Detections
Analytics

Google: sys-kernel/csql-kernel-6_12, sys-kernel/csql-kernel-6_6: security update to 19216.0.12

medium Tenable Self-Hosted Container Security Plugin ID 472251

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - In the Linux kernel, the following vulnerability has been resolved: tcp: Correct signedness in skb
 remaining space calculation Syzkaller reported a bug [1] where sk->sk_forward_alloc can overflow. When we
 send data, if an skb exists at the tail of the write queue, the kernel will attempt to append the new data
 to that skb. However, the code that checks for available space in the skb is flawed: ''' copy = size_goal
 - skb->len ''' The types of the variables involved are: ''' copy: ssize_t (s64 on 64-bit systems)
 size_goal: int skb->len: unsigned int ''' Due to C's type promotion rules, the signed size_goal is
 converted to an unsigned int to match skb->len before the subtraction. The result is an unsigned int. When
 this unsigned int result is then assigned to the s64 copy variable, it is zero-extended, preserving its
 non-negative value. Consequently, copy is always >= 0. Assume we are sending 2GB of data and size_goal has
 been adjusted to a value smaller than skb->len. The subtraction will result in copy holding a very large
 positive integer. In the subsequent logic, this large value is used to update sk->sk_forward_alloc, which
 can easily cause it to overflow. The syzkaller reproducer uses TCP_REPAIR to reliably create this
 condition. However, this can also occur in real-world scenarios. The tcp_bound_to_half_wnd() function can
 also reduce size_goal to a small value. This would cause the subsequent tcp_wmem_schedule() to set
 sk->sk_forward_alloc to a value close to INT_MAX. Further memory allocation requests would then cause
 sk_forward_alloc to wrap around and become negative. [1]:
 https://syzkaller.appspot.com/bug?extid=de6565462ab540f50e47 (CVE-2025-38463)

Solution

Update the sys-kernel/csql-kernel-6_12 library and its related packages to version 19216.0.12 or later.

See Also

https://storage.googleapis.com/cos-oval-vulnerability-feed/cos-125.oval.xml.tar.gz

Plugin Details

Severity: Medium

ID: 472251

Version: Revision 1.4

Type: Local

Published: 10/3/2026

Updated: 10/6/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Medium

Score: 5

Percentile: 93.96

Vendor

Vendor Severity: MEDIUM

CVSS v2

Risk Factor: Medium

Base Score: 4.6

Temporal Score: 3.4

Vector: CVSS2#AV:L/AC:L/Au:S/C:N/I:N/A:C

CVSS Score Source: CVE-2025-38463

CVSS v3

Risk Factor: Medium

Base Score: 5.5

Temporal Score: 4.8

Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Reference Information

CVE: CVE-2025-38463