Detections
Analytics

Echo: linux: security update to 6.1.170-1

medium Tenable Self-Hosted Container Security Plugin ID 464828

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - In the Linux kernel, the following vulnerability has been resolved: eth: bnxt: always recalculate features
 after XDP clearing, fix null-deref Recalculate features when XDP is detached. Before: # ip li set dev eth0
 xdp obj xdp_dummy.bpf.o sec xdp # ip li set dev eth0 xdp off # ethtool -k eth0 | grep gro rx-gro-hw: off
 [requested on] After: # ip li set dev eth0 xdp obj xdp_dummy.bpf.o sec xdp # ip li set dev eth0 xdp off #
 ethtool -k eth0 | grep gro rx-gro-hw: on The fact that HW-GRO doesn't get re-enabled automatically is just
 a minor annoyance. The real issue is that the features will randomly come back during another
 reconfiguration which just happens to invoke netdev_update_features(). The driver doesn't handle
 reconfiguring two things at a time very robustly. Starting with commit 98ba1d931f61 ("bnxt_en: Fix RSS
 logic in __bnxt_reserve_rings()") we only reconfigure the RSS hash table if the "effective" number of Rx
 rings has changed. If HW-GRO is enabled "effective" number of rings is 2x what user sees. So if we are in
 the bad state, with HW-GRO re-enablement "pending" after XDP off, and we lower the rings by / 2 - the HW-
 GRO rings doing 2x and the ethtool -L doing / 2 may cancel each other out, and the: if (old_rx_rings !=
 bp->hw_resc.resv_rx_rings && condition in __bnxt_reserve_rings() will be false. The RSS map won't get
 updated, and we'll crash with: BUG: kernel NULL pointer dereference, address: 0000000000000168 RIP:
 0010:__bnxt_hwrm_vnic_set_rss+0x13a/0x1a0 bnxt_hwrm_vnic_rss_cfg_p5+0x47/0x180
 __bnxt_setup_vnic_p5+0x58/0x110 bnxt_init_nic+0xb72/0xf50 __bnxt_open_nic+0x40d/0xab0
 bnxt_open_nic+0x2b/0x60 ethtool_set_channels+0x18c/0x1d0 As we try to access a freed ring. The issue is
 present since XDP support was added, really, but prior to commit 98ba1d931f61 ("bnxt_en: Fix RSS logic in
 __bnxt_reserve_rings()") it wasn't causing major issues. (CVE-2025-21682)

Solution

Update the linux library and its related packages to version 6.1.170-1 or later.

See Also

https://advisory.echohq.com/cve/CVE-2025-21682

Plugin Details

Severity: Medium

ID: 464828

Version: Revision 1.1

Type: Local

Published: 10/2/2026

Updated: 10/2/2026

Risk Information

VPR

Risk Factor: Low

Score: 3

Percentile: 23.18

CVSS v2

Risk Factor: Medium

Base Score: 4.6

Temporal Score: 3.4

Vector: CVSS2#AV:L/AC:L/Au:S/C:N/I:N/A:C

CVSS Score Source: CVE-2025-21682

CVSS v3

Risk Factor: Medium

Base Score: 5.5

Temporal Score: 4.8

Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 9/15/2025

Vulnerability Publication Date: 1/31/2025

Reference Information

CVE: CVE-2025-21682