Google: sys-kernel/cchost-kernel-6_18, sys-kernel/csql-kernel-6_18, sys-kernel/lakitu-kernel-6_18, sys-kernel/lakitu-nc-kernel-6_18: security update to 19999.44.106

high Tenable Cloud Security Plugin ID 475532

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

- In the Linux kernel, the following vulnerability has been resolved: svcrdma: Fix unmatched rn_unregister
on failed accept When svc_rdma_accept() takes the errout path before rpcrdma_rn_register() has succeeded,
the existing cleanup block calls rpcrdma_rn_unregister(dev, &newxprt->sc_rn) unconditionally. svcxprt_rdma
is kzalloc'd, so on that path sc_rn.rn_index is 0 and sc_rn.rn_done is NULL; the unregister therefore
xa_erase()s another caller's slot 0 and performs an unmatched kref_put() on the rpcrdma_device's rd_kref.
The same errout also brackets the cleanup with svc_xprt_get()/ svc_xprt_put() around the kref_init() birth
reference. The kref goes 1 -> 2 -> 1 and never reaches 0, so the svcxprt_rdma (and the net/ns_tracker it
pinned) is leaked on every failed accept. rpcrdma_rn_register() writes rn->rn_done last, only after
xa_alloc() and kref_get() have both succeeded, so rn_done == NULL is a natural "never registered"
sentinel. Guard rpcrdma_rn_unregister() with an early return when rn_done is NULL, and clear rn_done
before the matching xa_erase() so a repeated unregister is also a no-op. With that guard in place, the
accept errout drops the kref_init() birth reference via svc_xprt_put(), which dispatches svc_rdma_free().
Teardown of sc_qp, sc_sq_cq, sc_rq_cq, and sc_pd runs under existing IS_ERR/NULL guards in
svc_rdma_free(); sc_rn is covered by the new rn_done sentinel; sc_cm_id is non-NULL on every errout path
because svc_rdma_accept() dereferences it above the first goto errout. svc_xprt_free() drops the module
reference associated with the freed transport, and svc_handle_xprt() drops its pre-acquired reference when
->xpo_accept() returns NULL. Take a replacement module reference before svc_xprt_put() so the two
module_put()s remain balanced. The rn_done guard also covers svc_rdma_free()'s non-listener call to
rpcrdma_rn_unregister() for transports whose register attempt failed or never ran. (CVE-2026-93224)

Solution

Update the sys-kernel/cchost-kernel-6_18 library and its related packages to version 19999.44.106 or later.

Plugin Details

Severity: High

ID: 475532

Version: Revision 1.1

Type: Local

Family: Google COS Security Checks

Published: 10/16/2026

Updated: 10/16/2026

Risk Information

VPR

Risk Factor: Medium

Score: 4.9

Percentile: 58.34

Vendor

Vendor Severity: LOW

CVSS v2

Risk Factor: High

Base Score: 7.6

Temporal Score: 5.6

Vector: CVSS2#AV:N/AC:H/Au:N/C:C/I:C/A:C

CVSS Score Source: CVE-2026-93224

CVSS v3

Risk Factor: High

Base Score: 8.1

Temporal Score: 7.1

Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Vulnerability Publication Date: 9/24/2026

Reference Information

CVE: CVE-2026-93224

Detections

Analytics