Detections
Analytics

Echo: linux: security update to 6.1.140-1

medium Tenable Cloud Security Plugin ID 461965

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - In the Linux kernel, the following vulnerability has been resolved: drm/v3d: Add job to pending list if
 the reset was skipped When a CL/CSD job times out, we check if the GPU has made any progress since the
 last timeout. If so, instead of resetting the hardware, we skip the reset and let the timer get rearmed.
 This gives long-running jobs a chance to complete. However, when `timedout_job()` is called, the job in
 question is removed from the pending list, which means it won't be automatically freed through
 `free_job()`. Consequently, when we skip the reset and keep the job running, the job won't be freed when
 it finally completes. This situation leads to a memory leak, as exposed in [1] and [2]. Similarly to
 commit 704d3d60fec4 ("drm/etnaviv: don't block scheduler when GPU is still active"), this patch ensures
 the job is put back on the pending list when extending the timeout. (CVE-2025-37951)

Solution

Update the linux library and its related packages to version 6.1.140-1 or later.

See Also

https://advisory.echohq.com/cve/CVE-2025-37951

Plugin Details

Severity: Medium

ID: 461965

Version: Revision 1.1

Type: Local

Published: 10/2/2026

Updated: 10/2/2026

Risk Information

VPR

Risk Factor: Low

Score: 3

Percentile: 23.18

CVSS v2

Risk Factor: Medium

Base Score: 4.6

Temporal Score: 3.4

Vector: CVSS2#AV:L/AC:L/Au:S/C:N/I:N/A:C

CVSS Score Source: CVE-2025-37951

CVSS v3

Risk Factor: Medium

Base Score: 5.5

Temporal Score: 4.8

Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 9/15/2025

Vulnerability Publication Date: 5/20/2025

Reference Information

CVE: CVE-2025-37951