Detections
Analytics

Echo: linux: security update to 6.1.176-1

medium Tenable Self-Hosted Container Security Plugin ID 457604

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - In the Linux kernel, the following vulnerability has been resolved: USB: serial: kl5kusb105: fix bulk-out
 buffer overflow klsi_105_prepare_write_buffer() is called by the generic write path with the bulk-out
 buffer and its size (bulk_out_size, 64 bytes). It stores a two-byte length header at the start of the
 buffer and copies the payload from the write fifo starting at buf + KLSI_HDR_LEN, but passes the full
 buffer size as the number of bytes to copy: count = kfifo_out_locked(&port->write_fifo, buf +
 KLSI_HDR_LEN, size, &port->lock); When the fifo holds at least size bytes, size bytes are copied starting
 two bytes into the size-byte buffer, writing KLSI_HDR_LEN bytes past its end. Copy at most size -
 KLSI_HDR_LEN bytes instead, leaving room for the header as safe_serial already does. Writing bulk_out_size
 or more bytes to the tty triggers a slab out-of-bounds write, observed with KASAN by emulating the device
 with dummy_hcd and raw-gadget: BUG: KASAN: slab-out-of-bounds in kfifo_copy_out+0x83/0xc0 Write of size 64
 at addr ffff888112c62202 by task python3 kfifo_copy_out klsi_105_prepare_write_buffer [kl5kusb105]
 usb_serial_generic_write_start [usbserial] Allocated by task 139: usb_serial_probe [usbserial] The buggy
 address is located 2 bytes inside of allocated 64-byte region The out-of-bounds write no longer occurs
 with this change applied. (CVE-2026-53194)

Solution

Update the linux library and its related packages to version 6.1.176-1 or later.

See Also

https://advisory.echohq.com/cve/CVE-2026-53194

Plugin Details

Severity: Medium

ID: 457604

Version: Revision 1.1

Type: Local

Published: 10/2/2026

Updated: 10/2/2026

Risk Information

VPR

Risk Factor: Low

Score: 3.5

Percentile: 51.99

CVSS v2

Risk Factor: Medium

Base Score: 6.8

Temporal Score: 5

Vector: CVSS2#AV:L/AC:L/Au:S/C:C/I:C/A:C

CVSS Score Source: CVE-2026-53194

CVSS v3

Risk Factor: Medium

Base Score: 5.3

Temporal Score: 4.6

Vector: CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 6/25/2026

Vulnerability Publication Date: 6/25/2026

Reference Information

CVE: CVE-2026-53194