Echo: linux: security update to 6.12.85-1

high Tenable Self-Hosted Container Security Plugin ID 459853

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

- In the Linux kernel, the following vulnerability has been resolved: net: usb: cdc_ncm: add ndpoffset to
NDP16 nframes bounds check cdc_ncm_rx_verify_ndp16() validates that the NDP header and its DPE entries fit
within the skb. The first check correctly accounts for ndpoffset: if ((ndpoffset + sizeof(struct
usb_cdc_ncm_ndp16)) > skb_in->len) but the second check omits it: if ((sizeof(struct usb_cdc_ncm_ndp16) +
ret * (sizeof(struct usb_cdc_ncm_dpe16))) > skb_in->len) This validates the DPE array size against the
total skb length as if the NDP were at offset 0, rather than at ndpoffset. When the NDP is placed near the
end of the NTB (large wNdpIndex), the DPE entries can extend past the skb data buffer even though the
check passes. cdc_ncm_rx_fixup() then reads out-of-bounds memory when iterating the DPE array. Add
ndpoffset to the nframes bounds check and use struct_size_t() to express the NDP-plus-DPE-array size more
clearly. (CVE-2026-23448)

Solution

Update the linux library and its related packages to version 6.12.85-1 or later.

Plugin Details

Severity: High

ID: 459853

Version: Revision 1.1

Type: Local

Family: Echo Local Security Checks

Published: 10/2/2026

Updated: 10/2/2026

Risk Information

VPR

Risk Factor: High

Score: 7.6

Percentile: 98.37

CVSS v2

Risk Factor: Medium

Base Score: 6.8

Temporal Score: 5

Vector: CVSS2#AV:L/AC:L/Au:S/C:C/I:C/A:C

CVSS Score Source: CVE-2026-23448

CVSS v3

Risk Factor: High

Base Score: 7.8

Temporal Score: 6.8

Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 5/1/2026

Vulnerability Publication Date: 4/3/2026

Reference Information

CVE: CVE-2026-23448

Detections

Analytics