Detections
Analytics

Echo: linux: security update to 6.1.180-1

high Tenable Self-Hosted Container Security Plugin ID 457087

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free of a
 deferred file_lock on SMB2_CLOSE then SMB2_CANCEL Commit f580d27e8928 ("ksmbd: fix use-after-free of a
 deferred file_lock on double SMB2_CANCEL") made smb2_cancel() skip a work whose state is
 KSMBD_WORK_CANCELLED, so its cancel_fn cannot be fired a second time. But KSMBD_WORK has three states
 (ACTIVE, CANCELLED, CLOSED), and the same freeing producer path is reached for CLOSED too: SMB2_CLOSE on
 the locking handle -> set_close_state_blocked_works() sets the deferred work's state to KSMBD_WORK_CLOSED
 and wakes the smb2_lock() worker. The worker takes the non-ACTIVE early-exit, locks_free_lock()s the
 file_lock and, because the state is not KSMBD_WORK_CANCELLED, takes the STATUS_RANGE_NOT_LOCKED branch
 with "goto out2" -- which, like the cancelled branch, skips release_async_work(). The work stays on
 conn->async_requests with a live cancel_fn = smb2_remove_blocked_lock pointing at the freed file_lock. A
 subsequent SMB2_CANCEL for the same AsyncId then passes the KSMBD_WORK_CANCELLED-only guard (its state is
 KSMBD_WORK_CLOSED), so smb2_cancel() fires cancel_fn again over the freed file_lock -- the same use-after-
 free fixed, via SMB2_CLOSE instead of a first SMB2_CANCEL: BUG: KASAN: slab-use-after-free in
 __locks_delete_block __locks_delete_block locks_delete_block ksmbd_vfs_posix_lock_unblock
 smb2_remove_blocked_lock smb2_cancel <- 2nd SMB2_CANCEL fires cancel_fn handle_ksmbd_work Allocated by
 ...: locks_alloc_lock <- smb2_lock Freed by ...: locks_free_lock <- smb2_lock (non-ACTIVE early-exit) ...
 cache file_lock_cache of size 192 Reproduced on mainline 7.1-rc7 (which already contains f580d27e8928)
 with KASAN by an authenticated SMB client; the double-SMB2_CANCEL control is silent on that kernel, so the
 splat is attributable to the CLOSE trigger. Only an ACTIVE deferred work may have its cancel_fn fired:
 both terminal states (CANCELLED and CLOSED) reach the smb2_lock() early-exit that frees the file_lock and
 skips release_async_work(). Guard on KSMBD_WORK_ACTIVE so any non-active work is skipped. (CVE-2026-64437)

Solution

Update the linux library and its related packages to version 6.1.180-1 or later.

See Also

https://advisory.echohq.com/cve/CVE-2026-64437

Plugin Details

Severity: High

ID: 457087

Version: Revision 1.1

Type: Local

Published: 10/2/2026

Updated: 10/2/2026

Risk Information

VPR

Risk Factor: Medium

Score: 4.9

Percentile: 58.14

CVSS v2

Risk Factor: High

Base Score: 9

Temporal Score: 6.7

Vector: CVSS2#AV:N/AC:L/Au:S/C:C/I:C/A:C

CVSS Score Source: CVE-2026-64437

CVSS v3

Risk Factor: High

Base Score: 8.8

Temporal Score: 7.7

Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 7/26/2026

Vulnerability Publication Date: 7/23/2026

Reference Information

CVE: CVE-2026-64437