Detections
Analytics

Echo: linux: security update to 6.7.12-1

medium Tenable Cloud Security Plugin ID 461775

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - In the Linux kernel, the following vulnerability has been resolved: spi: lpspi: Avoid potential use-after-
 free in probe() fsl_lpspi_probe() is allocating/disposing memory manually with
 spi_alloc_host()/spi_alloc_target(), but uses devm_spi_register_controller(). In case of error after the
 latter call the memory will be explicitly freed in the probe function by spi_controller_put() call, but
 used afterwards by "devm" management outside probe() (spi_unregister_controller() <- devm_spi_unregister()
 below). Unable to handle kernel NULL pointer dereference at virtual address 0000000000000070 ... Call
 trace: kernfs_find_ns kernfs_find_and_get_ns sysfs_remove_group sysfs_remove_groups device_remove_attrs
 device_del spi_unregister_controller devm_spi_unregister release_nodes devres_release_all really_probe
 driver_probe_device __device_attach_driver bus_for_each_drv __device_attach device_initial_probe
 bus_probe_device deferred_probe_work_func process_one_work worker_thread kthread ret_from_fork
 (CVE-2024-26866)

Solution

Update the linux library and its related packages to version 6.7.12-1 or later.

See Also

https://advisory.echohq.com/cve/CVE-2024-26866

Plugin Details

Severity: Medium

ID: 461775

Version: Revision 1.1

Type: Local

Published: 10/2/2026

Updated: 10/2/2026

Risk Information

VPR

Risk Factor: Low

Score: 3

Percentile: 23.18

CVSS v2

Risk Factor: Medium

Base Score: 4.6

Temporal Score: 3.4

Vector: CVSS2#AV:L/AC:L/Au:S/C:N/I:N/A:C

CVSS Score Source: CVE-2024-26866

CVSS v3

Risk Factor: Medium

Base Score: 5.5

Temporal Score: 4.8

Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 9/15/2025

Vulnerability Publication Date: 4/17/2024

Reference Information

CVE: CVE-2024-26866