Detections
Analytics

Echo: linux: security update to 6.1.158-1

high Tenable Self-Hosted Container Security Plugin ID 455357

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - In the Linux kernel, the following vulnerability has been resolved: cnic: Fix use-after-free bugs in
 cnic_delete_task The original code uses cancel_delayed_work() in cnic_cm_stop_bnx2x_hw(), which does not
 guarantee that the delayed work item 'delete_task' has fully completed if it was already running.
 Additionally, the delayed work item is cyclic, the flush_workqueue() in cnic_cm_stop_bnx2x_hw() only
 blocks and waits for work items that were already queued to the workqueue prior to its invocation. Any
 work items submitted after flush_workqueue() is called are not included in the set of tasks that the flush
 operation awaits. This means that after the cyclic work items have finished executing, a delayed work item
 may still exist in the workqueue. This leads to use-after-free scenarios where the cnic_dev is deallocated
 by cnic_free_dev(), while delete_task remains active and attempt to dereference cnic_dev in
 cnic_delete_task(). A typical race condition is illustrated below: CPU 0 (cleanup) | CPU 1 (delayed work
 callback) cnic_netdev_event() | cnic_stop_hw() | cnic_delete_task() cnic_cm_stop_bnx2x_hw() | ...
 cancel_delayed_work() | /* the queue_delayed_work() flush_workqueue() | executes after flush_workqueue()*/
 | queue_delayed_work() cnic_free_dev(dev)//free | cnic_delete_task() //new instance | dev = cp->dev; //use
 Replace cancel_delayed_work() with cancel_delayed_work_sync() to ensure that the cyclic delayed work item
 is properly canceled and that any ongoing execution of the work item completes before the cnic_dev is
 deallocated. Furthermore, since cancel_delayed_work_sync() uses __flush_work(work, true) to synchronously
 wait for any currently executing instance of the work item to finish, the flush_workqueue() becomes
 redundant and should be removed. This bug was identified through static analysis. To reproduce the issue
 and validate the fix, I simulated the cnic PCI device in QEMU and introduced intentional delays — such as
 inserting calls to ssleep() within the cnic_delete_task() function — to increase the likelihood of
 triggering the bug. (CVE-2025-39945)

Solution

Update the linux library and its related packages to version 6.1.158-1 or later.

See Also

https://advisory.echohq.com/cve/CVE-2025-39945

Plugin Details

Severity: High

ID: 455357

Version: Revision 1.1

Type: Local

Published: 10/1/2026

Updated: 10/1/2026

Risk Information

VPR

Risk Factor: Medium

Score: 4.9

Percentile: 57.26

CVSS v2

Risk Factor: Medium

Base Score: 6.8

Temporal Score: 5

Vector: CVSS2#AV:L/AC:L/Au:S/C:C/I:C/A:C

CVSS Score Source: CVE-2025-39945

CVSS v3

Risk Factor: High

Base Score: 7.8

Temporal Score: 6.8

Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 10/4/2025

Vulnerability Publication Date: 10/4/2025

Reference Information

CVE: CVE-2025-39945