Detections
Analytics

Echo: linux: security update to 6.1.153-1

medium Tenable Cloud Security Plugin ID 460603

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - In the Linux kernel, the following vulnerability has been resolved: dmaengine: qcom: bam_dma: Fix DT error
 handling for num-channels/ees When we don't have a clock specified in the device tree, we have no way to
 ensure the BAM is on. This is often the case for remotely-controlled or remotely-powered BAM instances. In
 this case, we need to read num-channels from the DT to have all the necessary information to complete
 probing. However, at the moment invalid device trees without clock and without num-channels still continue
 probing, because the error handling is missing return statements. The driver will then later try to read
 the number of channels from the registers. This is unsafe, because it relies on boot firmware and lucky
 timing to succeed. Unfortunately, the lack of proper error handling here has been abused for several
 Qualcomm SoCs upstream, causing early boot crashes in several situations [1, 2]. Avoid these early crashes
 by erroring out when any of the required DT properties are missing. Note that this will break some of the
 existing DTs upstream (mainly BAM instances related to the crypto engine). However, clearly these DTs have
 never been tested properly, since the error in the kernel log was just ignored. It's safer to disable the
 crypto engine for these broken DTBs. [1]:
 https://lore.kernel.org/r/[email protected]/ [2]:
 https://lore.kernel.org/r/[email protected]/ (CVE-2025-39923)

Solution

Update the linux library and its related packages to version 6.1.153-1 or later.

See Also

https://advisory.echohq.com/cve/CVE-2025-39923

Plugin Details

Severity: Medium

ID: 460603

Version: Revision 1.1

Type: Local

Published: 10/2/2026

Updated: 10/2/2026

Risk Information

VPR

Risk Factor: Low

Score: 3

Percentile: 23.15

CVSS v2

Risk Factor: Medium

Base Score: 4.6

Temporal Score: 3.4

Vector: CVSS2#AV:L/AC:L/Au:S/C:N/I:N/A:C

CVSS Score Source: CVE-2025-39923

CVSS v3

Risk Factor: Medium

Base Score: 5.5

Temporal Score: 4.8

Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 10/22/2025

Vulnerability Publication Date: 9/29/2025

Reference Information

CVE: CVE-2025-39923