Echo: linux: security update to 6.12.3-1

medium Tenable Self-Hosted Container Security Plugin ID 460634

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

- In the Linux kernel, the following vulnerability has been resolved: virtiofs: use pages instead of pointer
for kernel direct IO When trying to insert a 10MB kernel module kept in a virtio-fs with cache disabled,
the following warning was reported: ------------[ cut here ]------------ WARNING: CPU: 1 PID: 404 at
mm/page_alloc.c:4551 ...... Modules linked in: CPU: 1 PID: 404 Comm: insmod Not tainted 6.9.0-rc5+ #123
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996) ...... RIP: 0010:__alloc_pages+0x2bf/0x380 ......
Call Trace: <TASK> ? __warn+0x8e/0x150 ? __alloc_pages+0x2bf/0x380 __kmalloc_large_node+0x86/0x160
__kmalloc+0x33c/0x480 virtio_fs_enqueue_req+0x240/0x6d0 virtio_fs_wake_pending_and_unlock+0x7f/0x190
queue_request_and_unlock+0x55/0x60 fuse_simple_request+0x152/0x2b0 fuse_direct_io+0x5d2/0x8c0
fuse_file_read_iter+0x121/0x160 __kernel_read+0x151/0x2d0 kernel_read+0x45/0x50
kernel_read_file+0x1a9/0x2a0 init_module_from_file+0x6a/0xe0 idempotent_init_module+0x175/0x230
__x64_sys_finit_module+0x5d/0xb0 x64_sys_call+0x1c3/0x9e0 do_syscall_64+0x3d/0xc0
entry_SYSCALL_64_after_hwframe+0x4b/0x53 ...... </TASK> ---[ end trace 0000000000000000 ]--- The warning
is triggered as follows: 1) syscall finit_module() handles the module insertion and it invokes
kernel_read_file() to read the content of the module first. 2) kernel_read_file() allocates a 10MB buffer
by using vmalloc() and passes it to kernel_read(). kernel_read() constructs a kvec iter by using
iov_iter_kvec() and passes it to fuse_file_read_iter(). 3) virtio-fs disables the cache, so
fuse_file_read_iter() invokes fuse_direct_io(). As for now, the maximal read size for kvec iter is only
limited by fc->max_read. For virtio-fs, max_read is UINT_MAX, so fuse_direct_io() doesn't split the 10MB
buffer. It saves the address and the size of the 10MB-sized buffer in out_args[0] of a fuse request and
passes the fuse request to virtio_fs_wake_pending_and_unlock(). 4) virtio_fs_wake_pending_and_unlock()
uses virtio_fs_enqueue_req() to queue the request. Because virtiofs need DMA-able address, so
virtio_fs_enqueue_req() uses kmalloc() to allocate a bounce buffer for all fuse args, copies these args
into the bounce buffer and passed the physical address of the bounce buffer to virtiofsd. The total length
of these fuse args for the passed fuse request is about 10MB, so copy_args_to_argbuf() invokes kmalloc()
with a 10MB size parameter and it triggers the warning in __alloc_pages(): if (WARN_ON_ONCE_GFP(order >
MAX_PAGE_ORDER, gfp)) return NULL; 5) virtio_fs_enqueue_req() will retry the memory allocation in a
kworker, but it won't help, because kmalloc() will always return NULL due to the abnormal size and
finit_module() will hang forever. A feasible solution is to limit the value of max_read for virtio-fs, so
the length passed to kmalloc() will be limited. However it will affect the maximal read size for normal
read. And for virtio-fs write initiated from kernel, it has the similar problem but now there is no way to
limit fc->max_write in kernel. So instead of limiting both the values of max_read and max_write in kernel,
introducing use_pages_for_kvec_io in fuse_conn and setting it as true in virtiofs. When
use_pages_for_kvec_io is enabled, fuse will use pages instead of pointer to pass the KVEC_IO data. After
switching to pages for KVEC_IO data, these pages will be used for DMA through virtio-fs. If these pages
are backed by vmalloc(), {flush|invalidate}_kernel_vmap_range() are necessary to flush or invalidate the
cache before the DMA operation. So add two new fields in fuse_args_pages to record the base address of
vmalloc area and the condition indicating whether invalidation is needed. Perform the flush in
fuse_get_user_pages() for write operations and the invalidation in fuse_release_user_pages() for read
operations. It may seem necessary to introduce another fie ---truncated--- (CVE-2024-53219)

Solution

Update the linux library and its related packages to version 6.12.3-1 or later.

Plugin Details

Severity: Medium

ID: 460634

Version: Revision 1.1

Type: Local

Family: Echo Local Security Checks

Published: 10/2/2026

Updated: 10/2/2026

Risk Information

VPR

Risk Factor: Low

Score: 3

Percentile: 23.19

CVSS v2

Risk Factor: Medium

Base Score: 4.6

Temporal Score: 3.4

Vector: CVSS2#AV:L/AC:L/Au:S/C:N/I:N/A:C

CVSS Score Source: CVE-2024-53219

CVSS v3

Risk Factor: Medium

Base Score: 5.5

Temporal Score: 4.8

Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 9/15/2025

Vulnerability Publication Date: 12/27/2024

Reference Information

CVE: CVE-2024-53219

Detections

Analytics