Google: sys-kernel/cchost-kernel-6_12, sys-kernel/cchost-kernel-6_18, sys-kernel/csql-kernel-6_12, sys-kernel/csql-kernel-6_18, sys-kernel/lakitu-kernel-6_12, sys-kernel/lakitu-kernel-6_18, sys-kernel/lakitu-nc-kernel-6_12, sys-kernel/lakitu-nc-kernel-6_18: security update to 19999.44.106

critical Tenable Self-Hosted Container Security Plugin ID 475243

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

- In the Linux kernel, the following vulnerability has been resolved: NFSD: Prevent lock owner use-after-
free during client teardown __destroy_client() releases a client's open owners, but a lock owner whose
only reference is a blocked lock (nbl) stays on cl_ownerstr_hashtbl. client_has_state() does not count a
bare owner, so DESTROY_CLIENTID can reach __destroy_client() with such owners present. __destroy_client()
then walks the table, calling remove_blocked_locks() on each owner without a reference. Freeing a blocked
lock drops the owner reference held via flc_owner. The per-net laundromat reaps blocked locks from
nn->blocked_locks_lru independently of client state. The two paths share blocked_locks_lock only for the
list splice, not the owner's lifetime. The laundromat therefore frees the owner as __destroy_client()
dereferences it, a NULL dereference in remove_blocked_locks(). nfsd4_release_lockowner() holds a reference
across the same call; __destroy_client() does not. Hold cl_lock across the walk, taking a reference and
unhashing each owner, then drop it before remove_blocked_locks() and nfs4_put_stateowner(), which take
blocked_locks_lock and cl_lock. (CVE-2026-89662)

Solution

Update the sys-kernel/cchost-kernel-6_12 library and its related packages to version 19999.44.106 or later.

Plugin Details

Severity: Critical

ID: 475243

Version: Revision 1.1

Type: Local

Family: Google COS Security Checks

Published: 10/16/2026

Updated: 10/16/2026

Risk Information

VPR

Risk Factor: Medium

Score: 4.9

Percentile: 58.42

Vendor

Vendor Severity: LOW

CVSS v2

Risk Factor: Critical

Base Score: 10

Temporal Score: 7.4

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS Score Source: CVE-2026-89662

CVSS v3

Risk Factor: Critical

Base Score: 9.8

Temporal Score: 8.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Vulnerability Publication Date: 9/11/2026

Reference Information

CVE: CVE-2026-89662

Detections

Analytics