In the Linux kernel, the following vulnerability has been resolved: drm/xe: Fix vm_bind_ioctl double free bug If the argument check during an array bind fails, the bind_ops are freed twice as seen below. Fix this by setting bind_ops to NULL after freeing. ================================================================== BUG: KASAN: double-free in xe_vm_bind_ioctl+0x1b2/0x21f0 [xe] Free of addr ffff88813bb9b800 by task xe_vm/14198 CPU: 5 UID: 0 PID: 14198 Comm: xe_vm Not tainted 6.16.0-xe-eudebug-cmanszew+ #520 PREEMPT(full) Hardware name: Intel Corporation Alder Lake Client Platform/AlderLake-P DDR5 RVP, BIOS ADLPFWI1.R00.2411.A02.2110081023 10/08/2021 Call Trace: <TASK> dump_stack_lvl+0x82/0xd0 print_report+0xcb/0x610 ? __virt_addr_valid+0x19a/0x300 ? xe_vm_bind_ioctl+0x1b2/0x21f0 [xe] kasan_report_invalid_free+0xc8/0xf0 ? xe_vm_bind_ioctl+0x1b2/0x21f0 [xe] ? xe_vm_bind_ioctl+0x1b2/0x21f0 [xe] check_slab_allocation+0x102/0x130 kfree+0x10d/0x440 ? should_fail_ex+0x57/0x2f0 ? xe_vm_bind_ioctl+0x1b2/0x21f0 [xe] xe_vm_bind_ioctl+0x1b2/0x21f0 [xe] ? __pfx_xe_vm_bind_ioctl+0x10/0x10 [xe] ? __lock_acquire+0xab9/0x27f0 ? lock_acquire+0x165/0x300 ? drm_dev_enter+0x53/0xe0 [drm] ? find_held_lock+0x2b/0x80 ? drm_dev_exit+0x30/0x50 [drm] ? drm_ioctl_kernel+0x128/0x1c0 [drm] drm_ioctl_kernel+0x128/0x1c0 [drm] ? __pfx_xe_vm_bind_ioctl+0x10/0x10 [xe] ? find_held_lock+0x2b/0x80 ? __pfx_drm_ioctl_kernel+0x10/0x10 [drm] ? should_fail_ex+0x57/0x2f0 ? __pfx_xe_vm_bind_ioctl+0x10/0x10 [xe] drm_ioctl+0x352/0x620 [drm] ? __pfx_drm_ioctl+0x10/0x10 [drm] ? __pfx_rpm_resume+0x10/0x10 ? do_raw_spin_lock+0x11a/0x1b0 ? find_held_lock+0x2b/0x80 ? __pm_runtime_resume+0x61/0xc0 ? rcu_is_watching+0x20/0x50 ? trace_irq_enable.constprop.0+0xac/0xe0 xe_drm_ioctl+0x91/0xc0 [xe] __x64_sys_ioctl+0xb2/0x100 ? rcu_is_watching+0x20/0x50 do_syscall_64+0x68/0x2e0 entry_SYSCALL_64_after_hwframe+0x76/0x7e RIP: 0033:0x7fa9acb24ded (cherry picked from commit a01b704527c28a2fd43a17a85f8996b75ec8492a)

The AlmaLinux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1771081379 advisory.

  - In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: Fix slab-use-after-     free Read in mgmt_remove_adv_monitor_sync This fixes the following crash:
    ================================================================== BUG: KASAN: slab-use-after-free in     mgmt_remove_adv_monitor_sync+0x3a/0xd0 net/bluetooth/mgmt.c:5543 Read of size 8 at addr ffff88814128f898     by task kworker/u9:4/5961 CPU: 1 UID: 0 PID: 5961 Comm: kworker/u9:4 Not tainted     6.12.0-syzkaller-10684-gf1cd565ce577 #0 Hardware name: Google Google Compute Engine/Google Compute Engine,     BIOS Google 09/13/2024 Workqueue: hci0 hci_cmd_sync_work Call Trace: <TASK> __dump_stack     lib/dump_stack.c:94 [inline] dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120 print_address_description     mm/kasan/report.c:378 [inline] print_report+0x169/0x550 mm/kasan/report.c:489 kasan_report+0x143/0x180     mm/kasan/report.c:602 mgmt_remove_adv_monitor_sync+0x3a/0xd0 net/bluetooth/mgmt.c:5543     hci_cmd_sync_work+0x22b/0x400 net/bluetooth/hci_sync.c:332 process_one_work kernel/workqueue.c:3229     [inline] process_scheduled_works+0xa63/0x1850 kernel/workqueue.c:3310 worker_thread+0x870/0xd30     kernel/workqueue.c:3391 kthread+0x2f0/0x390 kernel/kthread.c:389 ret_from_fork+0x4b/0x80     arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 </TASK> Allocated     by task 16026: kasan_save_stack mm/kasan/common.c:47 [inline] kasan_save_track+0x3f/0x80     mm/kasan/common.c:68 poison_kmalloc_redzone mm/kasan/common.c:377 [inline] __kasan_kmalloc+0x98/0xb0     mm/kasan/common.c:394 kasan_kmalloc include/linux/kasan.h:260 [inline] __kmalloc_cache_noprof+0x243/0x390     mm/slub.c:4314 kmalloc_noprof include/linux/slab.h:901 [inline] kzalloc_noprof include/linux/slab.h:1037     [inline] mgmt_pending_new+0x65/0x250 net/bluetooth/mgmt_util.c:269 mgmt_pending_add+0x36/0x120     net/bluetooth/mgmt_util.c:296 remove_adv_monitor+0x102/0x1b0 net/bluetooth/mgmt.c:5568     hci_mgmt_cmd+0xc47/0x11d0 net/bluetooth/hci_sock.c:1712 hci_sock_sendmsg+0x7b8/0x11c0     net/bluetooth/hci_sock.c:1832 sock_sendmsg_nosec net/socket.c:711 [inline] __sock_sendmsg+0x221/0x270     net/socket.c:726 sock_write_iter+0x2d7/0x3f0 net/socket.c:1147 new_sync_write fs/read_write.c:586 [inline]     vfs_write+0xaeb/0xd30 fs/read_write.c:679 ksys_write+0x18f/0x2b0 fs/read_write.c:731 do_syscall_x64     arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83     entry_SYSCALL_64_after_hwframe+0x77/0x7f Freed by task 16022: kasan_save_stack mm/kasan/common.c:47     [inline] kasan_save_track+0x3f/0x80 mm/kasan/common.c:68 kasan_save_free_info+0x40/0x50     mm/kasan/generic.c:582 poison_slab_object mm/kasan/common.c:247 [inline] __kasan_slab_free+0x59/0x70     mm/kasan/common.c:264 kasan_slab_free include/linux/kasan.h:233 [inline] slab_free_hook mm/slub.c:2338     [inline] slab_free mm/slub.c:4598 [inline] kfree+0x196/0x420 mm/slub.c:4746     mgmt_pending_foreach+0xd1/0x130 net/bluetooth/mgmt_util.c:259 __mgmt_power_off+0x183/0x430     net/bluetooth/mgmt.c:9550 hci_dev_close_sync+0x6c4/0x11c0 net/bluetooth/hci_sync.c:5208 hci_dev_do_close     net/bluetooth/hci_core.c:483 [inline] hci_dev_close+0x112/0x210 net/bluetooth/hci_core.c:508     sock_do_ioctl+0x158/0x460 net/socket.c:1209 sock_ioctl+0x626/0x8e0 net/socket.c:1328 vfs_ioctl     fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:906 [inline] __se_sys_ioctl+0xf5/0x170 fs/ioctl.c:892     do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83     entry_SYSCALL_64_after_hwframe+0x77/0x7f (CVE-2024-58013)

  - In the Linux kernel, the following vulnerability has been resolved: nvmet: fix out-of-bounds access in     nvmet_enable_port When trying to enable a port that has no transport configured yet, nvmet_enable_port()     uses NVMF_TRTYPE_MAX (255) to query the transports array, causing an out-of-bounds access: [ 106.058694]     BUG: KASAN: global-out-of-bounds in nvmet_enable_port+0x42/0x1da [ 106.058719] Read of size 8 at addr     ffffffff89dafa58 by task ln/632 [...] [ 106.076026] nvmet: transport type 255 not supported Since commit     200adac75888, NVMF_TRTYPE_MAX is the default state as configured by nvmet_ports_make(). Avoid this by     checking for NVMF_TRTYPE_MAX before proceeding. (CVE-2025-37825)

  - In the Linux kernel, the following vulnerability has been resolved: can: bcm: add locking for bcm_op     runtime updates The CAN broadcast manager (CAN BCM) can send a sequence of CAN frames via hrtimer. The     content and also the length of the sequence can be changed resp reduced at runtime where the 'currframe'     counter is then set to zero. Although this appeared to be a safe operation the updates of 'currframe' can     be triggered from user space and hrtimer context in bcm_can_tx(). Anderson Nascimento created a proof of     concept that triggered a KASAN slab-out-of-bounds read access which can be prevented with a spin_lock_bh.
    At the rework of bcm_can_tx() the 'count' variable has been moved into the protected section as this     variable can be modified from both contexts too. (CVE-2025-38004)

  - In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: Set n_channels after     allocating struct cfg80211_scan_request Make sure that n_channels is set after allocating the struct     cfg80211_registered_device::int_scan_req member. Seen with syzkaller: UBSAN: array-index-out-of-bounds in     net/mac80211/scan.c:1208:5 index 0 is out of range for type 'struct ieee80211_channel *[]
    __counted_by(n_channels)' (aka 'struct ieee80211_channel *[]') This was missed in the initial conversions     because I failed to locate the allocation likely due to the sizeof(void *) not matching the channels     array type. (CVE-2025-38013)

  - In the Linux kernel, the following vulnerability has been resolved: RDMA/core: Fix KASAN: slab-use-after-     free Read in ib_register_device problem Call Trace: __dump_stack lib/dump_stack.c:94 [inline]     dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:408 [inline]     print_report+0xc3/0x670 mm/kasan/report.c:521 kasan_report+0xe0/0x110 mm/kasan/report.c:634     strlen+0x93/0xa0 lib/string.c:420 __fortify_strlen include/linux/fortify-string.h:268 [inline]     get_kobj_path_length lib/kobject.c:118 [inline] kobject_get_path+0x3f/0x2a0 lib/kobject.c:158     kobject_uevent_env+0x289/0x1870 lib/kobject_uevent.c:545 ib_register_device     drivers/infiniband/core/device.c:1472 [inline] ib_register_device+0x8cf/0xe00     drivers/infiniband/core/device.c:1393 rxe_register_device+0x275/0x320     drivers/infiniband/sw/rxe/rxe_verbs.c:1552 rxe_net_add+0x8e/0xe0 drivers/infiniband/sw/rxe/rxe_net.c:550     rxe_newlink+0x70/0x190 drivers/infiniband/sw/rxe/rxe.c:225 nldev_newlink+0x3a3/0x680     drivers/infiniband/core/nldev.c:1796 rdma_nl_rcv_msg+0x387/0x6e0 drivers/infiniband/core/netlink.c:195     rdma_nl_rcv_skb.constprop.0.isra.0+0x2e5/0x450 netlink_unicast_kernel net/netlink/af_netlink.c:1313     [inline] netlink_unicast+0x53a/0x7f0 net/netlink/af_netlink.c:1339 netlink_sendmsg+0x8d1/0xdd0     net/netlink/af_netlink.c:1883 sock_sendmsg_nosec net/socket.c:712 [inline] __sock_sendmsg net/socket.c:727     [inline] ____sys_sendmsg+0xa95/0xc70 net/socket.c:2566 ___sys_sendmsg+0x134/0x1d0 net/socket.c:2620
    __sys_sendmsg+0x16d/0x220 net/socket.c:2652 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]     do_syscall_64+0xcd/0x260 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f This     problem is similar to the problem that the commit 1d6a9e7449e2 (RDMA/core: Fix use-after-free when rename     device name) fixes. The root cause is: the function ib_device_rename() renames the name with lock. But in     the function kobject_uevent(), this name is accessed without lock protection at the same time. The     solution is to add the lock protection when this name is accessed in the function kobject_uevent().
    (CVE-2025-38022)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1771081379 advisory.

  - In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: Fix slab-use-after-     free Read in mgmt_remove_adv_monitor_sync This fixes the following crash:
    ================================================================== BUG: KASAN: slab-use-after-free in     mgmt_remove_adv_monitor_sync+0x3a/0xd0 net/bluetooth/mgmt.c:5543 Read of size 8 at addr ffff88814128f898     by task kworker/u9:4/5961 CPU: 1 UID: 0 PID: 5961 Comm: kworker/u9:4 Not tainted     6.12.0-syzkaller-10684-gf1cd565ce577 #0 Hardware name: Google Google Compute Engine/Google Compute Engine,     BIOS Google 09/13/2024 Workqueue: hci0 hci_cmd_sync_work Call Trace: <TASK> __dump_stack     lib/dump_stack.c:94 [inline] dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120 print_address_description     mm/kasan/report.c:378 [inline] print_report+0x169/0x550 mm/kasan/report.c:489 kasan_report+0x143/0x180     mm/kasan/report.c:602 mgmt_remove_adv_monitor_sync+0x3a/0xd0 net/bluetooth/mgmt.c:5543     hci_cmd_sync_work+0x22b/0x400 net/bluetooth/hci_sync.c:332 process_one_work kernel/workqueue.c:3229     [inline] process_scheduled_works+0xa63/0x1850 kernel/workqueue.c:3310 worker_thread+0x870/0xd30     kernel/workqueue.c:3391 kthread+0x2f0/0x390 kernel/kthread.c:389 ret_from_fork+0x4b/0x80     arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 </TASK> Allocated     by task 16026: kasan_save_stack mm/kasan/common.c:47 [inline] kasan_save_track+0x3f/0x80     mm/kasan/common.c:68 poison_kmalloc_redzone mm/kasan/common.c:377 [inline] __kasan_kmalloc+0x98/0xb0     mm/kasan/common.c:394 kasan_kmalloc include/linux/kasan.h:260 [inline] __kmalloc_cache_noprof+0x243/0x390     mm/slub.c:4314 kmalloc_noprof include/linux/slab.h:901 [inline] kzalloc_noprof include/linux/slab.h:1037     [inline] mgmt_pending_new+0x65/0x250 net/bluetooth/mgmt_util.c:269 mgmt_pending_add+0x36/0x120     net/bluetooth/mgmt_util.c:296 remove_adv_monitor+0x102/0x1b0 net/bluetooth/mgmt.c:5568     hci_mgmt_cmd+0xc47/0x11d0 net/bluetooth/hci_sock.c:1712 hci_sock_sendmsg+0x7b8/0x11c0     net/bluetooth/hci_sock.c:1832 sock_sendmsg_nosec net/socket.c:711 [inline] __sock_sendmsg+0x221/0x270     net/socket.c:726 sock_write_iter+0x2d7/0x3f0 net/socket.c:1147 new_sync_write fs/read_write.c:586 [inline]     vfs_write+0xaeb/0xd30 fs/read_write.c:679 ksys_write+0x18f/0x2b0 fs/read_write.c:731 do_syscall_x64     arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83     entry_SYSCALL_64_after_hwframe+0x77/0x7f Freed by task 16022: kasan_save_stack mm/kasan/common.c:47     [inline] kasan_save_track+0x3f/0x80 mm/kasan/common.c:68 kasan_save_free_info+0x40/0x50     mm/kasan/generic.c:582 poison_slab_object mm/kasan/common.c:247 [inline] __kasan_slab_free+0x59/0x70     mm/kasan/common.c:264 kasan_slab_free include/linux/kasan.h:233 [inline] slab_free_hook mm/slub.c:2338     [inline] slab_free mm/slub.c:4598 [inline] kfree+0x196/0x420 mm/slub.c:4746     mgmt_pending_foreach+0xd1/0x130 net/bluetooth/mgmt_util.c:259 __mgmt_power_off+0x183/0x430     net/bluetooth/mgmt.c:9550 hci_dev_close_sync+0x6c4/0x11c0 net/bluetooth/hci_sync.c:5208 hci_dev_do_close     net/bluetooth/hci_core.c:483 [inline] hci_dev_close+0x112/0x210 net/bluetooth/hci_core.c:508     sock_do_ioctl+0x158/0x460 net/socket.c:1209 sock_ioctl+0x626/0x8e0 net/socket.c:1328 vfs_ioctl     fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:906 [inline] __se_sys_ioctl+0xf5/0x170 fs/ioctl.c:892     do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83     entry_SYSCALL_64_after_hwframe+0x77/0x7f (CVE-2024-58013)

  - In the Linux kernel, the following vulnerability has been resolved: nvmet: fix out-of-bounds access in     nvmet_enable_port When trying to enable a port that has no transport configured yet, nvmet_enable_port()     uses NVMF_TRTYPE_MAX (255) to query the transports array, causing an out-of-bounds access: [ 106.058694]     BUG: KASAN: global-out-of-bounds in nvmet_enable_port+0x42/0x1da [ 106.058719] Read of size 8 at addr     ffffffff89dafa58 by task ln/632 [...] [ 106.076026] nvmet: transport type 255 not supported Since commit     200adac75888, NVMF_TRTYPE_MAX is the default state as configured by nvmet_ports_make(). Avoid this by     checking for NVMF_TRTYPE_MAX before proceeding. (CVE-2025-37825)

  - In the Linux kernel, the following vulnerability has been resolved: can: bcm: add locking for bcm_op     runtime updates The CAN broadcast manager (CAN BCM) can send a sequence of CAN frames via hrtimer. The     content and also the length of the sequence can be changed resp reduced at runtime where the 'currframe'     counter is then set to zero. Although this appeared to be a safe operation the updates of 'currframe' can     be triggered from user space and hrtimer context in bcm_can_tx(). Anderson Nascimento created a proof of     concept that triggered a KASAN slab-out-of-bounds read access which can be prevented with a spin_lock_bh.
    At the rework of bcm_can_tx() the 'count' variable has been moved into the protected section as this     variable can be modified from both contexts too. (CVE-2025-38004)

  - In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: Set n_channels after     allocating struct cfg80211_scan_request Make sure that n_channels is set after allocating the struct     cfg80211_registered_device::int_scan_req member. Seen with syzkaller: UBSAN: array-index-out-of-bounds in     net/mac80211/scan.c:1208:5 index 0 is out of range for type 'struct ieee80211_channel *[]
    __counted_by(n_channels)' (aka 'struct ieee80211_channel *[]') This was missed in the initial conversions     because I failed to locate the allocation likely due to the sizeof(void *) not matching the channels     array type. (CVE-2025-38013)

  - In the Linux kernel, the following vulnerability has been resolved: RDMA/core: Fix KASAN: slab-use-after-     free Read in ib_register_device problem Call Trace: __dump_stack lib/dump_stack.c:94 [inline]     dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:408 [inline]     print_report+0xc3/0x670 mm/kasan/report.c:521 kasan_report+0xe0/0x110 mm/kasan/report.c:634     strlen+0x93/0xa0 lib/string.c:420 __fortify_strlen include/linux/fortify-string.h:268 [inline]     get_kobj_path_length lib/kobject.c:118 [inline] kobject_get_path+0x3f/0x2a0 lib/kobject.c:158     kobject_uevent_env+0x289/0x1870 lib/kobject_uevent.c:545 ib_register_device     drivers/infiniband/core/device.c:1472 [inline] ib_register_device+0x8cf/0xe00     drivers/infiniband/core/device.c:1393 rxe_register_device+0x275/0x320     drivers/infiniband/sw/rxe/rxe_verbs.c:1552 rxe_net_add+0x8e/0xe0 drivers/infiniband/sw/rxe/rxe_net.c:550     rxe_newlink+0x70/0x190 drivers/infiniband/sw/rxe/rxe.c:225 nldev_newlink+0x3a3/0x680     drivers/infiniband/core/nldev.c:1796 rdma_nl_rcv_msg+0x387/0x6e0 drivers/infiniband/core/netlink.c:195     rdma_nl_rcv_skb.constprop.0.isra.0+0x2e5/0x450 netlink_unicast_kernel net/netlink/af_netlink.c:1313     [inline] netlink_unicast+0x53a/0x7f0 net/netlink/af_netlink.c:1339 netlink_sendmsg+0x8d1/0xdd0     net/netlink/af_netlink.c:1883 sock_sendmsg_nosec net/socket.c:712 [inline] __sock_sendmsg net/socket.c:727     [inline] ____sys_sendmsg+0xa95/0xc70 net/socket.c:2566 ___sys_sendmsg+0x134/0x1d0 net/socket.c:2620
    __sys_sendmsg+0x16d/0x220 net/socket.c:2652 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]     do_syscall_64+0xcd/0x260 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f This     problem is similar to the problem that the commit 1d6a9e7449e2 (RDMA/core: Fix use-after-free when rename     device name) fixes. The root cause is: the function ib_device_rename() renames the name with lock. But in     the function kobject_uevent(), this name is accessed without lock protection at the same time. The     solution is to add the lock protection when this name is accessed in the function kobject_uevent().
    (CVE-2025-38022)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Rocky Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-2026_1690 advisory.

    * kernel: Linux kernel: irqchip/gic-v2m use-after-free vulnerability (CVE-2025-37819)

    * kernel: RDMA/core: Fix KASAN: slab-use-after-free Read in ib_register_device problem (CVE-2025-38022)

    * kernel: Linux kernel use-after-free in eventpoll (CVE-2025-38349)

    * kernel: io_uring/msg_ring: ensure io_kiocb freeing is deferred for RCU (CVE-2025-38453)

    * kernel: net/sched: mqprio: fix stack out-of-bounds write in tc entry parsing (CVE-2025-38568)

    * kernel: drm/xe: Fix vm_bind_ioctl double free bug (CVE-2025-38731)

    * kernel: ASoC: Intel: bytcr_rt5640: Fix invalid quirk input mapping (CVE-2025-40154)

    * kernel: net: use dst_dev_rcu() in sk_setup_caps() (CVE-2025-40170)

    * kernel: ipv6: use RCU in ip6_xmit() (CVE-2025-40135)

    * kernel: ipv6: use RCU in ip6_output() (CVE-2025-40158)

    * kernel: Linux kernel: vsock vulnerability may lead to memory corruption (CVE-2025-40248)

    * kernel: mptcp: fix race condition in mptcp_schedule_work() (CVE-2025-40258)

    * kernel: devlink: rate: Unset parent pointer in devl_rate_nodes_destroy (CVE-2025-40251)

    * kernel: Linux kernel: Use-after-free in proc_readdir_de() can lead to privilege escalation or denial of     service. (CVE-2025-40271)

    * kernel: Linux kernel: Out-of-bounds write in Bluetooth MGMT can lead to information disclosure and     denial of service (CVE-2025-40294)

    * kernel: Linux kernel: Information disclosure and denial of service in Bluetooth HCI event handling     (CVE-2025-40301)

    * kernel: Bluetooth: hci_sync: fix race in hci_cmd_sync_dequeue_once (CVE-2025-40318)

    * kernel: net: atlantic: fix fragment overflow handling in RX path (CVE-2025-68301)

    * kernel: Bluetooth: hci_sock: Prevent race in socket write iter and sock bind (CVE-2025-68305)

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-2026_1143 advisory.

    * kernel: Linux kernel: Use-after-free in device mapper due to race condition in zone reporting     (CVE-2025-38141)

    * kernel: Linux kernel use-after-free in eventpoll (CVE-2025-38349)

    * kernel: drm/xe: Fix vm_bind_ioctl double free bug (CVE-2025-38731)

    * kernel: Linux kernel: vsock vulnerability may lead to memory corruption (CVE-2025-40248)

    * kernel: mptcp: fix race condition in mptcp_schedule_work() (CVE-2025-40258)

    * kernel: Linux kernel: Out-of-bounds write in Bluetooth MGMT can lead to information disclosure and     denial of service (CVE-2025-40294)

    * kernel: net: atlantic: fix fragment overflow handling in RX path (CVE-2025-68301)

    * kernel: Bluetooth: hci_sock: Prevent race in socket write iter and sock bind (CVE-2025-68305)

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:1690 advisory.

    * kernel: Linux kernel: irqchip/gic-v2m use-after-free vulnerability (CVE-2025-37819)

    * kernel: RDMA/core: Fix KASAN: slab-use-after-free Read in ib_register_device problem (CVE-2025-38022)

    * kernel: Linux kernel use-after-free in eventpoll (CVE-2025-38349)

    * kernel: io_uring/msg_ring: ensure io_kiocb freeing is deferred for RCU (CVE-2025-38453)

    * kernel: net/sched: mqprio: fix stack out-of-bounds write in tc entry parsing (CVE-2025-38568)

    * kernel: drm/xe: Fix vm_bind_ioctl double free bug (CVE-2025-38731)

    * kernel: ASoC: Intel: bytcr_rt5640: Fix invalid quirk input mapping (CVE-2025-40154)

    * kernel: net: use dst_dev_rcu() in sk_setup_caps() (CVE-2025-40170)

    * kernel: ipv6: use RCU in ip6_xmit() (CVE-2025-40135)

    * kernel: ipv6: use RCU in ip6_output() (CVE-2025-40158)

    * kernel: Linux kernel: vsock vulnerability may lead to memory corruption (CVE-2025-40248)

    * kernel: mptcp: fix race condition in mptcp_schedule_work() (CVE-2025-40258)

    * kernel: devlink: rate: Unset parent pointer in devl_rate_nodes_destroy (CVE-2025-40251)

    * kernel: Linux kernel: Use-after-free in proc_readdir_de() can lead to privilege escalation or denial of     service. (CVE-2025-40271)

    * kernel: Linux kernel: Out-of-bounds write in Bluetooth MGMT can lead to information disclosure and     denial of service (CVE-2025-40294)

    * kernel: Linux kernel: Information disclosure and denial of service in Bluetooth HCI event handling     (CVE-2025-40301)

    * kernel: Bluetooth: hci_sync: fix race in hci_cmd_sync_dequeue_once (CVE-2025-40318)

    * kernel: net: atlantic: fix fragment overflow handling in RX path (CVE-2025-68301)

    * kernel: Bluetooth: hci_sock: Prevent race in socket write iter and sock bind (CVE-2025-68305)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:1690 advisory.

    * kernel: Linux kernel: irqchip/gic-v2m use-after-free vulnerability (CVE-2025-37819)
      * kernel: RDMA/core: Fix KASAN: slab-use-after-free Read in ib_register_device problem     (CVE-2025-38022)
      * kernel: Linux kernel use-after-free in eventpoll (CVE-2025-38349)
      * kernel: io_uring/msg_ring: ensure io_kiocb freeing is deferred for RCU (CVE-2025-38453)
      * kernel: net/sched: mqprio: fix stack out-of-bounds write in tc entry parsing (CVE-2025-38568)
      * kernel: drm/xe: Fix vm_bind_ioctl double free bug (CVE-2025-38731)
      * kernel: ASoC: Intel: bytcr_rt5640: Fix invalid quirk input mapping (CVE-2025-40154)
      * kernel: net: use dst_dev_rcu() in sk_setup_caps() (CVE-2025-40170)
      * kernel: ipv6: use RCU in ip6_xmit() (CVE-2025-40135)
      * kernel: ipv6: use RCU in ip6_output() (CVE-2025-40158)
      * kernel: Linux kernel: vsock vulnerability may lead to memory corruption (CVE-2025-40248)
      * kernel: mptcp: fix race condition in mptcp_schedule_work() (CVE-2025-40258)
      * kernel: devlink: rate: Unset parent pointer in devl_rate_nodes_destroy (CVE-2025-40251)
      * kernel: Linux kernel: Use-after-free in proc_readdir_de() can lead to privilege escalation or denial     of service. (CVE-2025-40271)
      * kernel: Linux kernel: Out-of-bounds write in Bluetooth MGMT can lead to information disclosure and     denial of service (CVE-2025-40294)
      * kernel: Linux kernel: Information disclosure and denial of service in Bluetooth HCI event handling     (CVE-2025-40301)
      * kernel: Bluetooth: hci_sync: fix race in hci_cmd_sync_dequeue_once (CVE-2025-40318)
      * kernel: net: atlantic: fix fragment overflow handling in RX path (CVE-2025-68301)
      * kernel: Bluetooth: hci_sock: Prevent race in socket write iter and sock bind (CVE-2025-68305)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:1143 advisory.

    * kernel: Linux kernel: Use-after-free in device mapper due to race condition in zone reporting     (CVE-2025-38141)

    * kernel: Linux kernel use-after-free in eventpoll (CVE-2025-38349)

    * kernel: drm/xe: Fix vm_bind_ioctl double free bug (CVE-2025-38731)

    * kernel: Linux kernel: vsock vulnerability may lead to memory corruption (CVE-2025-40248)

    * kernel: mptcp: fix race condition in mptcp_schedule_work() (CVE-2025-40258)

    * kernel: Linux kernel: Out-of-bounds write in Bluetooth MGMT can lead to information disclosure and     denial of service (CVE-2025-40294)

    * kernel: net: atlantic: fix fragment overflow handling in RX path (CVE-2025-68301)

    * kernel: Bluetooth: hci_sock: Prevent race in socket write iter and sock bind (CVE-2025-68305)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-144:08 advisory.

    * kernel: Linux kernel: Use-after-free in device mapper due to race condition in zone reporting     (CVE-2025-38141)
      * kernel: Linux kernel use-after-free in eventpoll (CVE-2025-38349)
      * kernel: drm/xe: Fix vm_bind_ioctl double free bug (CVE-2025-38731)
      * kernel: Linux kernel: vsock vulnerability may lead to memory corruption (CVE-2025-40248)
      * kernel: mptcp: fix race condition in mptcp_schedule_work() (CVE-2025-40258)
      * kernel: Linux kernel: Out-of-bounds write in Bluetooth MGMT can lead to information disclosure and     denial of service (CVE-2025-40294)
      * kernel: net: atlantic: fix fragment overflow handling in RX path (CVE-2025-68301)
      * kernel: Bluetooth: hci_sock: Prevent race in socket write iter and sock bind (CVE-2025-68305)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-1690 advisory.

    - RDMA/core: Fix 'KASAN: slab-use-after-free Read in ib_register_device' problem (CKI Backport Bot)     [RHEL-134363] {CVE-2025-38022}
    - ASoC: Intel: bytcr_rt5640: Fix invalid quirk input mapping (CKI Backport Bot) [RHEL-129115]     {CVE-2025-40154}
    - io_uring/msg_ring: ensure io_kiocb freeing is deferred for RCU (Jeff Moyer) [RHEL-129623]     {CVE-2025-38453}
    - net: atlantic: fix fragment overflow handling in RX path (CKI Backport Bot) [RHEL-139490]     {CVE-2025-68301}
    - Bluetooth: hci_sock: Prevent race in socket write iter and sock bind (CKI Backport Bot) [RHEL-139465]     {CVE-2025-68305}
    - vsock: Ignore signal/timeout on connect() if already established (CKI Backport Bot) [RHEL-139287]     {CVE-2025-40248}
    - net: use dst_dev_rcu() in sk_setup_caps() (Hangbin Liu) [RHEL-129087] {CVE-2025-40170}
    - ipv6: use RCU in ip6_xmit() (Hangbin Liu) [RHEL-129026] {CVE-2025-40135}
    - ipv6: use RCU in ip6_output() (Hangbin Liu) [RHEL-128991] {CVE-2025-40158}
    - eventpoll: don't decrement ep refcount while still holding the ep mutex (CKI Backport Bot) [RHEL-138041]     {CVE-2025-38349}
    - fs/proc: fix uaf in proc_readdir_de() (CKI Backport Bot) [RHEL-137101] {CVE-2025-40271}
    - Bluetooth: MGMT: Fix OOB access in parse_adv_monitor_pattern() (CKI Backport Bot) [RHEL-136972]     {CVE-2025-40294}
    - Bluetooth: hci_event: validate skb length for unknown CC opcode (CKI Backport Bot) [RHEL-136951]     {CVE-2025-40301}
    - net/sched: mqprio: fix stack out-of-bounds write in tc entry parsing (CKI Backport Bot) [RHEL-136836]     {CVE-2025-38568}
    - Bluetooth: hci_sync: fix race in hci_cmd_sync_dequeue_once (CKI Backport Bot) [RHEL-136259]     {CVE-2025-40318}
    - devlink: rate: Unset parent pointer in devl_rate_nodes_destroy (CKI Backport Bot) [RHEL-134926]     {CVE-2025-40251}
    - mptcp: fix race condition in mptcp_schedule_work() (CKI Backport Bot) [RHEL-134451] {CVE-2025-40258}
    - irqchip/gic-v2m: Prevent use after free of gicv2m_get_fwnode() (CKI Backport Bot) [RHEL-131989]     {CVE-2025-37819}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:1690 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: Linux kernel: irqchip/gic-v2m use-after-free vulnerability (CVE-2025-37819)

    * kernel: RDMA/core: Fix KASAN: slab-use-after-free Read in ib_register_device problem (CVE-2025-38022)

    * kernel: Linux kernel use-after-free in eventpoll (CVE-2025-38349)

    * kernel: io_uring/msg_ring: ensure io_kiocb freeing is deferred for RCU (CVE-2025-38453)

    * kernel: net/sched: mqprio: fix stack out-of-bounds write in tc entry parsing (CVE-2025-38568)

    * kernel: drm/xe: Fix vm_bind_ioctl double free bug (CVE-2025-38731)

    * kernel: ASoC: Intel: bytcr_rt5640: Fix invalid quirk input mapping (CVE-2025-40154)

    * kernel: net: use dst_dev_rcu() in sk_setup_caps() (CVE-2025-40170)

    * kernel: ipv6: use RCU in ip6_xmit() (CVE-2025-40135)

    * kernel: ipv6: use RCU in ip6_output() (CVE-2025-40158)

    * kernel: Linux kernel: vsock vulnerability may lead to memory corruption (CVE-2025-40248)

    * kernel: mptcp: fix race condition in mptcp_schedule_work() (CVE-2025-40258)

    * kernel: devlink: rate: Unset parent pointer in devl_rate_nodes_destroy (CVE-2025-40251)

    * kernel: Linux kernel: Use-after-free in proc_readdir_de() can lead to privilege escalation or denial of     service. (CVE-2025-40271)

    * kernel: Linux kernel: Out-of-bounds write in Bluetooth MGMT can lead to information disclosure and     denial of service (CVE-2025-40294)

    * kernel: Linux kernel: Information disclosure and denial of service in Bluetooth HCI event handling     (CVE-2025-40301)

    * kernel: Bluetooth: hci_sync: fix race in hci_cmd_sync_dequeue_once (CVE-2025-40318)

    * kernel: net: atlantic: fix fragment overflow handling in RX path (CVE-2025-68301)

    * kernel: Bluetooth: hci_sock: Prevent race in socket write iter and sock bind (CVE-2025-68305)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:1143 advisory.

    * kernel: Linux kernel: Use-after-free in device mapper due to race condition in zone reporting     (CVE-2025-38141)
      * kernel: Linux kernel use-after-free in eventpoll (CVE-2025-38349)
      * kernel: drm/xe: Fix vm_bind_ioctl double free bug (CVE-2025-38731)
      * kernel: Linux kernel: vsock vulnerability may lead to memory corruption (CVE-2025-40248)
      * kernel: mptcp: fix race condition in mptcp_schedule_work() (CVE-2025-40258)
      * kernel: Linux kernel: Out-of-bounds write in Bluetooth MGMT can lead to information disclosure and     denial of service (CVE-2025-40294)
      * kernel: net: atlantic: fix fragment overflow handling in RX path (CVE-2025-68301)
      * kernel: Bluetooth: hci_sock: Prevent race in socket write iter and sock bind (CVE-2025-68305)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-1143 advisory.

    - Bluetooth: hci_sock: Prevent race in socket write iter and sock bind (CKI Backport Bot) [RHEL-139462]     {CVE-2025-68305}
    - dm: fix dm_blk_report_zones (CKI Backport Bot) [RHEL-137949] {CVE-2025-38141}
    - Bluetooth: MGMT: Fix OOB access in parse_adv_monitor_pattern() (CKI Backport Bot) [RHEL-136964]     {CVE-2025-40294}
    - drm/xe: Fix vm_bind_ioctl double free bug (CKI Backport Bot) [RHEL-122309] {CVE-2025-38731}
    - net: atlantic: fix fragment overflow handling in RX path (CKI Backport Bot) [RHEL-139487]     {CVE-2025-68301}
    - vsock: Ignore signal/timeout on connect() if already established (CKI Backport Bot) [RHEL-139284]     {CVE-2025-40248}
    - eventpoll: don't decrement ep refcount while still holding the ep mutex (CKI Backport Bot) [RHEL-138035]     {CVE-2025-38349}
    - mptcp: fix race condition in mptcp_schedule_work() (CKI Backport Bot) [RHEL-134448] {CVE-2025-40258}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:1143 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: Linux kernel: Use-after-free in device mapper due to race condition in zone reporting     (CVE-2025-38141)

    * kernel: Linux kernel use-after-free in eventpoll (CVE-2025-38349)

    * kernel: drm/xe: Fix vm_bind_ioctl double free bug (CVE-2025-38731)

    * kernel: Linux kernel: vsock vulnerability may lead to memory corruption (CVE-2025-40248)

    * kernel: mptcp: fix race condition in mptcp_schedule_work() (CVE-2025-40258)

    * kernel: Linux kernel: Out-of-bounds write in Bluetooth MGMT can lead to information disclosure and     denial of service (CVE-2025-40294)

    * kernel: net: atlantic: fix fragment overflow handling in RX path (CVE-2025-68301)

    * kernel: Bluetooth: hci_sock: Prevent race in socket write iter and sock bind (CVE-2025-68305)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - In the Linux kernel, the following vulnerability has been resolved: drm/xe: Fix vm_bind_ioctl double free     bug If the argument check during an array bind fails, the bind_ops are freed twice as seen below. Fix this     by setting bind_ops to NULL after freeing.
    ================================================================== BUG: KASAN: double-free in     xe_vm_bind_ioctl+0x1b2/0x21f0 [xe] Free of addr ffff88813bb9b800 by task xe_vm/14198 CPU: 5 UID: 0 PID:
    14198 Comm: xe_vm Not tainted 6.16.0-xe-eudebug-cmanszew+ #520 PREEMPT(full) Hardware name: Intel     Corporation Alder Lake Client Platform/AlderLake-P DDR5 RVP, BIOS ADLPFWI1.R00.2411.A02.2110081023     10/08/2021 Call Trace: <TASK> dump_stack_lvl+0x82/0xd0 print_report+0xcb/0x610 ?
    __virt_addr_valid+0x19a/0x300 ? xe_vm_bind_ioctl+0x1b2/0x21f0 [xe] kasan_report_invalid_free+0xc8/0xf0 ?     xe_vm_bind_ioctl+0x1b2/0x21f0 [xe] ? xe_vm_bind_ioctl+0x1b2/0x21f0 [xe] check_slab_allocation+0x102/0x130     kfree+0x10d/0x440 ? should_fail_ex+0x57/0x2f0 ? xe_vm_bind_ioctl+0x1b2/0x21f0 [xe]     xe_vm_bind_ioctl+0x1b2/0x21f0 [xe] ? __pfx_xe_vm_bind_ioctl+0x10/0x10 [xe] ? __lock_acquire+0xab9/0x27f0 ?     lock_acquire+0x165/0x300 ? drm_dev_enter+0x53/0xe0 [drm] ? find_held_lock+0x2b/0x80 ?     drm_dev_exit+0x30/0x50 [drm] ? drm_ioctl_kernel+0x128/0x1c0 [drm] drm_ioctl_kernel+0x128/0x1c0 [drm] ?
    __pfx_xe_vm_bind_ioctl+0x10/0x10 [xe] ? find_held_lock+0x2b/0x80 ? __pfx_drm_ioctl_kernel+0x10/0x10 [drm]     ? should_fail_ex+0x57/0x2f0 ? __pfx_xe_vm_bind_ioctl+0x10/0x10 [xe] drm_ioctl+0x352/0x620 [drm] ?
    __pfx_drm_ioctl+0x10/0x10 [drm] ? __pfx_rpm_resume+0x10/0x10 ? do_raw_spin_lock+0x11a/0x1b0 ?     find_held_lock+0x2b/0x80 ? __pm_runtime_resume+0x61/0xc0 ? rcu_is_watching+0x20/0x50 ?     trace_irq_enable.constprop.0+0xac/0xe0 xe_drm_ioctl+0x91/0xc0 [xe] __x64_sys_ioctl+0xb2/0x100 ?     rcu_is_watching+0x20/0x50 do_syscall_64+0x68/0x2e0 entry_SYSCALL_64_after_hwframe+0x76/0x7e RIP:
    0033:0x7fa9acb24ded (cherry picked from commit a01b704527c28a2fd43a17a85f8996b75ec8492a) (CVE-2025-38731)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
361179	AlmaLinux 9.6 [TuxCare] Security Update: kernel / kernel-abi-stablelists / kernel-core / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1771081379)	Nessus	Alma Linux Local Security Checks	Local	high
361071	Rocky Linux 9.6 [TuxCare] Security Update: kernel / kernel-abi-stablelists / kernel-core / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1771081379)	Nessus	Rocky Linux Local Security Checks	Local	high
356543	Rocky Linux 10 [CIQ] Security Update: kernel / kernel-64k / kernel-64k-core / kernel-64k-debug / etc Multiple Vulnerabilities (crlsa-2026_1690)	Nessus	Rocky Linux Local Security Checks	Local	high
355821	Rocky Linux 9 [CIQ] Security Update: kernel / kernel-64k / kernel-64k-core / kernel-64k-debug / etc Multiple Vulnerabilities (crlsa-2026_1143)	Nessus	Rocky Linux Local Security Checks	Local	high
298315	RockyLinux 10 : kernel (RLSA-2026:1690)	Nessus	Rocky Linux Local Security Checks	Local	high
298047	AlmaLinux 10 : kernel (ALSA-2026:1690)	Nessus	Alma Linux Local Security Checks	Local	high
298023	RockyLinux 9 : kernel (RLSA-2026:1143)	Nessus	Rocky Linux Local Security Checks	Local	high
297994	MiracleLinux 9 : kernel-5.14.0-611.26.1.el9_7 (AXSA:2026-144:08)	Nessus	Miracle Linux Local Security Checks	Local	high
297701	Oracle Linux 10 : kernel (ELSA-2026-1690)	Nessus	Oracle Linux Local Security Checks	Local	high
297575	RHEL 10 : kernel (RHSA-2026:1690)	Nessus	Red Hat Local Security Checks	Local	high
297205	AlmaLinux 9 : kernel (ALSA-2026:1143)	Nessus	Alma Linux Local Security Checks	Local	high
296967	Oracle Linux 9 : kernel (ELSA-2026-1143)	Nessus	Oracle Linux Local Security Checks	Local	high
296624	RHEL 9 : kernel (RHSA-2026:1143)	Nessus	Red Hat Local Security Checks	Local	high
261601	Linux Distros Unpatched Vulnerability : CVE-2025-38731	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2025-38731

high

Tenable Plugins

high

high

high

high

high

high

high

high

high

high

high

high

high

high