Detections
Analytics

Google: sys-kernel/cchost-kernel-6_12, sys-kernel/csql-kernel-6_12, sys-kernel/csql-kernel-6_6, sys-kernel/lakitu-kernel-6_12, sys-kernel/lakitu-kernel-6_6, sys-kernel/lakitu-nc-kernel-6_12, sys-kernel/lakitu-nc-kernel-6_6, sys-kernel/lakitu-vgpu-kernel-6_6: security update to 19216.655.6

critical Tenable Self-Hosted Container Security Plugin ID 468895

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - In the Linux kernel, the following vulnerability has been resolved: vhost/net: complete zerocopy ubufs
 only once vhost-net initializes one ubuf_info per outstanding zerocopy TX descriptor and hands it to the
 backend socket. The networking stack may then clone a zerocopy skb before all skb references are released.
 For example, batman-adv fragmentation reaches skb_split(), which calls skb_zerocopy_clone() and increments
 the same ubuf_info refcount. vhost_zerocopy_complete() currently treats every ubuf callback as a completed
 vhost descriptor. It dereferences ubuf->ctx, writes the descriptor completion state, and drops the
 vhost_net_ubuf_ref even when the callback only releases a cloned skb reference. A backend reset can
 therefore wait for and free the vhost_net_ubuf_ref while another cloned skb still carries the same
 ubuf_info. A later completion then dereferences the freed ubufs pointer. KASAN reports the stale
 completion as: BUG: KASAN: slab-use-after-free in vhost_zerocopy_complete+0x1d7/0x1f0 BUG: KASAN: slab-
 use-after-free in vhost_zerocopy_complete+0x101/0x1f0 vhost_zerocopy_complete skb_copy_ubufs
 __dev_forward_skb2 veth_xmit The freed object was allocated from vhost_net_ioctl() while setting the
 backend and freed through kfree_rcu()/kvfree_rcu_bulk after backend removal, while delayed skb completion
 still reached vhost_zerocopy_complete(). Honor the generic ubuf_info refcount before touching vhost state,
 and run the vhost descriptor completion only for the final ubuf reference. This matches the
 msg_zerocopy_complete() ownership rule for cloned zerocopy skbs. (CVE-2026-74310)

Solution

Update the sys-kernel/cchost-kernel-6_12 library and its related packages to version 19216.655.6 or later.

See Also

https://storage.googleapis.com/cos-oval-vulnerability-feed/cos-125.oval.xml.tar.gz

Plugin Details

Severity: Critical

ID: 468895

Version: Revision 1.5

Type: Local

Published: 10/3/2026

Updated: 10/6/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Medium

Score: 5

Percentile: 93.48

Vendor

Vendor Severity: LOW

CVSS v2

Risk Factor: High

Base Score: 7.2

Temporal Score: 5.3

Vector: CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C

CVSS Score Source: CVE-2026-74310

CVSS v3

Risk Factor: Critical

Base Score: 9.3

Temporal Score: 8.1

Vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Vulnerability Publication Date: 8/11/2026

Reference Information

CVE: CVE-2026-74310