Google: sys-kernel/cchost-kernel-6_12, sys-kernel/csql-kernel-6_12: security update to 19506.120.44

medium Tenable Self-Hosted Container Security Plugin ID 472526

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

- In the Linux kernel, the following vulnerability has been resolved: btrfs: set BTRFS_ROOT_ORPHAN_CLEANUP
during subvol create We have recently observed a number of subvolumes with broken dentries. ls-ing the
parent dir looks like: drwxrwxrwt 1 root root 16 Jan 23 16:49 . drwxr-xr-x 1 root root 24 Jan 23 16:48 ..
d????????? ? ? ? ? ? broken_subvol and similarly stat-ing the file fails. In this state, deleting the
subvol fails with ENOENT, but attempting to create a new file or subvol over it errors out with EEXIST and
even aborts the fs. Which leaves us a bit stuck. dmesg contains a single notable error message reading:
"could not do orphan cleanup -2" 2 is ENOENT and the error comes from the failure handling path of
btrfs_orphan_cleanup(), with the stack leading back up to btrfs_lookup(). btrfs_lookup btrfs_lookup_dentry
btrfs_orphan_cleanup // prints that message and returns -ENOENT After some detailed inspection of the
internal state, it became clear that: - there are no orphan items for the subvol - the subvol is otherwise
healthy looking, it is not half-deleted or anything, there is no drop progress, etc. - the subvol was
created a while ago and does the meaningful first btrfs_orphan_cleanup() call that sets
BTRFS_ROOT_ORPHAN_CLEANUP much later. - after btrfs_orphan_cleanup() fails, btrfs_lookup_dentry() returns
-ENOENT, which results in a negative dentry for the subvolume via d_splice_alias(NULL, dentry), leading to
the observed behavior. The bug can be mitigated by dropping the dentry cache, at which point we can
successfully delete the subvolume if we want. i.e., btrfs_lookup() btrfs_lookup_dentry() if
(!sb_rdonly(inode->vfs_inode)->vfs_inode) btrfs_orphan_cleanup(sub_root)
test_and_set_bit(BTRFS_ROOT_ORPHAN_CLEANUP) btrfs_search_slot() // finds orphan item for inode N ...
prints "could not do orphan cleanup -2" if (inode == ERR_PTR(-ENOENT)) inode = NULL; return
d_splice_alias(NULL, dentry) // NEGATIVE DENTRY for valid subvolume btrfs_orphan_cleanup() does
test_and_set_bit(BTRFS_ROOT_ORPHAN_CLEANUP) on the root when it runs, so it cannot run more than once on a
given root, so something else must run concurrently. However, the obvious routes to deleting an orphan
when nlinks goes to 0 should not be able to run without first doing a lookup into the subvolume, which
should run btrfs_orphan_cleanup() and set the bit. The final important observation is that create_subvol()
calls d_instantiate_new() but does not set BTRFS_ROOT_ORPHAN_CLEANUP, so if the dentry cache gets dropped,
the next lookup into the subvolume will make a real call into btrfs_orphan_cleanup() for the first time.
This opens up the possibility of concurrently deleting the inode/orphan items but most typical evict()
paths will be holding a reference on the parent dentry (child dentry holds parent->d_lockref.count via
dget in d_alloc(), released in __dentry_kill()) and prevent the parent from being removed from the dentry
cache. The one exception is delayed iputs. Ordered extent creation calls igrab() on the inode. If the file
is unlinked and closed while those refs are held, iput() in __dentry_kill() decrements i_count but does
not trigger eviction (i_count > 0). The child dentry is freed and the subvol dentry's d_lockref.count
drops to 0, making it evictable while the inode is still alive. Since there are two races (the race
between writeback and unlink and the race between lookup and delayed iputs), and there are too many moving
parts, the following three diagrams show the complete picture. (Only the second and third are races) Phase
1: Create Subvol in dentry cache without BTRFS_ROOT_ORPHAN_CLEANUP set btrfs_mksubvol() lookup_one_len()
__lookup_slow() d_alloc_parallel() __d_alloc() // d_lockref.count = 1 create_subvol(dentry) // doesn't
touch the bit.. d_instantiate_new(dentry, inode) // dentry in cache with d_lockref.c ---truncated---
(CVE-2026-31519)

Solution

Update the sys-kernel/cchost-kernel-6_12 library and its related packages to version 19506.120.44 or later.

Plugin Details

Severity: Medium

ID: 472526

Version: Revision 1.1

Type: Local

Family: Google COS Security Checks

Published: 10/3/2026

Updated: 10/3/2026

Risk Information

VPR

Risk Factor: Low

Score: 3

Percentile: 23.72

Vendor

Vendor Severity: LOW

CVSS v2

Risk Factor: Medium

Base Score: 4.6

Temporal Score: 3.4

Vector: CVSS2#AV:L/AC:L/Au:S/C:N/I:N/A:C

CVSS Score Source: CVE-2026-31519

CVSS v3

Risk Factor: Medium

Base Score: 5.5

Temporal Score: 4.8

Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Vulnerability Publication Date: 4/22/2026

Reference Information

CVE: CVE-2026-31519

Detections

Analytics