Detections
Analytics

Google: sys-kernel/cchost-kernel-6_18, sys-kernel/csql-kernel-6_18, sys-kernel/lakitu-kernel-6_18, sys-kernel/lakitu-nc-kernel-6_18: security update to 19999.44.106

medium Tenable Cloud Security Plugin ID 475437

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - In the Linux kernel, the following vulnerability has been resolved: x86/alternatives: Exclude text poking
 against change_page_attr() From time to time, the following BUG can be observed in the x86 alternatives
 patching code [0]: > kernel BUG at arch/x86/kernel/alternative.c:2576! > Oops: invalid opcode: 0000 [#1]
 SMP NOPTI > CPU: 0 UID: 0 PID: 355 Comm: (udev-worker) Not tainted 7.1.3-1-default #1 PREEMPT(full)
 openSUSE Tumbleweed 8c1795b03ec64f997e57a8ad38b1161e3b98da64 > Hardware name: QEMU Standard PC (i440FX +
 PIIX, 1996), BIOS unknown 02/02/2022 > RIP: 0010:__text_poke+0x2aa/0x450 > Call Trace: > <TASK> >
 smp_text_poke_batch_finish+0x2a7/0x320 > __static_call_transform+0xb7/0x220 >
 arch_static_call_transform+0x5b/0xb0 > __static_call_init+0xe9/0x270 >
 static_call_module_notify+0x11f/0x150 > notifier_call_chain+0x61/0xe0 >
 blocking_notifier_call_chain_robust+0x63/0xc0 > load_module+0x1c92/0x20c0 >
 init_module_from_file+0xd8/0x140 > idempotent_init_module+0x100/0x2f0 > __x64_sys_finit_module+0x71/0xe0 >
 do_syscall_64+0xe1/0x610 > entry_SYSCALL_64_after_hwframe+0x76/0x7e which matches the following BUG_ON()
 in alternative.c: /* * If something went wrong, crash and burn since recovery paths are not * implemented.
 */ BUG_ON(!pages[0] || (cross_page_boundary && !pages[1])); This can happen if vmalloc_to_page() fails,
 for any reason. Such can happen if text poking races with CPA, which can possibly result in the collapsing
 of page tables (or breaking of PMD hugepages). It is not a problem for most users of vmalloc_to_page()
 (they solely own the vmalloc'd range) but, when CONFIG_ARCH_HAS_EXECMEM_ROX=y, various modules own a
 single execmem vmalloc range, and can call set_memory_*() in parallel on it. This can happen to race
 against __text_poke and cause havoc in vmalloc_to_page(). Fix it by excluding against CPA using the
 init_mm mmap read lock. [ dhansen: Fix up SoB ordering. The actual code flow here was:
 Pedro=>Lorenzo=>Mike=>Me which is reflected in the SoB chain now. I *believe* Mike simply picked up
 Lorenzo's update to Pedro's post from the Link ] (CVE-2026-97942)

Solution

Update the sys-kernel/cchost-kernel-6_18 library and its related packages to version 19999.44.106 or later.

See Also

https://storage.googleapis.com/cos-oval-vulnerability-feed/cos-133.oval.xml.tar.gz

Plugin Details

Severity: Medium

ID: 475437

Version: Revision 1.1

Type: Local

Published: 10/16/2026

Updated: 10/16/2026

Risk Information

VPR

Risk Factor: Low

Score: 3

Percentile: 23.6

Vendor

Vendor Severity: LOW

CVSS v2

Risk Factor: Medium

Base Score: 4.9

Temporal Score: 3.6

Vector: CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C

CVSS Score Source: CVE-2026-97942

CVSS v3

Risk Factor: Medium

Base Score: 5.5

Temporal Score: 4.8

Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Vulnerability Publication Date: 9/25/2026

Reference Information

CVE: CVE-2026-97942