Detections
Analytics

Echo: linux: security update to 6.1.140-1

medium Tenable Self-Hosted Container Security Plugin ID 463725

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - In the Linux kernel, the following vulnerability has been resolved: x86/mm: Eliminate window where TLB
 flushes may be inadvertently skipped tl;dr: There is a window in the mm switching code where the new CR3
 is set and the CPU should be getting TLB flushes for the new mm. But should_flush_tlb() has a bug and
 suppresses the flush. Fix it by widening the window where should_flush_tlb() sends an IPI. Long Version:
 === History === There were a few things leading up to this. First, updating mm_cpumask() was observed to
 be too expensive, so it was made lazier. But being lazy caused too many unnecessary IPIs to CPUs due to
 the now-lazy mm_cpumask(). So code was added to cull mm_cpumask() periodically[2]. But that culling was a
 bit too aggressive and skipped sending TLB flushes to CPUs that need them. So here we are again. ===
 Problem === The too-aggressive code in should_flush_tlb() strikes in this window: // Turn on IPIs for this
 CPU/mm combination, but only // if should_flush_tlb() agrees: cpumask_set_cpu(cpu, mm_cpumask(next));
 next_tlb_gen = atomic64_read(&next->context.tlb_gen); choose_new_asid(next, next_tlb_gen, &new_asid,
 &need_flush); load_new_mm_cr3(need_flush); // ^ After 'need_flush' is set to false, IPIs *MUST* // be sent
 to this CPU and not be ignored. this_cpu_write(cpu_tlbstate.loaded_mm, next); // ^ Not until this point
 does should_flush_tlb() // become true! should_flush_tlb() will suppress TLB flushes between
 load_new_mm_cr3() and writing to 'loaded_mm', which is a window where they should not be suppressed.
 Whoops. === Solution === Thankfully, the fuzzy "just about to write CR3" window is already marked with
 loaded_mm==LOADED_MM_SWITCHING. Simply checking for that state in should_flush_tlb() is sufficient to
 ensure that the CPU is targeted with an IPI. This will cause more TLB flush IPIs. But the window is
 relatively small and I do not expect this to cause any kind of measurable performance impact. Update the
 comment where LOADED_MM_SWITCHING is written since it grew yet another user. Peter Z also raised a concern
 that should_flush_tlb() might not observe 'loaded_mm' and 'is_lazy' in the same order that
 switch_mm_irqs_off() writes them. Add a barrier to ensure that they are observed in the order they are
 written. (CVE-2025-37964)

Solution

Update the linux library and its related packages to version 6.1.140-1 or later.

See Also

https://advisory.echohq.com/cve/CVE-2025-37964

Plugin Details

Severity: Medium

ID: 463725

Version: Revision 1.1

Type: Local

Published: 10/2/2026

Updated: 10/2/2026

Risk Information

VPR

Risk Factor: Medium

Score: 5.7

Percentile: 96.44

CVSS v2

Risk Factor: Medium

Base Score: 4.6

Temporal Score: 3.4

Vector: CVSS2#AV:L/AC:L/Au:S/C:N/I:N/A:C

CVSS Score Source: CVE-2025-37964

CVSS v3

Risk Factor: Medium

Base Score: 5.5

Temporal Score: 4.8

Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 9/15/2025

Vulnerability Publication Date: 5/20/2025

Reference Information

CVE: CVE-2025-37964