Google: sys-kernel/cchost-kernel-6_18, sys-kernel/csql-kernel-6_18, sys-kernel/lakitu-kernel-6_18, sys-kernel/lakitu-nc-kernel-6_18: security update to 20198.0.0

high Tenable Self-Hosted Container Security Plugin ID 475758

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

- In the Linux kernel, the following vulnerability has been resolved: signal: Prevent exec() race Hyunwoo
debugged the following KASAN UAF splat: BUG: KASAN: slab-use-after-free in
__send_signal_locked+0xb27/0xba0 Write of size 8 at addr ffff888007ed80c8 by task poc/79 ... Call Trace:
__send_signal_locked+0xb27/0xba0 do_send_sig_info+0xa7/0x160 do_send_specific+0x76/0xa0
__x64_sys_tgkill+0x193/0x270 ... Allocated by task 80: do_timer_create+0x1a4/0x1030
__x64_sys_timer_create+0x145/0x190 ... Freed by task 12: kmem_cache_free_bulk+0x1f8/0x4a0
kvfree_rcu_bulk+0x14f/0x1c0 kfree_rcu_work+0x128/0x1a0 ... Last potentially related work creation:
kvfree_call_rcu+0x39/0x390 __flush_itimer_signals+0x211/0x320 flush_itimer_signals+0x47/0x90
begin_new_exec+0xa6b/0x28c0 It turned out that this happens with a non-leader exec() as Hyunwoo explained:
de_thread() calls exchange_tids() before release_task(leader), so the struct pid held by a SIGEV_THREAD_ID
timer created against the leader's tid now points to the thread which called execve(). pid_task() returns
that thread and lock_task_sighand() on it succeeds. If the timer signal is blocked, its sigqueue stays
queued on the leader's task::pending. The next expiry of that timer can then run while release_task()
flushes the queue. posixtimer_send_sigqueue() checks whether the sigqueue is already queued with a plain
list_empty(), which only reads list_head::next. list_del_init() is not atomic and INIT_LIST_HEAD() stores
list_head::next before list_head::prev, so the check can pass in between. list_add_tail() queues the entry
on the task::pending of the live thread, and the list_head::prev store from the flush then overwrites the
list_head::prev link that list_add_tail() has just set. __flush_itimer_signals() does not undo that
either. With list_head::prev pointing at the entry itself, its list_del_init() only stores the same values
again, so the entry is not removed from the list. It is still there after the last reference is dropped
and the timer is freed by RCU, and the list_add_tail() of a later tgkill() follows that list_head::prev
into the freed timer. This problem surfaced with the recent commit which moved the sigqueue flush out of
the sighand lock held region. Hyonwoo proposed to fix this by using list_del_init_careful(), but that just
papers over the problem. After some disucssions and various attempts to solve it, Eric pointed out that
there is no reason to flush task::pending late in release_task() and it should be done in exit_signals()
already. As nothing can collect and deliver signals which are queued in a dying task's pending queue,
there is no reason to delay it further. But it has to be ensured that no signals can be queued into it
after that point. exit_signals() sets PF_EXITING in task::flags, which can be used as an indicator for
this. Cure it by: - Preventing signal queueing for task private signals (PIDTYPE_PID) when the task has
PF_EXITING set in __send_signal_locked() and in posixtimer_send_sigqueue(). - Protecting the unlocked
setting of PF_EXITING in exit_signals() for the task group empty and the group exit case with sighand lock
- Flushing task::pending signals right there. Optimize that by moving the whole pending list to an on-
stack list head under sighand lock and free the signals without the lock held. There has been quite some
discussion about the lockless flush and the non-leader exec case on weakly ordered systems. The problem is
that a third party which tries to send a posix timer signal relies on the PID lookup to find the target
task and that lookup might result in the new leader when the signal was originaly directed to the old
leader. In case that the signal was queued on the old leader then the lockless flush raised a concern over
the following situation: old_leader new_leader third party A: flush_list() // list_del_in ---truncated---
(CVE-2026-98256)

Solution

Update the sys-kernel/cchost-kernel-6_18 library and its related packages to version 20198.0.0 or later.

Plugin Details

Severity: High

ID: 475758

Version: Revision 1.1

Type: Local

Family: Google COS Security Checks

Published: 10/16/2026

Updated: 10/16/2026

Risk Information

VPR

Risk Factor: Medium

Score: 4.9

Percentile: 58.41

Vendor

Vendor Severity: LOW

CVSS v2

Risk Factor: Medium

Base Score: 6.8

Temporal Score: 5

Vector: CVSS2#AV:L/AC:L/Au:S/C:C/I:C/A:C

CVSS Score Source: CVE-2026-98256

CVSS v3

Risk Factor: High

Base Score: 7.8

Temporal Score: 6.8

Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Vulnerability Publication Date: 10/6/2026

Reference Information

CVE: CVE-2026-98256

Detections

Analytics