Detections
Analytics

Google: sys-kernel/cchost-kernel-6_12, sys-kernel/csql-kernel-6_12, sys-kernel/csql-kernel-6_6, sys-kernel/lakitu-kernel-6_12, sys-kernel/lakitu-kernel-6_6, sys-kernel/lakitu-nc-kernel-6_12, sys-kernel/lakitu-nc-kernel-6_6, sys-kernel/lakitu-vgpu-kernel-6_6: security update to 19216.739.5

medium Tenable Self-Hosted Container Security Plugin ID 474960

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - In the Linux kernel, the following vulnerability has been resolved: Input: evdev - zero absinfo before
 partial copy in EVIOCSABS The EVIOCSABS handler copies at most the user supplied ioctl size into an
 uninitialized on-stack struct input_absinfo: if (copy_from_user(&abs, p, min_t(size_t, size, sizeof(struct
 input_absinfo)))) The size comes from _IOC_SIZE() of the ioctl command and is therefore fully controlled
 by userspace. A short size leaves the trailing part of the structure holding whatever was on the kernel
 stack, and the whole structure is then stored into the device: dev->absinfo[t] = abs; EVIOCGABS hands that
 back to userspace, disclosing the stale stack bytes. Only the resolution field is currently cleared, which
 covers the legacy struct layout but not an arbitrarily short size. Zero the structure before the copy so
 any part not supplied by the caller reads back as zero. The existing resolution fixup is kept, since it
 also handles a size that partially overlaps that field. (CVE-2026-98205)

Solution

Update the sys-kernel/cchost-kernel-6_12 library and its related packages to version 19216.739.5 or later.

See Also

https://storage.googleapis.com/cos-oval-vulnerability-feed/cos-125.oval.xml.tar.gz

Plugin Details

Severity: Medium

ID: 474960

Version: Revision 1.1

Type: Local

Published: 10/16/2026

Updated: 10/16/2026

Risk Information

VPR

Risk Factor: Low

Score: 3.5

Percentile: 51.45

Vendor

Vendor Severity: LOW

CVSS v2

Risk Factor: Medium

Base Score: 4.9

Temporal Score: 3.6

Vector: CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C

CVSS Score Source: CVE-2026-98205

CVSS v3

Risk Factor: Medium

Base Score: 6.1

Temporal Score: 5.3

Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Vulnerability Publication Date: 10/6/2026

Reference Information

CVE: CVE-2026-98205