Detections
Analytics

Echo: linux: security update to 6.1.176-1

high Tenable Self-Hosted Container Security Plugin ID 458409

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - In the Linux kernel, the following vulnerability has been resolved: sctp: fix OOB write to userspace in
 sctp_getsockopt_peer_auth_chunks sctp_getsockopt_peer_auth_chunks() checks that the caller's optval buffer
 is large enough for the peer AUTH chunk list with if (len < num_chunks) return -EINVAL; but then writes
 num_chunks bytes to p->gauth_chunks, which lives at offset offsetof(struct sctp_authchunks, gauth_chunks)
 == 8 inside optval. The check is missing the sizeof(struct sctp_authchunks) = 8-byte header. When the
 caller supplies len == num_chunks (for any num_chunks > 0) the test passes but copy_to_user() writes
 sizeof(struct sctp_authchunks) = 8 bytes past the declared buffer. The sibling function
 sctp_getsockopt_local_auth_chunks() at the next line already has the correct check: if (len <
 sizeof(struct sctp_authchunks) + num_chunks) return -EINVAL; Align the peer variant with its sibling.
 Reproducer confirms on v7.0-13-generic: an unprivileged userspace caller that opens a loopback SCTP
 association with AUTH enabled, queries num_chunks with a short optval, then issues the real getsockopt
 with len == num_chunks and sentinel bytes painted past the buffer observes those sentinel bytes
 overwritten with the peer's AUTH chunk type. The bytes written are under the peer's control but land in
 the caller's own userspace; this is not a kernel memory corruption, but it is a kernel-side contract
 violation that can silently corrupt adjacent userspace data. (CVE-2026-53004)

Solution

Update the linux library and its related packages to version 6.1.176-1 or later.

See Also

https://advisory.echohq.com/cve/CVE-2026-53004

Plugin Details

Severity: High

ID: 458409

Version: Revision 1.1

Type: Local

Published: 10/2/2026

Updated: 10/2/2026

Risk Information

VPR

Risk Factor: Medium

Score: 4.9

Percentile: 58.14

CVSS v2

Risk Factor: Medium

Base Score: 6.8

Temporal Score: 5

Vector: CVSS2#AV:L/AC:L/Au:S/C:C/I:C/A:C

CVSS Score Source: CVE-2026-53004

CVSS v3

Risk Factor: High

Base Score: 7.8

Temporal Score: 6.8

Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 6/25/2026

Vulnerability Publication Date: 6/3/2026

Reference Information

CVE: CVE-2026-53004