Detections
Analytics

Echo: linux: security update to 6.11.7-1

high Tenable Cloud Security Plugin ID 459621

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - In the Linux kernel, the following vulnerability has been resolved: btrfs: fix use-after-free of block
 device file in __btrfs_free_extra_devids() Mounting btrfs from two images (which have the same one fsid
 and two different dev_uuids) in certain executing order may trigger an UAF for variable
 'device->bdev_file' in __btrfs_free_extra_devids(). And following are the details: 1. Attach image_1 to
 loop0, attach image_2 to loop1, and scan btrfs devices by ioctl(BTRFS_IOC_SCAN_DEV): / btrfs_device_1 →
 loop0 fs_device \ btrfs_device_2 → loop1 2. mount /dev/loop0 /mnt btrfs_open_devices
 btrfs_device_1->bdev_file = btrfs_get_bdev_and_sb(loop0) btrfs_device_2->bdev_file =
 btrfs_get_bdev_and_sb(loop1) btrfs_fill_super open_ctree fail: btrfs_close_devices // -ENOMEM
 btrfs_close_bdev(btrfs_device_1) fput(btrfs_device_1->bdev_file) // btrfs_device_1->bdev_file is freed
 btrfs_close_bdev(btrfs_device_2) fput(btrfs_device_2->bdev_file) 3. mount /dev/loop1 /mnt
 btrfs_open_devices btrfs_get_bdev_and_sb(&bdev_file) // EIO, btrfs_device_1->bdev_file is not assigned, //
 which points to a freed memory area btrfs_device_2->bdev_file = btrfs_get_bdev_and_sb(loop1)
 btrfs_fill_super open_ctree btrfs_free_extra_devids if (btrfs_device_1->bdev_file)
 fput(btrfs_device_1->bdev_file) // UAF ! Fix it by setting 'device->bdev_file' as 'NULL' after closing the
 btrfs_device in btrfs_close_one_device(). (CVE-2024-50217)

Solution

Update the linux library and its related packages to version 6.11.7-1 or later.

See Also

https://advisory.echohq.com/cve/CVE-2024-50217

Plugin Details

Severity: High

ID: 459621

Version: Revision 1.1

Type: Local

Published: 10/2/2026

Updated: 10/2/2026

Risk Information

VPR

Risk Factor: Medium

Score: 4.9

Percentile: 57.58

CVSS v2

Risk Factor: Medium

Base Score: 6.8

Temporal Score: 5

Vector: CVSS2#AV:L/AC:L/Au:S/C:C/I:C/A:C

CVSS Score Source: CVE-2024-50217

CVSS v3

Risk Factor: High

Base Score: 7.8

Temporal Score: 6.8

Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 9/15/2025

Vulnerability Publication Date: 11/9/2024

Reference Information

CVE: CVE-2024-50217