Google: sys-kernel/cchost-kernel-6_12, sys-kernel/csql-kernel-6_12, sys-kernel/csql-kernel-6_6, sys-kernel/lakitu-kernel-6_12, sys-kernel/lakitu-kernel-6_6, sys-kernel/lakitu-nc-kernel-6_12, sys-kernel/lakitu-nc-kernel-6_6, sys-kernel/lakitu-vgpu-kernel-6_6: security update to 19216.739.5

high Tenable Self-Hosted Container Security Plugin ID 475091

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

- In the Linux kernel, the following vulnerability has been resolved: exec: Cleanup POSIX timers right after
de_thread() A per-thread CPU timer holds a reference to the PID of the thread it is attached to and, while
it is armed, its node is queued in that thread's posix_cputimers. The task is looked up by that PID. When
a non-leader thread exec()s, de_thread() changes which task owns that PID. pid_task(timer->it.cpu.pid,
PIDTYPE_PID) then returns NULL, but the node is still queued on tsk, which is alive. timer_lock_sighand()
takes a failed lookup to mean that the node is already dequeued, so it has nothing to undo.
begin_new_exec() calls posix_cpu_timers_exit(me) right after exec_task_namespaces() and that removes the
leftover node, so the state normally stays invisible. But bprm->point_of_no_return is set before
de_thread(), so if unshare_files(), set_mm_exe_file(), exec_mmap() or exec_task_namespaces() fails, the
task dies before it gets there. exit_itimers() then frees the k_itimer while its node is still queued, and
reaping tsk later erases that freed node from the rbtree. In short: the non-leader thread B the parent
timer_create(CLOCK_THREAD_CPUTIME_ID) timer_settime() arm_timer() // the node is queued on B execve()
de_thread(B) exchange_tids(B, leader) // B's PID now belongs to the leader release_task(leader)
__exit_signal(leader) posix_cpu_timers_exit(leader) // cleans leader's queue, not B's
__unhash_process(leader) // that PID has no task anymore exec_mmap() mmap_read_lock_killable(old_mm)
kill(B, SIGKILL) // -EINTR get_signal() do_exit() exit_itimers() posix_timer_delete()
posix_cpu_timer_del() posix_timer_unhash_and_free() // freed while still queued wait4() release_task(B)
posix_cpu_timers_exit(B) cleanup_timerqueue() timerqueue_del() // use-after-free Move the POSIX timer
cleanup right after de_thread() before any of the later failure conditions brings the task into do_exit().
[ tglx: Move the cleanup right after de_thread() ] (CVE-2026-98260)

Solution

Update the sys-kernel/cchost-kernel-6_12 library and its related packages to version 19216.739.5 or later.

Plugin Details

Severity: High

ID: 475091

Version: Revision 1.2

Type: Local

Family: Google COS Security Checks

Published: 10/16/2026

Updated: 10/27/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Medium

Score: 6.9

Percentile: 96.41

Vendor

Vendor Severity: LOW

CVSS v2

Risk Factor: Medium

Base Score: 6.8

Temporal Score: 5.3

Vector: CVSS2#AV:L/AC:L/Au:S/C:C/I:C/A:C

CVSS Score Source: CVE-2026-98260

CVSS v3

Risk Factor: High

Base Score: 7.8

Temporal Score: 7

Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

Vulnerability Information

Exploit Available: true

Exploit Ease: Exploits are available

Vulnerability Publication Date: 10/6/2026

Reference Information

CVE: CVE-2026-98260

Detections

Analytics