Google: sys-kernel/cchost-kernel-6_12, sys-kernel/cchost-kernel-6_18, sys-kernel/csql-kernel-6_12, sys-kernel/csql-kernel-6_18, sys-kernel/lakitu-kernel-6_12, sys-kernel/lakitu-kernel-6_18, sys-kernel/lakitu-nc-kernel-6_12, sys-kernel/lakitu-nc-kernel-6_18: security update to 19999.44.106

high Tenable Cloud Security Plugin ID 475386

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

- In the Linux kernel, the following vulnerability has been resolved: smb: client: fix heap overflow in DACL
owner/group rewrite When id_mode_to_cifs_acl rewrites an existing DACL, it allocates a buffer sized
according to the on-disk DACL length reported by dacl_ptr->size. However, replace_sids_and_copy_aces may
rewrite each ACE with a new owner/group SID obtained from the cifs.idmap upcall. Those SIDs can have up to
SID_MAX_SUB_AUTHORITIES (15) sub-authorities, making each ACE up to 76 bytes (sizeof(struct smb_ace)). If
the original DACL contains short SIDs (e.g., 1 sub-authority) while the replacement SIDs are long, the
rewritten ACEs overflow the allocation. Fix this by always budgeting for worst-case SID expansion:
allocate sizeof(struct smb_acl) plus num_aces * sizeof(struct smb_ace), which covers the smb_acl header
and room for every ACE at maximum SID size. This replaces the previous split logic that used
dacl_ptr->size for cifsacl mounts but num_aces * sizeof(struct smb_ace) for mode_from_sid mounts: both
paths can trigger the same rewrite and need the same headroom. KASAN reports this as: BUG: KASAN: slab-
out-of-bounds in build_sec_desc+0x1e8a/0x2680 [cifs] Write of size 4 at addr ffff8881a5e25374 by task
chown/5298 ... The buggy address is located 0 bytes to the right of allocated 884-byte region
[ffff8881a5e25000, ffff8881a5e25374) (CVE-2026-97555)

Solution

Update the sys-kernel/cchost-kernel-6_12 library and its related packages to version 19999.44.106 or later.

Plugin Details

Severity: High

ID: 475386

Version: Revision 1.2

Type: Local

Family: Google COS Security Checks

Published: 10/16/2026

Updated: 11/2/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Medium

Score: 4.9

Percentile: 58.55

Vendor

Vendor Severity: HIGH

CVSS v2

Risk Factor: Critical

Base Score: 10

Temporal Score: 7.8

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS Score Source: CVE-2026-97555

CVSS v3

Risk Factor: High

Base Score: 8.8

Temporal Score: 7.9

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

Vulnerability Information

Exploit Available: true

Exploit Ease: Exploits are available

Vulnerability Publication Date: 9/25/2026

Reference Information

CVE: CVE-2026-97555

Detections

Analytics