Google: sys-kernel/cchost-kernel-6_12, sys-kernel/cchost-kernel-6_18, sys-kernel/csql-kernel-6_12, sys-kernel/csql-kernel-6_18, sys-kernel/lakitu-kernel-6_12, sys-kernel/lakitu-kernel-6_18, sys-kernel/lakitu-nc-kernel-6_12, sys-kernel/lakitu-nc-kernel-6_18: security update to 19999.44.126

medium Tenable Cloud Security Plugin ID 475490

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

- In the Linux kernel, the following vulnerability has been resolved: af_unix: Unify scc_index when
finalising SCC in __unix_walk_scc(). Commit bfdb01283ee8 ("af_unix: Assign a unique index to SCC.")
changed Tarjan's algorithm to update lowlink with lowlink, which is called lowpoint
(unix_vertex.scc_index). unix_vertex_dead() assumes all vertices in an SCC share the same lowpoint, but
this is not always true if an SCC has two or more back edges, depending on the order of DFS. For example,
the graph below has two back edges from B to A and from C to B. A --> B --> C ^ | ^ | `----' `----' If DFS
walks through A -> B -> C -> B (-> C -> B) -> A (-> B -> A), each index and scc_index will be updated as
follows. A --> B --> C C = (3, 3) (index, scc_index) B = (2, 2) A = (1, 1) A ... B ... C C = (3, 2)<-. ^ |
B = (2, 2) -' `----' A = (1, 1) A ... B ... C C = (3, 2) ^ | . . B = (2, 1)<-. `----' .... A = (1, 1) -'
Then, unix_vertex_dead() thinks that B is passed to another SCC with scc_index 2, and the SCC is not
garbage-collected. This does not happen if DFS walks in a different order below or starts from B. 1 3 A
--> B --> C ^ | ^ | `----' `----' 2 4 Let's unify scc_index across the SCC when finalising it. Note that
updating v->index was previously done in unix_scc_dead(), when called from __unix_walk_scc(), just to save
one loop. Since __unix_walk_scc() now iterates over the SCC anyway, the update is moved back to
__unix_walk_scc() and 'fast' argument is dropped. (CVE-2026-98289)

Solution

Update the sys-kernel/cchost-kernel-6_12 library and its related packages to version 19999.44.126 or later.

Plugin Details

Severity: Medium

ID: 475490

Version: Revision 1.1

Type: Local

Family: Google COS Security Checks

Published: 10/16/2026

Updated: 10/16/2026

Risk Information

VPR

Risk Factor: Low

Score: 3

Percentile: 23.67

Vendor

Vendor Severity: LOW

CVSS v2

Risk Factor: Medium

Base Score: 4.9

Temporal Score: 3.6

Vector: CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C

CVSS Score Source: CVE-2026-98289

CVSS v3

Risk Factor: Medium

Base Score: 5.5

Temporal Score: 4.8

Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Vulnerability Publication Date: 10/6/2026

Reference Information

CVE: CVE-2026-98289

Detections

Analytics