Google: sys-kernel/cchost-kernel-6_18, sys-kernel/csql-kernel-6_18, sys-kernel/lakitu-kernel-6_18, sys-kernel/lakitu-nc-kernel-6_18: security update to 20198.0.0

high Tenable Self-Hosted Container Security Plugin ID 475641

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

- In the Linux kernel, the following vulnerability has been resolved: bpf: Check load-acquire src ptr type
before the load check_atomic_load() calls check_load_mem() before atomic_ptr_type_ok(). For a load-acquire
that fetches into its own source register (dst_reg == src_reg), check_load_mem() overwrites src_reg's type
with the type of the loaded value, so the subsequent atomic_ptr_type_ok() no longer sees the source
pointer and fails to reject the disallowed types (ctx, pkt, flow_keys, sock). Since
bpf_convert_ctx_accesses() does not rewrite atomic loads, the raw access to the underlying kernel object
is left in place. The destination type is taken from the ctx access itself, so a load-acquire of the sk
field of struct __sk_buff for example leaves the register typed as PTR_TO_SOCK_COMMON_OR_NULL, which
type_is_sk_pointer() does not match either, while it actually holds unconverted struct sk_buff bytes. Once
the NULL check has passed this is a type confusion, not just a leak of kernel data. Validate src_reg with
check_reg_arg() and check the source pointer type with atomic_ptr_type_ok() before the load again,
mirroring check_atomic_rmw(). Out-of-range register numbers are already rejected earlier by
check_and_resolve_insns() (commit 503d21ef8eac ("bpf: Do register range validation early")), and the only
exemption there, is_stack_arg_ldx(), requires BPF_LDX | BPF_MEM | BPF_DW and thus never matches a
BPF_ATOMIC insn. atomic_ptr_type_ok() can therefore not dereference register state out of bounds, that is,
the out-of-bounds read addressed by the Fixes commit below does not reappear (as proven also via
selftest). (CVE-2026-90312)

Solution

Update the sys-kernel/cchost-kernel-6_18 library and its related packages to version 20198.0.0 or later.

Plugin Details

Severity: High

ID: 475641

Version: Revision 1.1

Type: Local

Family: Google COS Security Checks

Published: 10/16/2026

Updated: 10/16/2026

Risk Information

VPR

Risk Factor: Medium

Score: 4.9

Percentile: 58.37

Vendor

Vendor Severity: LOW

CVSS v2

Risk Factor: Medium

Base Score: 6.8

Temporal Score: 5

Vector: CVSS2#AV:L/AC:L/Au:S/C:C/I:C/A:C

CVSS Score Source: CVE-2026-90312

CVSS v3

Risk Factor: High

Base Score: 7.8

Temporal Score: 6.8

Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Vulnerability Publication Date: 9/17/2026

Reference Information

CVE: CVE-2026-90312

Detections

Analytics