Detections
Analytics

Echo: linux: security update to 6.1.147-1

high Tenable Cloud Security Plugin ID 458970

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - In the Linux kernel, the following vulnerability has been resolved: EDAC/skx_common: Fix general
 protection fault After loading i10nm_edac (which automatically loads skx_edac_common), if unload only
 i10nm_edac, then reload it and perform error injection testing, a general protection fault may occur: mce:
 [Hardware Error]: Machine check events logged Oops: general protection fault ... ... Workqueue: events
 mce_gen_pool_process RIP: 0010:string+0x53/0xe0 ... Call Trace: <TASK> ? die_addr+0x37/0x90 ?
 exc_general_protection+0x1e7/0x3f0 ? asm_exc_general_protection+0x26/0x30 ? string+0x53/0xe0
 vsnprintf+0x23e/0x4c0 snprintf+0x4d/0x70 skx_adxl_decode+0x16a/0x330 [skx_edac_common]
 skx_mce_check_error.part.0+0xf8/0x220 [skx_edac_common] skx_mce_check_error+0x17/0x20 [skx_edac_common]
 ... The issue arose was because the variable 'adxl_component_count' (inside skx_edac_common), which counts
 the ADXL components, was not reset. During the reloading of i10nm_edac, the count was incremented by the
 actual number of ADXL components again, resulting in a count that was double the real number of ADXL
 components. This led to an out-of-bounds reference to the ADXL component array, causing the general
 protection fault above. Fix this issue by resetting the 'adxl_component_count' in adxl_put(), which is
 called during the unloading of {skx,i10nm}_edac. (CVE-2025-38298)

Solution

Update the linux library and its related packages to version 6.1.147-1 or later.

See Also

https://advisory.echohq.com/cve/CVE-2025-38298

Plugin Details

Severity: High

ID: 458970

Version: Revision 1.1

Type: Local

Published: 10/2/2026

Updated: 10/2/2026

Risk Information

VPR

Risk Factor: Medium

Score: 4.9

Percentile: 57.39

CVSS v2

Risk Factor: Medium

Base Score: 6.8

Temporal Score: 5

Vector: CVSS2#AV:L/AC:L/Au:S/C:C/I:C/A:C

CVSS Score Source: CVE-2025-38298

CVSS v3

Risk Factor: High

Base Score: 7.8

Temporal Score: 6.8

Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 9/15/2025

Vulnerability Publication Date: 7/10/2025

Reference Information

CVE: CVE-2025-38298