Detections
Analytics

Echo: linux: security update to 6.1.170-1

high Tenable Self-Hosted Container Security Plugin ID 460158

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - In the Linux kernel, the following vulnerability has been resolved: wifi: wlcore: Return -ENOMEM instead
 of -EAGAIN if there is not enough headroom Since upstream commit e75665dd0968 ("wifi: wlcore: ensure skb
 headroom before skb_push"), wl1271_tx_allocate() and with it wl1271_prepare_tx_frame() returns -EAGAIN if
 pskb_expand_head() fails. However, in wlcore_tx_work_locked(), a return value of -EAGAIN from
 wl1271_prepare_tx_frame() is interpreted as the aggregation buffer being full. This causes the code to
 flush the buffer, put the skb back at the head of the queue, and immediately retry the same skb in a tight
 while loop. Because wlcore_tx_work_locked() holds wl->mutex, and the retry happens immediately with
 GFP_ATOMIC, this will result in an infinite loop and a CPU soft lockup. Return -ENOMEM instead so the
 packet is dropped and the loop terminates. The problem was found by an experimental code review agent
 based on gemini-3.1-pro while reviewing backports into v6.18.y. (CVE-2026-31552)

Solution

Update the linux library and its related packages to version 6.1.170-1 or later.

See Also

https://advisory.echohq.com/cve/CVE-2026-31552

Plugin Details

Severity: High

ID: 460158

Version: Revision 1.1

Type: Local

Published: 10/2/2026

Updated: 10/2/2026

Risk Information

VPR

Risk Factor: Low

Score: 3

Percentile: 23.75

CVSS v2

Risk Factor: High

Base Score: 7.8

Temporal Score: 5.8

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C

CVSS Score Source: CVE-2026-31552

CVSS v3

Risk Factor: High

Base Score: 7.5

Temporal Score: 6.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 5/1/2026

Vulnerability Publication Date: 4/24/2026

Reference Information

CVE: CVE-2026-31552