Detections
Analytics

Echo: linux: security update to 6.1.176-1

high Tenable Self-Hosted Container Security Plugin ID 462009

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - In the Linux kernel, the following vulnerability has been resolved: ALSA: 6fire: fix use-after-free on
 disconnect In usb6fire_chip_abort(), the chip struct is allocated as the card's private data (via
 snd_card_new with sizeof(struct sfire_chip)). When snd_card_free_when_closed() is called and no file
 handles are open, the card and embedded chip are freed synchronously. The subsequent chip->card = NULL
 write then hits freed slab memory. Call trace: usb6fire_chip_abort sound/usb/6fire/chip.c:59 [inline]
 usb6fire_chip_disconnect+0x348/0x358 sound/usb/6fire/chip.c:182 usb_unbind_interface+0x1a8/0x88c
 drivers/usb/core/driver.c:458 ... hub_event+0x1a04/0x4518 drivers/usb/core/hub.c:5953 Fix by moving the
 card lifecycle out of usb6fire_chip_abort() and into usb6fire_chip_disconnect(). The card pointer is saved
 in a local before any teardown, snd_card_disconnect() is called first to prevent new opens, URBs are
 aborted while chip is still valid, and snd_card_free_when_closed() is called last so chip is never
 accessed after the card may be freed. (CVE-2026-31581)

Solution

Update the linux library and its related packages to version 6.1.176-1 or later.

See Also

https://advisory.echohq.com/cve/CVE-2026-31581

Plugin Details

Severity: High

ID: 462009

Version: Revision 1.1

Type: Local

Published: 10/2/2026

Updated: 10/2/2026

Risk Information

VPR

Risk Factor: Medium

Score: 4.9

Percentile: 58.14

CVSS v2

Risk Factor: Medium

Base Score: 6.8

Temporal Score: 5

Vector: CVSS2#AV:L/AC:L/Au:S/C:C/I:C/A:C

CVSS Score Source: CVE-2026-31581

CVSS v3

Risk Factor: High

Base Score: 7.8

Temporal Score: 6.8

Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 5/1/2026

Vulnerability Publication Date: 4/24/2026

Reference Information

CVE: CVE-2026-31581