Detections
Analytics

Echo: linux: security update to 6.1.159-1

high Tenable Self-Hosted Container Security Plugin ID 465549

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - In the Linux kernel, the following vulnerability has been resolved: fbcon: Set fb_display[i]->mode to NULL
 when the mode is released Recently, we discovered the following issue through syzkaller: BUG: KASAN: slab-
 use-after-free in fb_mode_is_equal+0x285/0x2f0 Read of size 4 at addr ff11000001b3c69c by task syz.xxx ...
 Call Trace: <TASK> dump_stack_lvl+0xab/0xe0 print_address_description.constprop.0+0x2c/0x390
 print_report+0xb9/0x280 kasan_report+0xb8/0xf0 fb_mode_is_equal+0x285/0x2f0 fbcon_mode_deleted+0x129/0x180
 fb_set_var+0xe7f/0x11d0 do_fb_ioctl+0x6a0/0x750 fb_ioctl+0xe0/0x140 __x64_sys_ioctl+0x193/0x210
 do_syscall_64+0x5f/0x9c0 entry_SYSCALL_64_after_hwframe+0x76/0x7e Based on experimentation and analysis,
 during framebuffer unregistration, only the memory of fb_info->modelist is freed, without setting the
 corresponding fb_display[i]->mode to NULL for the freed modes. This leads to UAF issues during subsequent
 accesses. Here's an example of reproduction steps: 1. With /dev/fb0 already registered in the system, load
 a kernel module to register a new device /dev/fb1; 2. Set fb1's mode to the global fb_display[] array (via
 FBIOPUT_CON2FBMAP); 3. Switch console from fb to VGA (to allow normal rmmod of the ko); 4. Unload the
 kernel module, at this point fb1's modelist is freed, leaving a wild pointer in fb_display[]; 5. Trigger
 the bug via system calls through fb0 attempting to delete a mode from fb0. Add a check in
 do_unregister_framebuffer(): if the mode to be freed exists in fb_display[], set the corresponding mode
 pointer to NULL. (CVE-2025-40323)

Solution

Update the linux library and its related packages to version 6.1.159-1 or later.

See Also

https://advisory.echohq.com/cve/CVE-2025-40323

Plugin Details

Severity: High

ID: 465549

Version: Revision 1.1

Type: Local

Published: 10/2/2026

Updated: 10/2/2026

Risk Information

VPR

Risk Factor: Medium

Score: 4.9

Percentile: 58.12

CVSS v2

Risk Factor: Medium

Base Score: 6.8

Temporal Score: 5

Vector: CVSS2#AV:L/AC:L/Au:S/C:C/I:C/A:C

CVSS Score Source: CVE-2025-40323

CVSS v3

Risk Factor: High

Base Score: 7.8

Temporal Score: 6.8

Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 12/8/2025

Vulnerability Publication Date: 12/8/2025

Reference Information

CVE: CVE-2025-40323