Google: sys-kernel/cchost-kernel-6_12, sys-kernel/cchost-kernel-6_18, sys-kernel/csql-kernel-6_12, sys-kernel/csql-kernel-6_18, sys-kernel/lakitu-kernel-6_12, sys-kernel/lakitu-kernel-6_18, sys-kernel/lakitu-nc-kernel-6_12, sys-kernel/lakitu-nc-kernel-6_18: security update to 19999.44.106

medium Tenable Self-Hosted Container Security Plugin ID 475374

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

- In the Linux kernel, the following vulnerability has been resolved: reboot: fix cad_pid use-after-free
race cad_pid is a single kernel-wide struct pid pointer. proc_do_cad_pid() reads it and passes it to
pid_vnr() without protecting the lifetime of the referenced struct pid. A concurrent writer can replace
cad_pid and drop the final reference to the old struct pid after the reader has loaded the pointer but
before pid_vnr() has finished dereferencing it, causing a use-after-free. kill_cad_pid() has the same
lifetime race when it passes cad_pid to kill_pid(). At the time this issue was reported, an unprivileged
user could reach the sysctl through user and PID namespaces because cad_pid was registered in pid_table[].
Moving cad_pid back to the global reboot sysctl table corrected that namespace and permission mismatch,
but did not fix the underlying lifetime race. Fix this by treating cad_pid as an RCU-protected pointer at
both read sites and by waiting for a grace period before dropping the old reference on the write side.
call_rcu(&old_pid->rcu, ...) cannot be used here because free_pid() also queues pid->rcu; queueing the
same rcu_head twice can corrupt the RCU callback list. Original KASAN crash stack: kernel/pid.c:545
pid_nr_ns() # reads freed pid->level kernel/pid.c:556 pid_vnr() # calls pid_nr_ns() kernel/pid.c:775
proc_do_cad_pid() # calls pid_vnr(cad_pid) (CVE-2026-97938)

Solution

Update the sys-kernel/cchost-kernel-6_12 library and its related packages to version 19999.44.106 or later.

Plugin Details

Severity: Medium

ID: 475374

Version: Revision 1.1

Type: Local

Family: Google COS Security Checks

Published: 10/16/2026

Updated: 10/16/2026

Risk Information

VPR

Risk Factor: Low

Score: 3

Percentile: 23.63

Vendor

Vendor Severity: LOW

CVSS v2

Risk Factor: Medium

Base Score: 4.7

Temporal Score: 3.5

Vector: CVSS2#AV:L/AC:M/Au:N/C:N/I:N/A:C

CVSS Score Source: CVE-2026-97938

CVSS v3

Risk Factor: Medium

Base Score: 4.7

Temporal Score: 4.1

Vector: CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Vulnerability Publication Date: 9/25/2026

Reference Information

CVE: CVE-2026-97938

Detections

Analytics