Detections
Analytics

Google: sys-kernel/cchost-kernel-6_12, sys-kernel/csql-kernel-6_12, sys-kernel/lakitu-kernel-6_12, sys-kernel/lakitu-nc-kernel-6_12: security update to 19216.739.5

high Tenable Self-Hosted Container Security Plugin ID 474939

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - In the Linux kernel, the following vulnerability has been resolved: xfrm: serialize state GC with device
 state flush The deferred-device pass in xfrm_dev_state_flush() finds states under xfrm_state_dev_gc_lock,
 but drops the lock before calling xfrm_dev_state_free() because the driver callback may sleep. The device
 GC list does not hold an xfrm_state reference, so the state GC worker can destroy the same state
 concurrently. The race can proceed as follows: CPU 0 CPU 1 find x on the device GC list drop
 xfrm_state_dev_gc_lock read x->xso.dev xfrm_state_gc_destroy(x) xfrm_dev_state_free(x) xfrm_state_free(x)
 continue xfrm_dev_state_free(x) Both paths can invoke the driver callback and drop the device reference.
 CPU 0 can also access the xfrm_state after CPU 1 has freed it. KASAN reported: BUG: KASAN: slab-use-after-
 free in xfrm_dev_state_free+0x24c/0x2a0 Read of size 8 at addr ffff88810bbaa960 by task poc/102 Call
 Trace: xfrm_dev_state_free+0x24c/0x2a0 xfrm_dev_state_flush+0x353/0x400 xfrm_dev_event+0x26d/0x3a0
 notifier_call_chain+0xc0/0x280 __dev_notify_flags+0x169/0x250 netif_change_flags+0xe7/0x160
 dev_change_flags+0x96/0x220 devinet_ioctl+0x7f4/0x1880 Allocated by task 87: xfrm_state_alloc+0x1e/0x5c0
 xfrm_add_sa+0xe7f/0x5820 xfrm_user_rcv_msg+0x4f3/0x940 Freed by task 57: kmem_cache_free+0xcb/0x3d0
 xfrm_state_gc_task+0x4a8/0x650 process_one_work+0x63a/0x1070 Serialize xfrm_state destruction against the
 deferred-device pass with a mutex. Keep xfrm_state_dev_gc_lock limited to list operations and retain the
 existing callback and device-reference release ordering. (CVE-2026-98231)

Solution

Update the sys-kernel/cchost-kernel-6_12 library and its related packages to version 19216.739.5 or later.

See Also

https://storage.googleapis.com/cos-oval-vulnerability-feed/cos-125.oval.xml.tar.gz

Plugin Details

Severity: High

ID: 474939

Version: Revision 1.1

Type: Local

Published: 10/16/2026

Updated: 10/16/2026

Risk Information

VPR

Risk Factor: Medium

Score: 4.3

Percentile: 53.46

Vendor

Vendor Severity: LOW

CVSS v2

Risk Factor: Medium

Base Score: 5.6

Temporal Score: 4.1

Vector: CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:C

CVSS Score Source: CVE-2026-98231

CVSS v3

Risk Factor: High

Base Score: 7.1

Temporal Score: 6.2

Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Vulnerability Publication Date: 10/6/2026

Reference Information

CVE: CVE-2026-98231