Detections
Analytics

Google: sys-kernel/cchost-kernel-6_12, sys-kernel/cchost-kernel-6_18, sys-kernel/csql-kernel-6_12, sys-kernel/csql-kernel-6_18, sys-kernel/lakitu-kernel-6_12, sys-kernel/lakitu-kernel-6_18, sys-kernel/lakitu-nc-kernel-6_12, sys-kernel/lakitu-nc-kernel-6_18: security update to 19999.44.106

medium Tenable Cloud Security Plugin ID 475511

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - In the Linux kernel, the following vulnerability has been resolved: erofs: preserve LZMA decoders on
 resize failure The pool-resize path frees each stream's old decoder before allocating its replacement. If
 an allocation fails after some streams have already been replaced, the failed stream is put back on the
 list with state == NULL. z_erofs_lzma_max_dictsize is still advanced as if the whole pool had been
 resized. An existing LZMA mount can select the broken stream and pass NULL to xz_dec_microlzma_reset(). A
 retry at the same size also skip another resize attempt. Since the global maximum was advanced, thus, the
 invalid state is left unrepaired. Allocate each replacement before freeing the old decoder, temporarily
 retaining one old decoder during allocation. Stop at the first failure and advance
 z_erofs_lzma_max_dictsize only after all streams satisfy the request. Record each stream's dictionary
 capacity so retries can skip streams already enlarged before a partial failure. (CVE-2026-97605)

Solution

Update the sys-kernel/cchost-kernel-6_12 library and its related packages to version 19999.44.106 or later.

See Also

https://storage.googleapis.com/cos-oval-vulnerability-feed/cos-133.oval.xml.tar.gz

Plugin Details

Severity: Medium

ID: 475511

Version: Revision 1.1

Type: Local

Published: 10/16/2026

Updated: 10/16/2026

Risk Information

VPR

Risk Factor: Low

Score: 3

Percentile: 23.6

Vendor

Vendor Severity: LOW

CVSS v2

Risk Factor: Medium

Base Score: 4.9

Temporal Score: 3.6

Vector: CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C

CVSS Score Source: CVE-2026-97605

CVSS v3

Risk Factor: Medium

Base Score: 5.5

Temporal Score: 4.8

Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Vulnerability Publication Date: 9/25/2026

Reference Information

CVE: CVE-2026-97605