Google: sys-kernel/cchost-kernel-6_12, sys-kernel/cchost-kernel-6_18, sys-kernel/csql-kernel-6_12, sys-kernel/csql-kernel-6_18, sys-kernel/lakitu-kernel-6_12, sys-kernel/lakitu-kernel-6_18, sys-kernel/lakitu-nc-kernel-6_12, sys-kernel/lakitu-nc-kernel-6_18: security update to 19999.44.21

high Tenable Self-Hosted Container Security Plugin ID 470316

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

- In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Fix HV VHCA stats agent
registration race mlx5e_hv_vhca_stats_create() registers the stats agent through
mlx5_hv_vhca_agent_create(). The helper publishes the agent in hv_vhca->agents[type] under agents_lock and
immediately schedules an asynchronous control invalidation on the HV VHCA workqueue before returning to
mlx5e. The asynchronous invalidation invokes the control agent's invalidate callback, which reads the
hypervisor control block and forwards the command to mlx5e_hv_vhca_stats_control(). That callback may
either: - call cancel_delayed_work_sync(&priv->stats_agent.work), or - call queue_delayed_work(priv->wq,
&sagent->work, sagent->delay). However, the delayed_work and priv->stats_agent.agent are only initialized
after mlx5_hv_vhca_agent_create() returns to mlx5e: agent = mlx5_hv_vhca_agent_create(...); /* publish +
invalidate */ ... priv->stats_agent.agent = agent; /* too late */
INIT_DELAYED_WORK(&priv->stats_agent.work, ...); /* too late */ If the asynchronous control path runs
before the two assignments above, it can: - Operate on an uninitialized delayed_work whose timer.function
is NULL. queue_delayed_work() calls add_timer() unconditionally, so when the timer expires the timer
softirq invokes a NULL function pointer. - Re-initialize the timer later through INIT_DELAYED_WORK() while
the timer is already enqueued in the timer wheel, corrupting the hlist (entry.pprev cleared while the
previous bucket node still points at this entry). - When the worker eventually runs,
mlx5e_hv_vhca_stats_work() reads sagent->agent (NULL) and dereferences it inside
mlx5_hv_vhca_agent_write(). Fix this by: - Initializing priv->stats_agent.work before invoking
mlx5_hv_vhca_agent_create(), so the work is always in a valid state when the control callback observes it.
- Adding a struct mlx5_hv_vhca_agent **ctx_update out-parameter to mlx5_hv_vhca_agent_create(). The helper
writes the agent pointer to *ctx_update before publishing into hv_vhca->agents[] and triggering the
agents_update flow, so any callback subsequently invoked from that flow already sees a valid
priv->stats_agent.agent. This avoids having the control callback participate in agent initialization.
While at it, access priv->stats_agent.agent with READ_ONCE()/WRITE_ONCE() for the cross-CPU access with
the worker, and clear priv->stats_agent.buf on the agent_create() failure path. (CVE-2026-72342)

Solution

Update the sys-kernel/cchost-kernel-6_12 library and its related packages to version 19999.44.21 or later.

Plugin Details

Severity: High

ID: 470316

Version: Revision 1.6

Type: Local

Family: Google COS Security Checks

Published: 10/3/2026

Updated: 10/6/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Medium

Score: 4.9

Percentile: 58.27

Vendor

Vendor Severity: LOW

CVSS v2

Risk Factor: High

Base Score: 7.2

Temporal Score: 5.3

Vector: CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C

CVSS Score Source: CVE-2026-72342

CVSS v3

Risk Factor: High

Base Score: 8.4

Temporal Score: 7.3

Vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Vulnerability Publication Date: 8/11/2026

Reference Information

CVE: CVE-2026-72342

Detections

Analytics