Google: sys-kernel/cchost-kernel-6_12, sys-kernel/csql-kernel-6_12, sys-kernel/lakitu-kernel-6_12, sys-kernel/lakitu-nc-kernel-6_12: security update to 19506.448.8

critical Tenable Self-Hosted Container Security Plugin ID 469928

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

- In the Linux kernel, the following vulnerability has been resolved: ipvs: reset full ip_vs_seq structs in
ip_vs_conn_new Commit 9a05475cebdd ("ipvs: avoid kmem_cache_zalloc in ip_vs_conn_new") changed
ip_vs_conn_new() to allocate an ip_vs_conn object with kmem_cache_alloc(). The function then initializes
many fields explicitly, but only resets in_seq.delta and out_seq.delta in the two struct ip_vs_seq
members. That leaves init_seq and previous_delta uninitialized. This is normally harmless while the
corresponding IP_VS_CONN_F_IN_SEQ or IP_VS_CONN_F_OUT_SEQ flag is clear. For connections learned from a
sync message, however, ip_vs_proc_conn() preserves those flags from IP_VS_CONN_F_BACKUP_MASK and passes
opt=NULL when the message omits IPVS_OPT_SEQ_DATA. In that case the new connection can be hashed with SEQ
flags set but with the rest of in_seq/out_seq still containing stale slab data. When a packet for such a
connection is later handled by an IPVS application helper, vs_fix_seq() and vs_fix_ack_seq() use
previous_delta and init_seq to rewrite TCP sequence numbers. A malformed sync message can therefore make
forwarded packets carry stale slab bytes in their TCP seq/ack numbers, and can also corrupt the forwarded
TCP flow. Reset both struct ip_vs_seq members completely before publishing the connection. This matches
the existing "reset struct ip_vs_seq" comment and keeps the sequence-adjustment gates inactive unless
valid sequence data is installed later. (CVE-2026-72020)

Solution

Update the sys-kernel/cchost-kernel-6_12 library and its related packages to version 19506.448.8 or later.

Plugin Details

Severity: Critical

ID: 469928

Version: Revision 1.6

Type: Local

Family: Google COS Security Checks

Published: 10/3/2026

Updated: 10/6/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Medium

Score: 4.9

Percentile: 58.27

Vendor

Vendor Severity: LOW

CVSS v2

Risk Factor: Critical

Base Score: 10

Temporal Score: 7.4

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS Score Source: CVE-2026-72020

CVSS v3

Risk Factor: Critical

Base Score: 9.8

Temporal Score: 8.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Vulnerability Publication Date: 8/11/2026

Reference Information

CVE: CVE-2026-72020

Detections

Analytics