Google: sys-kernel/cchost-kernel-6_18, sys-kernel/csql-kernel-6_18, sys-kernel/lakitu-kernel-6_18, sys-kernel/lakitu-nc-kernel-6_18: security update to 20162.0.0

critical Tenable Self-Hosted Container Security Plugin ID 475655

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

- In the Linux kernel, the following vulnerability has been resolved: SUNRPC: Reject krb5 v2 wrap tokens
with oversized ec field gss_krb5_unwrap_v2() sets buf->len to a logical length, which can be much smaller
than head[0].iov_len (the allocated receive-page capacity). It then calls xdr_buf_trim() with a trim
length derived from the 16-bit "extra count" (ec) field in the Kerberos v2 token header. The ec field is
authenticated by the post-decrypt memcmp() against the encrypted header copy, so a randomly-mutated value
is rejected. However, any peer holding a valid GSS context can legitimately encrypt a token whose ec
exceeds the plaintext length. Per RFC 4121, such a token is structurally malformed. Although
xdr_buf_trim() now clamps the buf->len subtraction to avoid unsigned underflow, the buffer is still left
in a semantically invalid state (zero length, inconsistent iov lengths) when ec is oversized. Reject these
tokens before calling xdr_buf_trim(), giving callers a well-defined GSS_S_DEFECTIVE_TOKEN error and
keeping the xdr_buf internally consistent. The wrapped blob begins at a nonzero offset -- both callers
pass len as offset + opaque_len -- so buf->len still counts the offset bytes that precede the blob.
Compare the trim length against the remaining wrapped segment, buf->len - offset, rather than the whole
buffer; comparing against buf->len alone leaves an offset-wide window in which an oversized ec passes the
test and xdr_buf_trim() cuts into the bytes ahead of the blob. (CVE-2026-89538)

Solution

Update the sys-kernel/cchost-kernel-6_18 library and its related packages to version 20162.0.0 or later.

Plugin Details

Severity: Critical

ID: 475655

Version: Revision 1.1

Type: Local

Family: Google COS Security Checks

Published: 10/16/2026

Updated: 10/16/2026

Risk Information

VPR

Risk Factor: Medium

Score: 4.9

Percentile: 58.42

Vendor

Vendor Severity: LOW

CVSS v2

Risk Factor: Critical

Base Score: 10

Temporal Score: 7.4

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS Score Source: CVE-2026-89538

CVSS v3

Risk Factor: Critical

Base Score: 9.8

Temporal Score: 8.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Vulnerability Publication Date: 9/11/2026

Reference Information

CVE: CVE-2026-89538

Detections

Analytics