Detections
Analytics

Echo: linux: security update to 6.12.10-1

medium Tenable Cloud Security Plugin ID 458268

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - In the Linux kernel, the following vulnerability has been resolved: cgroup/cpuset: remove kernfs active
 break A warning was found: WARNING: CPU: 10 PID: 3486953 at fs/kernfs/file.c:828 CPU: 10 PID: 3486953
 Comm: rmdir Kdump: loaded Tainted: G RIP: 0010:kernfs_should_drain_open_files+0x1a1/0x1b0 RSP:
 0018:ffff8881107ef9e0 EFLAGS: 00010202 RAX: 0000000080000002 RBX: ffff888154738c00 RCX: dffffc0000000000
 RDX: 0000000000000007 RSI: 0000000000000004 RDI: ffff888154738c04 RBP: ffff888154738c04 R08:
 ffffffffaf27fa15 R09: ffffed102a8e7180 R10: ffff888154738c07 R11: 0000000000000000 R12: ffff888154738c08
 R13: ffff888750f8c000 R14: ffff888750f8c0e8 R15: ffff888154738ca0 FS: 00007f84cd0be740(0000)
 GS:ffff8887ddc00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2:
 0000555f9fbe00c8 CR3: 0000000153eec001 CR4: 0000000000370ee0 DR0: 0000000000000000 DR1: 0000000000000000
 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace:
 kernfs_drain+0x15e/0x2f0 __kernfs_remove+0x165/0x300 kernfs_remove_by_name_ns+0x7b/0xc0
 cgroup_rm_file+0x154/0x1c0 cgroup_addrm_files+0x1c2/0x1f0 css_clear_dir+0x77/0x110 kill_css+0x4c/0x1b0
 cgroup_destroy_locked+0x194/0x380 cgroup_rmdir+0x2a/0x140 It can be explained by: rmdir echo 1 >
 cpuset.cpus kernfs_fop_write_iter // active=0 cgroup_rm_file kernfs_remove_by_name_ns kernfs_get_active //
 active=1 __kernfs_remove // active=0x80000002 kernfs_drain cpuset_write_resmask wait_event //waiting
 (active == 0x80000001) kernfs_break_active_protection // active = 0x80000001 // continue
 kernfs_unbreak_active_protection // active = 0x80000002 ... kernfs_should_drain_open_files // warning
 occurs kernfs_put_active This warning is caused by 'kernfs_break_active_protection' when it is writing to
 cpuset.cpus, and the cgroup is removed concurrently. The commit 3a5a6d0c2b03 ("cpuset: don't nest
 cgroup_mutex inside get_online_cpus()") made cpuset_hotplug_workfn asynchronous, This change involves
 calling flush_work(), which can create a multiple processes circular locking dependency that involve
 cgroup_mutex, potentially leading to a deadlock. To avoid deadlock. the commit 76bb5ab8f6e3 ("cpuset:
 break kernfs active protection in cpuset_write_resmask()") added 'kernfs_break_active_protection' in the
 cpuset_write_resmask. This could lead to this warning. After the commit 2125c0034c5d ("cgroup/cpuset: Make
 cpuset hotplug processing synchronous"), the cpuset_write_resmask no longer needs to wait the hotplug to
 finish, which means that concurrent hotplug and cpuset operations are no longer possible. Therefore, the
 deadlock doesn't exist anymore and it does not have to 'break active protection' now. To fix this warning,
 just remove kernfs_break_active_protection operation in the 'cpuset_write_resmask'. (CVE-2025-21634)

Solution

Update the linux library and its related packages to version 6.12.10-1 or later.

See Also

https://advisory.echohq.com/cve/CVE-2025-21634

Plugin Details

Severity: Medium

ID: 458268

Version: Revision 1.1

Type: Local

Published: 10/2/2026

Updated: 10/2/2026

Risk Information

VPR

Risk Factor: Low

Score: 3

Percentile: 23.18

CVSS v2

Risk Factor: Medium

Base Score: 4.6

Temporal Score: 3.4

Vector: CVSS2#AV:L/AC:L/Au:S/C:N/I:N/A:C

CVSS Score Source: CVE-2025-21634

CVSS v3

Risk Factor: Medium

Base Score: 5.5

Temporal Score: 4.8

Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 9/15/2025

Vulnerability Publication Date: 1/19/2025

Reference Information

CVE: CVE-2025-21634