Detections
Analytics

Echo: linux: security update to 6.8.12-1

medium Tenable Self-Hosted Container Security Plugin ID 462927

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Reload only IB representors
 upon lag disable/enable On lag disable, the bond IB device along with all of its representors are
 destroyed, and then the slaves' representors get reloaded. In case the slave IB representor load fails,
 the eswitch error flow unloads all representors, including ethernet representors, where the netdevs get
 detached and removed from lag bond. Such flow is inaccurate as the lag driver is not responsible for
 loading/unloading ethernet representors. Furthermore, the flow described above begins by holding lag lock
 to prevent bond changes during disable flow. However, when reaching the ethernet representors detachment
 from lag, the lag lock is required again, triggering the following deadlock: Call trace:
 __switch_to+0xf4/0x148 __schedule+0x2c8/0x7d0 schedule+0x50/0xe0 schedule_preempt_disabled+0x18/0x28
 __mutex_lock.isra.13+0x2b8/0x570 __mutex_lock_slowpath+0x1c/0x28 mutex_lock+0x4c/0x68
 mlx5_lag_remove_netdev+0x3c/0x1a0 [mlx5_core] mlx5e_uplink_rep_disable+0x70/0xa0 [mlx5_core]
 mlx5e_detach_netdev+0x6c/0xb0 [mlx5_core] mlx5e_netdev_change_profile+0x44/0x138 [mlx5_core]
 mlx5e_netdev_attach_nic_profile+0x28/0x38 [mlx5_core] mlx5e_vport_rep_unload+0x184/0x1b8 [mlx5_core]
 mlx5_esw_offloads_rep_load+0xd8/0xe0 [mlx5_core] mlx5_eswitch_reload_reps+0x74/0xd0 [mlx5_core]
 mlx5_disable_lag+0x130/0x138 [mlx5_core] mlx5_lag_disable_change+0x6c/0x70 [mlx5_core] // hold ldev->lock
 mlx5_devlink_eswitch_mode_set+0xc0/0x410 [mlx5_core] devlink_nl_cmd_eswitch_set_doit+0xdc/0x180
 genl_family_rcv_msg_doit.isra.17+0xe8/0x138 genl_rcv_msg+0xe4/0x220 netlink_rcv_skb+0x44/0x108
 genl_rcv+0x40/0x58 netlink_unicast+0x198/0x268 netlink_sendmsg+0x1d4/0x418 sock_sendmsg+0x54/0x60
 __sys_sendto+0xf4/0x120 __arm64_sys_sendto+0x30/0x40 el0_svc_common+0x8c/0x120 do_el0_svc+0x30/0xa0
 el0_svc+0x20/0x30 el0_sync_handler+0x90/0xb8 el0_sync+0x160/0x180 Thus, upon lag enable/disable, load and
 unload only the IB representors of the slaves preventing the deadlock mentioned above. While at it,
 refactor the mlx5_esw_offloads_rep_load() function to have a static helper method for its internal logic,
 in symmetry with the representor unload design. (CVE-2024-38557)

Solution

Update the linux library and its related packages to version 6.8.12-1 or later.

See Also

https://advisory.echohq.com/cve/CVE-2024-38557

Plugin Details

Severity: Medium

ID: 462927

Version: Revision 1.1

Type: Local

Published: 10/2/2026

Updated: 10/2/2026

Risk Information

VPR

Risk Factor: Low

Score: 3

Percentile: 23.18

CVSS v2

Risk Factor: Medium

Base Score: 4.6

Temporal Score: 3.4

Vector: CVSS2#AV:L/AC:L/Au:S/C:N/I:N/A:C

CVSS Score Source: CVE-2024-38557

CVSS v3

Risk Factor: Medium

Base Score: 5.5

Temporal Score: 4.8

Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 9/15/2025

Vulnerability Publication Date: 6/19/2024

Reference Information

CVE: CVE-2024-38557