Detections
Analytics

Google: sys-kernel/csql-kernel-6_6, sys-kernel/lakitu-kernel-6_6, sys-kernel/lakitu-nc-kernel-6_6, sys-kernel/lakitu-vgpu-kernel-6_6: security update to 18867.528.43

medium Tenable Self-Hosted Container Security Plugin ID 467327

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - In the Linux kernel, the following vulnerability has been resolved: block: skip sync_blockdev() on
 surprise removal in bdev_mark_dead() bdev_mark_dead()'s @surprise == true means the device is already
 gone. The filesystem callback fs_bdev_mark_dead() honours this and skips sync_filesystem(), but the bare
 block device path (no ->mark_dead op) lost its !surprise guard when the holder ->mark_dead callback was
 wired up (see Fixes), and now calls sync_blockdev() unconditionally, which can hang forever waiting on
 writeback that can no longer complete. syzkaller hit this via nvme_reset_work()'s "I/O queues lost" path:
 nvme_mark_namespaces_dead() -> blk_mark_disk_dead() -> bdev_mark_dead(bdev, true) -> sync_blockdev()
 blocks in folio_wait_writeback(), wedging the reset worker and every task waiting on it. Skip the sync on
 surprise removal, matching fs_bdev_mark_dead(); invalidate_bdev() still runs. Orderly removal (surprise ==
 false) is unchanged. Found by FuzzNvme(Syzkaller with FEMU fuzzing framework). (CVE-2026-64326)

Solution

Update the sys-kernel/csql-kernel-6_6 library and its related packages to version 18867.528.43 or later.

See Also

https://storage.googleapis.com/cos-oval-vulnerability-feed/cos-121.oval.xml.tar.gz

Plugin Details

Severity: Medium

ID: 467327

Version: Revision 1.3

Type: Local

Published: 10/2/2026

Updated: 10/3/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Low

Score: 3

Percentile: 23.63

Vendor

Vendor Severity: MEDIUM

CVSS v2

Risk Factor: Medium

Base Score: 4.6

Temporal Score: 3.4

Vector: CVSS2#AV:L/AC:L/Au:S/C:N/I:N/A:C

CVSS Score Source: CVE-2026-64326

CVSS v3

Risk Factor: Medium

Base Score: 5.5

Temporal Score: 4.8

Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Vulnerability Publication Date: 7/23/2026

Reference Information

CVE: CVE-2026-64326