Google: sys-kernel/cchost-kernel-6_18, sys-kernel/csql-kernel-6_18, sys-kernel/lakitu-kernel-6_18, sys-kernel/lakitu-nc-kernel-6_18: security update to 20162.0.0

critical Tenable Self-Hosted Container Security Plugin ID 475783

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

- In the Linux kernel, the following vulnerability has been resolved: lockd: pin next file across
nlm_inspect_file lock-drop nlm_traverse_files() pins the current file with f_count++ across a mutex_unlock
for nlm_inspect_file(), but nothing pins the saved next pointer. A concurrent nlm_release_file() can kfree
the next file during the unlock window, and the iterator dereferences freed memory on the next loop step.
Pin both current and next before the lock-drop. Advance by swapping the pinned cursors at the end of each
iteration so next is always held alive across the unlock. Always call nlm_file_release() after dropping
the iteration pin, regardless of whether the file matched the predicate. Use nlm_file_inuse(), which does
a live walk of the inode lock list, rather than the cached f_locks field, so skipped files that never ran
nlm_inspect_file() are evaluated correctly. Because every file in a hash bucket is now pinned and
released, files skipped by the is_failover_file predicate that have no locks, blocks, shares, or external
references are deleted during traversal. The old code never evaluated skipped files for cleanup. The new
behavior is intentional: such files are stale and should not persist in the table. (CVE-2026-89485)

Solution

Update the sys-kernel/cchost-kernel-6_18 library and its related packages to version 20162.0.0 or later.

Plugin Details

Severity: Critical

ID: 475783

Version: Revision 1.1

Type: Local

Family: Google COS Security Checks

Published: 10/16/2026

Updated: 10/16/2026

Risk Information

VPR

Risk Factor: Medium

Score: 6.9

Percentile: 96.43

Vendor

Vendor Severity: LOW

CVSS v2

Risk Factor: Critical

Base Score: 10

Temporal Score: 7.4

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS Score Source: CVE-2026-89485

CVSS v3

Risk Factor: Critical

Base Score: 9.8

Temporal Score: 8.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Vulnerability Publication Date: 9/11/2026

Reference Information

CVE: CVE-2026-89485

Detections

Analytics