Detections
Analytics

Echo: linux: security update to 6.1.180-1

medium Tenable Self-Hosted Container Security Plugin ID 462214

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - In the Linux kernel, the following vulnerability has been resolved: mm/damon/ops-common: handle extreme
 intervals in damon_hot_score() Fix three issues in damon_hot_score() that comes from wrong handling of
 extreme (zero or too high) monitoring intervals user setup. When the user sets sampling interval zero,
 damon_max_nr_accesses(), which is called from damon_hot_score(), causes a divide-by-zero. Needless to say,
 it is a problem. When the user sets the aggregation interval zero, the function returns zero. It is wrong,
 since the real maximum nr_acceses in the setup should be one. Worse yet, it can cause another divide-by-
 zero from its caller, damon_hot_score(), since it uses damon_max_nr_accesses() return value as a
 denominator. When the user sets the aggregation interval very high, damon_hot_score() could return a value
 out of [0, DAMOS_MAX_SCORE] range. Since the return value is used as an index to the
 regions_score_histogram array, which is DAMOS_MAX_SCORE+1 size, it causes out of bounds array access. The
 issues can be relatively easily reproduced like below. The sysfs write permission is required, though. #
 ./damo start --damos_action lru_prio --damos_quota_space 100M \ --damos_quota_interval 1s # cd
 /sys/kernel/mm/damon/admin/kdamonds/0 # echo 0 > contexts/0/monitoring_attrs/intervals/sample_us # echo 0
 > contexts/0/monitoring_attrs/intervals/aggr_us # echo commit > state # dmesg [...] [ 131.329762] Oops:
 divide error: 0000 [#1] SMP NOPTI [...] [ 131.336089] RIP: 0010:damon_hot_score+0x27/0xd0 [...] Fix the
 divide-by-zero intervals problems by explicitly handling the zero intervals in damon_max_nr_accesses().
 Fix the out-of-bound array access by applying [0, DAMOS_MAX_SCORE] bounds before returning from
 damon_hot_score(). The issue was discovered [1] by Sashiko. (CVE-2026-64458)

Solution

Update the linux library and its related packages to version 6.1.180-1 or later.

See Also

https://advisory.echohq.com/cve/CVE-2026-64458

Plugin Details

Severity: Medium

ID: 462214

Version: Revision 1.1

Type: Local

Published: 10/2/2026

Updated: 10/2/2026

Risk Information

VPR

Risk Factor: Medium

Score: 5.7

Percentile: 95.91

CVSS v2

Risk Factor: Medium

Base Score: 4.3

Temporal Score: 3.2

Vector: CVSS2#AV:L/AC:L/Au:M/C:N/I:N/A:C

CVSS Score Source: CVE-2026-64458

CVSS v3

Risk Factor: Medium

Base Score: 4.4

Temporal Score: 3.9

Vector: CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 7/26/2026

Vulnerability Publication Date: 7/23/2026

Reference Information

CVE: CVE-2026-64458