Detections
Analytics

Echo: linux: security update to 6.1.176-1

high Tenable Self-Hosted Container Security Plugin ID 464509

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - In the Linux kernel, the following vulnerability has been resolved: misc: fastrpc: fix use-after-free of
 fastrpc_user in workqueue context There is a race between fastrpc_device_release() and the workqueue that
 processes DSP responses. When the user closes the file descriptor, fastrpc_device_release() frees the
 fastrpc_user structure. Concurrently, an in-flight DSP invocation can complete and
 fastrpc_rpmsg_callback() schedules context cleanup via schedule_work(&ctx->put_work). If the workqueue
 runs fastrpc_context_free() in parallel with or after fastrpc_device_release() has freed the user
 structure, it dereferences the freed fastrpc_user. Depending on the state of the context at the time of
 the race, any one of the following accesses can be hit: 1. fastrpc_buf_free() calls
 fastrpc_ipa_to_dma_addr(buf->fl->cctx, ...) to strip the SID bits from the stored IOVA before passing the
 physical address to dma_free_coherent(). 2. fastrpc_free_map() reads map->fl->cctx->vmperms[0].vmid to
 reconstruct the source permission bitmask needed for the qcom_scm_assign_mem() call that returns memory
 from the DSP VM back to HLOS. 3. fastrpc_free_map() acquires map->fl->lock to safely remove the map node
 from the fl->maps list. The resulting use-after-free manifests as: pc : fastrpc_buf_free+0x38/0x80
 [fastrpc] lr : fastrpc_context_free+0xa8/0x1b0 [fastrpc] fastrpc_context_free+0xa8/0x1b0 [fastrpc]
 fastrpc_context_put_wq+0x78/0xa0 [fastrpc] process_one_work+0x180/0x450 worker_thread+0x26c/0x388 Add
 kref-based reference counting to fastrpc_user. Have each invoke context take a reference on the user at
 allocation time and release it when the context is freed. Release the initial reference in
 fastrpc_device_release() at file close. Move the teardown of the user structure — freeing pending
 contexts, maps, mmaps, and the channel context reference — into the kref release callback
 fastrpc_user_free(), so that it runs only when the last reference is dropped, regardless of whether that
 happens at device close or after the final in-flight context completes. (CVE-2026-53161)

Solution

Update the linux library and its related packages to version 6.1.176-1 or later.

See Also

https://advisory.echohq.com/cve/CVE-2026-53161

Plugin Details

Severity: High

ID: 464509

Version: Revision 1.1

Type: Local

Published: 10/2/2026

Updated: 10/2/2026

Risk Information

VPR

Risk Factor: Medium

Score: 4.9

Percentile: 58.14

CVSS v2

Risk Factor: Medium

Base Score: 6.8

Temporal Score: 5

Vector: CVSS2#AV:L/AC:L/Au:S/C:C/I:C/A:C

CVSS Score Source: CVE-2026-53161

CVSS v3

Risk Factor: High

Base Score: 7.8

Temporal Score: 6.8

Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 6/25/2026

Vulnerability Publication Date: 6/25/2026

Reference Information

CVE: CVE-2026-53161