Detections
Analytics

Echo: linux: security update to 6.1.133-1

medium Tenable Self-Hosted Container Security Plugin ID 463970

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: regulatory: improve
 invalid hints checking Syzbot keeps reporting an issue [1] that occurs when erroneous symbols sent from
 userspace get through into user_alpha2[] via regulatory_hint_user() call. Such invalid regulatory hints
 should be rejected. While a sanity check from commit 47caf685a685 ("cfg80211: regulatory: reject invalid
 hints") looks to be enough to deter these very cases, there is a way to get around it due to 2 reasons. 1)
 The way isalpha() works, symbols other than latin lower and upper letters may be used to determine a
 country/domain. For instance, greek letters will also be considered upper/lower letters and for such
 characters isalpha() will return true as well. However, ISO-3166-1 alpha2 codes should only hold latin
 characters. 2) While processing a user regulatory request, between reg_process_hint_user() and
 regulatory_hint_user() there happens to be a call to queue_regulatory_request() which modifies letters in
 request->alpha2[] with toupper(). This works fine for latin symbols, less so for weird letter characters
 from the second part of _ctype[]. Syzbot triggers a warning in is_user_regdom_saved() by first sending
 over an unexpected non-latin letter that gets malformed by toupper() into a character that ends up failing
 isalpha() check. Prevent this by enhancing is_an_alpha2() to ensure that incoming symbols are latin
 letters and nothing else. [1] Syzbot report: ------------[ cut here ]------------ Unexpected user alpha2:
 A� WARNING: CPU: 1 PID: 964 at net/wireless/reg.c:442 is_user_regdom_saved net/wireless/reg.c:440 [inline]
 WARNING: CPU: 1 PID: 964 at net/wireless/reg.c:442 restore_alpha2 net/wireless/reg.c:3424 [inline]
 WARNING: CPU: 1 PID: 964 at net/wireless/reg.c:442 restore_regulatory_settings+0x3c0/0x1e50
 net/wireless/reg.c:3516 Modules linked in: CPU: 1 UID: 0 PID: 964 Comm: kworker/1:2 Not tainted
 6.12.0-rc5-syzkaller-00044-gc1e939a21eb1 #0 Hardware name: Google Google Compute Engine/Google Compute
 Engine, BIOS Google 09/13/2024 Workqueue: events_power_efficient crda_timeout_work RIP:
 0010:is_user_regdom_saved net/wireless/reg.c:440 [inline] RIP: 0010:restore_alpha2 net/wireless/reg.c:3424
 [inline] RIP: 0010:restore_regulatory_settings+0x3c0/0x1e50 net/wireless/reg.c:3516 ... Call Trace: <TASK>
 crda_timeout_work+0x27/0x50 net/wireless/reg.c:542 process_one_work kernel/workqueue.c:3229 [inline]
 process_scheduled_works+0xa65/0x1850 kernel/workqueue.c:3310 worker_thread+0x870/0xd30
 kernel/workqueue.c:3391 kthread+0x2f2/0x390 kernel/kthread.c:389 ret_from_fork+0x4d/0x80
 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 </TASK>
 (CVE-2025-21910)

Solution

Update the linux library and its related packages to version 6.1.133-1 or later.

See Also

https://advisory.echohq.com/cve/CVE-2025-21910

Plugin Details

Severity: Medium

ID: 463970

Version: Revision 1.1

Type: Local

Published: 10/2/2026

Updated: 10/2/2026

Risk Information

VPR

Risk Factor: Low

Score: 3

Percentile: 23.18

CVSS v2

Risk Factor: Medium

Base Score: 4.6

Temporal Score: 3.4

Vector: CVSS2#AV:L/AC:L/Au:S/C:N/I:N/A:C

CVSS Score Source: CVE-2025-21910

CVSS v3

Risk Factor: Medium

Base Score: 5.5

Temporal Score: 4.8

Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 1/28/2026

Vulnerability Publication Date: 3/20/2025

Reference Information

CVE: CVE-2025-21910