Google: sys-kernel/cchost-kernel-6_12, sys-kernel/csql-kernel-6_12, sys-kernel/csql-kernel-6_6, sys-kernel/lakitu-kernel-6_12, sys-kernel/lakitu-kernel-6_6, sys-kernel/lakitu-nc-kernel-6_12, sys-kernel/lakitu-nc-kernel-6_6, sys-kernel/lakitu-vgpu-kernel-6_6: security update to 19216.739.5

high Tenable Self-Hosted Container Security Plugin ID 475016

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

- In the Linux kernel, the following vulnerability has been resolved: net/packet: defer vmalloc TX_RING free
until skbs finish AF_PACKET TX_RING skbs keep a raw pointer to their ring frame. The skb page references
preserve page-backed ring blocks after pg_vec is freed, but they do not preserve a vmalloc mapping.
tpacket_destruct_skb() currently drops the pending reference before writing the timestamp and
TP_STATUS_AVAILABLE to the frame. Move the decrement after those stores. The smp_wmb() in
__packet_set_status() orders the frame stores before the decrement. Also recheck pending TX frames under
pg_vec_lock before non-closing ring replacement, so a racing send cannot add a pending skb between the
initial check and the ring swap. Ring allocation can produce a mixture of page-backed and vmalloc-backed
blocks. Allocate deferred-work storage during TX ring setup when the first vmalloc-backed block is
encountered, and keep its pointer in the pg_vec allocation header. If allocation fails, return -ENOMEM
from ring setup. On socket close, a non-NULL pointer identifies a vmalloc-backed vector without a scan. If
TX skbs remain, defer the whole vector to system_long_wq. After pg_vec is detached, a late destructor can
skip the pending decrement. Use socket write-memory accounting as the deferred lifetime gate instead: an
skb remains charged through its final sock_wfree(), after all ring-frame accesses. The delayed work
retains a socket reference and reschedules itself until no TX skbs remain. Move pending_refcnt release to
packet_sock_destruct() so late skb destructors and deferred cleanup can safely use it after
packet_release(). Page-backed teardown remains synchronous, and no lock is added to the TX completion hot
path. (CVE-2026-80841)

Solution

Update the sys-kernel/cchost-kernel-6_12 library and its related packages to version 19216.739.5 or later.

Plugin Details

Severity: High

ID: 475016

Version: Revision 1.1

Type: Local

Family: Google COS Security Checks

Published: 10/16/2026

Updated: 10/16/2026

Risk Information

VPR

Risk Factor: Medium

Score: 6.9

Percentile: 96.49

Vendor

Vendor Severity: LOW

CVSS v2

Risk Factor: Medium

Base Score: 6

Temporal Score: 4.4

Vector: CVSS2#AV:L/AC:H/Au:S/C:C/I:C/A:C

CVSS Score Source: CVE-2026-80841

CVSS v3

Risk Factor: High

Base Score: 7

Temporal Score: 6.1

Vector: CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Vulnerability Publication Date: 9/4/2026

Reference Information

CVE: CVE-2026-80841

Detections

Analytics