Detections
Analytics

Echo: linux: security update to 6.1.176-1

medium Tenable Cloud Security Plugin ID 458575

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - In the Linux kernel, the following vulnerability has been resolved: net/smc: fix sleep-inside-lock in
 __smc_setsockopt() causing local DoS A logic flaw in __smc_setsockopt() allows a local unprivileged user
 to cause a Denial of Service (DoS) by holding the socket lock indefinitely. The function
 __smc_setsockopt() calls copy_from_sockptr() while holding lock_sock(sk). By passing a userfaultfd-
 monitored memory page (or FUSE-backed memory on systems where unprivileged userfaultfd is disabled) as the
 optval, an attacker can halt execution during the copy operation, keeping the lock held. Combined with
 asynchronous tear-down operations like shutdown(), this exhausts the kernel wq (kworkers) and triggers the
 hung task watchdog. [ 240.123456] INFO: task kworker/u8:2 blocked for more than 120 seconds. [ 240.123489]
 Call Trace: [ 240.123501] smc_shutdown+... [ 240.123512] lock_sock_nested+... This patch moves the user-
 space copy outside the lock_sock() critical section to prevent the issue. (CVE-2026-53274)

Solution

Update the linux library and its related packages to version 6.1.176-1 or later.

See Also

https://advisory.echohq.com/cve/CVE-2026-53274

Plugin Details

Severity: Medium

ID: 458575

Version: Revision 1.1

Type: Local

Published: 10/2/2026

Updated: 10/2/2026

Risk Information

VPR

Risk Factor: Low

Score: 3

Percentile: 23.75

CVSS v2

Risk Factor: Medium

Base Score: 4.6

Temporal Score: 3.4

Vector: CVSS2#AV:L/AC:L/Au:S/C:N/I:N/A:C

CVSS Score Source: CVE-2026-53274

CVSS v3

Risk Factor: Medium

Base Score: 5.5

Temporal Score: 4.8

Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 6/25/2026

Vulnerability Publication Date: 6/25/2026

Reference Information

CVE: CVE-2026-53274