Google: sys-kernel/cchost-kernel-6_18, sys-kernel/csql-kernel-6_18, sys-kernel/lakitu-kernel-6_18, sys-kernel/lakitu-nc-kernel-6_18: security update to 20198.0.0

high Tenable Cloud Security Plugin ID 475654

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

- In the Linux kernel, the following vulnerability has been resolved: smb: client: bound dirent name against
end of SMB response in cifs_filldir cifs_filldir() copies the entry name out of an SMB1 TRANS2_FIND_FIRST
/ FIND_NEXT response using a length (de.namelen) supplied by the server. The kmalloc'd SMB response buffer
is bounded, but nothing checks that de.name + de.namelen still lies inside that buffer before the eventual
filldir64() -> verify_dirent_name() -> memchr() reads namelen bytes. A hostile SMB1 server that returns an
oversized FileNameLength in a directory entry therefore causes memchr() to read past the end of the
response slab buffer. Reachable from any user who can list a directory on a CIFS mount served by an
attacker-controlled server (getdents64() on the mounted directory): BUG: KASAN: slab-out-of-bounds in
memchr+0x71/0x80 Read of size 1 at addr ffff88800e0640cc by task poc/115 Call Trace:
dump_stack_lvl+0x64/0x80 print_report+0xce/0x620 kasan_report+0xec/0x120 memchr+0x71/0x80
filldir64+0x4c/0x6a0 cifs_filldir.constprop.0+0x9bb/0x1e00 cifs_readdir+0x2101/0x3380
iterate_dir+0x19c/0x520 __x64_sys_getdents64+0x126/0x210 do_syscall_64+0x107/0x5a0
entry_SYSCALL_64_after_hwframe+0x77/0x7f Pass the end-of-response pointer down to cifs_filldir() and
reject entries whose name would extend past that boundary. This bug was discovered by Artiphishell's
vTriage pipeline, which generated a userspace reproducer (an emulated hostile SMB1 server plus a
getdents64() client) that reliably triggers the KASAN report on an unpatched kernel. The fix below was
drafted with the Claude coding assistant; a userspace reproducer is available on request. (CVE-2026-93787)

Solution

Update the sys-kernel/cchost-kernel-6_18 library and its related packages to version 20198.0.0 or later.

Plugin Details

Severity: High

ID: 475654

Version: Revision 1.1

Type: Local

Family: Google COS Security Checks

Published: 10/16/2026

Updated: 10/16/2026

Risk Information

VPR

Risk Factor: Medium

Score: 4.3

Percentile: 53.46

Vendor

Vendor Severity: LOW

CVSS v2

Risk Factor: High

Base Score: 9.4

Temporal Score: 7

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:N/A:C

CVSS Score Source: CVE-2026-93787

CVSS v3

Risk Factor: High

Base Score: 8.1

Temporal Score: 7.1

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Vulnerability Publication Date: 9/24/2026

Reference Information

CVE: CVE-2026-93787

Detections

Analytics