Detections
Analytics

Echo: linux: security update to 6.1.176-1

high Tenable Self-Hosted Container Security Plugin ID 460527

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - In the Linux kernel, the following vulnerability has been resolved: f2fs: fix UAF caused by decrementing
 sbi->nr_pages[] in f2fs_write_end_io() The xfstests case "generic/107" and syzbot have both reported a
 NULL pointer dereference. The concurrent scenario that triggers the panic is as follows: F2FS_WB_CP_DATA
 write callback umount - f2fs_write_checkpoint - f2fs_wait_on_all_pages(sbi, F2FS_WB_CP_DATA) -
 blk_mq_end_request - bio_endio - f2fs_write_end_io : dec_page_count(sbi, F2FS_WB_CP_DATA) :
 wake_up(&sbi->cp_wait) - kill_f2fs_super - kill_block_super - f2fs_put_super : iput(sbi->node_inode) :
 sbi->node_inode = NULL : f2fs_in_warm_node_list - is_node_folio // sbi->node_inode is NULL and panic The
 root cause is that f2fs_put_super() calls iput(sbi->node_inode) and sets sbi->node_inode to NULL after
 sbi->nr_pages[F2FS_WB_CP_DATA] is decremented to zero. As a result, f2fs_in_warm_node_list() may
 dereference a NULL node_inode when checking whether a folio belongs to the node inode, leading to a panic.
 This patch fixes the issue by calling f2fs_in_warm_node_list() before decrementing
 sbi->nr_pages[F2FS_WB_CP_DATA], thus preventing the use-after-free condition. (CVE-2026-31715)

Solution

Update the linux library and its related packages to version 6.1.176-1 or later.

See Also

https://advisory.echohq.com/cve/CVE-2026-31715

Plugin Details

Severity: High

ID: 460527

Version: Revision 1.1

Type: Local

Published: 10/2/2026

Updated: 10/2/2026

Risk Information

VPR

Risk Factor: Medium

Score: 4.9

Percentile: 57.83

CVSS v2

Risk Factor: Medium

Base Score: 6.8

Temporal Score: 5

Vector: CVSS2#AV:L/AC:L/Au:S/C:C/I:C/A:C

CVSS Score Source: CVE-2026-31715

CVSS v3

Risk Factor: High

Base Score: 7.8

Temporal Score: 6.8

Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 5/8/2026

Vulnerability Publication Date: 5/1/2026

Reference Information

CVE: CVE-2026-31715