Detections
Analytics

Google: sys-kernel/csql-kernel-6_1, sys-kernel/csql-kernel-6_6, sys-kernel/lakitu-kernel-6_1, sys-kernel/lakitu-kernel-6_6, sys-kernel/lakitu-nc-kernel-6_6, sys-kernel/lakitu-vgpu-kernel-6_6, sys-kernel/tpusev-kernel-6_6: security update to 18613.731.2

medium Tenable Self-Hosted Container Security Plugin ID 466727

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - In the Linux kernel, the following vulnerability has been resolved: xprtrdma: Check frwr_wp_create()
 during connect frwr_wp_create() creates the singleton Memory Region used to encode padding for Write
 chunks whose payload length is not XDR-aligned. Its failure paths return a negative errno and leave
 ep->re_write_pad_mr set to NULL. rpcrdma_xprt_connect() currently ignores that return value. If
 frwr_wp_create() fails after the rest of the connection setup succeeds, xprt_rdma_connect_worker() treats
 the connection attempt as successful and sets XPRT_CONNECTED. A later NFS/RDMA read with a non-4-byte-
 aligned receive page length reaches rpcrdma_encode_write_list(), passes the NULL write-pad MR to
 encode_rdma_segment(), and dereferences it. This is locally triggerable on an NFS/RDMA client after a
 connect or reconnect hits a local MR allocation, DMA-map, MR-map, or post-send failure; a remote peer
 alone cannot force the local MR setup failure. Check the return value and fail the connect as -ENOTCONN,
 matching the adjacent setup failures. This keeps XPRT_CONNECTED clear and lets the normal reconnect path
 retry. (CVE-2026-72467)

Solution

Update the sys-kernel/csql-kernel-6_1 library and its related packages to version 18613.731.2 or later.

See Also

https://storage.googleapis.com/cos-oval-vulnerability-feed/cos-117.oval.xml.tar.gz

Plugin Details

Severity: Medium

ID: 466727

Version: Revision 1.3

Type: Local

Published: 10/2/2026

Updated: 10/3/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Low

Score: 3

Percentile: 23.58

Vendor

Vendor Severity: LOW

CVSS v2

Risk Factor: Medium

Base Score: 4.6

Temporal Score: 3.4

Vector: CVSS2#AV:L/AC:L/Au:S/C:N/I:N/A:C

CVSS Score Source: CVE-2026-72467

CVSS v3

Risk Factor: Medium

Base Score: 5.5

Temporal Score: 4.8

Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Vulnerability Publication Date: 8/11/2026

Reference Information

CVE: CVE-2026-72467