Detections
Analytics

Google: sys-kernel/csql-kernel-6_6, sys-kernel/lakitu-kernel-6_6, sys-kernel/lakitu-nc-kernel-6_6, sys-kernel/lakitu-vgpu-kernel-6_6: security update to 18867.624.2

critical Tenable Self-Hosted Container Security Plugin ID 472595

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - In the Linux kernel, the following vulnerability has been resolved: inetpeer: randomize RB-tree node
 comparison using SipHash The inetpeer rate limiting system stores peer entries in a Red-Black tree keyed
 deterministically on the remote IP address. Because tree lookups walk the RB-tree using standard
 lexicographical comparisons (inetpeer_addr_cmp), an off-path adversary can predict the exact topology of
 the tree and the sequence of nodes traversed during lookups (the gc_stack candidate list). By combining
 deterministic tree traversal with aggressive garbage collection (triggered when tree size exceeds
 inet_peer_threshold), an attacker can selectively force the eviction of targeted inet_peer nodes. When an
 evicted node is subsequently re-created upon receiving a new packet, its rate-limiting token bucket
 (rate_tokens, rate_last) is reset to full capacity. This creates a side-channel primitive allowing off-
 path attackers to bypass IP-keyed ICMP rate limits and infer open UDP ports (similar to SAD DNS style
 attacks). Mitigate this by randomizing the RB-tree node comparison logic using SipHash with a secret key
 (inetpeer_hash_key) initialized via net_get_random_once(). Nodes are ordered in the tree by SipHash(addr,
 key) rather than raw IP addresses. Because the secret key is unknown to external entities, the tree layout
 and lookup traversal paths are unpredictable to off-path adversaries, breaking the deterministic eviction
 gadget. Cache the computed 64-bit SipHash (hash) in struct inet_peer and compute the target hash (dhash)
 once at the beginning of inet_getpeer() to avoid recomputing SipHash at every step of the RB-tree walk.
 (CVE-2026-90110)

Solution

Update the sys-kernel/csql-kernel-6_6 library and its related packages to version 18867.624.2 or later.

See Also

https://storage.googleapis.com/cos-oval-vulnerability-feed/cos-121.oval.xml.tar.gz

Plugin Details

Severity: Critical

ID: 472595

Version: Revision 1.3

Type: Local

Published: 10/5/2026

Updated: 10/6/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Medium

Score: 4.5

Percentile: 57.64

Vendor

Vendor Severity: LOW

CVSS v2

Risk Factor: High

Base Score: 9.7

Temporal Score: 7.2

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:P

CVSS Score Source: CVE-2026-90110

CVSS v3

Risk Factor: Critical

Base Score: 9.4

Temporal Score: 8.2

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Vulnerability Publication Date: 9/17/2026

Reference Information

CVE: CVE-2026-90110