Google: sys-kernel/cchost-kernel-6_12, sys-kernel/csql-kernel-6_12: security update to 19216.220.174

high Tenable Self-Hosted Container Security Plugin ID 471882

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

- In the Linux kernel, the following vulnerability has been resolved: xfrm: Fix work re-schedule after
cancel in xfrm_nat_keepalive_net_fini() After cancel_delayed_work_sync() is called from
xfrm_nat_keepalive_net_fini(), xfrm_state_fini() flushes remaining states via __xfrm_state_delete(), which
calls xfrm_nat_keepalive_state_updated() to re-schedule nat_keepalive_work. The following is a simple race
scenario: cpu0 cpu1 cleanup_net() [Round 1] ops_undo_list() xfrm_net_exit() xfrm_nat_keepalive_net_fini()
cancel_delayed_work_sync(nat_keepalive_work); xfrm_state_fini() xfrm_state_flush() xfrm_state_delete(x)
__xfrm_state_delete(x) xfrm_nat_keepalive_state_updated(x) schedule_delayed_work(nat_keepalive_work);
rcu_barrier(); net_complete_free(); net_passive_dec(net); llist_add(&net->defer_free_list,
&defer_free_list); cleanup_net() [Round 2] rcu_barrier(); net_complete_free() kmem_cache_free(net_cachep,
net); nat_keepalive_work() // on freed net To prevent this, cancel_delayed_work_sync() is replaced with
disable_delayed_work_sync(). (CVE-2026-31406)

Solution

Update the sys-kernel/cchost-kernel-6_12 library and its related packages to version 19216.220.174 or later.

Plugin Details

Severity: High

ID: 471882

Version: Revision 1.2

Type: Local

Family: Google COS Security Checks

Published: 10/3/2026

Updated: 10/3/2026

Risk Information

VPR

Risk Factor: Medium

Score: 4.9

Percentile: 57.86

Vendor

Vendor Severity: LOW

CVSS v2

Risk Factor: Medium

Base Score: 6.8

Temporal Score: 5

Vector: CVSS2#AV:L/AC:L/Au:S/C:C/I:C/A:C

CVSS Score Source: CVE-2026-31406

CVSS v3

Risk Factor: High

Base Score: 7.8

Temporal Score: 6.8

Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Vulnerability Publication Date: 4/6/2026

Reference Information

CVE: CVE-2026-31406

Detections

Analytics