Google: sys-kernel/cchost-kernel-6_12, sys-kernel/cchost-kernel-6_18, sys-kernel/csql-kernel-6_12, sys-kernel/csql-kernel-6_18, sys-kernel/lakitu-kernel-6_12, sys-kernel/lakitu-kernel-6_18, sys-kernel/lakitu-nc-kernel-6_12, sys-kernel/lakitu-nc-kernel-6_18: security update to 19999.44.106

high Tenable Self-Hosted Container Security Plugin ID 475340

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

- In the Linux kernel, the following vulnerability has been resolved: PCI: Allow per function PCI slots to
fix slot reset on s390 On s390 systems, which use a machine level hypervisor, PCI devices are always
accessed through a form of PCI pass-through which fundamentally operates on a per PCI function
granularity. This is also reflected in the s390 PCI hotplug driver which creates hotplug slots for
individual PCI functions. Its reset_slot() function, which is a wrapper for zpci_hot_reset_device(), thus
also resets individual functions. Currently, the pci_create_slot() assigns the same pci_slot object to
multifunction devices. This approach worked fine on s390 systems that only exposed virtual functions as
individual PCI domains to the operating system. Since commit 44510d6fa0c0 ("s390/pci: Handling
multifunctions") s390 supports exposing the topology of multifunction PCI devices by grouping them in a
shared PCI domain. This creates a problem when resetting a function through the hotplug driver's
slot_reset() interface. When attempting to reset a function through the hotplug driver, the shared slot
assignment causes the wrong function to be reset instead of the intended one. It also leaks memory as we
do create a pci_slot object for the function, but don't correctly free it in pci_slot_release(). Add a
flag for struct pci_slot to allow per function PCI slots for functions managed through a hypervisor, which
exposes individual PCI functions while retaining the topology. Since we can use all 8 bits for slot
'number' (for ARI devices), change slot 'number' u16 to account for special values PCI_SLOT_PLACEHOLDER
and PCI_SLOT_ALL_DEVICES. (CVE-2026-89795)

Solution

Update the sys-kernel/cchost-kernel-6_12 library and its related packages to version 19999.44.106 or later.

Plugin Details

Severity: High

ID: 475340

Version: Revision 1.1

Type: Local

Family: Google COS Security Checks

Published: 10/16/2026

Updated: 10/16/2026

Risk Information

VPR

Risk Factor: Medium

Score: 4.8

Percentile: 57.87

Vendor

Vendor Severity: HIGH

CVSS v2

Risk Factor: Medium

Base Score: 6.2

Temporal Score: 4.6

Vector: CVSS2#AV:L/AC:L/Au:S/C:N/I:C/A:C

CVSS Score Source: CVE-2026-89795

CVSS v3

Risk Factor: High

Base Score: 8.4

Temporal Score: 7.3

Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Vulnerability Publication Date: 9/16/2026

Reference Information

CVE: CVE-2026-89795

Detections

Analytics