Detections
Analytics

Google: sys-kernel/cchost-kernel-6_18, sys-kernel/csql-kernel-6_18, sys-kernel/lakitu-kernel-6_18, sys-kernel/lakitu-nc-kernel-6_18: security update to 19999.44.106

medium Tenable Self-Hosted Container Security Plugin ID 475275

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - In the Linux kernel, the following vulnerability has been resolved: x86/cfi: Fix FineIBT hash offset in
 cfi_get_func_hash() The switch of the FineIBT preamble from "subl $hash, %r10d" to the shorter "subl
 $hash, %eax" moved the hash immediate from offset 7 to offset 5 of the preamble. fineibt_preamble_hash was
 updated to match, but the open-coded offset in cfi_get_func_hash() was missed and it still reads the hash
 at offset 7. cfi_get_func_hash() is used by the BPF JIT to give a struct_ops trampoline the CFI hash of
 the stub function it stands in for. With FineIBT the trampoline now gets the upper half of the real hash
 followed by the first two bytes of the next instruction, so the first indirect call from the kernel into a
 struct_ops program, tcp_init_congestion_control() calling ->init() of a BPF congestion control for
 example, fails the FineIBT check and the kernel dies with a CFI failure. Move the FineIBT preamble
 template and its offset defines above cfi_get_func_hash() and use fineibt_preamble_hash there, so every
 reader of the preamble shares one definition of its layout. The CFI_FINEIBT arm is only built with
 CONFIG_FINEIBT, the only configuration in which cfi_mode can take that value. cfi_get_func_arity() does
 not need the same treatment: the __bhi_args call whose displacement it reads still ends at the function
 address. (CVE-2026-97944)

Solution

Update the sys-kernel/cchost-kernel-6_18 library and its related packages to version 19999.44.106 or later.

See Also

https://storage.googleapis.com/cos-oval-vulnerability-feed/cos-133.oval.xml.tar.gz

Plugin Details

Severity: Medium

ID: 475275

Version: Revision 1.1

Type: Local

Published: 10/16/2026

Updated: 10/16/2026

Risk Information

VPR

Risk Factor: Medium

Score: 4.9

Percentile: 58.37

Vendor

Vendor Severity: LOW

CVSS v2

Risk Factor: Medium

Base Score: 5.6

Temporal Score: 4.1

Vector: CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:C

CVSS Score Source: CVE-2026-97944

CVSS v3

Risk Factor: Medium

Base Score: 5.5

Temporal Score: 4.8

Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Vulnerability Publication Date: 9/25/2026

Reference Information

CVE: CVE-2026-97944