Detections
Analytics

Echo: linux: security update to 6.1.170-1

medium Tenable Cloud Security Plugin ID 465360

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - In the Linux kernel, the following vulnerability has been resolved: usb: gadget: u_ether: Fix race between
 gether_disconnect and eth_stop A race condition between gether_disconnect() and eth_stop() leads to a NULL
 pointer dereference. Specifically, if eth_stop() is triggered concurrently while gether_disconnect() is
 tearing down the endpoints, eth_stop() attempts to access the cleared endpoint descriptor, causing the
 following NPE: Unable to handle kernel NULL pointer dereference Call trace:
 __dwc3_gadget_ep_enable+0x60/0x788 dwc3_gadget_ep_enable+0x70/0xe4 usb_ep_enable+0x60/0x15c
 eth_stop+0xb8/0x108 Because eth_stop() crashes while holding the dev->lock, the thread running
 gether_disconnect() fails to acquire the same lock and spins forever, resulting in a hardlockup: Core -
 Debugging Information for Hardlockup core(7) Call trace: queued_spin_lock_slowpath+0x94/0x488
 _raw_spin_lock+0x64/0x6c gether_disconnect+0x19c/0x1e8 ncm_set_alt+0x68/0x1a0 composite_setup+0x6a0/0xc50
 The root cause is that the clearing of dev->port_usb in gether_disconnect() is delayed until the end of
 the function. Move the clearing of dev->port_usb to the very beginning of gether_disconnect() while
 holding dev->lock. This cuts off the link immediately, ensuring eth_stop() will see dev->port_usb as NULL
 and safely bail out. (CVE-2026-31728)

Solution

Update the linux library and its related packages to version 6.1.170-1 or later.

See Also

https://advisory.echohq.com/cve/CVE-2026-31728

Plugin Details

Severity: Medium

ID: 465360

Version: Revision 1.1

Type: Local

Published: 10/2/2026

Updated: 10/2/2026

Risk Information

VPR

Risk Factor: Low

Score: 3

Percentile: 23.75

CVSS v2

Risk Factor: Low

Base Score: 3.8

Temporal Score: 2.8

Vector: CVSS2#AV:L/AC:H/Au:S/C:N/I:N/A:C

CVSS Score Source: CVE-2026-31728

CVSS v3

Risk Factor: Medium

Base Score: 4.7

Temporal Score: 4.1

Vector: CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 5/2/2026

Vulnerability Publication Date: 4/23/2026

Reference Information

CVE: CVE-2026-31728