Detections
Analytics

Echo: linux: security update to 6.1.147-1

medium Tenable Cloud Security Plugin ID 459122

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - In the Linux kernel, the following vulnerability has been resolved: libnvdimm/labels: Fix divide error in
 nd_label_data_init() If a faulty CXL memory device returns a broken zero LSA size in its memory device
 information (Identify Memory Device (Opcode 4000h), CXL spec. 3.1, 8.2.9.9.1.1), a divide error occurs in
 the libnvdimm driver: Oops: divide error: 0000 [#1] PREEMPT SMP NOPTI RIP:
 0010:nd_label_data_init+0x10e/0x800 [libnvdimm] Code and flow: 1) CXL Command 4000h returns LSA size = 0
 2) config_size is assigned to zero LSA size (CXL pmem driver): drivers/cxl/pmem.c: .config_size =
 mds->lsa_size, 3) max_xfer is set to zero (nvdimm driver): drivers/nvdimm/label.c: max_xfer =
 min_t(size_t, ndd->nsarea.max_xfer, config_size); 4) A subsequent DIV_ROUND_UP() causes a division by
 zero: drivers/nvdimm/label.c: /* Make our initial read size a multiple of max_xfer size */
 drivers/nvdimm/label.c: read_size = min(DIV_ROUND_UP(read_size, max_xfer) * max_xfer,
 drivers/nvdimm/label.c- config_size); Fix this by checking the config size parameter by extending an
 existing check. (CVE-2025-38072)

Solution

Update the linux library and its related packages to version 6.1.147-1 or later.

See Also

https://advisory.echohq.com/cve/CVE-2025-38072

Plugin Details

Severity: Medium

ID: 459122

Version: Revision 1.1

Type: Local

Published: 10/2/2026

Updated: 10/2/2026

Risk Information

VPR

Risk Factor: Low

Score: 3

Percentile: 23.18

CVSS v2

Risk Factor: Medium

Base Score: 4.6

Temporal Score: 3.4

Vector: CVSS2#AV:L/AC:L/Au:S/C:N/I:N/A:C

CVSS Score Source: CVE-2025-38072

CVSS v3

Risk Factor: Medium

Base Score: 5.5

Temporal Score: 4.8

Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 9/15/2025

Vulnerability Publication Date: 6/11/2025

Reference Information

CVE: CVE-2025-38072