Detections
Analytics

Echo: linux: security update to 6.1.170-1

critical Tenable Self-Hosted Container Security Plugin ID 459428

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - In the Linux kernel, the following vulnerability has been resolved: net: stmmac: fix integer underflow in
 chain mode The jumbo_frm() chain-mode implementation unconditionally computes len = nopaged_len - bmax;
 where nopaged_len = skb_headlen(skb) (linear bytes only) and bmax is BUF_SIZE_8KiB or BUF_SIZE_2KiB.
 However, the caller stmmac_xmit() decides to invoke jumbo_frm() based on skb->len (total length including
 page fragments): is_jumbo = stmmac_is_jumbo_frm(priv, skb->len, enh_desc); When a packet has a small
 linear portion (nopaged_len <= bmax) but a large total length due to page fragments (skb->len > bmax), the
 subtraction wraps as an unsigned integer, producing a huge len value (~0xFFFFxxxx). This causes the while
 (len != 0) loop to execute hundreds of thousands of iterations, passing skb->data + bmax * i pointers far
 beyond the skb buffer to dma_map_single(). On IOMMU-less SoCs (the typical deployment for stmmac), this
 maps arbitrary kernel memory to the DMA engine, constituting a kernel memory disclosure and potential
 memory corruption from hardware. Fix this by introducing a buf_len local variable clamped to
 min(nopaged_len, bmax). Computing len = nopaged_len - buf_len is then always safe: it is zero when the
 linear portion fits within a single descriptor, causing the while (len != 0) loop to be skipped naturally,
 and the fragment loop in stmmac_xmit() handles page fragments afterward. (CVE-2026-31649)

Solution

Update the linux library and its related packages to version 6.1.170-1 or later.

See Also

https://advisory.echohq.com/cve/CVE-2026-31649

Plugin Details

Severity: Critical

ID: 459428

Version: Revision 1.1

Type: Local

Published: 10/2/2026

Updated: 10/2/2026

Risk Information

VPR

Risk Factor: Medium

Score: 4.9

Percentile: 57.92

CVSS v2

Risk Factor: Critical

Base Score: 10

Temporal Score: 7.4

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS Score Source: CVE-2026-31649

CVSS v3

Risk Factor: Critical

Base Score: 9.8

Temporal Score: 8.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 5/1/2026

Vulnerability Publication Date: 4/23/2026

Reference Information

CVE: CVE-2026-31649