Detections
Analytics

Echo: linux: security update to 6.1.135-1

medium Tenable Self-Hosted Container Security Plugin ID 461512

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - In the Linux kernel, the following vulnerability has been resolved: PCI: vmd: Make vmd_dev::cfg_lock a
 raw_spinlock_t type The access to the PCI config space via pci_ops::read and pci_ops::write is a low-level
 hardware access. The functions can be accessed with disabled interrupts even on PREEMPT_RT. The pci_lock
 is a raw_spinlock_t for this purpose. A spinlock_t becomes a sleeping lock on PREEMPT_RT, so it cannot be
 acquired with disabled interrupts. The vmd_dev::cfg_lock is accessed in the same context as the pci_lock.
 Make vmd_dev::cfg_lock a raw_spinlock_t type so it can be used with interrupts disabled. This was reported
 as: BUG: sleeping function called from invalid context at kernel/locking/spinlock_rt.c:48 Call Trace:
 rt_spin_lock+0x4e/0x130 vmd_pci_read+0x8d/0x100 [vmd] pci_user_read_config_byte+0x6f/0xe0
 pci_read_config+0xfe/0x290 sysfs_kf_bin_read+0x68/0x90 [bigeasy: reword commit message] Tested-off-by:
 Luis Claudio R. Goncalves <[email protected]> [kwilczynski: commit log] [bhelgaas: add back report info
 from https://lore.kernel.org/lkml/[email protected]/] (CVE-2025-23161)

Solution

Update the linux library and its related packages to version 6.1.135-1 or later.

See Also

https://advisory.echohq.com/cve/CVE-2025-23161

Plugin Details

Severity: Medium

ID: 461512

Version: Revision 1.1

Type: Local

Published: 10/2/2026

Updated: 10/2/2026

Risk Information

VPR

Risk Factor: Low

Score: 3

Percentile: 23.18

CVSS v2

Risk Factor: Medium

Base Score: 4.6

Temporal Score: 3.4

Vector: CVSS2#AV:L/AC:L/Au:S/C:N/I:N/A:C

CVSS Score Source: CVE-2025-23161

CVSS v3

Risk Factor: Medium

Base Score: 5.5

Temporal Score: 4.8

Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 9/15/2025

Vulnerability Publication Date: 5/1/2025

Reference Information

CVE: CVE-2025-23161