Detections
Analytics

Echo: linux: security update to 6.1.187-1

high Tenable Self-Hosted Container Security Plugin ID 459288

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - In the Linux kernel, the following vulnerability has been resolved: ibmvnic: Use kernel helpers for hex
 dumps Previously, when the driver was printing hex dumps, the buffer was cast to an 8 byte long and
 printed using string formatters. If the buffer size was not a multiple of 8 then a read buffer overflow
 was possible. Therefore, create a new ibmvnic function that loops over a buffer and calls
 hex_dump_to_buffer instead. This patch address KASAN reports like the one below: ibmvnic 30000003 env3:
 Login Buffer: ibmvnic 30000003 env3: 01000000af000000 <...> ibmvnic 30000003 env3: 2e6d62692e736261
 ibmvnic 30000003 env3: 65050003006d6f63 ==================================================================
 BUG: KASAN: slab-out-of-bounds in ibmvnic_login+0xacc/0xffc [ibmvnic] Read of size 8 at addr
 c0000001331a9aa8 by task ip/17681 <...> Allocated by task 17681: <...> ibmvnic_login+0x2f0/0xffc [ibmvnic]
 ibmvnic_open+0x148/0x308 [ibmvnic] __dev_open+0x1ac/0x304 <...> The buggy address is located 168 bytes
 inside of allocated 175-byte region [c0000001331a9a00, c0000001331a9aaf) <...>
 ================================================================= ibmvnic 30000003 env3: 000000000033766e
 (CVE-2025-22104)

Solution

Update the linux library and its related packages to version 6.1.187-1 or later.

See Also

https://advisory.echohq.com/cve/CVE-2025-22104

Plugin Details

Severity: High

ID: 459288

Version: Revision 1.1

Type: Local

Published: 10/2/2026

Updated: 10/2/2026

Risk Information

VPR

Risk Factor: Medium

Score: 4.3

Percentile: 53.04

CVSS v2

Risk Factor: Medium

Base Score: 6.2

Temporal Score: 4.6

Vector: CVSS2#AV:L/AC:L/Au:S/C:C/I:N/A:C

CVSS Score Source: CVE-2025-22104

CVSS v3

Risk Factor: High

Base Score: 7.1

Temporal Score: 6.2

Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 9/15/2025

Vulnerability Publication Date: 4/16/2025

Reference Information

CVE: CVE-2025-22104