Detections
Analytics

Echo: linux: security update to 6.12.25-1

medium Tenable Cloud Security Plugin ID 457026

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - In the Linux kernel, the following vulnerability has been resolved: perf: Fix hang while freeing sigtrap
 event Perf can hang while freeing a sigtrap event if a related deferred signal hadn't managed to be sent
 before the file got closed: perf_event_overflow() task_work_add(perf_pending_task) fput()
 task_work_add(____fput()) task_work_run() ____fput() perf_release() perf_event_release_kernel()
 _free_event() perf_pending_task_sync() task_work_cancel() -> FAILED rcuwait_wait_event() Once
 task_work_run() is running, the list of pending callbacks is removed from the task_struct and from this
 point on task_work_cancel() can't remove any pending and not yet started work items, hence the
 task_work_cancel() failure and the hang on rcuwait_wait_event(). Task work could be changed to remove one
 work at a time, so a work running on the current task can always cancel a pending one, however the wait /
 wake design is still subject to inverted dependencies when remote targets are involved, as pictured by
 Oleg: T1 T2 fd = perf_event_open(pid => T2->pid); fd = perf_event_open(pid => T1->pid); close(fd)
 close(fd) <IRQ> <IRQ> perf_event_overflow() perf_event_overflow() task_work_add(perf_pending_task)
 task_work_add(perf_pending_task) </IRQ> </IRQ> fput() fput() task_work_add(____fput())
 task_work_add(____fput()) task_work_run() task_work_run() ____fput() ____fput() perf_release()
 perf_release() perf_event_release_kernel() perf_event_release_kernel() _free_event() _free_event()
 perf_pending_task_sync() perf_pending_task_sync() rcuwait_wait_event() rcuwait_wait_event() Therefore the
 only option left is to acquire the event reference count upon queueing the perf task work and release it
 from the task work, just like it was done before 3a5465418f5f ("perf: Fix event leak upon exec and file
 release") but without the leaks it fixed. Some adjustments are necessary to make it work: * A child event
 might dereference its parent upon freeing. Care must be taken to release the parent last. * Some places
 assuming the event doesn't have any reference held and therefore can be freed right away must instead put
 the reference and let the reference counting to its job. (CVE-2025-37747)

Solution

Update the linux library and its related packages to version 6.12.25-1 or later.

See Also

https://advisory.echohq.com/cve/CVE-2025-37747

Plugin Details

Severity: Medium

ID: 457026

Version: Revision 1.1

Type: Local

Published: 10/2/2026

Updated: 10/2/2026

Risk Information

VPR

Risk Factor: Low

Score: 3

Percentile: 23.18

CVSS v2

Risk Factor: Medium

Base Score: 4.6

Temporal Score: 3.4

Vector: CVSS2#AV:L/AC:L/Au:S/C:N/I:N/A:C

CVSS Score Source: CVE-2025-37747

CVSS v3

Risk Factor: Medium

Base Score: 5.5

Temporal Score: 4.8

Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 9/15/2025

Vulnerability Publication Date: 5/1/2025

Reference Information

CVE: CVE-2025-37747