Detections
Analytics

Echo: linux: security update to 6.1.170-1

high Tenable Self-Hosted Container Security Plugin ID 458892

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - In the Linux kernel, the following vulnerability has been resolved: Bluetooth: SMP: derive legacy
 responder STK authentication from MITM state The legacy responder path in smp_random() currently labels
 the stored STK as authenticated whenever pending_sec_level is BT_SECURITY_HIGH. That reflects what the
 local service requested, not what the pairing flow actually achieved. For Just Works/Confirm legacy
 pairing, SMP_FLAG_MITM_AUTH stays clear and the resulting STK should remain unauthenticated even if the
 local side requested HIGH security. Use the established MITM state when storing the responder STK so the
 key metadata matches the pairing result. This also keeps the legacy path aligned with the Secure
 Connections code, which already treats JUST_WORKS/JUST_CFM as unauthenticated. (CVE-2026-31773)

Solution

Update the linux library and its related packages to version 6.1.170-1 or later.

See Also

https://advisory.echohq.com/cve/CVE-2026-31773

Plugin Details

Severity: High

ID: 458892

Version: Revision 1.1

Type: Local

Published: 10/2/2026

Updated: 10/2/2026

Risk Information

VPR

Risk Factor: Medium

Score: 4.9

Percentile: 58.14

CVSS v2

Risk Factor: High

Base Score: 8.3

Temporal Score: 6.1

Vector: CVSS2#AV:A/AC:L/Au:N/C:C/I:C/A:C

CVSS Score Source: CVE-2026-31773

CVSS v3

Risk Factor: High

Base Score: 8.8

Temporal Score: 7.7

Vector: CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 5/2/2026

Vulnerability Publication Date: 4/23/2026

Reference Information

CVE: CVE-2026-31773