Detections
Analytics

Echo: linux: security update to 6.1.176-1

critical Tenable Cloud Security Plugin ID 458995

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - In the Linux kernel, the following vulnerability has been resolved: ocfs2/dlm: validate qr_numregions in
 dlm_match_regions() Patch series "ocfs2/dlm: fix two bugs in dlm_match_regions()". In dlm_match_regions(),
 the qr_numregions field from a DLM_QUERY_REGION network message is used to drive loops over the qr_regions
 buffer without sufficient validation. This series fixes two issues: - Patch 1 adds a bounds check to
 reject messages where qr_numregions exceeds O2NM_MAX_REGIONS. The o2net layer only validates message byte
 length; it does not constrain field values, so a crafted message can set qr_numregions up to 255 and
 trigger out-of-bounds reads past the 1024-byte qr_regions buffer. - Patch 2 fixes an off-by-one in the
 local-vs-remote comparison loop, which uses '<=' instead of '<', reading one entry past the valid range
 even when qr_numregions is within bounds. This patch (of 2): The qr_numregions field from a
 DLM_QUERY_REGION network message is used directly as loop bounds in dlm_match_regions() without checking
 against O2NM_MAX_REGIONS. Since qr_regions is sized for at most O2NM_MAX_REGIONS (32) entries, a crafted
 message with qr_numregions > 32 causes out-of-bounds reads past the qr_regions buffer. Add a bounds check
 for qr_numregions before entering the loops. (CVE-2026-53043)

Solution

Update the linux library and its related packages to version 6.1.176-1 or later.

See Also

https://advisory.echohq.com/cve/CVE-2026-53043

Plugin Details

Severity: Critical

ID: 458995

Version: Revision 1.1

Type: Local

Published: 10/2/2026

Updated: 10/2/2026

Risk Information

VPR

Risk Factor: Medium

Score: 4.3

Percentile: 53.64

CVSS v2

Risk Factor: High

Base Score: 9.4

Temporal Score: 7

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:N/A:C

CVSS Score Source: CVE-2026-53043

CVSS v3

Risk Factor: Critical

Base Score: 9.1

Temporal Score: 7.9

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 6/25/2026

Vulnerability Publication Date: 6/3/2026

Reference Information

CVE: CVE-2026-53043