Detections
Analytics

Chainguard: multiple linux-qemu-melange packages: security update to 6.18.57-r0

medium Tenable Self-Hosted Container Security Plugin ID 476171

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - In the Linux kernel, the following vulnerability has been resolved: nvme-pci: fix dma mapping leak on data
 setup error We're leaking the initial DMA mapping during iteration if we fail to allocate the tracking
 descriptor for both PRP and SGL. Unmap the iterator directly; we can't use the existing unmap helper
 because it depends on the tracking descriptor being successfully allocated, so a new one for an in-use
 iterator is provided. The mappings were also leaking when the driver detects an invalid bio_vec when
 mapping PRPs, so fix that too. (CVE-2026-64019)

Solution

Update the linux-qemu-melange library and its related packages to version 6.18.57-r0 or later.

Plugin Details

Severity: Medium

ID: 476171

Version: Revision 1.1

Type: Local

Published: 10/19/2026

Updated: 10/19/2026

Risk Information

VPR

Risk Factor: Low

Score: 3

Percentile: 23.67

CVSS v2

Risk Factor: Medium

Base Score: 4.6

Temporal Score: 3.4

Vector: CVSS2#AV:L/AC:L/Au:S/C:N/I:N/A:C

CVSS Score Source: CVE-2026-64019

CVSS v3

Risk Factor: Medium

Base Score: 5.5

Temporal Score: 4.8

Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Vulnerability Publication Date: 7/19/2026

Reference Information

CVE: CVE-2026-64019