Google: sys-kernel/cchost-kernel-6_18, sys-kernel/csql-kernel-6_18, sys-kernel/lakitu-kernel-6_18, sys-kernel/lakitu-nc-kernel-6_18: security update to 20198.0.0

medium Tenable Self-Hosted Container Security Plugin ID 475756

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

- In the Linux kernel, the following vulnerability has been resolved: scsi: core: Do not block on tag
allocation in scsi_eh_lock_door() scsi_eh_lock_door() is called from scsi_restart_operations() while the
host is still in the SHOST_RECOVERY state, i.e. before the host is switched back to SHOST_RUNNING and
scsi_run_host_queues() restarts the queues. It allocates a request via scsi_alloc_request() with no flags,
so blk_mq_get_tag() may block waiting for a free sched tag when all tags are already in use. Those tags
can be held by commands that were just requeued by scsi_eh_flush_done_q() during error handling. Such
commands cannot be dispatched until the host leaves SHOST_RECOVERY and scsi_run_host_queues() is called -
which only happens *after* scsi_eh_lock_door() returns. This forms a circular dependency: -
scsi_eh_lock_door(), running in the SCSI error handler thread, waits for a sched tag held by a requeued
command; - the requeued command cannot complete and release its sched tag until the error handler thread
leaves scsi_restart_operations() and restart the queues. For devices with a single driver tag (e.g. USB
storage) it is a guaranteed deadlock and I/O that can never be submitted. This problem has also been
reproduced in our environment. Locking the door is a best-effort operation, and scsi_eh_lock_door()
already returns silently when the request allocation fails. Pass BLK_MQ_REQ_NOWAIT to scsi_alloc_request()
so the allocation fails instead of blocking when no tag is available. This breaks the circular dependency
and allows the error handler to finish restarting the queues, after which the pending commands are
dispatched normally. (CVE-2026-93781)

Solution

Update the sys-kernel/cchost-kernel-6_18 library and its related packages to version 20198.0.0 or later.

Plugin Details

Severity: Medium

ID: 475756

Version: Revision 1.1

Type: Local

Family: Google COS Security Checks

Published: 10/16/2026

Updated: 10/16/2026

Risk Information

VPR

Risk Factor: Medium

Score: 5.7

Percentile: 95.9

Vendor

Vendor Severity: LOW

CVSS v2

Risk Factor: High

Base Score: 7.2

Temporal Score: 5.3

Vector: CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C

CVSS Score Source: CVE-2026-93781

CVSS v3

Risk Factor: Medium

Base Score: 5.5

Temporal Score: 4.8

Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Vulnerability Publication Date: 9/24/2026

Reference Information

CVE: CVE-2026-93781

Detections

Analytics