Google: sys-kernel/cchost-kernel-6_12, sys-kernel/cchost-kernel-6_18, sys-kernel/csql-kernel-6_12, sys-kernel/csql-kernel-6_18, sys-kernel/lakitu-kernel-6_12, sys-kernel/lakitu-kernel-6_18, sys-kernel/lakitu-nc-kernel-6_12, sys-kernel/lakitu-nc-kernel-6_18: security update to 19999.44.106

high Tenable Self-Hosted Container Security Plugin ID 475447

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

- In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: vgic-v3: take an LPI
reference in vgic_v3_save_pending_tables vgic_v3_save_pending_tables() iterates dist->lpi_xa using
xa_for_each() and dereferences the returned struct vgic_irq in the loop body without holding a reference
on the LPI. The xarray iterator only provides temporary RCU coverage while looking up the current entry.
That is not sufficient for this loop body, which reads fields from struct vgic_irq and performs guest
memory accesses before the iteration completes. A concurrent path can trigger this race: the irqfd cached
injection path (vgic_its_inject_cached_translation) obtains a transient LPI reference via
vgic_its_check_cache() without holding kvm->lock, vcpu->mutex, config_lock, or its_lock. If guest ITS
DISCARD then drops the cache and ITE references under its_lock, the transient inject reference may become
the final one. When vgic_put_irq() drops it, the LPI is erased from lpi_xa and freed via kfree_rcu().
Meanwhile, vgic_v3_save_pending_tables() may still hold a stale pointer obtained from the xarray iterator
and dereference it after the RCU grace period completes. Fix this by re-fetching each iterated LPI via
vgic_get_irq(), which takes a stable reference, and dropping it with vgic_put_irq() on all paths. This
matches the pattern already used by other lpi_xa iterators in the vgic ITS code. (CVE-2026-89913)

Solution

Update the sys-kernel/cchost-kernel-6_12 library and its related packages to version 19999.44.106 or later.

Plugin Details

Severity: High

ID: 475447

Version: Revision 1.1

Type: Local

Family: Google COS Security Checks

Published: 10/16/2026

Updated: 10/16/2026

Risk Information

VPR

Risk Factor: Medium

Score: 5

Percentile: 93.04

Vendor

Vendor Severity: HIGH

CVSS v2

Risk Factor: Medium

Base Score: 6.8

Temporal Score: 5

Vector: CVSS2#AV:L/AC:L/Au:S/C:C/I:C/A:C

CVSS Score Source: CVE-2026-89913

CVSS v3

Risk Factor: High

Base Score: 8.8

Temporal Score: 7.7

Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Vulnerability Publication Date: 9/16/2026

Reference Information

CVE: CVE-2026-89913

Detections

Analytics