Google: sys-kernel/cchost-kernel-6_12, sys-kernel/csql-kernel-6_12, sys-kernel/lakitu-kernel-6_12, sys-kernel/lakitu-nc-kernel-6_12: security update to 19506.448.8

medium Tenable Self-Hosted Container Security Plugin ID 469754

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

- In the Linux kernel, the following vulnerability has been resolved: firmware_loader: Fix recursive lock in
device_cache_fw_images() A recursive locking deadlock can occur in the firmware loader's power management
notification handler. During system suspend or hibernation preparation, fw_pm_notify() calls
device_cache_fw_images(). This function acquires fw_lock to set the firmware cache state to
FW_LOADER_START_CACHE and then iterates over all devices using dpm_for_each_dev() while still holding the
lock. For each device, dev_cache_fw_image() schedules asynchronous work to cache the firmware. If memory
allocation for the async work entry fails (e.g., in out-of-memory conditions),
async_schedule_node_domain() falls back to executing the work function synchronously in the current
thread. The synchronous execution path (__async_dev_cache_fw_image() -> cache_firmware() ->
request_firmware() -> assign_fw()) attempts to acquire fw_lock again. Since the current thread already
holds fw_lock, this results in a recursive locking deadlock. Fix this by releasing fw_lock immediately
after updating the cache state and before calling dpm_for_each_dev(). The lock is only needed to protect
the state update. Concurrent firmware requests will correctly see the FW_LOADER_START_CACHE state and use
the piggyback mechanism, which is independently protected by its own fwc->name_lock. (CVE-2026-74331)

Solution

Update the sys-kernel/cchost-kernel-6_12 library and its related packages to version 19506.448.8 or later.

Plugin Details

Severity: Medium

ID: 469754

Version: Revision 1.6

Type: Local

Family: Google COS Security Checks

Published: 10/3/2026

Updated: 10/6/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Low

Score: 3

Percentile: 23.66

Vendor

Vendor Severity: LOW

CVSS v2

Risk Factor: Medium

Base Score: 4.9

Temporal Score: 3.6

Vector: CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C

CVSS Score Source: CVE-2026-74331

CVSS v3

Risk Factor: Medium

Base Score: 5.5

Temporal Score: 4.8

Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Vulnerability Publication Date: 8/11/2026

Reference Information

CVE: CVE-2026-74331

Detections

Analytics