Detections
Analytics

Echo: linux: security update to 6.1.180-1

high Tenable Cloud Security Plugin ID 455539

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: validate option
 length before reading conf opt value l2cap_get_conf_opt() derives the option length from the attacker-
 controlled opt->len field and immediately dereferences opt->val (as u8, get_unaligned_le16() or
 get_unaligned_le32(), or a raw pointer for the default case) before any caller has confirmed that opt->len
 bytes are present in the buffer. The callers (l2cap_parse_conf_req(), l2cap_parse_conf_rsp() and
 l2cap_conf_rfc_get()) only detect a malformed option afterwards, once the running length has gone
 negative, by which point the out-of-bounds read has already executed. An existing post-hoc length check
 keeps the garbage value from being consumed, so this is not a data leak in the current control flow. It is
 still a validate-after-use ordering bug: up to 4 bytes are read past the end of the buffer before it is
 known to contain them, and it is fragile to future changes in the callers. Fix it at the source. Pass the
 end of the buffer into l2cap_get_conf_opt() and refuse to touch opt->val unless the full option (header +
 value) fits. Each caller computes an end pointer once before the loop and checks the return value directly
 instead of inferring the error from a negative length. (CVE-2026-64403)

Solution

Update the linux library and its related packages to version 6.1.180-1 or later.

See Also

https://advisory.echohq.com/cve/CVE-2026-64403

Plugin Details

Severity: High

ID: 455539

Version: Revision 1.2

Type: Local

Published: 10/1/2026

Updated: 10/2/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Medium

Score: 5.5

Percentile: 95.92

CVSS v2

Risk Factor: Medium

Base Score: 6.8

Temporal Score: 5

Vector: CVSS2#AV:A/AC:L/Au:N/C:P/I:N/A:C

CVSS Score Source: CVE-2026-64403

CVSS v3

Risk Factor: High

Base Score: 7.1

Temporal Score: 6.2

Vector: CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 7/26/2026

Vulnerability Publication Date: 7/23/2026

Reference Information

CVE: CVE-2026-64403