Google: sys-kernel/cchost-kernel-6_12, sys-kernel/csql-kernel-6_12, sys-kernel/lakitu-kernel-6_12, sys-kernel/lakitu-nc-kernel-6_12: security update to 19506.505.8

high Tenable Self-Hosted Container Security Plugin ID 468988

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

- In the Linux kernel, the following vulnerability has been resolved: apparmor: fix out-of-bounds write when
null terminating a label vec aa_vec_unique() null terminates at vec[n - dups] when VEC_FLAG_TERMINATE is
passed. If the components are all distinct no duplicates are dropped, dups is 0 and the terminator goes to
vec[n], so the caller has to provide room for n + 1 entries. aa_label_strn_parse() sets up its vector with
vec_setup(profile, vec, len, gfp) and then calls aa_vec_unique(vec, len, VEC_FLAG_TERMINATE), but
vec_setup() does not reserve the terminator entry. Up to LOCAL_VEC_ENTRIES it uses the local array of
LOCAL_VEC_ENTRIES pointers, above that it allocates exactly len pointers. The terminator therefore lands
one entry past the end of the local array when len is LOCAL_VEC_ENTRIES, and one entry past the end of the
allocation when len is larger. len comes from the number of "//&" separated components in the label name
and label_count_strn_entries() does not bound it. An unprivileged task reaches the parse by writing to
/proc/self/attr/apparmor/current or through lsm_set_self_attr(2), both of which go through do_setattr(),
and the name is parsed before the change_profile permission is checked. The query_label() path behind the
securityfs .access file, which is mode 0666, performs no permission check at all. Every component has to
resolve to a loaded profile, so a system with policy loaded is required. The other two VEC_FLAG_TERMINATE
users work on a label vec that aa_label_alloc() has already sized with "+ 1 for null terminator entry on
vec". Reserve the same entry in vec_setup() and DEFINE_VEC(). Passing len + 1 from the caller instead
would move len == LOCAL_VEC_ENTRIES out of the local array and into kzalloc(). (CVE-2026-89761)

Solution

Update the sys-kernel/cchost-kernel-6_12 library and its related packages to version 19506.505.8 or later.

Plugin Details

Severity: High

ID: 468988

Version: Revision 1.3

Type: Local

Family: Google COS Security Checks

Published: 10/3/2026

Updated: 10/3/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Medium

Score: 4.9

Percentile: 58.22

Vendor

Vendor Severity: LOW

CVSS v2

Risk Factor: Medium

Base Score: 6.8

Temporal Score: 5

Vector: CVSS2#AV:L/AC:L/Au:S/C:C/I:C/A:C

CVSS Score Source: CVE-2026-89761

CVSS v3

Risk Factor: High

Base Score: 7.8

Temporal Score: 6.8

Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Vulnerability Publication Date: 9/11/2026

Reference Information

CVE: CVE-2026-89761

Detections

Analytics