Detections
Analytics

Echo: linux: security update to 6.1.159-1

medium Tenable Cloud Security Plugin ID 464259

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: remove never-working
 support for setting nsh fields The validation of the set(nsh(...)) action is completely wrong. It runs
 through the nsh_key_put_from_nlattr() function that is the same function that validates NSH keys for the
 flow match and the push_nsh() action. However, the set(nsh(...)) has a very different memory layout.
 Nested attributes in there are doubled in size in case of the masked set(). That makes proper validation
 impossible. There is also confusion in the code between the 'masked' flag, that says that the nested
 attributes are doubled in size containing both the value and the mask, and the 'is_mask' that says that
 the value we're parsing is the mask. This is causing kernel crash on trying to write into mask part of the
 match with SW_FLOW_KEY_PUT() during validation, while validate_nsh() doesn't allocate any memory for it:
 BUG: kernel NULL pointer dereference, address: 0000000000000018 #PF: supervisor read access in kernel mode
 #PF: error_code(0x0000) - not-present page PGD 1c2383067 P4D 1c2383067 PUD 20b703067 PMD 0 Oops: Oops:
 0000 [#1] SMP NOPTI CPU: 8 UID: 0 Kdump: loaded Not tainted 6.17.0-rc4+ #107 PREEMPT(voluntary) RIP:
 0010:nsh_key_put_from_nlattr+0x19d/0x610 [openvswitch] Call Trace: <TASK> validate_nsh+0x60/0x90
 [openvswitch] validate_set.constprop.0+0x270/0x3c0 [openvswitch] __ovs_nla_copy_actions+0x477/0x860
 [openvswitch] ovs_nla_copy_actions+0x8d/0x100 [openvswitch] ovs_packet_cmd_execute+0x1cc/0x310
 [openvswitch] genl_family_rcv_msg_doit+0xdb/0x130 genl_family_rcv_msg+0x14b/0x220 genl_rcv_msg+0x47/0xa0
 netlink_rcv_skb+0x53/0x100 genl_rcv+0x24/0x40 netlink_unicast+0x280/0x3b0 netlink_sendmsg+0x1f7/0x430
 ____sys_sendmsg+0x36b/0x3a0 ___sys_sendmsg+0x87/0xd0 __sys_sendmsg+0x6d/0xd0 do_syscall_64+0x7b/0x2c0
 entry_SYSCALL_64_after_hwframe+0x76/0x7e The third issue with this process is that while trying to convert
 the non-masked set into masked one, validate_set() copies and doubles the size of the OVS_KEY_ATTR_NSH as
 if it didn't have any nested attributes. It should be copying each nested attribute and doubling them in
 size independently. And the process must be properly reversed during the conversion back from masked to a
 non-masked variant during the flow dump. In the end, the only two outcomes of trying to use this action
 are either validation failure or a kernel crash. And if somehow someone manages to install a flow with
 such an action, it will most definitely not do what it is supposed to, since all the keys and the masks
 are mixed up. Fixing all the issues is a complex task as it requires re-writing most of the validation
 code. Given that and the fact that this functionality never worked since introduction, let's just remove
 it altogether. It's better to re-introduce it later with a proper implementation instead of trying to fix
 it in stable releases. (CVE-2025-40254)

Solution

Update the linux library and its related packages to version 6.1.159-1 or later.

See Also

https://advisory.echohq.com/cve/CVE-2025-40254

Plugin Details

Severity: Medium

ID: 464259

Version: Revision 1.1

Type: Local

Published: 10/2/2026

Updated: 10/2/2026

Risk Information

VPR

Risk Factor: Medium

Score: 5

Percentile: 94.35

CVSS v2

Risk Factor: Medium

Base Score: 6

Temporal Score: 4.4

Vector: CVSS2#AV:L/AC:H/Au:S/C:C/I:C/A:C

CVSS Score Source: CVE-2025-40254

CVSS v3

Risk Factor: Medium

Base Score: 5.5

Temporal Score: 4.8

Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 12/7/2025

Vulnerability Publication Date: 12/4/2025

Reference Information

CVE: CVE-2025-40254