Detections
Analytics

Echo: linux: security update to 6.1.153-1

high Tenable Self-Hosted Container Security Plugin ID 459415

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - In the Linux kernel, the following vulnerability has been resolved: fbdev: Fix vmalloc out-of-bounds write
 in fast_imageblit This issue triggers when a userspace program does an ioctl FBIOPUT_CON2FBMAP by passing
 console number and frame buffer number. Ideally this maps console to frame buffer and updates the screen
 if console is visible. As part of mapping it has to do resize of console according to frame buffer info.
 if this resize fails and returns from vc_do_resize() and continues further. At this point console and new
 frame buffer are mapped and sets display vars. Despite failure still it continue to proceed updating the
 screen at later stages where vc_data is related to previous frame buffer and frame buffer info and display
 vars are mapped to new frame buffer and eventully leading to out-of-bounds write in fast_imageblit(). This
 bheviour is excepted only when fg_console is equal to requested console which is a visible console and
 updates screen with invalid struct references in fbcon_putcs(). (CVE-2025-38685)

Solution

Update the linux library and its related packages to version 6.1.153-1 or later.

See Also

https://advisory.echohq.com/cve/CVE-2025-38685

Plugin Details

Severity: High

ID: 459415

Version: Revision 1.1

Type: Local

Published: 10/2/2026

Updated: 10/2/2026

Risk Information

VPR

Risk Factor: Medium

Score: 4.9

Percentile: 57.16

CVSS v2

Risk Factor: Medium

Base Score: 6.8

Temporal Score: 5

Vector: CVSS2#AV:L/AC:L/Au:S/C:C/I:C/A:C

CVSS Score Source: CVE-2025-38685

CVSS v3

Risk Factor: High

Base Score: 7.8

Temporal Score: 6.8

Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 9/15/2025

Vulnerability Publication Date: 9/4/2025

Reference Information

CVE: CVE-2025-38685