Detections
Analytics

Google: sys-kernel/cchost-kernel-6_12, sys-kernel/csql-kernel-6_12, sys-kernel/lakitu-kernel-6_12, sys-kernel/lakitu-nc-kernel-6_12: security update to 19506.299.137

medium Tenable Self-Hosted Container Security Plugin ID 468959

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - In the Linux kernel, the following vulnerability has been resolved: ipv4: fib: free fib_alias with
 kfree_rcu() on insert error path fib_table_insert() publishes new_fa into the leaf's fa_list with
 fib_insert_alias() before calling the fib entry notifiers. When a notifier fails, the error path removes
 new_fa with fib_remove_alias() (hlist_del_rcu) and frees it right away with kmem_cache_free().
 fib_table_lookup() walks that list under rcu_read_lock() only, so a concurrent lookup that already reached
 new_fa keeps reading it after the free: BUG: KASAN: slab-use-after-free in fib_table_lookup
 (net/ipv4/fib_trie.c:1601) Read of size 1 at addr ffff88810676d4eb by task exploit/297 Call Trace:
 fib_table_lookup (net/ipv4/fib_trie.c:1601) ip_route_output_key_hash_rcu (net/ipv4/route.c:2814)
 ip_route_output_key_hash (net/ipv4/route.c:2705) __ip4_datagram_connect (net/ipv4/datagram.c:49)
 udp_connect (net/ipv4/udp.c:2144) __sys_connect (net/socket.c:2167) __x64_sys_connect (net/socket.c:2173)
 do_syscall_64 entry_SYSCALL_64_after_hwframe which belongs to the cache ip_fib_alias of size 56 Triggering
 the error path needs CAP_NET_ADMIN and a registered fib notifier that can reject a route; a netdevsim
 device whose IPv4 FIB resource is exhausted is enough. Free new_fa with alias_free_mem_rcu(), as
 fib_table_delete() already does for a fib_alias removed from the trie. (CVE-2026-64572)

Solution

Update the sys-kernel/cchost-kernel-6_12 library and its related packages to version 19506.299.137 or later.

See Also

https://storage.googleapis.com/cos-oval-vulnerability-feed/cos-129.oval.xml.tar.gz

Plugin Details

Severity: Medium

ID: 468959

Version: Revision 1.5

Type: Local

Published: 10/3/2026

Updated: 10/6/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Low

Score: 3.5

Percentile: 51.47

Vendor

Vendor Severity: LOW

CVSS v2

Risk Factor: Medium

Base Score: 6

Temporal Score: 4.4

Vector: CVSS2#AV:L/AC:H/Au:S/C:C/I:C/A:C

CVSS Score Source: CVE-2026-64572

CVSS v3

Risk Factor: Medium

Base Score: 4.7

Temporal Score: 4.1

Vector: CVSS:3.0/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Vulnerability Publication Date: 8/5/2026

Reference Information

CVE: CVE-2026-64572