Detections
Analytics

Google: sys-kernel/cchost-kernel-6_18, sys-kernel/csql-kernel-6_18, sys-kernel/lakitu-kernel-6_18, sys-kernel/lakitu-nc-kernel-6_18: security update to 19999.44.21

medium Tenable Self-Hosted Container Security Plugin ID 469992

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - In the Linux kernel, the following vulnerability has been resolved: bpf: fix crash in
 bpf_[set|remove]_dentry_xattr for negative dentries bpf_set_dentry_xattr and bpf_remove_dentry_xattr BPF
 kfuncs attempt to lock the inode of the supplied dentry without checking if it is NULL. If a negative
 dentry is passed (e.g. from security_inode_create), d_inode(dentry) returns NULL, and inode_lock(inode)
 will cause a NULL pointer dereference. Trivially fix this by adding a NULL check for inode before
 attempting to lock it, returning -EINVAL if it is NULL. Additionally, drop WARN_ON(!inode) in
 bpf_xattr_read_permission() and bpf_xattr_write_permission(). These warnings could be triggered by passing
 a negative dentry to bpf_get_dentry_xattr() or the _locked variants of the xattr kfuncs, potentially
 causing a Denial of Service on systems with panic_on_warn enabled. Instead, simply return -EINVAL.
 (CVE-2026-74400)

Solution

Update the sys-kernel/cchost-kernel-6_18 library and its related packages to version 19999.44.21 or later.

See Also

https://storage.googleapis.com/cos-oval-vulnerability-feed/cos-133.oval.xml.tar.gz

Plugin Details

Severity: Medium

ID: 469992

Version: Revision 1.6

Type: Local

Published: 10/3/2026

Updated: 10/6/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Low

Score: 3

Percentile: 23.66

Vendor

Vendor Severity: LOW

CVSS v2

Risk Factor: Low

Base Score: 2.1

Temporal Score: 1.6

Vector: CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:P

CVSS Score Source: CVE-2026-74400

CVSS v3

Risk Factor: Medium

Base Score: 5.5

Temporal Score: 4.8

Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Vulnerability Publication Date: 8/15/2026

Reference Information

CVE: CVE-2026-74400