Detections
Analytics

Echo: linux: security update to 6.1.180-1

high Tenable Cloud Security Plugin ID 457143

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - In the Linux kernel, the following vulnerability has been resolved: iio: event: Fix event FIFO reset race
 `iio_event_getfd()` creates the event file descriptor with `anon_inode_getfd()`, which allocates a new fd,
 creates the anonymous file and installs it in the process fd table before returning to the caller. The IIO
 code resets the event FIFO after `anon_inode_getfd()` has returned, but before `IIO_GET_EVENT_FD_IOCTL`
 has copied the fd number to userspace. But since fd tables are shared between threads, another thread can
 guess the newly allocated fd number and issue a `read()` on it as soon as the fd has been installed. This
 means the `kfifo_to_user()` in `iio_event_chrdev_read()` can run in parallel with the `kfifo_reset_out()`
 in `iio_event_getfd()`. The kfifo documentation says that `kfifo_reset_out()` is only safe when it is
 called from the reader thread and there is only one concurrent reader. Otherwise it is dangerous and must
 be handled in the same way as `kfifo_reset()`. If that happens, `kfifo_to_user()` can advance the FIFO
 `out` index based on state from before the reset, after the reset has already moved the `out` index to the
 current `in` index. That can leave the FIFO with an `out` index past the `in` index. A later `read()` can
 then see an underflowed FIFO length and copy more data than the event FIFO buffer contains. This can
 result in an out-of-bounds read and leak adjacent kernel memory to userspace. Move the FIFO reset before
 `anon_inode_getfd()`. At that point the event fd is marked busy, but the new fd has not been installed
 yet, so userspace cannot access it while the FIFO is reset. (CVE-2026-64496)

Solution

Update the linux library and its related packages to version 6.1.180-1 or later.

See Also

https://advisory.echohq.com/cve/CVE-2026-64496

Plugin Details

Severity: High

ID: 457143

Version: Revision 1.1

Type: Local

Published: 10/2/2026

Updated: 10/2/2026

Risk Information

VPR

Risk Factor: Medium

Score: 4.3

Percentile: 53.41

CVSS v2

Risk Factor: Medium

Base Score: 6.2

Temporal Score: 4.6

Vector: CVSS2#AV:L/AC:L/Au:S/C:C/I:N/A:C

CVSS Score Source: CVE-2026-64496

CVSS v3

Risk Factor: High

Base Score: 7.1

Temporal Score: 6.2

Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 7/26/2026

Vulnerability Publication Date: 7/23/2026

Reference Information

CVE: CVE-2026-64496