Google: sys-kernel/cchost-kernel-6_12, sys-kernel/csql-kernel-6_12, sys-kernel/csql-kernel-6_6, sys-kernel/lakitu-kernel-6_12, sys-kernel/lakitu-kernel-6_6, sys-kernel/lakitu-nc-kernel-6_12, sys-kernel/lakitu-nc-kernel-6_6, sys-kernel/lakitu-vgpu-kernel-6_6: security update to 19216.700.7

high Tenable Self-Hosted Container Security Plugin ID 474969

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

- In the Linux kernel, the following vulnerability has been resolved: btrfs: drop recovered reloc root refs
on recovery failure During relocation recovery, each fs root gets a reference to its relocation root. If
loading or adding a later root fails, or if the first transaction commit fails, btrfs_recover_relocation()
jumps to out_unset before merge_reloc_roots() and clean_dirty_subvols(). put_reloc_control() drops the
list-owned relocation root references, but it does not clear fs_root->reloc_root or drop the references
owned by those pointers. Mount cleanup only drops them when BTRFS_FS_ERROR is set, so an error such as
-ENOMEM while processing a later root can leave references behind. Keep temporary references to the fs
roots associated during recovery. On failure, clear their reloc_root pointers and drop the corresponding
references. Once the first transaction commit succeeds, drop only the temporary fs root references and let
the normal merge and cleanup paths handle the relocation roots. Fault injection on a pending-relocation
image confirmed the cleanup gap. With an injected first-commit failure, 25 fs roots had reloc_root set
with fs_error=0. With this fix, the same failure path drops that count to 0 before mount fails.
(CVE-2026-89645)

Solution

Update the sys-kernel/cchost-kernel-6_12 library and its related packages to version 19216.700.7 or later.

Plugin Details

Severity: High

ID: 474969

Version: Revision 1.1

Type: Local

Family: Google COS Security Checks

Published: 10/16/2026

Updated: 10/16/2026

Risk Information

VPR

Risk Factor: Medium

Score: 6.9

Percentile: 96.59

Vendor

Vendor Severity: LOW

CVSS v2

Risk Factor: High

Base Score: 7.2

Temporal Score: 5.3

Vector: CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C

CVSS Score Source: CVE-2026-89645

CVSS v3

Risk Factor: High

Base Score: 7.8

Temporal Score: 6.8

Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Vulnerability Publication Date: 9/11/2026

Reference Information

CVE: CVE-2026-89645

Detections

Analytics