Detections
Analytics

Echo: linux: security update to 6.1.176-1

high Tenable Self-Hosted Container Security Plugin ID 463230

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_uart: fix UAFs and race
 conditions in close and init paths Vulnerabilities leading to Use-After-Free (UAF) and Null Pointer
 Dereference (NPD) conditions were observed in the lifecycle management of hci_uart. The primary issue
 arises because the workqueues (init_ready and write_work) are only flushed/cancelled if the
 HCI_UART_PROTO_READY flag is set during TTY close. If a hangup occurs before setup completes,
 hci_uart_tty_close() skips the teardown of these workqueues and proceeds to free the `hu` struct. When the
 scheduled work executes later, it blindly dereferences the freed `hu` struct. Furthermore, several data
 races and UAFs were identified in the teardown sequence: 1. Calling hci_uart_flush() from hci_uart_close()
 without effectively disabling write_work causes a race condition where both can concurrently double-free
 hu->tx_skb. This happens because protocol timers can concurrently invoke hci_uart_tx_wakeup() and requeue
 write_work. 2. Calling hci_free_dev(hdev) before hu->proto->close(hu) causes a UAF when vendor specific
 protocol close callbacks dereference hu->hdev. 3. In the initialization error paths, failing to take the
 proto_lock write lock before clearing PROTO_READY leads to races with active readers. Additionally,
 hci_uart_tty_receive() accesses hu->hdev outside the read lock, leading to UAFs if the initialization
 error path frees hdev concurrently. Fix these synchronization and lifecycle issues by: 1. Re-ordering
 hci_uart_tty_close() to clear HCI_UART_PROTO_READY first, followed immediately by a
 cancel_work_sync(&hu->write_work). Clearing the flag locks out concurrent protocol timers from
 successfully invoking hci_uart_tx_wakeup(), effectively rendering the cancellation permanent and
 preventing the tx_skb double-free. 2. Note: Clearing PROTO_READY early causes hci_uart_close() to skip
 hu->proto->flush(). This is perfectly safe in the tty_close path because hu->proto->close() executes
 shortly after, which intrinsically purges all protocol SKB queues and tears down the state. 3. Relocating
 hu->proto->close(hu) strictly prior to hci_free_dev(hdev) across all close and error paths to prevent
 vendor-level UAFs. 4. Moving the hdev->stat.byte_rx increment in hci_uart_tty_receive() inside the
 proto_lock read-side critical section to safely synchronize with device unregistration. 5. Adding
 cancel_work_sync(&hu->write_work) to hci_uart_close() to safely flush the workqueue before
 hci_uart_flush() is invoked via the HCI core. 6. Utilizing cancel_work_sync() instead of
 disable_work_sync() across all paths to prevent permanently breaking user-space retry capabilities.
 (CVE-2026-46275)

Solution

Update the linux library and its related packages to version 6.1.176-1 or later.

See Also

https://advisory.echohq.com/cve/CVE-2026-46275

Plugin Details

Severity: High

ID: 463230

Version: Revision 1.1

Type: Local

Published: 10/2/2026

Updated: 10/2/2026

Risk Information

VPR

Risk Factor: Medium

Score: 4.9

Percentile: 58.14

CVSS v2

Risk Factor: Medium

Base Score: 6.8

Temporal Score: 5

Vector: CVSS2#AV:L/AC:L/Au:S/C:C/I:C/A:C

CVSS Score Source: CVE-2026-46275

CVSS v3

Risk Factor: High

Base Score: 7.8

Temporal Score: 6.8

Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 6/9/2026

Vulnerability Publication Date: 6/8/2026

Reference Information

CVE: CVE-2026-46275