Detections
Analytics

Echo: linux: security update to 6.1.180-1

medium Tenable Cloud Security Plugin ID 458816

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - In the Linux kernel, the following vulnerability has been resolved: slimbus: qcom-ngd-ctrl: Register
 callbacks after creating the ngd When the remoteproc starts in parallel with the NGD driver being probed,
 or the remoteproc is already up when the PDR lookup is being registered, or in the theoretical event that
 we get an interrupt from the hardware, these callbacks will operate on uninitialized data. This result in
 issues to boot the affected boards. One such example can be seen in the following fault, where
 qcom_slim_ngd_ssr_pdr_notify() schedules work on the NULL ngd_up_work. [ 21.858578] ------------[ cut here
 ]------------ [ 21.858745] WARNING: kernel/workqueue.c:2338 at __queue_work+0x5e0/0x790, CPU#2:
 kworker/2:2/116 ... [ 21.859251] Call trace: [ 21.859255] __queue_work+0x5e0/0x790 (P) [ 21.859265]
 queue_work_on+0x6c/0xf0 [ 21.859273] qcom_slim_ngd_ssr_pdr_notify+0x110/0x150 [slim_qcom_ngd_ctrl] [
 21.859304] qcom_slim_ngd_ssr_notify+0x24/0x40 [slim_qcom_ngd_ctrl] [ 21.859318]
 notifier_call_chain+0xa4/0x230 [ 21.859329] srcu_notifier_call_chain+0x64/0xb8 [ 21.859338]
 ssr_notify_start+0x40/0x78 [qcom_common] [ 21.859355] rproc_start+0x130/0x230 [ 21.859367]
 rproc_boot+0x3d4/0x518 ... Move the enablement of interrupts, and the registration of SSR and PDR until
 after the NGD device has been registered. This could be further refined by moving initialization to the
 control driver probe and by removing the platform driver model from the picture. (CVE-2026-53332)

Solution

Update the linux library and its related packages to version 6.1.180-1 or later.

See Also

https://advisory.echohq.com/cve/CVE-2026-53332

Plugin Details

Severity: Medium

ID: 458816

Version: Revision 1.1

Type: Local

Published: 10/2/2026

Updated: 10/2/2026

Risk Information

VPR

Risk Factor: Low

Score: 3

Percentile: 23.63

CVSS v2

Risk Factor: Medium

Base Score: 4.6

Temporal Score: 3.4

Vector: CVSS2#AV:L/AC:L/Au:S/C:N/I:N/A:C

CVSS Score Source: CVE-2026-53332

CVSS v3

Risk Factor: Medium

Base Score: 5.5

Temporal Score: 4.8

Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 7/2/2026

Vulnerability Publication Date: 7/1/2026

Reference Information

CVE: CVE-2026-53332