Detections
Analytics

Echo: linux: security update to 6.12.20-1

medium Tenable Cloud Security Plugin ID 461369

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - In the Linux kernel, the following vulnerability has been resolved: fbdev: hyperv_fb: Allow graceful
 removal of framebuffer When a Hyper-V framebuffer device is unbind, hyperv_fb driver tries to release the
 framebuffer forcefully. If this framebuffer is in use it produce the following WARN and hence this
 framebuffer is never released. [ 44.111220] WARNING: CPU: 35 PID: 1882 at
 drivers/video/fbdev/core/fb_info.c:70 framebuffer_release+0x2c/0x40 < snip > [ 44.111289] Call Trace: [
 44.111290] <TASK> [ 44.111291] ? show_regs+0x6c/0x80 [ 44.111295] ? __warn+0x8d/0x150 [ 44.111298] ?
 framebuffer_release+0x2c/0x40 [ 44.111300] ? report_bug+0x182/0x1b0 [ 44.111303] ? handle_bug+0x6e/0xb0 [
 44.111306] ? exc_invalid_op+0x18/0x80 [ 44.111308] ? asm_exc_invalid_op+0x1b/0x20 [ 44.111311] ?
 framebuffer_release+0x2c/0x40 [ 44.111313] ? hvfb_remove+0x86/0xa0 [hyperv_fb] [ 44.111315]
 vmbus_remove+0x24/0x40 [hv_vmbus] [ 44.111323] device_remove+0x40/0x80 [ 44.111325]
 device_release_driver_internal+0x20b/0x270 [ 44.111327] ? bus_find_device+0xb3/0xf0 Fix this by moving the
 release of framebuffer and assosiated memory to fb_ops.fb_destroy function, so that framebuffer framework
 handles it gracefully. While we fix this, also replace manual registrations/unregistration of framebuffer
 with devm_register_framebuffer. (CVE-2025-21976)

Solution

Update the linux library and its related packages to version 6.12.20-1 or later.

See Also

https://advisory.echohq.com/cve/CVE-2025-21976

Plugin Details

Severity: Medium

ID: 461369

Version: Revision 1.1

Type: Local

Published: 10/2/2026

Updated: 10/2/2026

Risk Information

VPR

Risk Factor: Low

Score: 3

Percentile: 23.19

CVSS v2

Risk Factor: Medium

Base Score: 4.6

Temporal Score: 3.4

Vector: CVSS2#AV:L/AC:L/Au:S/C:N/I:N/A:C

CVSS Score Source: CVE-2025-21976

CVSS v3

Risk Factor: Medium

Base Score: 5.5

Temporal Score: 4.8

Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 9/15/2025

Vulnerability Publication Date: 4/1/2025

Reference Information

CVE: CVE-2025-21976