Detections
Analytics

Google: sys-kernel/csql-kernel-6_1, sys-kernel/csql-kernel-6_6, sys-kernel/lakitu-kernel-6_1, sys-kernel/lakitu-kernel-6_6, sys-kernel/lakitu-nc-kernel-6_6, sys-kernel/lakitu-vgpu-kernel-6_6, sys-kernel/tpusev-kernel-6_6: security update to 18613.675.2

high Tenable Self-Hosted Container Security Plugin ID 466585

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - In the Linux kernel, the following vulnerability has been resolved: smb: client: fix OOB reads parsing
 symlink error response When a CREATE returns STATUS_STOPPED_ON_SYMLINK, smb2_check_message() returns
 success without any length validation, leaving the symlink parsers as the only defense against an
 untrusted server. symlink_data() walks SMB 3.1.1 error contexts with the loop test "p < end", but reads
 p->ErrorId at offset 4 and p->ErrorDataLength at offset 0. When the server-controlled ErrorDataLength
 advances p to within 1-7 bytes of end, the next iteration will read past it. When the matching context is
 found, sym->SymLinkErrorTag is read at offset 4 from p->ErrorContextData with no check that the symlink
 header itself fits. smb2_parse_symlink_response() then bounds-checks the substitute name using
 SMB2_SYMLINK_STRUCT_SIZE as the offset of PathBuffer from iov_base. That value is computed as
 sizeof(smb2_err_rsp) + sizeof(smb2_symlink_err_rsp), which is correct only when ErrorContextCount == 0.
 With at least one error context the symlink data sits 8 bytes deeper, and each skipped non-matching
 context shifts it further by 8 + ALIGN(ErrorDataLength, 8). The check is too short, allowing the
 substitute name read to run past iov_len. The out-of-bound heap bytes are UTF-16-decoded into the symlink
 target and returned to userspace via readlink(2). Fix this all up by making the loops test require the
 full context header to fit, rejecting sym if its header runs past end, and bound the substitute name
 against the actual position of sym->PathBuffer rather than a fixed offset. Because sub_offs and sub_len
 are 16bits, the pointer math will not overflow here with the new greater-than. (CVE-2026-31613)

Solution

Update the sys-kernel/csql-kernel-6_1 library and its related packages to version 18613.675.2 or later.

See Also

https://storage.googleapis.com/cos-oval-vulnerability-feed/cos-117.oval.xml.tar.gz

Plugin Details

Severity: High

ID: 466585

Version: Revision 1.1

Type: Local

Published: 10/2/2026

Updated: 10/2/2026

Risk Information

VPR

Risk Factor: High

Score: 7

Percentile: 98.3

Vendor

Vendor Severity: LOW

CVSS v2

Risk Factor: High

Base Score: 9.4

Temporal Score: 7

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:N/A:C

CVSS Score Source: CVE-2026-31613

CVSS v3

Risk Factor: High

Base Score: 8.1

Temporal Score: 7.1

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Vulnerability Publication Date: 4/24/2026

Reference Information

CVE: CVE-2026-31613