Detections
Analytics

Echo: linux: security update to 6.1.180-1

high Tenable Self-Hosted Container Security Plugin ID 463133

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - In the Linux kernel, the following vulnerability has been resolved: isofs: bound Rock Ridge symlink
 components to the SL record get_symlink_chunk() and the SL handling in parse_rock_ridge_inode_internal()
 walk the variable-length components of a Rock Ridge "SL" (symbolic link) record. Each component is a two-
 byte header (flags, len) followed by len bytes of text, so it occupies slp->len + 2 bytes. Both loops read
 slp->len and advance to the next component, and get_symlink_chunk() additionally does memcpy(rpnt,
 slp->text, slp->len), but neither checks that the component lies within the SL record before dereferencing
 it. A crafted SL record whose component declares a len that runs past the record (rr->len) therefore
 triggers an out-of-bounds read of up to 255 bytes. When the record sits at the tail of its backing buffer
 - for example a small kmalloc()ed continuation block reached through a CE record - the read crosses the
 allocation; get_symlink_chunk() then copies the out-of-bounds bytes into the symlink body returned to user
 space by readlink(), disclosing adjacent kernel memory. ISO 9660 images are routinely mounted from
 untrusted removable media - desktop environments auto-mount them (e.g. via udisks2) without CAP_SYS_ADMIN
 - so the record contents are attacker-controlled. Reject any component that does not fit in the remaining
 record bytes before using it. In get_symlink_chunk() return NULL, like the existing output-buffer (plimit)
 checks, so a malformed record makes readlink() fail with -EIO rather than silently returning a truncated
 target; in parse_rock_ridge_inode_internal() stop the inode-size walk. (CVE-2026-64317)

Solution

Update the linux library and its related packages to version 6.1.180-1 or later.

See Also

https://advisory.echohq.com/cve/CVE-2026-64317

Plugin Details

Severity: High

ID: 463133

Version: Revision 1.2

Type: Local

Published: 10/2/2026

Updated: 10/5/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: High

Score: 7

Percentile: 98.16

CVSS v2

Risk Factor: Medium

Base Score: 6.2

Temporal Score: 4.6

Vector: CVSS2#AV:L/AC:L/Au:S/C:C/I:N/A:C

CVSS Score Source: CVE-2026-64317

CVSS v3

Risk Factor: High

Base Score: 7.1

Temporal Score: 6.2

Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 7/26/2026

Vulnerability Publication Date: 7/23/2026

Reference Information

CVE: CVE-2026-64317