Google: sys-kernel/cchost-kernel-6_12, sys-kernel/csql-kernel-6_12, sys-kernel/csql-kernel-6_6, sys-kernel/lakitu-kernel-6_12, sys-kernel/lakitu-kernel-6_6, sys-kernel/lakitu-nc-kernel-6_12, sys-kernel/lakitu-nc-kernel-6_6, sys-kernel/lakitu-vgpu-kernel-6_6: security update to 19216.700.7

critical Tenable Self-Hosted Container Security Plugin ID 472661

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

- In the Linux kernel, the following vulnerability has been resolved: KVM: nVMX: Service local TLB flushes
on failed nested VM-Enter KVM services local TLB flushes on "full" nested VM-Exits (through
__nested_vmx_vmexit()), but not if a nested VM-Enter fails (e.g. due to failed VMCS checks in
nested_vmx_enter_non_root_mode()). However, it is possible that KVM had queued TLB flushes that need to be
performed, even if the nested VM-Enter was not successful. For example, if VPID is disabled for L2 (via
nested_vmx_transition_tlb_flush(), or if via the MSR load lists, as the SDM says: If any MSR is being
loaded in such a way that would architecturally require a TLB flush, the TLBs are updated so that, after
VM entry, the logical processor will not use any translations that were cached before the transition. The
SDM is unclear about when the TLB flush should occur, and whether or not a failed VM entry would flush the
TLB, so it is safer to always do the TLB flush in this case. More concretely, KVM also updates the last
VPID L1 used for L2 in nested_vmx_transition_tlb_flush() (i.e. last_vpid), even if the VM entry ultimately
fails. With the current code, KVM could miss a TLB flush if L1 changes L2's VPID, then does a failed VM
entry followed by a successful one, as the failed VM entry would update last_vpid but not actually flush
the TLB. Servicing local TLB flushes on failed VM entries makes sure that the TLB is always flushed when
last_vpid is updated. (CVE-2026-89930)

Solution

Update the sys-kernel/cchost-kernel-6_12 library and its related packages to version 19216.700.7 or later.

Plugin Details

Severity: Critical

ID: 472661

Version: Revision 1.3

Type: Local

Family: Google COS Security Checks

Published: 10/5/2026

Updated: 10/6/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Medium

Score: 5

Percentile: 93.31

Vendor

Vendor Severity: HIGH

CVSS v2

Risk Factor: High

Base Score: 7.2

Temporal Score: 5.3

Vector: CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C

CVSS Score Source: CVE-2026-89930

CVSS v3

Risk Factor: Critical

Base Score: 9.3

Temporal Score: 8.1

Vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Vulnerability Publication Date: 9/16/2026

Reference Information

CVE: CVE-2026-89930

Detections

Analytics