Detections
Analytics

Echo: linux: security update to 6.12.25-1

medium Tenable Cloud Security Plugin ID 462189

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - In the Linux kernel, the following vulnerability has been resolved: LoongArch: BPF: Fix off-by-one error
 in build_prologue() Vincent reported that running BPF progs with tailcalls on LoongArch causes kernel hard
 lockup. Debugging the issues shows that the JITed image missing a jirl instruction at the end of the
 epilogue. There are two passes in JIT compiling, the first pass set the flags and the second pass
 generates JIT code based on those flags. With BPF progs mixing bpf2bpf and tailcalls, build_prologue()
 generates N insns in the first pass and then generates N+1 insns in the second pass. This makes
 epilogue_offset off by one and we will jump to some unexpected insn and cause lockup. Fix this by
 inserting a nop insn. (CVE-2025-37893)

Solution

Update the linux library and its related packages to version 6.12.25-1 or later.

See Also

https://advisory.echohq.com/cve/CVE-2025-37893

Plugin Details

Severity: Medium

ID: 462189

Version: Revision 1.1

Type: Local

Published: 10/2/2026

Updated: 10/2/2026

Risk Information

VPR

Risk Factor: Low

Score: 3

Percentile: 23.18

CVSS v2

Risk Factor: Medium

Base Score: 4.6

Temporal Score: 3.4

Vector: CVSS2#AV:L/AC:L/Au:S/C:N/I:N/A:C

CVSS Score Source: CVE-2025-37893

CVSS v3

Risk Factor: Medium

Base Score: 5.5

Temporal Score: 4.8

Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 9/15/2025

Vulnerability Publication Date: 4/18/2025

Reference Information

CVE: CVE-2025-37893