Detections
Analytics

Echo: linux: security update to 6.1.153-1

high Tenable Cloud Security Plugin ID 458257

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - In the Linux kernel, the following vulnerability has been resolved: scsi: lpfc: Fix buffer free/clear
 order in deferred receive path Fix a use-after-free window by correcting the buffer release sequence in
 the deferred receive path. The code freed the RQ buffer first and only then cleared the context pointer
 under the lock. Concurrent paths (e.g., ABTS and the repost path) also inspect and release the same
 pointer under the lock, so the old order could lead to double-free/UAF. Note that the repost path already
 uses the correct pattern: detach the pointer under the lock, then free it after dropping the lock. The
 deferred path should do the same. (CVE-2025-39841)

Solution

Update the linux library and its related packages to version 6.1.153-1 or later.

See Also

https://advisory.echohq.com/cve/CVE-2025-39841

Plugin Details

Severity: High

ID: 458257

Version: Revision 1.1

Type: Local

Published: 10/2/2026

Updated: 10/2/2026

Risk Information

VPR

Risk Factor: Medium

Score: 4.9

Percentile: 57.26

CVSS v2

Risk Factor: Medium

Base Score: 6.8

Temporal Score: 5

Vector: CVSS2#AV:L/AC:L/Au:S/C:C/I:C/A:C

CVSS Score Source: CVE-2025-39841

CVSS v3

Risk Factor: High

Base Score: 7.8

Temporal Score: 6.8

Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 9/20/2025

Vulnerability Publication Date: 9/19/2025

Reference Information

CVE: CVE-2025-39841