Google: sys-kernel/cchost-kernel-6_18, sys-kernel/csql-kernel-6_18, sys-kernel/lakitu-kernel-6_18, sys-kernel/lakitu-nc-kernel-6_18: security update to 20198.0.0

high Tenable Cloud Security Plugin ID 475732

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

- In the Linux kernel, the following vulnerability has been resolved: mm, swap: fix SWAP_USAGE_OFFLIST_BIT
collision with real usage count SWAP_USAGE_OFFLIST_BIT is embedded in the si->inuse_pages usage counter,
and is meant to sit above any value that counter can reach. However, it is defined from
BITS_PER_TYPE(atomic_t), so it is bit 30. On a system with 4 KiB pages the flag collides with the usage
count once that count reaches 4 TiB. swap_usage_in_pages() masks bit 30 out, so whenever the real count
has that bit set, every caller of it reads 4 TiB low: * /proc/swaps understates Used by 4 TiB. * A raw
count of exactly 2^30 masks to zero, so try_to_unuse() takes its "if (!swap_usage_in_pages(si)) goto
success;" early exit and swapoff tears the device down while pages are still swapped out. Nothing in the
rest of swapoff aborts the teardown, so those pages are lost. Independently of swapoff, the collision also
corrupts the counter and the plist. On a device in normal use, a free that leaves bit 30 set in the count
makes swap_usage_sub() see the flag where there is only count, and call add_to_avail_list(). It clears the
bit with fetch_and(~SWAP_USAGE_OFFLIST_BIT), leaving the stored count 4 TiB below the real one, and calls
plist_add() on a device that is already listed, tripping the WARN_ON(!plist_node_empty(node)) in
plist_add() and linking the node a second time. Change the definition of SWAP_USAGE_OFFLIST_BIT to be
based on atomic_long_t instead. Note that the usage counter field itself is of this same type, so it is
still a valid bit. (CVE-2026-98226)

Solution

Update the sys-kernel/cchost-kernel-6_18 library and its related packages to version 20198.0.0 or later.

Plugin Details

Severity: High

ID: 475732

Version: Revision 1.1

Type: Local

Family: Google COS Security Checks

Published: 10/16/2026

Updated: 10/16/2026

Risk Information

VPR

Risk Factor: Medium

Score: 4.3

Percentile: 53.47

Vendor

Vendor Severity: LOW

CVSS v2

Risk Factor: Medium

Base Score: 6.2

Temporal Score: 4.6

Vector: CVSS2#AV:L/AC:L/Au:S/C:N/I:C/A:C

CVSS Score Source: CVE-2026-98226

CVSS v3

Risk Factor: High

Base Score: 7.1

Temporal Score: 6.2

Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Vulnerability Publication Date: 10/6/2026

Reference Information

CVE: CVE-2026-98226

Detections

Analytics