Detections
Analytics

Google: sys-kernel/csql-kernel-6_1, sys-kernel/csql-kernel-6_6, sys-kernel/lakitu-kernel-6_1, sys-kernel/lakitu-kernel-6_6, sys-kernel/lakitu-nc-kernel-6_6, sys-kernel/lakitu-vgpu-kernel-6_6, sys-kernel/tpusev-kernel-6_6: security update to 18613.731.2

high Tenable Self-Hosted Container Security Plugin ID 466304

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - In the Linux kernel, the following vulnerability has been resolved: ata: libata-core: Reject an invalid
 concurrent positioning ranges count ata_dev_config_cpr() takes the number of range descriptors from buf[0]
 of the concurrent positioning ranges log (up to 255), which the device reports independently of the log
 size in the GPL directory. The count is then walked at a fixed 32-byte stride in two places with no bound:
 the log read here, and the INQUIRY VPD page B9h emitter, which writes one descriptor per range into the
 fixed 2048-byte ata_scsi_rbuf. A device reporting a count larger than its own log overflows the read
 buffer (up to 7704 bytes past a 512-byte slab), and a count above 62 overflows the response buffer on the
 emit side. Bound the count once, on probe, against both the log the device returned and the number of
 descriptors the VPD B9h response buffer can hold (ATA_DEV_MAX_CPR, derived from the rbuf size). Reject an
 out-of-range count with a warning; this keeps the emitter in bounds with no separate change there.
 (CVE-2026-72030)

Solution

Update the sys-kernel/csql-kernel-6_1 library and its related packages to version 18613.731.2 or later.

See Also

https://storage.googleapis.com/cos-oval-vulnerability-feed/cos-117.oval.xml.tar.gz

Plugin Details

Severity: High

ID: 466304

Version: Revision 1.2

Type: Local

Published: 10/2/2026

Updated: 10/3/2026

Risk Information

VPR

Risk Factor: Medium

Score: 4.3

Percentile: 53.53

Vendor

Vendor Severity: LOW

CVSS v2

Risk Factor: Medium

Base Score: 6.6

Temporal Score: 4.9

Vector: CVSS2#AV:L/AC:L/Au:N/C:C/I:N/A:C

CVSS Score Source: CVE-2026-72030

CVSS v3

Risk Factor: High

Base Score: 7.1

Temporal Score: 6.2

Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Vulnerability Publication Date: 8/11/2026

Reference Information

CVE: CVE-2026-72030