Detections
Analytics

Echo: linux: security update to 6.1.180-1

critical Tenable Self-Hosted Container Security Plugin ID 462962

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - In the Linux kernel, the following vulnerability has been resolved: tipc: fix out-of-bounds read in
 broadcast Gap ACK blocks A broadcast PROTOCOL/STATE_MSG can carry a Gap ACK blocks record in its data
 area. tipc_get_gap_ack_blks() only verifies that the record's len field is self-consistent with its
 ugack_cnt/bgack_cnt counts (sz == struct_size(p, gacks, ugack_cnt + bgack_cnt)); it does not check that
 the record actually fits in the message data area, msg_data_sz(). The unicast caller tipc_link_proto_rcv()
 bounds it ("if (glen > dlen) break;"), but the broadcast caller tipc_bcast_sync_rcv() discards the
 returned size, so tipc_link_advance_transmq() copies the record off the receive skb with an attacker-
 controlled count: this_ga = kmemdup(ga, struct_size(ga, gacks, ga->bgack_cnt), GFP_ATOMIC); A TIPC
 neighbour that negotiated TIPC_GAP_ACK_BLOCK triggers it with one ordinary broadcast STATE_MSG
 (msg_bc_ack_invalid() clear), sized so its data area is short, carrying a Gap ACK record with len = 0x400,
 bgack_cnt = 0xff and ugack_cnt = 0. len then equals struct_size(p, gacks, 255), so the consistency check
 passes and ga is non-NULL; kmemdup() reads struct_size(ga, gacks, 255) = 1024 bytes out of the much
 smaller skb: BUG: KASAN: slab-out-of-bounds in kmemdup_noprof+0x48/0x60 Read of size 1024 at addr
 ffff0000c7030d38 by task poc864/69 Call trace: kmemdup_noprof+0x48/0x60
 tipc_link_advance_transmq+0x86c/0xb80 tipc_link_bc_ack_rcv+0x19c/0x1e0 tipc_bcast_sync_rcv+0x1c4/0x2c4
 tipc_rcv+0x85c/0x1340 tipc_l2_rcv_msg+0xac/0x104 The buggy address belongs to the object at
 ffff0000c7030d00 which belongs to the cache skbuff_small_head of size 704 The buggy address is located 56
 bytes inside of allocated 704-byte region [ffff0000c7030d00, ffff0000c7030fc0) The copied-out bytes are
 subsequently consumed as gap/ack values, but the read is already out of bounds at the kmemdup() regardless
 of how they are used. The unicast STATE path drops such a message: "if (glen > dlen) break;" skips the
 rest of STATE_MSG handling and the skb is freed. Make the broadcast path drop it too.
 tipc_bcast_sync_rcv() now bounds the record against msg_data_sz() and, when it does not fit, reports it
 back through tipc_node_bc_sync_rcv() to tipc_rcv() so the skb is discarded rather than processed. ga is
 not cleared on this path: ga == NULL already means "legacy peer without Selective ACK", a distinct
 legitimate state. (CVE-2026-64450)

Solution

Update the linux library and its related packages to version 6.1.180-1 or later.

See Also

https://advisory.echohq.com/cve/CVE-2026-64450

Plugin Details

Severity: Critical

ID: 462962

Version: Revision 1.1

Type: Local

Published: 10/2/2026

Updated: 10/2/2026

Risk Information

VPR

Risk Factor: Medium

Score: 4.3

Percentile: 53.41

CVSS v2

Risk Factor: High

Base Score: 9.4

Temporal Score: 7

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:N/A:C

CVSS Score Source: CVE-2026-64450

CVSS v3

Risk Factor: Critical

Base Score: 9.1

Temporal Score: 7.9

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 7/26/2026

Vulnerability Publication Date: 7/23/2026

Reference Information

CVE: CVE-2026-64450