Google: sys-kernel/cchost-kernel-6_12, sys-kernel/cchost-kernel-6_18, sys-kernel/csql-kernel-6_12, sys-kernel/csql-kernel-6_18, sys-kernel/lakitu-kernel-6_12, sys-kernel/lakitu-kernel-6_18, sys-kernel/lakitu-nc-kernel-6_12, sys-kernel/lakitu-nc-kernel-6_18: security update to 19999.44.28

critical Tenable Self-Hosted Container Security Plugin ID 471099

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

- In the Linux kernel, the following vulnerability has been resolved: net: gro: properly validate BIG TCP
aggregation criteria When GRO attempts to aggregate packets beyond GRO_LEGACY_MAX_SIZE (64KB), BIG TCP
should only be permitted for plain IPv4 TCP and plain IPv6 TCP (with sufficient MAC header room to insert
the temporary HBH jumbo header). However, commit b1a78b9b9886 ("net: add support for ipv4 big tcp")
loosened the check in skb_gro_receive(), leading to several issues: 1. skb_gro_receive() checked
skb_headroom(p) instead of the actual space before the MAC header (p->mac_header). Because skb_headroom(p)
includes mac_len, crafted frames (e.g. injected via AF_PACKET) can pass the check with p->mac_header < 8
bytes. When ipv6_gro_complete() inserts the temporary HBH jumbo header, the memmove() starts before
skb->head, causing an out-of-bounds write and wrapping skb->mac_header. 2. It allowed non-IP protocols
such as software VLAN (ETH_P_8021Q / ETH_P_8021AD) to aggregate beyond 64KB because p->protocol !=
ETH_P_IPV6 was true. 3. It checked p->encapsulation instead of NAPI_GRO_CB(skb)->encap_mark, allowing
encapsulated flows (e.g. SIT / IPv6-in-IPv4) to aggregate beyond 64KB. Fix skb_gro_receive() to strictly
enforce: - NAPI_GRO_CB(skb)->proto == IPPROTO_TCP - Not encapsulated (!NAPI_GRO_CB(skb)->encap_mark &&
!p->encapsulation) - Protocol must be either ETH_P_IP or ETH_P_IPV6 - If ETH_P_IPV6, p->mac_header must be
at least sizeof(struct hop_jumbo_hdr) Returning -E2BIG from skb_gro_receive() ensures that packets which
cannot become BIG TCP are cleanly flushed at <= 64KB and delivered intact without dropping. This issue
does not exist in mainline (7.0+) because the subsystem was rewritten in commit 81be30c1f5f2 ("net/ipv6:
Drop HBH for BIG TCP on RX side"), making this fix relevant only for older stable branches like 6.18.y.
(CVE-2026-80725)

Solution

Update the sys-kernel/cchost-kernel-6_12 library and its related packages to version 19999.44.28 or later.

Plugin Details

Severity: Critical

ID: 471099

Version: Revision 1.6

Type: Local

Family: Google COS Security Checks

Published: 10/3/2026

Updated: 10/6/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Medium

Score: 4.9

Percentile: 58.35

Vendor

Vendor Severity: LOW

CVSS v2

Risk Factor: Critical

Base Score: 10

Temporal Score: 7.4

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS Score Source: CVE-2026-80725

CVSS v3

Risk Factor: Critical

Base Score: 9.8

Temporal Score: 8.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Vulnerability Publication Date: 8/29/2026

Reference Information

CVE: CVE-2026-80725

Detections

Analytics