Detections
Analytics

Echo: linux: security update to 6.1.170-1

high Tenable Cloud Security Plugin ID 457077

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: fix use-after-free
 when rescheduling brcmf_btcoex_info work The brcmf_btcoex_detach() only shuts down the btcoex timer, if
 the flag timer_on is false. However, the brcmf_btcoex_timerfunc(), which runs as timer handler, sets
 timer_on to false. This creates critical race conditions: 1.If brcmf_btcoex_detach() is called while
 brcmf_btcoex_timerfunc() is executing, it may observe timer_on as false and skip the call to
 timer_shutdown_sync(). 2.The brcmf_btcoex_timerfunc() may then reschedule the brcmf_btcoex_info worker
 after the cancel_work_sync() has been executed, resulting in use-after-free bugs. The use-after-free bugs
 occur in two distinct scenarios, depending on the timing of when the brcmf_btcoex_info struct is freed
 relative to the execution of its worker thread. Scenario 1: Freed before the worker is scheduled The
 brcmf_btcoex_info is deallocated before the worker is scheduled. A race condition can occur when
 schedule_work(&bt_local->work) is called after the target memory has been freed. The sequence of events is
 detailed below: CPU0 | CPU1 brcmf_btcoex_detach | brcmf_btcoex_timerfunc | bt_local->timer_on = false; if
 (cfg->btcoex->timer_on) | ... | cancel_work_sync(); | ... | kfree(cfg->btcoex); // FREE | |
 schedule_work(&bt_local->work); // USE Scenario 2: Freed after the worker is scheduled The
 brcmf_btcoex_info is freed after the worker has been scheduled but before or during its execution. In this
 case, statements within the brcmf_btcoex_handler() — such as the container_of macro and subsequent
 dereferences of the brcmf_btcoex_info object will cause a use-after-free access. The following timeline
 illustrates this scenario: CPU0 | CPU1 brcmf_btcoex_detach | brcmf_btcoex_timerfunc | bt_local->timer_on =
 false; if (cfg->btcoex->timer_on) | ... | cancel_work_sync(); | ... | schedule_work(); // Reschedule |
 kfree(cfg->btcoex); // FREE | brcmf_btcoex_handler() // Worker /* | btci = container_of(....); // USE The
 kfree() above could | ... also occur at any point | btci-> // USE during the worker's execution| */ | To
 resolve the race conditions, drop the conditional check and call timer_shutdown_sync() directly. It can
 deactivate the timer reliably, regardless of its current state. Once stopped, the timer_on state is then
 set to false. (CVE-2025-39863)

Solution

Update the linux library and its related packages to version 6.1.170-1 or later.

See Also

https://advisory.echohq.com/cve/CVE-2025-39863

Plugin Details

Severity: High

ID: 457077

Version: Revision 1.1

Type: Local

Published: 10/2/2026

Updated: 10/2/2026

Risk Information

VPR

Risk Factor: Medium

Score: 4.9

Percentile: 57.39

CVSS v2

Risk Factor: Medium

Base Score: 6.8

Temporal Score: 5

Vector: CVSS2#AV:L/AC:L/Au:S/C:C/I:C/A:C

CVSS Score Source: CVE-2025-39863

CVSS v3

Risk Factor: High

Base Score: 7.8

Temporal Score: 6.8

Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 9/20/2025

Vulnerability Publication Date: 9/19/2025

Reference Information

CVE: CVE-2025-39863