Google: sys-kernel/cchost-kernel-6_12, sys-kernel/cchost-kernel-6_18, sys-kernel/csql-kernel-6_12, sys-kernel/csql-kernel-6_18, sys-kernel/lakitu-kernel-6_12, sys-kernel/lakitu-kernel-6_18, sys-kernel/lakitu-nc-kernel-6_12, sys-kernel/lakitu-nc-kernel-6_18: security update to 19999.44.106

critical Tenable Cloud Security Plugin ID 475319

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

- In the Linux kernel, the following vulnerability has been resolved: svcrdma: Validate Read chunk positions
before reconstruction The RPC/RDMA Read chunk position field is supplied by the remote client and stored
verbatim in the parsed chunk list. xdr_count_read_segments() checks only 4-byte alignment; it never
compares the position against the received inline body length. In the single-chunk path,
svc_rdma_read_complete_one() splits the head and tail kvecs at ch_position. A position past the inline
body underflows the tail length, exposing adjacent slab memory to the upper XDR decoder. In the multi-
chunk path, svc_rdma_read_multiple_chunks() computes gap lengths between chunks as unsigned subtractions
from ch_position. Overlapping Read chunks cause these subtractions to underflow. A final position past the
inline body likewise underflows the trailing gap length. svc_rdma_copy_inline_range() then copies past the
receive buffer into request pages that are returned to the client through the Reply channel. Bound inline-
range copies in svc_rdma_copy_inline_range() against the decoded inline RPC body saved in rc_saved_arg.
Reject a single Read chunk positioned beyond that body, and reject multi-chunk lists where accumulated
read bytes exceed the next chunk's position. Apply the same position and overlap checks in the call-chunk
interleaving path. (CVE-2026-89526)

Solution

Update the sys-kernel/cchost-kernel-6_12 library and its related packages to version 19999.44.106 or later.

Plugin Details

Severity: Critical

ID: 475319

Version: Revision 1.1

Type: Local

Family: Google COS Security Checks

Published: 10/16/2026

Updated: 10/16/2026

Risk Information

VPR

Risk Factor: Medium

Score: 4.9

Percentile: 58.24

Vendor

Vendor Severity: LOW

CVSS v2

Risk Factor: Critical

Base Score: 10

Temporal Score: 7.4

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS Score Source: CVE-2026-89526

CVSS v3

Risk Factor: Critical

Base Score: 9.8

Temporal Score: 8.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Vulnerability Publication Date: 9/11/2026

Reference Information

CVE: CVE-2026-89526

Detections

Analytics