Detections
Analytics

Echo: linux: security update to 6.1.162-1

high Tenable Cloud Security Plugin ID 455174

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - In the Linux kernel, the following vulnerability has been resolved: net/sched: Enforce that teql can only
 be used as root qdisc Design intent of teql is that it is only supposed to be used as root qdisc. We need
 to check for that constraint. Although not important, I will describe the scenario that unearthed this
 issue for the curious. GangMin Kim <[email protected]> managed to concot a scenario as follows: ROOT
 qdisc 1:0 (QFQ) ├── class 1:1 (weight=15, lmax=16384) netem with delay 6.4s └── class 1:2 (weight=1,
 lmax=1514) teql GangMin sends a packet which is enqueued to 1:1 (netem). Any invocation of dequeue by QFQ
 from this class will not return a packet until after 6.4s. In the meantime, a second packet is sent and it
 lands on 1:2. teql's enqueue will return success and this will activate class 1:2. Main issue is that teql
 only updates the parent visible qlen (sch->q.qlen) at dequeue. Since QFQ will only call dequeue if peek
 succeeds (and teql's peek always returns NULL), dequeue will never be called and thus the qlen will remain
 as 0. With that in mind, when GangMin updates 1:2's lmax value, the qfq_change_class calls
 qfq_deact_rm_from_agg. Since the child qdisc's qlen was not incremented, qfq fails to deactivate the
 class, but still frees its pointers from the aggregate. So when the first packet is rescheduled after 6.4
 seconds (netem's delay), a dangling pointer is accessed causing GangMin's causing a UAF. (CVE-2026-23074)

Solution

Update the linux library and its related packages to version 6.1.162-1 or later.

See Also

https://advisory.echohq.com/cve/CVE-2026-23074

Plugin Details

Severity: High

ID: 455174

Version: Revision 1.2

Type: Local

Published: 10/1/2026

Updated: 10/2/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Medium

Score: 4.9

Percentile: 57.51

CVSS v2

Risk Factor: Medium

Base Score: 6.8

Temporal Score: 5

Vector: CVSS2#AV:L/AC:L/Au:S/C:C/I:C/A:C

CVSS Score Source: CVE-2026-23074

CVSS v3

Risk Factor: High

Base Score: 7.8

Temporal Score: 6.8

Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 2/15/2026

Vulnerability Publication Date: 2/4/2026

Reference Information

CVE: CVE-2026-23074