Detections
Analytics

Google: sys-kernel/cchost-kernel-6_18, sys-kernel/csql-kernel-6_18, sys-kernel/lakitu-kernel-6_18, sys-kernel/lakitu-nc-kernel-6_18: security update to 20198.0.0

medium Tenable Cloud Security Plugin ID 475735

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - In the Linux kernel, the following vulnerability has been resolved: net: skbuff: do not leave stale header
 offsets after pskb_carve() pskb_carve_inside_header() and pskb_carve_inside_nonlinear() remove the first
 bytes of a packet and reallocate skb->head. All the headers that were present before the operation are
 gone, but both functions call skb_headers_offset_update(skb, 0), which is a no-op : skb->mac_header,
 skb->network_header, skb->transport_header and skb->csum_start keep their old values and now describe
 bytes which are no longer there. Both helpers size the new head from the old skb_end_offset(), so the
 stale offsets still land inside the new allocation. They point past skb_tail_pointer() though, to bytes
 that were never initialized. pskb_carve_inside_nonlinear() is the worst case, because it leaves a zombie
 skb with an empty linear part (skb->data == skb_tail_pointer(skb), skb_headlen(skb) == 0), while
 skb_mac_header_was_set() is still true and skb->mac_header is way ahead of skb->data. The only user of
 pskb_extract() is rds_tcp_data_recv(), and the carved skb is queued on tinc->ti_skb_list. When the RDS
 incoming message is released, rds_tcp_inc_free() calls skb_queue_purge(), which frees the skbs with
 SKB_DROP_REASON_QUEUE_PURGE. This is visible from drop_monitor, which then tries to pull back to the
 (bogus) mac header : skbuff: __skb_pull(len=234) skb len=6968 data_len=6968 headroom=0 headlen=0
 tailroom=0 end-tail=384 mac=(234,14) mac_len=14 net=(248,40) trans=288 shinfo(txflags=0 nr_frags=1
 gso(size=1428 type=16 segs=5)) csum(0x100120 start=288 offset=16 ip_summed=3 complete_sw=0 valid=1
 level=0) hash(0x7b446c6c sw=0 l4=1) proto=0x86dd pkttype=0 iif=60 kernel BUG at
 ./include/linux/skbuff.h:2847! Add skb_carve_reset_headers() to mark the mac and transport headers as not
 set, reset the network header, clear skb->mac_len, and drop a now meaningless CHECKSUM_PARTIAL (csum_start
 no longer describes anything). Invalidate the inner offsets as well. Unlike mac_header and
 transport_header they have no "unset" sentinel, so a leftover non-zero value still looks like a real
 header. Zero skb->inner_mac_header, skb->inner_network_header, skb->inner_transport_header,
 skb->inner_protocol and skb->encapsulation, so that all the header state is invalidated in one place. v2:
 fixed an inaccurate changelog. The stale offsets stay inside the new skb->head, which is never smaller
 than the old one, they simply point past skb_tail_pointer() to bytes that are gone. Thanks to Xuanqiang
 Luo for insisting on this. Also invalidate the inner header state, as suggested by the netdev AI review :
 https://netdev-ai.bots.linux.dev/sashiko/#/patchset/20260911114922.621937-1-edumazet%40google.com
 (CVE-2026-98271)

Solution

Update the sys-kernel/cchost-kernel-6_18 library and its related packages to version 20198.0.0 or later.

See Also

https://storage.googleapis.com/cos-oval-vulnerability-feed/cos-138.oval.xml.tar.gz

Plugin Details

Severity: Medium

ID: 475735

Version: Revision 1.1

Type: Local

Published: 10/16/2026

Updated: 10/16/2026

Risk Information

VPR

Risk Factor: Low

Score: 3.5

Percentile: 51.46

Vendor

Vendor Severity: LOW

CVSS v2

Risk Factor: Low

Base Score: 2.1

Temporal Score: 1.6

Vector: CVSS2#AV:L/AC:L/Au:N/C:N/I:P/A:N

CVSS Score Source: CVE-2026-98271

CVSS v3

Risk Factor: Medium

Base Score: 6.1

Temporal Score: 5.3

Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Vulnerability Publication Date: 10/6/2026

Reference Information

CVE: CVE-2026-98271