Detections
Analytics

Echo: linux: security update to 6.12.32-1

medium Tenable Self-Hosted Container Security Plugin ID 459500

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - In the Linux kernel, the following vulnerability has been resolved: btrfs: avoid NULL pointer dereference
 if no valid csum tree [BUG] When trying read-only scrub on a btrfs with rescue=idatacsums mount option, it
 will crash with the following call trace: BUG: kernel NULL pointer dereference, address: 0000000000000208
 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page CPU: 1 UID: 0 PID:
 835 Comm: btrfs Tainted: G O 6.15.0-rc3-custom+ #236 PREEMPT(full) Hardware name: QEMU Standard PC (Q35 +
 ICH9, 2009), BIOS unknown 02/02/2022 RIP: 0010:btrfs_lookup_csums_bitmap+0x49/0x480 [btrfs] Call Trace:
 <TASK> scrub_find_fill_first_stripe+0x35b/0x3d0 [btrfs] scrub_simple_mirror+0x175/0x290 [btrfs]
 scrub_stripe+0x5f7/0x6f0 [btrfs] scrub_chunk+0x9a/0x150 [btrfs] scrub_enumerate_chunks+0x333/0x660 [btrfs]
 btrfs_scrub_dev+0x23e/0x600 [btrfs] btrfs_ioctl+0x1dcf/0x2f80 [btrfs] __x64_sys_ioctl+0x97/0xc0
 do_syscall_64+0x4f/0x120 entry_SYSCALL_64_after_hwframe+0x76/0x7e [CAUSE] Mount option "rescue=idatacsums"
 will completely skip loading the csum tree, so that any data read will not find any data csum thus we will
 ignore data checksum verification. Normally call sites utilizing csum tree will check the fs state flag
 NO_DATA_CSUMS bit, but unfortunately scrub does not check that bit at all. This results in scrub to call
 btrfs_search_slot() on a NULL pointer and triggered above crash. [FIX] Check both extent and csum tree
 root before doing any tree search. (CVE-2025-38059)

Solution

Update the linux library and its related packages to version 6.12.32-1 or later.

See Also

https://advisory.echohq.com/cve/CVE-2025-38059

Plugin Details

Severity: Medium

ID: 459500

Version: Revision 1.1

Type: Local

Published: 10/2/2026

Updated: 10/2/2026

Risk Information

VPR

Risk Factor: Low

Score: 3

Percentile: 23.18

CVSS v2

Risk Factor: Medium

Base Score: 4.6

Temporal Score: 3.4

Vector: CVSS2#AV:L/AC:L/Au:S/C:N/I:N/A:C

CVSS Score Source: CVE-2025-38059

CVSS v3

Risk Factor: Medium

Base Score: 5.5

Temporal Score: 4.8

Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 9/15/2025

Vulnerability Publication Date: 6/18/2025

Reference Information

CVE: CVE-2025-38059