Google: sys-kernel/cchost-kernel-6_12, sys-kernel/cchost-kernel-6_18, sys-kernel/csql-kernel-6_12, sys-kernel/csql-kernel-6_18, sys-kernel/lakitu-kernel-6_12, sys-kernel/lakitu-kernel-6_18, sys-kernel/lakitu-nc-kernel-6_12, sys-kernel/lakitu-nc-kernel-6_18: security update to 19999.44.106

critical Tenable Cloud Security Plugin ID 475422

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

- In the Linux kernel, the following vulnerability has been resolved: svcrdma: Reject inline replies that
overflow the pull-up buffer An RPC-over-RDMA client can request a reply, such as an NFS READ payload,
without providing a Write list or a Reply chunk to carry it. When such a reply needs more scatter/gather
entries than the device's Send Queue supports, svc_rdma_pull_up_needed() selects pull-up and
svc_rdma_pull_up_reply_msg() linearizes the whole reply into sctxt->sc_xprt_buf. That buffer is only
sc_max_req_size bytes, while the reply on this path is bounded only by the client's request, so
svc_rdma_xb_linearize() copies past the end of the buffer and corrupts adjacent slab memory. The oversized
length is then stored in sc_sges[0].length and posted, so the device also reads beyond the mapped region.
The SGE-exhaustion branch is the only pull-up path that can exceed the buffer: the threshold branch pulls
up only replies smaller than RPCRDMA_PULLUP_THRESH, and replies that fit the device's SGE budget are sent
directly without linearization. Make svc_rdma_pull_up_needed() report -E2BIG when the reply it would pull
up cannot fit sc_max_req_size, and fail the request with ERR_CHUNK as RFC 8166 Section 4.5.3 directs
rather than dropping the connection. The helper no longer answers a simple yes/no question: it now reports
pull-up, no pull-up, or -E2BIG for a reply too large to linearize. Rename svc_rdma_pull_up_needed() to
svc_rdma_check_pull_up() so its name no longer implies a boolean predicate. (CVE-2026-89530)

Solution

Update the sys-kernel/cchost-kernel-6_12 library and its related packages to version 19999.44.106 or later.

Plugin Details

Severity: Critical

ID: 475422

Version: Revision 1.1

Type: Local

Family: Google COS Security Checks

Published: 10/16/2026

Updated: 10/16/2026

Risk Information

VPR

Risk Factor: High

Score: 7.6

Percentile: 98.3

Vendor

Vendor Severity: LOW

CVSS v2

Risk Factor: Critical

Base Score: 10

Temporal Score: 7.4

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS Score Source: CVE-2026-89530

CVSS v3

Risk Factor: Critical

Base Score: 9.8

Temporal Score: 8.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Vulnerability Publication Date: 9/11/2026

Reference Information

CVE: CVE-2026-89530

Detections

Analytics