In the Linux kernel, the following vulnerability has been resolved: drm/xe: Fix vm_bind_ioctl double free bug If the argument check during an array bind fails, the bind_ops are freed twice as seen below. Fix this by setting bind_ops to NULL after freeing. ================================================================== BUG: KASAN: double-free in xe_vm_bind_ioctl+0x1b2/0x21f0 [xe] Free of addr ffff88813bb9b800 by task xe_vm/14198 CPU: 5 UID: 0 PID: 14198 Comm: xe_vm Not tainted 6.16.0-xe-eudebug-cmanszew+ #520 PREEMPT(full) Hardware name: Intel Corporation Alder Lake Client Platform/AlderLake-P DDR5 RVP, BIOS ADLPFWI1.R00.2411.A02.2110081023 10/08/2021 Call Trace: <TASK> dump_stack_lvl+0x82/0xd0 print_report+0xcb/0x610 ? __virt_addr_valid+0x19a/0x300 ? xe_vm_bind_ioctl+0x1b2/0x21f0 [xe] kasan_report_invalid_free+0xc8/0xf0 ? xe_vm_bind_ioctl+0x1b2/0x21f0 [xe] ? xe_vm_bind_ioctl+0x1b2/0x21f0 [xe] check_slab_allocation+0x102/0x130 kfree+0x10d/0x440 ? should_fail_ex+0x57/0x2f0 ? xe_vm_bind_ioctl+0x1b2/0x21f0 [xe] xe_vm_bind_ioctl+0x1b2/0x21f0 [xe] ? __pfx_xe_vm_bind_ioctl+0x10/0x10 [xe] ? __lock_acquire+0xab9/0x27f0 ? lock_acquire+0x165/0x300 ? drm_dev_enter+0x53/0xe0 [drm] ? find_held_lock+0x2b/0x80 ? drm_dev_exit+0x30/0x50 [drm] ? drm_ioctl_kernel+0x128/0x1c0 [drm] drm_ioctl_kernel+0x128/0x1c0 [drm] ? __pfx_xe_vm_bind_ioctl+0x10/0x10 [xe] ? find_held_lock+0x2b/0x80 ? __pfx_drm_ioctl_kernel+0x10/0x10 [drm] ? should_fail_ex+0x57/0x2f0 ? __pfx_xe_vm_bind_ioctl+0x10/0x10 [xe] drm_ioctl+0x352/0x620 [drm] ? __pfx_drm_ioctl+0x10/0x10 [drm] ? __pfx_rpm_resume+0x10/0x10 ? do_raw_spin_lock+0x11a/0x1b0 ? find_held_lock+0x2b/0x80 ? __pm_runtime_resume+0x61/0xc0 ? rcu_is_watching+0x20/0x50 ? trace_irq_enable.constprop.0+0xac/0xe0 xe_drm_ioctl+0x91/0xc0 [xe] __x64_sys_ioctl+0xb2/0x100 ? rcu_is_watching+0x20/0x50 do_syscall_64+0x68/0x2e0 entry_SYSCALL_64_after_hwframe+0x76/0x7e RIP: 0033:0x7fa9acb24ded (cherry picked from commit a01b704527c28a2fd43a17a85f8996b75ec8492a)

The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:1690 advisory.

    * kernel: Linux kernel: irqchip/gic-v2m use-after-free vulnerability (CVE-2025-37819)

    * kernel: RDMA/core: Fix KASAN: slab-use-after-free Read in ib_register_device problem (CVE-2025-38022)

    * kernel: Linux kernel use-after-free in eventpoll (CVE-2025-38349)

    * kernel: io_uring/msg_ring: ensure io_kiocb freeing is deferred for RCU (CVE-2025-38453)

    * kernel: net/sched: mqprio: fix stack out-of-bounds write in tc entry parsing (CVE-2025-38568)

    * kernel: drm/xe: Fix vm_bind_ioctl double free bug (CVE-2025-38731)

    * kernel: ASoC: Intel: bytcr_rt5640: Fix invalid quirk input mapping (CVE-2025-40154)

    * kernel: net: use dst_dev_rcu() in sk_setup_caps() (CVE-2025-40170)

    * kernel: ipv6: use RCU in ip6_xmit() (CVE-2025-40135)

    * kernel: ipv6: use RCU in ip6_output() (CVE-2025-40158)

    * kernel: Linux kernel: vsock vulnerability may lead to memory corruption (CVE-2025-40248)

    * kernel: mptcp: fix race condition in mptcp_schedule_work() (CVE-2025-40258)

    * kernel: devlink: rate: Unset parent pointer in devl_rate_nodes_destroy (CVE-2025-40251)

    * kernel: Linux kernel: Use-after-free in proc_readdir_de() can lead to privilege escalation or denial of     service. (CVE-2025-40271)

    * kernel: Linux kernel: Out-of-bounds write in Bluetooth MGMT can lead to information disclosure and     denial of service (CVE-2025-40294)

    * kernel: Linux kernel: Information disclosure and denial of service in Bluetooth HCI event handling     (CVE-2025-40301)

    * kernel: Bluetooth: hci_sync: fix race in hci_cmd_sync_dequeue_once (CVE-2025-40318)

    * kernel: net: atlantic: fix fragment overflow handling in RX path (CVE-2025-68301)

    * kernel: Bluetooth: hci_sock: Prevent race in socket write iter and sock bind (CVE-2025-68305)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:1690 advisory.

    * kernel: Linux kernel: irqchip/gic-v2m use-after-free vulnerability (CVE-2025-37819)
      * kernel: RDMA/core: Fix KASAN: slab-use-after-free Read in ib_register_device problem     (CVE-2025-38022)
      * kernel: Linux kernel use-after-free in eventpoll (CVE-2025-38349)
      * kernel: io_uring/msg_ring: ensure io_kiocb freeing is deferred for RCU (CVE-2025-38453)
      * kernel: net/sched: mqprio: fix stack out-of-bounds write in tc entry parsing (CVE-2025-38568)
      * kernel: drm/xe: Fix vm_bind_ioctl double free bug (CVE-2025-38731)
      * kernel: ASoC: Intel: bytcr_rt5640: Fix invalid quirk input mapping (CVE-2025-40154)
      * kernel: net: use dst_dev_rcu() in sk_setup_caps() (CVE-2025-40170)
      * kernel: ipv6: use RCU in ip6_xmit() (CVE-2025-40135)
      * kernel: ipv6: use RCU in ip6_output() (CVE-2025-40158)
      * kernel: Linux kernel: vsock vulnerability may lead to memory corruption (CVE-2025-40248)
      * kernel: mptcp: fix race condition in mptcp_schedule_work() (CVE-2025-40258)
      * kernel: devlink: rate: Unset parent pointer in devl_rate_nodes_destroy (CVE-2025-40251)
      * kernel: Linux kernel: Use-after-free in proc_readdir_de() can lead to privilege escalation or denial     of service. (CVE-2025-40271)
      * kernel: Linux kernel: Out-of-bounds write in Bluetooth MGMT can lead to information disclosure and     denial of service (CVE-2025-40294)
      * kernel: Linux kernel: Information disclosure and denial of service in Bluetooth HCI event handling     (CVE-2025-40301)
      * kernel: Bluetooth: hci_sync: fix race in hci_cmd_sync_dequeue_once (CVE-2025-40318)
      * kernel: net: atlantic: fix fragment overflow handling in RX path (CVE-2025-68301)
      * kernel: Bluetooth: hci_sock: Prevent race in socket write iter and sock bind (CVE-2025-68305)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:1143 advisory.

    * kernel: Linux kernel: Use-after-free in device mapper due to race condition in zone reporting     (CVE-2025-38141)

    * kernel: Linux kernel use-after-free in eventpoll (CVE-2025-38349)

    * kernel: drm/xe: Fix vm_bind_ioctl double free bug (CVE-2025-38731)

    * kernel: Linux kernel: vsock vulnerability may lead to memory corruption (CVE-2025-40248)

    * kernel: mptcp: fix race condition in mptcp_schedule_work() (CVE-2025-40258)

    * kernel: Linux kernel: Out-of-bounds write in Bluetooth MGMT can lead to information disclosure and     denial of service (CVE-2025-40294)

    * kernel: net: atlantic: fix fragment overflow handling in RX path (CVE-2025-68301)

    * kernel: Bluetooth: hci_sock: Prevent race in socket write iter and sock bind (CVE-2025-68305)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-144:08 advisory.

    * kernel: Linux kernel: Use-after-free in device mapper due to race condition in zone reporting     (CVE-2025-38141)
      * kernel: Linux kernel use-after-free in eventpoll (CVE-2025-38349)
      * kernel: drm/xe: Fix vm_bind_ioctl double free bug (CVE-2025-38731)
      * kernel: Linux kernel: vsock vulnerability may lead to memory corruption (CVE-2025-40248)
      * kernel: mptcp: fix race condition in mptcp_schedule_work() (CVE-2025-40258)
      * kernel: Linux kernel: Out-of-bounds write in Bluetooth MGMT can lead to information disclosure and     denial of service (CVE-2025-40294)
      * kernel: net: atlantic: fix fragment overflow handling in RX path (CVE-2025-68301)
      * kernel: Bluetooth: hci_sock: Prevent race in socket write iter and sock bind (CVE-2025-68305)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-1690 advisory.

    - RDMA/core: Fix 'KASAN: slab-use-after-free Read in ib_register_device' problem (CKI Backport Bot)     [RHEL-134363] {CVE-2025-38022}
    - ASoC: Intel: bytcr_rt5640: Fix invalid quirk input mapping (CKI Backport Bot) [RHEL-129115]     {CVE-2025-40154}
    - io_uring/msg_ring: ensure io_kiocb freeing is deferred for RCU (Jeff Moyer) [RHEL-129623]     {CVE-2025-38453}
    - net: atlantic: fix fragment overflow handling in RX path (CKI Backport Bot) [RHEL-139490]     {CVE-2025-68301}
    - Bluetooth: hci_sock: Prevent race in socket write iter and sock bind (CKI Backport Bot) [RHEL-139465]     {CVE-2025-68305}
    - vsock: Ignore signal/timeout on connect() if already established (CKI Backport Bot) [RHEL-139287]     {CVE-2025-40248}
    - net: use dst_dev_rcu() in sk_setup_caps() (Hangbin Liu) [RHEL-129087] {CVE-2025-40170}
    - ipv6: use RCU in ip6_xmit() (Hangbin Liu) [RHEL-129026] {CVE-2025-40135}
    - ipv6: use RCU in ip6_output() (Hangbin Liu) [RHEL-128991] {CVE-2025-40158}
    - eventpoll: don't decrement ep refcount while still holding the ep mutex (CKI Backport Bot) [RHEL-138041]     {CVE-2025-38349}
    - fs/proc: fix uaf in proc_readdir_de() (CKI Backport Bot) [RHEL-137101] {CVE-2025-40271}
    - Bluetooth: MGMT: Fix OOB access in parse_adv_monitor_pattern() (CKI Backport Bot) [RHEL-136972]     {CVE-2025-40294}
    - Bluetooth: hci_event: validate skb length for unknown CC opcode (CKI Backport Bot) [RHEL-136951]     {CVE-2025-40301}
    - net/sched: mqprio: fix stack out-of-bounds write in tc entry parsing (CKI Backport Bot) [RHEL-136836]     {CVE-2025-38568}
    - Bluetooth: hci_sync: fix race in hci_cmd_sync_dequeue_once (CKI Backport Bot) [RHEL-136259]     {CVE-2025-40318}
    - devlink: rate: Unset parent pointer in devl_rate_nodes_destroy (CKI Backport Bot) [RHEL-134926]     {CVE-2025-40251}
    - mptcp: fix race condition in mptcp_schedule_work() (CKI Backport Bot) [RHEL-134451] {CVE-2025-40258}
    - irqchip/gic-v2m: Prevent use after free of gicv2m_get_fwnode() (CKI Backport Bot) [RHEL-131989]     {CVE-2025-37819}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:1690 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: Linux kernel: irqchip/gic-v2m use-after-free vulnerability (CVE-2025-37819)

    * kernel: RDMA/core: Fix KASAN: slab-use-after-free Read in ib_register_device problem (CVE-2025-38022)

    * kernel: Linux kernel use-after-free in eventpoll (CVE-2025-38349)

    * kernel: io_uring/msg_ring: ensure io_kiocb freeing is deferred for RCU (CVE-2025-38453)

    * kernel: net/sched: mqprio: fix stack out-of-bounds write in tc entry parsing (CVE-2025-38568)

    * kernel: drm/xe: Fix vm_bind_ioctl double free bug (CVE-2025-38731)

    * kernel: ASoC: Intel: bytcr_rt5640: Fix invalid quirk input mapping (CVE-2025-40154)

    * kernel: net: use dst_dev_rcu() in sk_setup_caps() (CVE-2025-40170)

    * kernel: ipv6: use RCU in ip6_xmit() (CVE-2025-40135)

    * kernel: ipv6: use RCU in ip6_output() (CVE-2025-40158)

    * kernel: Linux kernel: vsock vulnerability may lead to memory corruption (CVE-2025-40248)

    * kernel: mptcp: fix race condition in mptcp_schedule_work() (CVE-2025-40258)

    * kernel: devlink: rate: Unset parent pointer in devl_rate_nodes_destroy (CVE-2025-40251)

    * kernel: Linux kernel: Use-after-free in proc_readdir_de() can lead to privilege escalation or denial of     service. (CVE-2025-40271)

    * kernel: Linux kernel: Out-of-bounds write in Bluetooth MGMT can lead to information disclosure and     denial of service (CVE-2025-40294)

    * kernel: Linux kernel: Information disclosure and denial of service in Bluetooth HCI event handling     (CVE-2025-40301)

    * kernel: Bluetooth: hci_sync: fix race in hci_cmd_sync_dequeue_once (CVE-2025-40318)

    * kernel: net: atlantic: fix fragment overflow handling in RX path (CVE-2025-68301)

    * kernel: Bluetooth: hci_sock: Prevent race in socket write iter and sock bind (CVE-2025-68305)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:1143 advisory.

    * kernel: Linux kernel: Use-after-free in device mapper due to race condition in zone reporting     (CVE-2025-38141)
      * kernel: Linux kernel use-after-free in eventpoll (CVE-2025-38349)
      * kernel: drm/xe: Fix vm_bind_ioctl double free bug (CVE-2025-38731)
      * kernel: Linux kernel: vsock vulnerability may lead to memory corruption (CVE-2025-40248)
      * kernel: mptcp: fix race condition in mptcp_schedule_work() (CVE-2025-40258)
      * kernel: Linux kernel: Out-of-bounds write in Bluetooth MGMT can lead to information disclosure and     denial of service (CVE-2025-40294)
      * kernel: net: atlantic: fix fragment overflow handling in RX path (CVE-2025-68301)
      * kernel: Bluetooth: hci_sock: Prevent race in socket write iter and sock bind (CVE-2025-68305)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-1143 advisory.

    - Bluetooth: hci_sock: Prevent race in socket write iter and sock bind (CKI Backport Bot) [RHEL-139462]     {CVE-2025-68305}
    - dm: fix dm_blk_report_zones (CKI Backport Bot) [RHEL-137949] {CVE-2025-38141}
    - Bluetooth: MGMT: Fix OOB access in parse_adv_monitor_pattern() (CKI Backport Bot) [RHEL-136964]     {CVE-2025-40294}
    - drm/xe: Fix vm_bind_ioctl double free bug (CKI Backport Bot) [RHEL-122309] {CVE-2025-38731}
    - net: atlantic: fix fragment overflow handling in RX path (CKI Backport Bot) [RHEL-139487]     {CVE-2025-68301}
    - vsock: Ignore signal/timeout on connect() if already established (CKI Backport Bot) [RHEL-139284]     {CVE-2025-40248}
    - eventpoll: don't decrement ep refcount while still holding the ep mutex (CKI Backport Bot) [RHEL-138035]     {CVE-2025-38349}
    - mptcp: fix race condition in mptcp_schedule_work() (CKI Backport Bot) [RHEL-134448] {CVE-2025-40258}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:1143 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: Linux kernel: Use-after-free in device mapper due to race condition in zone reporting     (CVE-2025-38141)

    * kernel: Linux kernel use-after-free in eventpoll (CVE-2025-38349)

    * kernel: drm/xe: Fix vm_bind_ioctl double free bug (CVE-2025-38731)

    * kernel: Linux kernel: vsock vulnerability may lead to memory corruption (CVE-2025-40248)

    * kernel: mptcp: fix race condition in mptcp_schedule_work() (CVE-2025-40258)

    * kernel: Linux kernel: Out-of-bounds write in Bluetooth MGMT can lead to information disclosure and     denial of service (CVE-2025-40294)

    * kernel: net: atlantic: fix fragment overflow handling in RX path (CVE-2025-68301)

    * kernel: Bluetooth: hci_sock: Prevent race in socket write iter and sock bind (CVE-2025-68305)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - In the Linux kernel, the following vulnerability has been resolved: drm/xe: Fix vm_bind_ioctl double free     bug If the argument check during an array bind fails, the bind_ops are freed twice as seen below. Fix this     by setting bind_ops to NULL after freeing.
    ================================================================== BUG: KASAN: double-free in     xe_vm_bind_ioctl+0x1b2/0x21f0 [xe] Free of addr ffff88813bb9b800 by task xe_vm/14198 CPU: 5 UID: 0 PID:
    14198 Comm: xe_vm Not tainted 6.16.0-xe-eudebug-cmanszew+ #520 PREEMPT(full) Hardware name: Intel     Corporation Alder Lake Client Platform/AlderLake-P DDR5 RVP, BIOS ADLPFWI1.R00.2411.A02.2110081023     10/08/2021 Call Trace: <TASK> dump_stack_lvl+0x82/0xd0 print_report+0xcb/0x610 ?
    __virt_addr_valid+0x19a/0x300 ? xe_vm_bind_ioctl+0x1b2/0x21f0 [xe] kasan_report_invalid_free+0xc8/0xf0 ?     xe_vm_bind_ioctl+0x1b2/0x21f0 [xe] ? xe_vm_bind_ioctl+0x1b2/0x21f0 [xe] check_slab_allocation+0x102/0x130     kfree+0x10d/0x440 ? should_fail_ex+0x57/0x2f0 ? xe_vm_bind_ioctl+0x1b2/0x21f0 [xe]     xe_vm_bind_ioctl+0x1b2/0x21f0 [xe] ? __pfx_xe_vm_bind_ioctl+0x10/0x10 [xe] ? __lock_acquire+0xab9/0x27f0 ?     lock_acquire+0x165/0x300 ? drm_dev_enter+0x53/0xe0 [drm] ? find_held_lock+0x2b/0x80 ?     drm_dev_exit+0x30/0x50 [drm] ? drm_ioctl_kernel+0x128/0x1c0 [drm] drm_ioctl_kernel+0x128/0x1c0 [drm] ?
    __pfx_xe_vm_bind_ioctl+0x10/0x10 [xe] ? find_held_lock+0x2b/0x80 ? __pfx_drm_ioctl_kernel+0x10/0x10 [drm]     ? should_fail_ex+0x57/0x2f0 ? __pfx_xe_vm_bind_ioctl+0x10/0x10 [xe] drm_ioctl+0x352/0x620 [drm] ?
    __pfx_drm_ioctl+0x10/0x10 [drm] ? __pfx_rpm_resume+0x10/0x10 ? do_raw_spin_lock+0x11a/0x1b0 ?     find_held_lock+0x2b/0x80 ? __pm_runtime_resume+0x61/0xc0 ? rcu_is_watching+0x20/0x50 ?     trace_irq_enable.constprop.0+0xac/0xe0 xe_drm_ioctl+0x91/0xc0 [xe] __x64_sys_ioctl+0xb2/0x100 ?     rcu_is_watching+0x20/0x50 do_syscall_64+0x68/0x2e0 entry_SYSCALL_64_after_hwframe+0x76/0x7e RIP:
    0033:0x7fa9acb24ded (cherry picked from commit a01b704527c28a2fd43a17a85f8996b75ec8492a) (CVE-2025-38731)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
298315	RockyLinux 10 : kernel (RLSA-2026:1690)	Nessus	Rocky Linux Local Security Checks	high
298047	AlmaLinux 10 : kernel (ALSA-2026:1690)	Nessus	Alma Linux Local Security Checks	high
298023	RockyLinux 9 : kernel (RLSA-2026:1143)	Nessus	Rocky Linux Local Security Checks	high
297994	MiracleLinux 9 : kernel-5.14.0-611.26.1.el9_7 (AXSA:2026-144:08)	Nessus	Miracle Linux Local Security Checks	high
297701	Oracle Linux 10 : kernel (ELSA-2026-1690)	Nessus	Oracle Linux Local Security Checks	high
297575	RHEL 10 : kernel (RHSA-2026:1690)	Nessus	Red Hat Local Security Checks	high
297205	AlmaLinux 9 : kernel (ALSA-2026:1143)	Nessus	Alma Linux Local Security Checks	high
296967	Oracle Linux 9 : kernel (ELSA-2026-1143)	Nessus	Oracle Linux Local Security Checks	high
296624	RHEL 9 : kernel (RHSA-2026:1143)	Nessus	Red Hat Local Security Checks	high
261601	Linux Distros Unpatched Vulnerability : CVE-2025-38731	Nessus	Misc.	high

Detections

Analytics

CVE-2025-38731

high

Tenable Plugins

high

high

high

high

high

high

high

high

high

high