Echo: linux: security update to 6.1.133-1

medium Tenable Self-Hosted Container Security Plugin ID 465435

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

- In the Linux kernel, the following vulnerability has been resolved: md/md-bitmap: Synchronize
bitmap_get_stats() with bitmap lifetime After commit ec6bb299c7c3 ("md/md-bitmap: add 'sync_size' into
struct md_bitmap_stats"), following panic is reported: Oops: general protection fault, probably for non-
canonical address RIP: 0010:bitmap_get_stats+0x2b/0xa0 Call Trace: <TASK> md_seq_show+0x2d2/0x5b0
seq_read_iter+0x2b9/0x470 seq_read+0x12f/0x180 proc_reg_read+0x57/0xb0 vfs_read+0xf6/0x380
ksys_read+0x6c/0xf0 do_syscall_64+0x82/0x170 entry_SYSCALL_64_after_hwframe+0x76/0x7e Root cause is that
bitmap_get_stats() can be called at anytime if mddev is still there, even if bitmap is destroyed, or not
fully initialized. Deferenceing bitmap in this case can crash the kernel. Meanwhile, the above commit
start to deferencing bitmap->storage, make the problem easier to trigger. Fix the problem by protecting
bitmap_get_stats() with bitmap_info.mutex. (CVE-2025-21712)

Solution

Update the linux library and its related packages to version 6.1.133-1 or later.

Plugin Details

Severity: Medium

ID: 465435

Version: Revision 1.1

Type: Local

Family: Echo Local Security Checks

Published: 10/2/2026

Updated: 10/2/2026

Risk Information

VPR

Risk Factor: Low

Score: 3

Percentile: 23.68

CVSS v2

Risk Factor: Medium

Base Score: 4.6

Temporal Score: 3.4

Vector: CVSS2#AV:L/AC:L/Au:S/C:N/I:N/A:C

CVSS Score Source: CVE-2025-21712

CVSS v3

Risk Factor: Medium

Base Score: 5.5

Temporal Score: 4.8

Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 1/28/2026

Vulnerability Publication Date: 2/27/2025

Reference Information

CVE: CVE-2025-21712

Detections

Analytics