Detections
Analytics

Echo: linux: security update to 6.1.180-1

medium Tenable Self-Hosted Container Security Plugin ID 457935

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - In the Linux kernel, the following vulnerability has been resolved: ALSA: caiaq: fix out-of-bounds read in
 the Traktor Kontrol S4 input parser snd_usb_caiaq_tks4_dispatch() decodes the Traktor Kontrol S4 input
 stream in fixed 16-byte (TKS4_MSGBLOCK_SIZE) message blocks. On every iteration it advances buf and
 subtracts the block size while looping on "while (len)". len is urb->actual_length. That value is supplied
 by the device and is not guaranteed to be a multiple of 16. When a final short block leaves len between 1
 and 15, the loop runs once more, reads up to buf[15], and then does "len -= TKS4_MSGBLOCK_SIZE". As len is
 unsigned this underflows to a huge value. The loop then keeps iterating and walking buf far past the end
 of the 512-byte ep4_in_buf, reading out of bounds until a bogus block id happens to be hit. Iterate only
 while a full message block is available. This stops the unsigned underflow and silently drops any trailing
 partial block, which carries no complete control value anyway. The sibling endpoint-4 parsers are not
 affected. The Traktor Kontrol X1 and Maschine arms in snd_usb_caiaq_ep4_reply_dispatch() floor
 urb->actual_length before dispatching. (CVE-2026-64487)

Solution

Update the linux library and its related packages to version 6.1.180-1 or later.

See Also

https://advisory.echohq.com/cve/CVE-2026-64487

Plugin Details

Severity: Medium

ID: 457935

Version: Revision 1.1

Type: Local

Published: 10/2/2026

Updated: 10/2/2026

Risk Information

VPR

Risk Factor: Low

Score: 3

Percentile: 23.58

CVSS v2

Risk Factor: Medium

Base Score: 4.6

Temporal Score: 3.4

Vector: CVSS2#AV:L/AC:L/Au:S/C:N/I:N/A:C

CVSS Score Source: CVE-2026-64487

CVSS v3

Risk Factor: Medium

Base Score: 5.5

Temporal Score: 4.8

Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 7/26/2026

Vulnerability Publication Date: 7/23/2026

Reference Information

CVE: CVE-2026-64487