Detections
Analytics

Google: sys-kernel/cchost-kernel-6_18, sys-kernel/csql-kernel-6_18, sys-kernel/lakitu-kernel-6_18, sys-kernel/lakitu-nc-kernel-6_18: security update to 19999.44.106

critical Tenable Cloud Security Plugin ID 475456

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Make VNCR invalidation
 participate in MMU invalidation retry A VNCR TLB invalidation can occur on one vcpu while another vcpu is
 faulting in this same page. Without correctly handling this, we can end up with the following scenario: -
 vcpu A walks the PTs to translate VNCR - before vcpu A is able to grab the MMU lock to insert the TLB,
 vcpu B updates the S1 PTs with an invalid entry, and issues a TLBI S1E2 for this VA - vcpu A inserts the
 TLB for something that is now invalid This isn't a new problem, and we manage S2 by having the MMU
 notifier to bump up mmu_invalidate_seq on invalidation so that the fault can be replayed. We can perform
 something similar here, and extend invalidate_vncr_va() to update the same counter, clearly indicating
 that the context has changed under our feet. This is safe as the invalidation always happen while holding
 the MMU lock for write, and that we sample the sequence number before walking S1. (CVE-2026-89916)

Solution

Update the sys-kernel/cchost-kernel-6_18 library and its related packages to version 19999.44.106 or later.

See Also

https://storage.googleapis.com/cos-oval-vulnerability-feed/cos-133.oval.xml.tar.gz

Plugin Details

Severity: Critical

ID: 475456

Version: Revision 1.1

Type: Local

Published: 10/16/2026

Updated: 10/16/2026

Risk Information

VPR

Risk Factor: Medium

Score: 5

Percentile: 93.27

Vendor

Vendor Severity: HIGH

CVSS v2

Risk Factor: High

Base Score: 7.2

Temporal Score: 5.3

Vector: CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C

CVSS Score Source: CVE-2026-89916

CVSS v3

Risk Factor: Critical

Base Score: 9.3

Temporal Score: 8.1

Vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Vulnerability Publication Date: 9/16/2026

Reference Information

CVE: CVE-2026-89916