Detections
Analytics

Echo: linux: security update to 6.1.180-1

high Tenable Self-Hosted Container Security Plugin ID 459482

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - In the Linux kernel, the following vulnerability has been resolved: staging: vme_user: bound slave
 read/write to the kern_buf size The SLAVE-path helpers buffer_to_user() and buffer_from_user() copy
 'count' bytes into/out of the fixed-size kern_buf (size_buf == PCI_BUF_SIZE == 0x20000, 128 KiB) using
 *ppos as the offset, without bounding *ppos + count against size_buf. vme_user_write()/vme_user_read()
 only clamp count to the VME window size (image_size = vme_get_size(resource)), which VME_SET_SLAVE sets
 from the user-supplied slave.size -- validated against the VME address space (up to VME_A32_MAX = 4 GiB),
 not against PCI_BUF_SIZE. When the window exceeds 128 KiB, a write()/read() copies past the kern_buf
 allocation. Clamp count against size_buf in both helpers, with an early return when *ppos is already
 at/after the buffer end. *ppos is >= 0 here (the caller rejects negative offsets), so size_buf - *ppos
 cannot wrap. This mirrors the existing clamp in the MASTER-path helpers resource_to_user() /
 resource_from_user(), and matches the read()/write() convention of a short transfer at end-of-buffer.
 Found by static analysis (CodeQL taint tracking + CBMC bounded model checking) and confirmed dynamically
 under KASAN with the vme_fake bridge: BUG: KASAN: slab-out-of-bounds in _copy_from_user+0x2d/0x80 Write of
 size 262144 at addr ffff888004100000 by task trigger/68 _copy_from_user+0x2d/0x80
 vme_user_write+0x13e/0x240 [vme_user] vfs_write+0x1b8/0x7a0 ksys_write+0xb8/0x150 (CVE-2026-64449)

Solution

Update the linux library and its related packages to version 6.1.180-1 or later.

See Also

https://advisory.echohq.com/cve/CVE-2026-64449

Plugin Details

Severity: High

ID: 459482

Version: Revision 1.1

Type: Local

Published: 10/2/2026

Updated: 10/2/2026

Risk Information

VPR

Risk Factor: Medium

Score: 4.9

Percentile: 58.14

CVSS v2

Risk Factor: Medium

Base Score: 6.8

Temporal Score: 5

Vector: CVSS2#AV:L/AC:L/Au:S/C:C/I:C/A:C

CVSS Score Source: CVE-2026-64449

CVSS v3

Risk Factor: High

Base Score: 7.8

Temporal Score: 6.8

Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 7/26/2026

Vulnerability Publication Date: 7/23/2026

Reference Information

CVE: CVE-2026-64449