Google: sys-kernel/cchost-kernel-6_12, sys-kernel/csql-kernel-6_12: security update to 19506.0.32

medium Tenable Self-Hosted Container Security Plugin ID 473426

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

- In the Linux kernel, the following vulnerability has been resolved: mm/shmem, swap: fix race of truncate
and swap entry split The helper for shmem swap freeing is not handling the order of swap entries
correctly. It uses xa_cmpxchg_irq to erase the swap entry, but it gets the entry order before that using
xa_get_order without lock protection, and it may get an outdated order value if the entry is split or
changed in other ways after the xa_get_order and before the xa_cmpxchg_irq. And besides, the order could
grow and be larger than expected, and cause truncation to erase data beyond the end border. For example,
if the target entry and following entries are swapped in or freed, then a large folio was added in place
and swapped out, using the same entry, the xa_cmpxchg_irq will still succeed, it's very unlikely to happen
though. To fix that, open code the Xarray cmpxchg and put the order retrieval and value checking in the
same critical section. Also, ensure the order won't exceed the end border, skip it if the entry goes
across the border. Skipping large swap entries crosses the end border is safe here. Shmem truncate
iterates the range twice, in the first iteration, find_lock_entries already filtered such entries, and
shmem will swapin the entries that cross the end border and partially truncate the folio (split the folio
or at least zero part of it). So in the second loop here, if we see a swap entry that crosses the end
order, it must at least have its content erased already. I observed random swapoff hangs and kernel panics
when stress testing ZSWAP with shmem. After applying this patch, all problems are gone. (CVE-2026-23161)

Solution

Update the sys-kernel/cchost-kernel-6_12 library and its related packages to version 19506.0.32 or later.

Plugin Details

Severity: Medium

ID: 473426

Version: Revision 1.1

Type: Local

Family: Google COS Security Checks

Published: 10/6/2026

Updated: 10/6/2026

Risk Information

VPR

Risk Factor: Low

Score: 3

Percentile: 23.49

Vendor

Vendor Severity: LOW

CVSS v2

Risk Factor: Low

Base Score: 3.8

Temporal Score: 2.8

Vector: CVSS2#AV:L/AC:H/Au:S/C:N/I:N/A:C

CVSS Score Source: CVE-2026-23161

CVSS v3

Risk Factor: Medium

Base Score: 4.7

Temporal Score: 4.1

Vector: CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Vulnerability Publication Date: 2/14/2026

Reference Information

CVE: CVE-2026-23161

Detections

Analytics