Detections
Analytics

Echo: linux: security update to 6.1.180-1

critical Tenable Cloud Security Plugin ID 458534

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: bound Read Response
 placement to the RREAD length In drivers/infiniband/sw/siw/siw_qp_rx.c, siw_proc_rresp() places each
 inbound Read Response DDP segment at sge->laddr + wqe->processed and then accumulates wqe->processed, but
 it never checks the running total against the sink buffer length on continuation segments. siw_check_sge()
 resolves and validates the sink memory only on the first fragment (the if (!*mem) branch), and
 siw_rresp_check_ntoh() compares the cumulative length against wqe->bytes only on the final segment (the
 !frx->more_ddp_segs guard). A connected siw peer that answers an outstanding RREAD with Read Response
 segments that keep the DDP Last flag clear, carrying more total payload than the RREAD requested, drives
 wqe->processed past the validated sink buffer; the next siw_rx_data() call writes out of bounds at
 sge->laddr + wqe->processed. siw runs iWARP over ordinary routable TCP, so the peer is the remote end of
 an established RDMA connection and needs no local privilege. Bound every segment before placement, exactly
 as siw_proc_send() and siw_proc_write() already do for their tagged and untagged paths, and terminate the
 connection with a base-or-bounds DDP error when the Read Response would overrun the sink buffer. This is
 the second receive-path length fix for this file. A separate change rejects an MPA FPDU length that
 underflows the per-fragment remainder in the header decode; that guard does not cover this case, because
 here each individual segment length is self-consistent and only the accumulated placement offset overruns
 the buffer. (CVE-2026-64268)

Solution

Update the linux library and its related packages to version 6.1.180-1 or later.

See Also

https://advisory.echohq.com/cve/CVE-2026-64268

Plugin Details

Severity: Critical

ID: 458534

Version: Revision 1.1

Type: Local

Published: 10/2/2026

Updated: 10/2/2026

Risk Information

VPR

Risk Factor: Medium

Score: 4.9

Percentile: 58.21

CVSS v2

Risk Factor: Critical

Base Score: 10

Temporal Score: 7.4

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS Score Source: CVE-2026-64268

CVSS v3

Risk Factor: Critical

Base Score: 9.8

Temporal Score: 8.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 7/26/2026

Vulnerability Publication Date: 7/23/2026

Reference Information

CVE: CVE-2026-64268