Google: sys-kernel/cchost-kernel-6_12, sys-kernel/cchost-kernel-6_18, sys-kernel/csql-kernel-6_12, sys-kernel/csql-kernel-6_18, sys-kernel/lakitu-kernel-6_12, sys-kernel/lakitu-kernel-6_18, sys-kernel/lakitu-nc-kernel-6_12, sys-kernel/lakitu-nc-kernel-6_18: security update to 19999.44.106

medium Tenable Self-Hosted Container Security Plugin ID 475470

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

- In the Linux kernel, the following vulnerability has been resolved: mm/mglru: fix and remove redundant
unevictable folio handling sort_folio() has a shortcut for moving folios that are no longer evictable but
are still sitting on a generation list. However, this shortcut is buggy. It does not follow the PG_lru
usage convention, and it has a more serious issue. Unevictable folios are not threaded on
lists[LRU_UNEVICTABLE], so that folio->lru can be reused to hold folio->mlock_count (see the comment in
lruvec_init()). Hence lruvec_add_folio() skips the list_add() for them, and every other place that turns a
folio unevictable initialises mlock_count explicitly: lru_add() sets it to 0, __mlock_folio() and
__mlock_new_folio() set it to !!folio_test_mlocked(folio). sort_folio() sets nothing, and the
lru_gen_del_folio() right above it may have already poisoned folio->lru via list_del(), so mlock_count
ends up aliasing LIST_POISON2, which reads as 0x122, i.e. 290. The result is user visible. On munlock,
__munlock_folio() decrements that bogus count, finds it still non-zero and bails out before clearing
PG_mlocked, so the folio remains unevictable and the Mlocked accounting stays inflated until the folio is
freed. The shortcut also touches the LRU flags in the wrong order. It calls lru_gen_del_folio() while
PG_lru is still set, so a concurrent folio_test_clear_lru() (e.g. compaction, folio_isolate_lru()) can
succeed on a folio that has already been taken off the generation list, which may lead to unexpected
behavior. So fix it by isolating them as common folios and letting the generic shrink path cull them. This
matches the classical LRU behavior, and there should be no visible effect on the generic eviction or
isolation behavior. There is no performance concern either, such a folio goes through this once, and then
it is off the generation lists for good. (CVE-2026-89757)

Solution

Update the sys-kernel/cchost-kernel-6_12 library and its related packages to version 19999.44.106 or later.

Plugin Details

Severity: Medium

ID: 475470

Version: Revision 1.1

Type: Local

Family: Google COS Security Checks

Published: 10/16/2026

Updated: 10/16/2026

Risk Information

VPR

Risk Factor: Low

Score: 3

Percentile: 23.66

Vendor

Vendor Severity: LOW

CVSS v2

Risk Factor: High

Base Score: 7.2

Temporal Score: 5.3

Vector: CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C

CVSS Score Source: CVE-2026-89757

CVSS v3

Risk Factor: Medium

Base Score: 5.5

Temporal Score: 4.8

Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Vulnerability Publication Date: 9/11/2026

Reference Information

CVE: CVE-2026-89757

Detections

Analytics