Detections
Analytics

Echo: linux: security update to 6.1.148-1

medium Tenable Cloud Security Plugin ID 459517

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - In the Linux kernel, the following vulnerability has been resolved: PCI: pnv_php: Clean up allocated IRQs
 on unplug When the root of a nested PCIe bridge configuration is unplugged, the pnv_php driver leaked the
 allocated IRQ resources for the child bridges' hotplug event notifications, resulting in a panic. Fix this
 by walking all child buses and deallocating all its IRQ resources before calling pci_hp_remove_devices().
 Also modify the lifetime of the workqueue at struct pnv_php_slot::wq so that it is only destroyed in
 pnv_php_free_slot(), instead of pnv_php_disable_irq(). This is required since pnv_php_disable_irq() will
 now be called by workers triggered by hot unplug interrupts, so the workqueue needs to stay allocated. The
 abridged kernel panic that occurs without this patch is as follows: WARNING: CPU: 0 PID: 687 at
 kernel/irq/msi.c:292 msi_device_data_release+0x6c/0x9c CPU: 0 UID: 0 PID: 687 Comm: bash Not tainted
 6.14.0-rc5+ #2 Call Trace: msi_device_data_release+0x34/0x9c (unreliable) release_nodes+0x64/0x13c
 devres_release_all+0xc0/0x140 device_del+0x2d4/0x46c pci_destroy_dev+0x5c/0x194
 pci_hp_remove_devices+0x90/0x128 pci_hp_remove_devices+0x44/0x128 pnv_php_disable_slot+0x54/0xd4
 power_write_file+0xf8/0x18c pci_slot_attr_store+0x40/0x5c sysfs_kf_write+0x64/0x78
 kernfs_fop_write_iter+0x1b0/0x290 vfs_write+0x3bc/0x50c ksys_write+0x84/0x140
 system_call_exception+0x124/0x230 system_call_vectored_common+0x15c/0x2ec [bhelgaas: tidy comments]
 (CVE-2025-38624)

Solution

Update the linux library and its related packages to version 6.1.148-1 or later.

See Also

https://advisory.echohq.com/cve/CVE-2025-38624

Plugin Details

Severity: Medium

ID: 459517

Version: Revision 1.1

Type: Local

Published: 10/2/2026

Updated: 10/2/2026

Risk Information

VPR

Risk Factor: Low

Score: 3

Percentile: 23.18

CVSS v2

Risk Factor: Medium

Base Score: 4.6

Temporal Score: 3.4

Vector: CVSS2#AV:L/AC:L/Au:S/C:N/I:N/A:C

CVSS Score Source: CVE-2025-38624

CVSS v3

Risk Factor: Medium

Base Score: 5.5

Temporal Score: 4.8

Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 9/15/2025

Vulnerability Publication Date: 8/22/2025

Reference Information

CVE: CVE-2025-38624