Detections
Analytics

Echo: linux: security update to 6.12.43-1

medium Tenable Cloud Security Plugin ID 458352

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: cancle set bad inode after
 removing name fails The reproducer uses a file0 on a ntfs3 file system with a corrupted i_link. When
 renaming, the file0's inode is marked as a bad inode because the file name cannot be deleted. The
 underlying bug is that make_bad_inode() is called on a live inode. In some cases it's "icache lookup finds
 a normal inode, d_splice_alias() is called to attach it to dentry, while another thread decides to call
 make_bad_inode() on it - that would evict it from icache, but we'd already found it there earlier". In
 some it's outright "we have an inode attached to dentry - that's how we got it in the first place; let's
 call make_bad_inode() on it just for shits and giggles". (CVE-2025-38615)

Solution

Update the linux library and its related packages to version 6.12.43-1 or later.

See Also

https://advisory.echohq.com/cve/CVE-2025-38615

Plugin Details

Severity: Medium

ID: 458352

Version: Revision 1.1

Type: Local

Published: 10/2/2026

Updated: 10/2/2026

Risk Information

VPR

Risk Factor: Low

Score: 3

Percentile: 23.28

CVSS v2

Risk Factor: Medium

Base Score: 4.6

Temporal Score: 3.4

Vector: CVSS2#AV:L/AC:L/Au:S/C:N/I:N/A:C

CVSS Score Source: CVE-2025-38615

CVSS v3

Risk Factor: Medium

Base Score: 5.5

Temporal Score: 4.8

Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 9/15/2025

Vulnerability Publication Date: 8/19/2025

Reference Information

CVE: CVE-2025-38615