Google: sys-kernel/cchost-kernel-6_12, sys-kernel/csql-kernel-6_12: security update to 19506.120.44

high Tenable Self-Hosted Container Security Plugin ID 472518

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

- In the Linux kernel, the following vulnerability has been resolved: nfnetlink_osf: validate individual
option lengths in fingerprints nfnl_osf_add_callback() validates opt_num bounds and string NUL-termination
but does not check individual option length fields. A zero-length option causes nf_osf_match_one() to
enter the option matching loop even when foptsize sums to zero, which matches packets with no TCP options
where ctx->optp is NULL: Oops: general protection fault KASAN: null-ptr-deref in range
[0x0000000000000000-0x0000000000000007] RIP: 0010:nf_osf_match_one (net/netfilter/nfnetlink_osf.c:98) Call
Trace: nf_osf_match (net/netfilter/nfnetlink_osf.c:227) xt_osf_match_packet (net/netfilter/xt_osf.c:32)
ipt_do_table (net/ipv4/netfilter/ip_tables.c:293) nf_hook_slow (net/netfilter/core.c:623) ip_local_deliver
(net/ipv4/ip_input.c:262) ip_rcv (net/ipv4/ip_input.c:573) Additionally, an MSS option (kind=2) with
length < 4 causes out-of-bounds reads when nf_osf_match_one() unconditionally accesses optp[2] and optp[3]
for MSS value extraction. While RFC 9293 section 3.2 specifies that the MSS option is always exactly 4
bytes (Kind=2, Length=4), the check uses "< 4" rather than "!= 4" because lengths greater than 4 do not
cause memory safety issues -- the buffer is guaranteed to be at least foptsize bytes by the ctx->optsize
== foptsize check. Reject fingerprints where any option has zero length, or where an MSS option has length
less than 4, at add time rather than trusting these values in the packet matching hot path.
(CVE-2026-23397)

Solution

Update the sys-kernel/cchost-kernel-6_12 library and its related packages to version 19506.120.44 or later.

Plugin Details

Severity: High

ID: 472518

Version: Revision 1.1

Type: Local

Family: Google COS Security Checks

Published: 10/3/2026

Updated: 10/3/2026

Risk Information

VPR

Risk Factor: High

Score: 7

Percentile: 98.3

Vendor

Vendor Severity: LOW

CVSS v2

Risk Factor: Medium

Base Score: 6.2

Temporal Score: 4.6

Vector: CVSS2#AV:L/AC:L/Au:S/C:C/I:N/A:C

CVSS Score Source: CVE-2026-23397

CVSS v3

Risk Factor: High

Base Score: 7.1

Temporal Score: 6.2

Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Vulnerability Publication Date: 3/26/2026

Reference Information

CVE: CVE-2026-23397

Detections

Analytics