Google: sys-kernel/cchost-kernel-6_12, sys-kernel/csql-kernel-6_12: security update to 19506.0.109

medium Tenable Self-Hosted Container Security Plugin ID 471950

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

- In the Linux kernel, the following vulnerability has been resolved: net: ipv4: fix ARM64 alignment fault
in multipath hash seed `struct sysctl_fib_multipath_hash_seed` contains two u32 fields (user_seed and
mp_seed), making it an 8-byte structure with a 4-byte alignment requirement. In
`fib_multipath_hash_from_keys()`, the code evaluates the entire struct atomically via `READ_ONCE()`:
mp_seed = READ_ONCE(net->ipv4.sysctl_fib_multipath_hash_seed).mp_seed; While this silently works on GCC by
falling back to unaligned regular loads which the ARM64 kernel tolerates, it causes a fatal kernel panic
when compiled with Clang and LTO enabled. Commit e35123d83ee3 ("arm64: lto: Strengthen READ_ONCE() to
acquire when CONFIG_LTO=y") strengthens `READ_ONCE()` to use Load-Acquire instructions (`ldar` / `ldapr`)
to prevent compiler reordering bugs under Clang LTO. Since the macro evaluates the full 8-byte struct,
Clang emits a 64-bit `ldar` instruction. ARM64 architecture strictly requires `ldar` to be naturally
aligned, thus executing it on a 4-byte aligned address triggers a strict Alignment Fault (FSC = 0x21). Fix
the read side by moving the `READ_ONCE()` directly to the `u32` member, which emits a safe 32-bit `ldar
Wn`. Furthermore, Eric Dumazet pointed out that `WRITE_ONCE()` on the entire struct in
`proc_fib_multipath_hash_set_seed()` is also flawed. Analysis shows that Clang splits this 8-byte write
into two separate 32-bit `str` instructions. While this avoids an alignment fault, it destroys atomicity
and exposes a tear-write vulnerability. Fix this by explicitly splitting the write into two 32-bit
`WRITE_ONCE()` operations. Finally, add the missing `READ_ONCE()` when reading `user_seed` in
`proc_fib_multipath_hash_seed()` to ensure proper pairing and concurrency safety. (CVE-2026-23316)

Solution

Update the sys-kernel/cchost-kernel-6_12 library and its related packages to version 19506.0.109 or later.

Plugin Details

Severity: Medium

ID: 471950

Version: Revision 1.1

Type: Local

Family: Google COS Security Checks

Published: 10/3/2026

Updated: 10/3/2026

Risk Information

VPR

Risk Factor: Low

Score: 3

Percentile: 23.62

Vendor

Vendor Severity: LOW

CVSS v2

Risk Factor: Medium

Base Score: 4.6

Temporal Score: 3.4

Vector: CVSS2#AV:L/AC:L/Au:S/C:N/I:N/A:C

CVSS Score Source: CVE-2026-23316

CVSS v3

Risk Factor: Medium

Base Score: 5.5

Temporal Score: 4.8

Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Vulnerability Publication Date: 3/25/2026

Reference Information

CVE: CVE-2026-23316

Detections

Analytics