Detections
Analytics

Echo: linux: security update to 6.1.170-1

medium Tenable Cloud Security Plugin ID 464370

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: fix NULL deref in
 mesh_matches_local() mesh_matches_local() unconditionally dereferences ie->mesh_config to compare mesh
 configuration parameters. When called from mesh_rx_csa_frame(), the parsed action-frame elements may not
 contain a Mesh Configuration IE, leaving ie->mesh_config NULL and triggering a kernel NULL pointer
 dereference. The other two callers are already safe: - ieee80211_mesh_rx_bcn_presp() checks
 !elems->mesh_config before calling mesh_matches_local() - mesh_plink_get_event() is only reached through
 mesh_process_plink_frame(), which checks !elems->mesh_config, too mesh_rx_csa_frame() is the only caller
 that passes raw parsed elements to mesh_matches_local() without guarding mesh_config. An adjacent attacker
 can exploit this by sending a crafted CSA action frame that includes a valid Mesh ID IE but omits the Mesh
 Configuration IE, crashing the kernel. The captured crash log: Oops: general protection fault, probably
 for non-canonical address ... KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]
 Workqueue: events_unbound cfg80211_wiphy_work [...] Call Trace: <TASK> ? __pfx_mesh_matches_local
 (net/mac80211/mesh.c:65) ieee80211_mesh_rx_queued_mgmt (net/mac80211/mesh.c:1686) [...]
 ieee80211_iface_work (net/mac80211/iface.c:1754 net/mac80211/iface.c:1802) [...] cfg80211_wiphy_work
 (net/wireless/core.c:426) process_one_work (net/kernel/workqueue.c:3280) ? assign_work
 (net/kernel/workqueue.c:1219) worker_thread (net/kernel/workqueue.c:3352) ? __pfx_worker_thread
 (net/kernel/workqueue.c:3385) kthread (net/kernel/kthread.c:436) [...] ret_from_fork_asm
 (net/arch/x86/entry/entry_64.S:255) </TASK> This patch adds a NULL check for ie->mesh_config at the top of
 mesh_matches_local() to return false early when the Mesh Configuration IE is absent. (CVE-2026-23396)

Solution

Update the linux library and its related packages to version 6.1.170-1 or later.

See Also

https://advisory.echohq.com/cve/CVE-2026-23396

Plugin Details

Severity: Medium

ID: 464370

Version: Revision 1.1

Type: Local

Published: 10/2/2026

Updated: 10/2/2026

Risk Information

VPR

Risk Factor: Low

Score: 3

Percentile: 23.72

CVSS v2

Risk Factor: Medium

Base Score: 4.6

Temporal Score: 3.4

Vector: CVSS2#AV:L/AC:L/Au:S/C:N/I:N/A:C

CVSS Score Source: CVE-2026-23396

CVSS v3

Risk Factor: Medium

Base Score: 5.5

Temporal Score: 4.8

Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 5/1/2026

Vulnerability Publication Date: 3/26/2026

Reference Information

CVE: CVE-2026-23396