Detections
Analytics

Google: sys-kernel/cchost-kernel-6_18, sys-kernel/csql-kernel-6_18, sys-kernel/lakitu-kernel-6_18, sys-kernel/lakitu-nc-kernel-6_18: security update to 19999.44.106

high Tenable Cloud Security Plugin ID 475420

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - In the Linux kernel, the following vulnerability has been resolved: fanotify: fix use-after-free of file
 range info fsnotify_pre_content() builds its file_range on the triggering task's stack.
 fanotify_alloc_perm_event() saves a pointer to range.pos in the heap-allocated permission event so
 copy_range_info_to_user() can report the offset later. The event reader can set the event state to
 FAN_EVENT_REPORTED and then sleep while preparing the file descriptor. If a signal interrupts the
 triggering task at that point, fanotify_get_response() changes the state to FAN_EVENT_CANCELED and
 returns. This unwinds the file_range stack frame while the reader still owns the event. The reader then
 dereferences pevent->ppos and copies the stale stack value to userspace. KASAN reported: BUG: KASAN: use-
 after-free in fanotify_read+0x293e/0x2970 Read of size 8 at addr ffff88811434fc50 by task
 fanotify_inotif/95 Call Trace: fanotify_read+0x293e/0x2970 vfs_read+0x177/0xa20 ksys_read+0xf7/0x1c0
 do_syscall_64+0xf9/0x540 entry_SYSCALL_64_after_hwframe+0x77/0x7f Store the range position directly in the
 permission event and use FANOTIFY_NO_RANGE when range information is unavailable. The event remains alive
 until the reader finishes, so the reported offset no longer depends on the triggering task's stack.
 (CVE-2026-89600)

Solution

Update the sys-kernel/cchost-kernel-6_18 library and its related packages to version 19999.44.106 or later.

See Also

https://storage.googleapis.com/cos-oval-vulnerability-feed/cos-133.oval.xml.tar.gz

Plugin Details

Severity: High

ID: 475420

Version: Revision 1.1

Type: Local

Published: 10/16/2026

Updated: 10/16/2026

Risk Information

VPR

Risk Factor: Medium

Score: 4.9

Percentile: 58.28

Vendor

Vendor Severity: LOW

CVSS v2

Risk Factor: Medium

Base Score: 6.8

Temporal Score: 5

Vector: CVSS2#AV:L/AC:L/Au:S/C:C/I:C/A:C

CVSS Score Source: CVE-2026-89600

CVSS v3

Risk Factor: High

Base Score: 7.8

Temporal Score: 6.8

Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Vulnerability Publication Date: 9/11/2026

Reference Information

CVE: CVE-2026-89600