Google: sys-kernel/csql-kernel-6_6, sys-kernel/lakitu-kernel-6_6, sys-kernel/lakitu-nc-kernel-6_6, sys-kernel/lakitu-vgpu-kernel-6_6: security update to 18867.584.3

high Tenable Self-Hosted Container Security Plugin ID 467355

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

- In the Linux kernel, the following vulnerability has been resolved: tpm: Make the TPM character devices
non-seekable The TPM character devices expose a sequential command/response interface, but their open
handlers leave FMODE_PREAD and FMODE_PWRITE enabled. After a command leaves a response pending, pread(fd,
buf, 16, 0x1400) passes 0x1400 as *off to tpm_common_read(). The transfer length is bounded by
response_length, but the offset is used unchecked when forming data_buffer + *off. A sufficiently large
offset therefore causes an out-of-bounds heap read through copy_to_user() and, if the copy succeeds, an
out-of-bounds zero-write through the following memset(). Positional I/O does not provide coherent
semantics for this interface. An arbitrary pread offset cannot represent how much of a response has been
consumed sequentially. The write callback always stores a command at the start of data_buffer, while
pwrite() does not update file->f_pos and can leave the sequential read cursor stale. Call
nonseekable_open() from both open handlers. This removes FMODE_PREAD and FMODE_PWRITE, causing positional
reads and writes to fail with -ESPIPE before reaching the TPM callbacks, and explicitly marks the files
non-seekable. Normal read() and write() continue to use the existing sequential f_pos cursor, leaving the
response state machine unchanged. Tested on Linux 6.12 with KASAN and a swtpm TPM2 device: - sequential
partial reads returned the complete response - pread() and preadv() with offset 0x1400 returned -ESPIPE -
pwrite() and pwritev() with offset zero returned -ESPIPE - the pending response remained intact after the
rejected operations - a subsequent normal command/response cycle completed normally - no KASAN report was
produced. (CVE-2026-72135)

Solution

Update the sys-kernel/csql-kernel-6_6 library and its related packages to version 18867.584.3 or later.

Plugin Details

Severity: High

ID: 467355

Version: Revision 1.2

Type: Local

Family: Google COS Security Checks

Published: 10/2/2026

Updated: 10/3/2026

Risk Information

VPR

Risk Factor: Medium

Score: 4.9

Percentile: 58.29

Vendor

Vendor Severity: LOW

CVSS v2

Risk Factor: Medium

Base Score: 6.8

Temporal Score: 5

Vector: CVSS2#AV:L/AC:L/Au:S/C:C/I:C/A:C

CVSS Score Source: CVE-2026-72135

CVSS v3

Risk Factor: High

Base Score: 7.8

Temporal Score: 6.8

Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Vulnerability Publication Date: 8/11/2026

Reference Information

CVE: CVE-2026-72135

Detections

Analytics