Google: sys-kernel/cchost-kernel-6_12, sys-kernel/csql-kernel-6_12, sys-kernel/csql-kernel-6_6, sys-kernel/lakitu-kernel-6_12, sys-kernel/lakitu-kernel-6_6, sys-kernel/lakitu-nc-kernel-6_12, sys-kernel/lakitu-nc-kernel-6_6, sys-kernel/lakitu-vgpu-kernel-6_6: security update to 19216.700.7

critical Tenable Self-Hosted Container Security Plugin ID 475104

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

- In the Linux kernel, the following vulnerability has been resolved: SUNRPC: svcauth_gss: enforce krb5
token minimum length svcauth_gss_unwrap_priv() validates only an upper bound on the wire-supplied opaque
length before handing the buffer to gss_unwrap(): if (len > xdr_stream_remaining(xdr)) goto unwrap_failed;
offset = xdr_stream_pos(xdr); ... maj_stat = gss_unwrap(ctx, offset, offset + len, buf); The wire value
`len` flows unchanged as the upper bound into the krb5 unwrap path, so a len in [0, 16] passes this check
and is handed to gss_unwrap(). For a krb5 v2 context that lands in gss_krb5_unwrap_v2(), which reads the
16-byte RFC 4121 token header fields at ptr+4 and ptr+6 and then calls rotate_left() before any integrity
check. With a sub-header length the header reads run past the token, and _rotate_left()'s `shift %=
buf->len` path can divide by zero when buf->len has been driven to zero by the truncated token. A header-
only token (len == 16) is equally invalid: with a non-zero RRC field and the opaque blob ending at the XDR
buffer boundary, rotate_left() builds a zero-length subbuffer, reaching the same division. Reject the
token at the server entry point before it reaches the krb5 unwrap core. A valid sealed RFC 4121 token must
contain the 16-byte header plus at least some encrypted payload. Fix by adding a minimum-length check
immediately after the existing upper-bound check: if (len <= GSS_KRB5_TOK_HDR_LEN) goto unwrap_failed;
(CVE-2026-89550)

Solution

Update the sys-kernel/cchost-kernel-6_12 library and its related packages to version 19216.700.7 or later.

Plugin Details

Severity: Critical

ID: 475104

Version: Revision 1.1

Type: Local

Family: Google COS Security Checks

Published: 10/16/2026

Updated: 10/16/2026

Risk Information

VPR

Risk Factor: Medium

Score: 6.9

Percentile: 96.43

Vendor

Vendor Severity: LOW

CVSS v2

Risk Factor: Critical

Base Score: 10

Temporal Score: 7.4

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS Score Source: CVE-2026-89550

CVSS v3

Risk Factor: Critical

Base Score: 9.8

Temporal Score: 8.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Vulnerability Publication Date: 9/11/2026

Reference Information

CVE: CVE-2026-89550

Detections

Analytics