Detections
Analytics

Echo: linux: security update to 6.1.158-1

medium Tenable Self-Hosted Container Security Plugin ID 464460

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - In the Linux kernel, the following vulnerability has been resolved: Squashfs: fix uninit-value in
 squashfs_get_parent Syzkaller reports a "KMSAN: uninit-value in squashfs_get_parent" bug. This is caused
 by open_by_handle_at() being called with a file handle containing an invalid parent inode number. In
 particular the inode number is that of a symbolic link, rather than a directory. Squashfs_get_parent()
 gets called with that symbolic link inode, and accesses the parent member field. unsigned int parent_ino =
 squashfs_i(inode)->parent; Because non-directory inodes in Squashfs do not have a parent value, this is
 uninitialised, and this causes an uninitialised value access. The fix is to initialise parent with the
 invalid inode 0, which will cause an EINVAL error to be returned. Regular inodes used to share the parent
 field with the block_list_start field. This is removed in this commit to enable the parent field to
 contain the invalid inode number 0. (CVE-2025-40049)

Solution

Update the linux library and its related packages to version 6.1.158-1 or later.

See Also

https://advisory.echohq.com/cve/CVE-2025-40049

Plugin Details

Severity: Medium

ID: 464460

Version: Revision 1.1

Type: Local

Published: 10/2/2026

Updated: 10/2/2026

Risk Information

VPR

Risk Factor: Low

Score: 3.5

Percentile: 51.8

CVSS v2

Risk Factor: Medium

Base Score: 5.2

Temporal Score: 3.8

Vector: CVSS2#AV:L/AC:L/Au:S/C:P/I:N/A:C

CVSS Score Source: CVE-2025-40049

CVSS v3

Risk Factor: Medium

Base Score: 6.1

Temporal Score: 5.3

Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 10/30/2025

Vulnerability Publication Date: 10/23/2025

Reference Information

CVE: CVE-2025-40049