Detections
Analytics

Echo: linux: security update to 6.12.41-1

medium Tenable Cloud Security Plugin ID 459730

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix recv-recv race of completed
 call If a call receives an event (such as incoming data), the call gets placed on the socket's queue and a
 thread in recvmsg can be awakened to go and process it. Once the thread has picked up the call off of the
 queue, further events will cause it to be requeued, and once the socket lock is dropped (recvmsg uses
 call->user_mutex to allow the socket to be used in parallel), a second thread can come in and its recvmsg
 can pop the call off the socket queue again. In such a case, the first thread will be receiving stuff from
 the call and the second thread will be blocked on call->user_mutex. The first thread can, at this point,
 process both the event that it picked call for and the event that the second thread picked the call for
 and may see the call terminate - in which case the call will be "released", decoupling the call from the
 user call ID assigned to it (RXRPC_USER_CALL_ID in the control message). The first thread will return
 okay, but then the second thread will wake up holding the user_mutex and, if it sees that the call has
 been released by the first thread, it will BUG thusly: kernel BUG at net/rxrpc/recvmsg.c:474! Fix this by
 just dequeuing the call and ignoring it if it is seen to be already released. We can't tell userspace
 about it anyway as the user call ID has become stale. (CVE-2025-38524)

Solution

Update the linux library and its related packages to version 6.12.41-1 or later.

See Also

https://advisory.echohq.com/cve/CVE-2025-38524

Plugin Details

Severity: Medium

ID: 459730

Version: Revision 1.2

Type: Local

Published: 10/2/2026

Updated: 10/5/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Low

Score: 3

Percentile: 23.18

CVSS v2

Risk Factor: Low

Base Score: 3.8

Temporal Score: 2.8

Vector: CVSS2#AV:L/AC:H/Au:S/C:N/I:N/A:C

CVSS Score Source: CVE-2025-38524

CVSS v3

Risk Factor: Medium

Base Score: 4.7

Temporal Score: 4.1

Vector: CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 9/15/2025

Vulnerability Publication Date: 9/15/2025

Reference Information

CVE: CVE-2025-38524