Detections
Analytics

Chainguard: multiple linux-gcp-6.18-bootc packages: security update to 6.18.38-r2

high Tenable Self-Hosted Container Security Plugin ID 473061

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - In the Linux kernel, the following vulnerability has been resolved: Revert "net/smc: Introduce TCP ULP
 support" This reverts commit d7cd421da9da2cc7b4d25b8537f66db5c8331c40. As reported by Al Viro, the TCP ULP
 support for SMC is fundamentally broken. The implementation attempts to convert an active TCP socket into
 an SMC socket by modifying the underlying `struct file`, dentry, and inode in-place, which violates core
 VFS invariants that assume these structures are immutable for an open file, creating a risk of use after
 free errors and general system instability. Given the severity of this design flaw and the fact that
 cleaner alternatives (e.g., LD_PRELOAD, BPF) exist for legacy application transparency, the correct course
 of action is to remove this feature entirely. (CVE-2026-46330)

Solution

Update the linux-gcp-6.18-bootc library and its related packages to version 6.18.38-r2 or later.

Plugin Details

Severity: High

ID: 473061

Version: Revision 1.1

Type: Local

Published: 10/6/2026

Updated: 10/6/2026

Risk Information

VPR

Risk Factor: Medium

Score: 4.9

Percentile: 58.09

CVSS v2

Risk Factor: Medium

Base Score: 6.8

Temporal Score: 5

Vector: CVSS2#AV:L/AC:L/Au:S/C:C/I:C/A:C

CVSS Score Source: CVE-2026-46330

CVSS v3

Risk Factor: High

Base Score: 7.8

Temporal Score: 6.8

Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Vulnerability Publication Date: 6/9/2026

Reference Information

CVE: CVE-2026-46330