Google: sys-kernel/cchost-kernel-6_12, sys-kernel/csql-kernel-6_6: security update to 19216.220.174

high Tenable Self-Hosted Container Security Plugin ID 472477

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

- In the Linux kernel, the following vulnerability has been resolved: smb: client: fix krb5 mount with
username option Customer reported that some of their krb5 mounts were failing against a single server as
the client was trying to mount the shares with wrong credentials. It turned out the client was reusing SMB
session from first mount to try mounting the other shares, even though a different username= option had
been specified to the other mounts. By using username mount option along with sec=krb5 to search for
principals from keytab is supported by cifs.upcall(8) since cifs-utils-4.8. So fix this by matching
username mount option in match_session() even with Kerberos. For example, the second mount below should
fail with -ENOKEY as there is no 'foobar' principal in keytab (/etc/krb5.keytab). The client ends up
reusing SMB session from first mount to perform the second one, which is wrong. ``` $ ktutil ktutil:
add_entry -password -p testuser -k 1 -e aes256-cts Password for [email protected]: ktutil: write_kt
/etc/krb5.keytab ktutil: quit $ klist -ke Keytab name: FILE:/etc/krb5.keytab KVNO Principal ----
---------------------------------------------------------------- 1 [email protected] (aes256-cts-hmac-
sha1-96) $ mount.cifs //w22-root2/scratch /mnt/1 -o sec=krb5,username=testuser $ mount.cifs
//w22-root2/scratch /mnt/2 -o sec=krb5,username=foobar $ mount -t cifs | grep -Po 'username=\K\w+'
testuser testuser ``` (CVE-2026-31392)

Solution

Update the sys-kernel/cchost-kernel-6_12 library and its related packages to version 19216.220.174 or later.

Plugin Details

Severity: High

ID: 472477

Version: Revision 1.1

Type: Local

Family: Google COS Security Checks

Published: 10/3/2026

Updated: 10/3/2026

Risk Information

VPR

Risk Factor: Medium

Score: 5

Percentile: 94.16

Vendor

Vendor Severity: LOW

CVSS v2

Risk Factor: Medium

Base Score: 6.2

Temporal Score: 4.6

Vector: CVSS2#AV:L/AC:L/Au:M/C:C/I:C/A:P

CVSS Score Source: CVE-2026-31392

CVSS v3

Risk Factor: High

Base Score: 8.1

Temporal Score: 7.1

Vector: CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:L

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Vulnerability Publication Date: 4/3/2026

Reference Information

CVE: CVE-2026-31392

Detections

Analytics