a0 Only grab the socket lock when
 SOCK_TIMESTAMP has to be set, to keep the common case lockless. (CVE-2026-98276)

Solution

Update the sys-kernel/cchost-kernel-6_12 library and its related packages to version 19999.44.126 or later.

See Also

https://storage.googleapis.com/cos-oval-vulnerability-feed/cos-133.oval.xml.tar.gz

Plugin Details

Severity: High

ID: 475308

Version: Revision 1.1

Type: Local

Published: 10/16/2026

Updated: 10/16/2026

Risk Information

VPR

Risk Factor: Medium

Score: 4.9

Percentile: 58.4

Vendor

Vendor Severity: LOW

CVSS v2

Risk Factor: Medium

Base Score: 6.8

Temporal Score: 5

Vector: CVSS2#AV:L/AC:L/Au:S/C:C/I:C/A:C

CVSS Score Source: CVE-2026-98276

CVSS v3

Risk Factor: High

Base Score: 7.8

Temporal Score: 6.8

Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Vulnerability Publication Date: 10/6/2026

Reference Information

CVE: CVE-2026-98276