Detections
Analytics

Echo: linux: security update to 6.1.176-1

medium Tenable Cloud Security Plugin ID 460350

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - In the Linux kernel, the following vulnerability has been resolved: net/802/mrp: fix vector attribute
 parsing in mrp_pdu_parse_vecattr In mrp_pdu_parse_vecattr(), vector attribute events are encoded three per
 byte and valen tracks the number of events left to process. The parser decrements valen after processing
 the first and second events from each event byte, but not after processing the third one. When valen is
 exactly a multiple of three, the loop continues after the last valid event and consumes the next byte as a
 new event byte, applying a spurious event to the MRP applicant state. Additionally, when valen is zero the
 parser unconditionally consumes attrlen bytes as FirstValue and advances the offset, even though per IEEE
 802.1ak a VectorAttribute with only a LeaveAllEvent has valen of zero and no FirstValue or Vector fields.
 This corrupts the offset for subsequent PDU parsing. Also, when valen exceeds three the loop crosses byte
 boundaries but the attribute value is not incremented between the last event of one byte and the first
 event of the next. This causes the first event of the next byte to use the same attribute value as the
 third event rather than the next consecutive value. Decrement valen after processing the third event, skip
 FirstValue consumption when valen is zero, and increment the attribute value at the end of each loop
 iteration. (CVE-2026-53245)

Solution

Update the linux library and its related packages to version 6.1.176-1 or later.

See Also

https://advisory.echohq.com/cve/CVE-2026-53245

Plugin Details

Severity: Medium

ID: 460350

Version: Revision 1.1

Type: Local

Published: 10/2/2026

Updated: 10/2/2026

Risk Information

VPR

Risk Factor: Medium

Score: 5

Percentile: 93.46

CVSS v2

Risk Factor: Medium

Base Score: 4.6

Temporal Score: 3.4

Vector: CVSS2#AV:L/AC:L/Au:S/C:N/I:N/A:C

CVSS Score Source: CVE-2026-53245

CVSS v3

Risk Factor: Medium

Base Score: 5.5

Temporal Score: 4.8

Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 6/25/2026

Vulnerability Publication Date: 6/25/2026

Reference Information

CVE: CVE-2026-53245