Detections
Analytics

Echo: linux: security update to 6.1.140-1

medium Tenable Self-Hosted Container Security Plugin ID 458976

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - In the Linux kernel, the following vulnerability has been resolved: bnxt_en: Fix out-of-bound memcpy()
 during ethtool -w When retrieving the FW coredump using ethtool, it can sometimes cause memory corruption:
 BUG: KFENCE: memory corruption in __bnxt_get_coredump+0x3ef/0x670 [bnxt_en] Corrupted memory at
 0x000000008f0f30e8 [ ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ] (in kfence-#45): __bnxt_get_coredump+0x3ef/0x670
 [bnxt_en] ethtool_get_dump_data+0xdc/0x1a0 __dev_ethtool+0xa1e/0x1af0 dev_ethtool+0xa8/0x170
 dev_ioctl+0x1b5/0x580 sock_do_ioctl+0xab/0xf0 sock_ioctl+0x1ce/0x2e0 __x64_sys_ioctl+0x87/0xc0
 do_syscall_64+0x5c/0xf0 entry_SYSCALL_64_after_hwframe+0x78/0x80 ... This happens when copying the
 coredump segment list in bnxt_hwrm_dbg_dma_data() with the HWRM_DBG_COREDUMP_LIST FW command. The
 info->dest_buf buffer is allocated based on the number of coredump segments returned by the FW. The
 segment list is then DMA'ed by the FW and the length of the DMA is returned by FW. The driver then copies
 this DMA'ed segment list to info->dest_buf. In some cases, this DMA length may exceed the info->dest_buf
 length and cause the above BUG condition. Fix it by capping the copy length to not exceed the length of
 info->dest_buf. The extra DMA data contains no useful information. This code path is shared for the
 HWRM_DBG_COREDUMP_LIST and the HWRM_DBG_COREDUMP_RETRIEVE FW commands. The buffering is different for
 these 2 FW commands. To simplify the logic, we need to move the line to adjust the buffer length for
 HWRM_DBG_COREDUMP_RETRIEVE up, so that the new check to cap the copy length will work for both commands.
 (CVE-2025-37911)

Solution

Update the linux library and its related packages to version 6.1.140-1 or later.

See Also

https://advisory.echohq.com/cve/CVE-2025-37911

Plugin Details

Severity: Medium

ID: 458976

Version: Revision 1.1

Type: Local

Published: 10/2/2026

Updated: 10/2/2026

Risk Information

VPR

Risk Factor: Low

Score: 3

Percentile: 23.27

CVSS v2

Risk Factor: Medium

Base Score: 4.6

Temporal Score: 3.4

Vector: CVSS2#AV:L/AC:L/Au:S/C:N/I:N/A:C

CVSS Score Source: CVE-2025-37911

CVSS v3

Risk Factor: Medium

Base Score: 5.5

Temporal Score: 4.8

Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 9/15/2025

Vulnerability Publication Date: 5/13/2025

Reference Information

CVE: CVE-2025-37911