Detections
Analytics

Google: sys-kernel/cchost-kernel-6_12, sys-kernel/csql-kernel-6_12, sys-kernel/csql-kernel-6_6, sys-kernel/lakitu-kernel-6_12, sys-kernel/lakitu-kernel-6_6, sys-kernel/lakitu-nc-kernel-6_12, sys-kernel/lakitu-nc-kernel-6_6, sys-kernel/lakitu-vgpu-kernel-6_6: security update to 19216.532.3

critical Tenable Self-Hosted Container Security Plugin ID 468646

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - In the Linux kernel, the following vulnerability has been resolved: scsi: target: iscsi: Validate CHAP_R
 length before base64 decode chap_server_compute_hash() allocates client_digest as
 kzalloc(chap->digest_size) and then, for BASE64-encoded responses, passes chap_r directly to
 chap_base64_decode() without checking whether the input length could produce more than digest_size bytes
 of output. chap_base64_decode() writes to the destination unconditionally as long as there is input to
 consume. With MAX_RESPONSE_LENGTH set to 128 and the "0b" prefix stripped by extract_param(), up to 127
 base64 characters can reach the decoder. 127 characters decode to 95 bytes. For SHA-256 (digest_size=32)
 this overflows client_digest by 63 bytes; for MD5 (digest_size=16) the overflow is 79 bytes. The length
 check at line 344 fires after the write has already happened. The HEX branch in the same switch statement
 already validates the length up front. Apply the same approach to the BASE64 branch: strip trailing base64
 padding characters, then reject any input whose data length exceeds DIV_ROUND_UP(digest_size * 4, 3)
 before calling the decoder. Stripping trailing '=' before the comparison handles both padded and unpadded
 encodings. chap_base64_decode() already returns early on '=', so the full original string is still passed
 to the decoder unchanged. The mutual CHAP path decodes CHAP_C into initiatorchg_binhex, which is
 kzalloc(CHAP_CHALLENGE_STR_LEN). extract_param() caps initiatorchg at CHAP_CHALLENGE_STR_LEN characters,
 so at most CHAP_CHALLENGE_STR_LEN-1 base64 characters reach the decoder. The maximum decoded size,
 DIV_ROUND_UP((CHAP_CHALLENGE_STR_LEN-1) * 3, 4), is less than CHAP_CHALLENGE_STR_LEN, so no overflow is
 possible there. A comment is added at the call site to document this. (CVE-2026-63886)

Solution

Update the sys-kernel/cchost-kernel-6_12 library and its related packages to version 19216.532.3 or later.

See Also

https://storage.googleapis.com/cos-oval-vulnerability-feed/cos-125.oval.xml.tar.gz

Plugin Details

Severity: Critical

ID: 468646

Version: Revision 1.5

Type: Local

Published: 10/3/2026

Updated: 10/6/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Medium

Score: 4.9

Percentile: 58.27

Vendor

Vendor Severity: LOW

CVSS v2

Risk Factor: Critical

Base Score: 10

Temporal Score: 7.4

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS Score Source: CVE-2026-63886

CVSS v3

Risk Factor: Critical

Base Score: 9.8

Temporal Score: 8.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Vulnerability Publication Date: 6/22/2026

Reference Information

CVE: CVE-2026-63886