Google: sys-kernel/cchost-kernel-6_12, sys-kernel/cchost-kernel-6_18, sys-kernel/csql-kernel-6_12, sys-kernel/csql-kernel-6_18, sys-kernel/lakitu-kernel-6_12, sys-kernel/lakitu-kernel-6_18, sys-kernel/lakitu-nc-kernel-6_12, sys-kernel/lakitu-nc-kernel-6_18: security update to 19999.44.106

high Tenable Self-Hosted Container Security Plugin ID 475396

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

- In the Linux kernel, the following vulnerability has been resolved: net/sched: cls_u32: fix duplicate
handle when node ID pool is exhausted gen_new_kid() falls back to returning max (htid | 0xFFF) when both
idr_alloc_u32() ranges are full, instead of reporting an error. u32_change() trusts that value and inserts
a new knode with a handle that is already live in the hash table, breaking handle uniqueness within the
table's node ID space. The handle was never reserved in ht->handle_idr, so every later error path that
does idr_remove(&ht->handle_idr, handle) removes the reservation of a different, live knode, which is then
reused — one failed add compounds into further duplicates. The 4095 limit is per (table, bucket) —
ht->handle_idr is per hash table and the range is derived from htid (bucketid), so a table with divisor
256 can legitimately hold 256*4095 knodes. The sibling helper gen_new_htid() has the same silent in-band
failure: it returns 0 when the tp_c handle pool (1..0x7FF) is full, and u32_init() publishes the root hash
table with handle 0 without checking. Two root tables with handle 0 alias in u32_lookup_ht(), allowing
cross-tcf_proto knode add/lookup/delete. Add the same exhaustion check that the divisor path already has.
Return an error so u32_change() fails with ENOSPC/ENOMEM when the node ID space is exhausted, and so
u32_init() fails with -ENOMEM when the hash table ID space is exhausted. The extack message distinguishes
pool exhaustion (-ENOSPC) from a transient allocation failure (-ENOMEM). Conditions to recreate the bug: -
CONFIG_NET_SCHED=y, CONFIG_CLS_U32=y (or =m with module loaded) - Create a clsact qdisc on a device, then
add 4095 u32 filters with auto-generated handles to fill the node ID space for the root hash table (single
bucket). The 4096th auto-handle filter add triggers the duplicate handle (fh 800::fff reused). Reachable
at Level 2 (unshare -Urn, namespace-local CAP_NET_ADMIN). - For gen_new_htid: create 2047 u32 proto
entries on the same block to fill the tp_c handle pool, then create one more. The root table gets handle 0
and aliases with other handle-0 root tables. (CVE-2026-98104)

Solution

Update the sys-kernel/cchost-kernel-6_12 library and its related packages to version 19999.44.106 or later.

Plugin Details

Severity: High

ID: 475396

Version: Revision 1.1

Type: Local

Family: Google COS Security Checks

Published: 10/16/2026

Updated: 10/16/2026

Risk Information

VPR

Risk Factor: Medium

Score: 4.3

Percentile: 53.45

Vendor

Vendor Severity: LOW

CVSS v2

Risk Factor: High

Base Score: 7.2

Temporal Score: 5.3

Vector: CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C

CVSS Score Source: CVE-2026-98104

CVSS v3

Risk Factor: High

Base Score: 7.1

Temporal Score: 6.2

Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Vulnerability Publication Date: 9/25/2026

Reference Information

CVE: CVE-2026-98104

Detections

Analytics