Google: sys-kernel/cchost-kernel-6_12, sys-kernel/csql-kernel-6_12, sys-kernel/lakitu-kernel-6_12, sys-kernel/lakitu-nc-kernel-6_12: security update to 19506.299.3

medium Tenable Self-Hosted Container Security Plugin ID 469520

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

- In the Linux kernel, the following vulnerability has been resolved: netfs: Fix netfs_invalidate_folio() to
clear dirty bit if all changes gone If a streaming write is made, this will leave the relevant modified
folio in a not-uptodate, but dirty state with a netfs_folio struct hung off of folio->private indicating
the dirty range. Subsequently truncating the file such that the dirty data in the folio is removed, but
the first part of the folio theoretically remains will cause the netfs_folio struct to be discarded... but
will leave the dirty flag set. If the folio is then read via mmap(), netfs_read_folio() will see that the
page is dirty and jump to netfs_read_gaps() to fill in the missing bits. netfs_read_gaps(), however,
expects there to be a netfs_folio struct present and can oops because truncate removed it. Fix this by
calling folio_cancel_dirty() in netfs_invalidate_folio() in the event that all the dirty data in the folio
is erased (as nfs does). Also add some tracepoints to log modifications to a dirty page. This can be
reproduced with something like: dd if=/dev/zero of=/xfstest.test/foo bs=1M count=1 umount /xfstest.test
mount /xfstest.test xfs_io -c "w 0xbbbf 0xf96c" \ -c "truncate 0xbbbf" \ -c "mmap -r 0xb000 0x11000" \ -c
"mr 0xb000 0x11000" \ /xfstest.test/foo with fscaching disabled (otherwise streaming writes are
suppressed) and a change to netfs_perform_write() to disallow streaming writes if the fd is open O_RDWR:
if (//(file->f_mode & FMODE_READ) || <--- comment this out netfs_is_cache_enabled(ctx)) { It should be
reproducible even without this change, but if prevents the above trivial xfs_io command from reproducing
it. Note that the initial dd is important: the file must start out sufficiently large that the zero-point
logic doesn't just clear the gaps because it knows there's nothing in the file to read yet. Unmounting and
mounting is needed to clear the pagecache (there are other ways to do that that may also work). This was
initially reproduced with the generic/522 xfstest on some patches that remove the FMODE_READ restriction.
(CVE-2026-64064)

Solution

Update the sys-kernel/cchost-kernel-6_12 library and its related packages to version 19506.299.3 or later.

Plugin Details

Severity: Medium

ID: 469520

Version: Revision 1.5

Type: Local

Family: Google COS Security Checks

Published: 10/3/2026

Updated: 10/6/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Low

Score: 3

Percentile: 23.64

Vendor

Vendor Severity: MEDIUM

CVSS v2

Risk Factor: Medium

Base Score: 4.6

Temporal Score: 3.4

Vector: CVSS2#AV:L/AC:L/Au:S/C:N/I:N/A:C

CVSS Score Source: CVE-2026-64064

CVSS v3

Risk Factor: Medium

Base Score: 5.5

Temporal Score: 4.8

Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Vulnerability Publication Date: 6/4/2026

Reference Information

CVE: CVE-2026-64064

Detections

Analytics