Detections
Analytics

Echo: linux: security update to 6.1.158-1

high Tenable Cloud Security Plugin ID 458555

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - In the Linux kernel, the following vulnerability has been resolved: media: rc: fix races with
 imon_disconnect() Syzbot reports a KASAN issue as below: BUG: KASAN: use-after-free in __create_pipe
 include/linux/usb.h:1945 [inline] BUG: KASAN: use-after-free in send_packet+0xa2d/0xbc0
 drivers/media/rc/imon.c:627 Read of size 4 at addr ffff8880256fb000 by task syz-executor314/4465 CPU: 2
 PID: 4465 Comm: syz-executor314 Not tainted 6.0.0-rc1-syzkaller #0 Hardware name: QEMU Standard PC (Q35 +
 ICH9, 2009), BIOS 1.14.0-2 04/01/2014 Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106 print_address_description mm/kasan/report.c:317 [inline]
 print_report.cold+0x2ba/0x6e9 mm/kasan/report.c:433 kasan_report+0xb1/0x1e0 mm/kasan/report.c:495
 __create_pipe include/linux/usb.h:1945 [inline] send_packet+0xa2d/0xbc0 drivers/media/rc/imon.c:627
 vfd_write+0x2d9/0x550 drivers/media/rc/imon.c:991 vfs_write+0x2d7/0xdd0 fs/read_write.c:576
 ksys_write+0x127/0x250 fs/read_write.c:631 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd The iMON
 driver improperly releases the usb_device reference in imon_disconnect without coordinating with active
 users of the device. Specifically, the fields usbdev_intf0 and usbdev_intf1 are not protected by the users
 counter (ictx->users). During probe, imon_init_intf0 or imon_init_intf1 increments the usb_device
 reference count depending on the interface. However, during disconnect, usb_put_dev is called
 unconditionally, regardless of actual usage. As a result, if vfd_write or other operations are still in
 progress after disconnect, this can lead to a use-after-free of the usb_device pointer. Thread 1 vfd_write
 Thread 2 imon_disconnect ... if usb_put_dev(ictx->usbdev_intf0) else usb_put_dev(ictx->usbdev_intf1) ...
 while send_packet if pipe = usb_sndintpipe( ictx->usbdev_intf0) UAF else pipe = usb_sndctrlpipe(
 ictx->usbdev_intf0, 0) UAF Guard access to usbdev_intf0 and usbdev_intf1 after disconnect by checking
 ictx->disconnected in all writer paths. Add early return with -ENODEV in send_packet(), vfd_write(),
 lcd_write() and display_open() if the device is no longer present. Set and read ictx->disconnected under
 ictx->lock to ensure memory synchronization. Acquire the lock in imon_disconnect() before setting the flag
 to synchronize with any ongoing operations. Ensure writers exit early and safely after disconnect before
 the USB core proceeds with cleanup. Found by Linux Verification Center (linuxtesting.org) with Syzkaller.
 (CVE-2025-39993)

Solution

Update the linux library and its related packages to version 6.1.158-1 or later.

See Also

https://advisory.echohq.com/cve/CVE-2025-39993

Plugin Details

Severity: High

ID: 458555

Version: Revision 1.1

Type: Local

Published: 10/2/2026

Updated: 10/2/2026

Risk Information

VPR

Risk Factor: Medium

Score: 4.9

Percentile: 57.47

CVSS v2

Risk Factor: Medium

Base Score: 6.8

Temporal Score: 5

Vector: CVSS2#AV:L/AC:L/Au:S/C:C/I:C/A:C

CVSS Score Source: CVE-2025-39993

CVSS v3

Risk Factor: High

Base Score: 7.8

Temporal Score: 6.8

Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 10/16/2025

Vulnerability Publication Date: 10/15/2025

Reference Information

CVE: CVE-2025-39993