In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 This commit simplifies the amdgpu_gem_va_ioctl function, key updates include: - Moved the logic for managing the last update fence directly into amdgpu_gem_va_update_vm. - Introduced checks for the timeline point to enable conditional replacement or addition of fences. v2: Addressed review comments from Christian. v3: Updated comments (Christian). v4: The previous version selected the fence too early and did not manage its reference correctly, which could lead to stale or freed fences being used. This resulted in refcount underflows and could crash when updating GPU timelines. The fence is now chosen only after the VA mapping work is completed, and its reference is taken safely. After exporting it to the VM timeline syncobj, the driver always drops its local fence reference, ensuring balanced refcounting and avoiding use-after-free on dma_fence. Crash signature: [ 205.828135] refcount_t: underflow; use-after-free. [ 205.832963] WARNING: CPU: 30 PID: 7274 at lib/refcount.c:28 refcount_warn_saturate+0xbe/0x110 ... [ 206.074014] Call Trace: [ 206.076488] <TASK> [ 206.078608] amdgpu_gem_va_ioctl+0x6ea/0x740 [amdgpu] [ 206.084040] ? __pfx_amdgpu_gem_va_ioctl+0x10/0x10 [amdgpu] [ 206.089994] drm_ioctl_kernel+0x86/0xe0 [drm] [ 206.094415] drm_ioctl+0x26e/0x520 [drm] [ 206.098424] ? __pfx_amdgpu_gem_va_ioctl+0x10/0x10 [amdgpu] [ 206.104402] amdgpu_drm_ioctl+0x4b/0x80 [amdgpu] [ 206.109387] __x64_sys_ioctl+0x96/0xe0 [ 206.113156] do_syscall_64+0x66/0x2d0 ... [ 206.553351] BUG: unable to handle page fault for address: ffffffffc0dfde90 ... [ 206.553378] RIP: 0010:dma_fence_signal_timestamp_locked+0x39/0xe0 ... [ 206.553405] Call Trace: [ 206.553409] <IRQ> [ 206.553415] ? __pfx_drm_sched_fence_free_rcu+0x10/0x10 [gpu_sched] [ 206.553424] dma_fence_signal+0x30/0x60 [ 206.553427] drm_sched_job_done.isra.0+0x123/0x150 [gpu_sched] [ 206.553434] dma_fence_signal_timestamp_locked+0x6e/0xe0 [ 206.553437] dma_fence_signal+0x30/0x60 [ 206.553441] amdgpu_fence_process+0xd8/0x150 [amdgpu] [ 206.553854] sdma_v4_0_process_trap_irq+0x97/0xb0 [amdgpu] [ 206.554353] edac_mce_amd(E) ee1004(E) [ 206.554270] amdgpu_irq_dispatch+0x150/0x230 [amdgpu] [ 206.554702] amdgpu_ih_process+0x6a/0x180 [amdgpu] [ 206.555101] amdgpu_irq_handler+0x23/0x60 [amdgpu] [ 206.555500] __handle_irq_event_percpu+0x4a/0x1c0 [ 206.555506] handle_irq_event+0x38/0x80 [ 206.555509] handle_edge_irq+0x92/0x1e0 [ 206.555513] __common_interrupt+0x3e/0xb0 [ 206.555519] common_interrupt+0x80/0xa0 [ 206.555525] </IRQ> [ 206.555527] <TASK> ... [ 206.555650] RIP: 0010:dma_fence_signal_timestamp_locked+0x39/0xe0 ... [ 206.555667] Kernel panic - not syncing: Fatal exception in interrupt

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:57252 advisory.

    * kernel: netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CVE-2026-43233)
      * kernel: drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CVE-2026-43206)
      * kernel: drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline     Management v4 (CVE-2026-43237)
      * kernel: udf: fix partition descriptor append bookkeeping (CVE-2026-45991)
      * kernel: drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CVE-2026-45878)
      * kernel: ip6_gre: Use cached t->net in ip6erspan_changelink() (CVE-2026-46120)
      * kernel: sched/psi: fix race between file release and pressure write (CVE-2026-52991)
      * kernel: drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CVE-2026-53143)
      * kernel: drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CVE-2026-53136)
      * kernel: mm/huge_memory: update file PMD counter before folio_put() (CVE-2026-53189)
      * kernel: drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CVE-2026-53329)
      * kernel: drm/i915/gem: Fix phys BO pread/pwrite with offset (CVE-2026-53356)
      * kernel: drm/amdgpu: zero-initialize GART table on allocation (CVE-2026-53374)
      * kernel: drm/i915: Fix potential UAF in TTM object purge (CVE-2026-63884)
      * kernel: netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CVE-2026-64007)
      * kernel: memfd: deny writeable mappings when implying SEAL_WRITE (CVE-2026-63952)
      * kernel: scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd()     (CVE-2026-63888)
      * kernel: drm/amdgpu: fix amdgpu_hmm_range_get_pages (CVE-2026-63879)
      * kernel: net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CVE-2026-64048)
      * kernel: drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async     (CVE-2026-64219)
      * kernel: smb: client: fix double-free in SMB2_open() replay (CVE-2026-64382)
      * kernel: smb: client: mask server-provided mode to 07777 in modefromsid (CVE-2026-64379)
      * kernel: smb: client: fix query_info() replay double-free (CVE-2026-64386)
      * kernel: posix-cpu-timers: Prevent UAF caused by non-leader exec() race (CVE-2026-64560)
      * kernel: smb: client: validate DFS referral PathConsumed (CVE-2026-68343)
      * kernel: smb/client: handle overlapping allocated ranges in fallocate (CVE-2026-68388)


    Bug Fix(es) and Enhancement(s):

      * kernel 5.14.0-687.5.1.el9_8 breaks wifi when using FIPS (JIRA:AlmaLinux-181065)
      * vhost: reset the vring metadata cache on vring reconfiguration [almalinux-9.8.z]     (JIRA:AlmaLinux-224549)
      * cifs: smb1 directory listings from xp server returning EINVAL and EIO [almalinux-9.8.z]     (JIRA:AlmaLinux-235811)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:57251 advisory.

    * kernel: drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CVE-2026-43206)
      * kernel: drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline     Management v4 (CVE-2026-43237)
      * kernel: crypto: pcrypt - Fix handling of MAY_BACKLOG requests (CVE-2026-43493)
      * kernel: udf: fix partition descriptor append bookkeeping (CVE-2026-45991)
      * kernel: drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CVE-2026-45878)
      * kernel: smb/client: fix out-of-bounds read in symlink_data() (CVE-2026-46185)
      * kernel: sched/psi: fix race between file release and pressure write (CVE-2026-52991)
      * kernel: drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CVE-2026-53143)
      * kernel: drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CVE-2026-53136)
      * kernel: drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CVE-2026-53329)
      * kernel: drm/i915/gem: Fix phys BO pread/pwrite with offset (CVE-2026-53356)
      * kernel: drm/amdgpu: zero-initialize GART table on allocation (CVE-2026-53374)
      * kernel: drm/i915: Fix potential UAF in TTM object purge (CVE-2026-63884)
      * kernel: scsi: target: iscsi: Validate CHAP_R length before base64 decode (CVE-2026-63886)
      * kernel: memfd: deny writeable mappings when implying SEAL_WRITE (CVE-2026-63952)
      * kernel: scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd()     (CVE-2026-63888)
      * kernel: blk-mq: pop cached request if it is usable (CVE-2026-64017)
      * kernel: drm/amdgpu: fix amdgpu_hmm_range_get_pages (CVE-2026-63879)
      * kernel: drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async     (CVE-2026-64219)
      * kernel: smb: client: fix double-free in SMB2_open() replay (CVE-2026-64382)
      * kernel: smb: client: mask server-provided mode to 07777 in modefromsid (CVE-2026-64379)
      * kernel: smb: client: fix query_info() replay double-free (CVE-2026-64386)
      * kernel: posix-cpu-timers: Prevent UAF caused by non-leader exec() race (CVE-2026-64560)
      * kernel: smb/client: handle overlapping allocated ranges in fallocate (CVE-2026-68388)


    Bug Fix(es) and Enhancement(s):

      * CLONE - AlmaLinux 10.2.z xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN     (JIRA:AlmaLinux-223954)
      * vhost: reset the vring metadata cache on vring reconfiguration [almalinux-10.2.z]     (JIRA:AlmaLinux-224545)
      * cifs: periodic IO errors when rename races with lease break [almalinux-10.2.z] (JIRA:AlmaLinux-235459)
      * cifs: smb1 directory listings from xp server returning EINVAL and EIO [almalinux-10.2.z]     (JIRA:AlmaLinux-235812)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:57251 advisory.

    * kernel: drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CVE-2026-43206)

    * kernel: drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management     v4 (CVE-2026-43237)

    * kernel: crypto: pcrypt - Fix handling of MAY_BACKLOG requests (CVE-2026-43493)

    * kernel: udf: fix partition descriptor append bookkeeping (CVE-2026-45991)

    * kernel: drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CVE-2026-45878)

    * kernel: smb/client: fix out-of-bounds read in symlink_data() (CVE-2026-46185)

    * kernel: sched/psi: fix race between file release and pressure write (CVE-2026-52991)

    * kernel: drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CVE-2026-53143)

    * kernel: drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CVE-2026-53136)

    * kernel: drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CVE-2026-53329)

    * kernel: drm/i915/gem: Fix phys BO pread/pwrite with offset (CVE-2026-53356)

    * kernel: drm/amdgpu: zero-initialize GART table on allocation (CVE-2026-53374)

    * kernel: drm/i915: Fix potential UAF in TTM object purge (CVE-2026-63884)

    * kernel: scsi: target: iscsi: Validate CHAP_R length before base64 decode (CVE-2026-63886)

    * kernel: memfd: deny writeable mappings when implying SEAL_WRITE (CVE-2026-63952)

    * kernel: scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd()     (CVE-2026-63888)

    * kernel: blk-mq: pop cached request if it is usable (CVE-2026-64017)

    * kernel: drm/amdgpu: fix amdgpu_hmm_range_get_pages (CVE-2026-63879)

    * kernel: drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async     (CVE-2026-64219)

    * kernel: smb: client: fix double-free in SMB2_open() replay (CVE-2026-64382)

    * kernel: smb: client: mask server-provided mode to 07777 in modefromsid (CVE-2026-64379)

    * kernel: smb: client: fix query_info() replay double-free (CVE-2026-64386)

    * kernel: posix-cpu-timers: Prevent UAF caused by non-leader exec() race (CVE-2026-64560)

    * kernel: smb/client: handle overlapping allocated ranges in fallocate (CVE-2026-68388)

    Bug Fix(es) and Enhancement(s):

    * CLONE - Rocky Linux 10.2.z xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN     (JIRA:Rocky Linux-223954)

    * vhost: reset the vring metadata cache on vring reconfiguration [rhel-10.2.z] (JIRA:Rocky Linux-224545)

    * cifs: periodic IO errors when rename races with lease break [rhel-10.2.z] (JIRA:Rocky Linux-235459)

    * cifs: smb1 directory listings from xp server returning EINVAL and EIO [rhel-10.2.z] (JIRA:Rocky     Linux-235812)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-57252 advisory.

    - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343}
    - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844]     {CVE-2026-64560}
    - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844]     {CVE-2026-64370}
    - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207]     {CVE-2026-68388}
    - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528]     {CVE-2026-64379}
    - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991}
    - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386}
    - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382}
    - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225]     {CVE-2026-53189}
    - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090]     {CVE-2026-64048}
    - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120}
    - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi)     [RHEL-213222] {CVE-2026-63888}
    - drm/amdgpu: fix amdgpu_hmm_range_get_pages (Jose Exposito) [RHEL-222614] {CVE-2026-63879}
    - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668]     {CVE-2026-53329}
    - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683]     {CVE-2026-53136}
    - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot)     [RHEL-222703] {CVE-2026-53143}
    - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718]     {CVE-2026-45878}
    - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884}
    - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356}
    - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI     Backport Bot) [RHEL-222571] {CVE-2026-64219}
    - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374}
    - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333]     {CVE-2026-43206}
    - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI     Backport Bot) [RHEL-221368] {CVE-2026-43237}
    - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI     Backport Bot) [RHEL-221368] {CVE-2026-43237}
    - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625]     {CVE-2026-43233}
    - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909]     {CVE-2026-64007}
    - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-57251 advisory.

    - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179570] {CVE-2026-45991}
    - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226717] {CVE-2026-43493}
    - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236210]     {CVE-2026-68388}
    - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227850]     {CVE-2026-64560}
    - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227850]     {CVE-2026-64370}
    - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234551] {CVE-2026-64382}
    - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234530]     {CVE-2026-64379}
    - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234129] {CVE-2026-64386}
    - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229066] {CVE-2026-46185}
    - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017}
    - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017}
    - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi)     [RHEL-213217] {CVE-2026-63888}
    - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222740] {CVE-2026-63884}
    - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI     Backport Bot) [RHEL-222567] {CVE-2026-64219}
    - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222667]     {CVE-2026-53329}
    - drm/amdgpu: fix amdgpu_hmm_range_get_pages (Mika Penttila) [RHEL-222625] {CVE-2026-63879}
    - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221336]     {CVE-2026-43206}
    - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222753] {CVE-2026-53356}
    - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222721]     {CVE-2026-45878}
    - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot)     [RHEL-222701] {CVE-2026-53143}
    - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222685]     {CVE-2026-53136}
    - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222646] {CVE-2026-53374}
    - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI     Backport Bot) [RHEL-221380] {CVE-2026-43237}
    - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI     Backport Bot) [RHEL-221380] {CVE-2026-43237}
    - sched/psi: Create the psimon kthread outside of cgroup_mutex (CKI Backport Bot) [RHEL-232560]     {CVE-2026-52991}
    - sched/psi: fix race between file release and pressure write (CKI Backport Bot) [RHEL-232560]     {CVE-2026-52991}
    - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886}
    - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231667]     {CVE-2026-63886}
    - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228531] {CVE-2026-63952}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:57252 advisory.

    * kernel: netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CVE-2026-43233)

    * kernel: drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CVE-2026-43206)

    * kernel: drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management     v4 (CVE-2026-43237)

    * kernel: udf: fix partition descriptor append bookkeeping (CVE-2026-45991)

    * kernel: drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CVE-2026-45878)

    * kernel: ip6_gre: Use cached t->net in ip6erspan_changelink() (CVE-2026-46120)

    * kernel: sched/psi: fix race between file release and pressure write (CVE-2026-52991)

    * kernel: drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CVE-2026-53143)

    * kernel: drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CVE-2026-53136)

    * kernel: mm/huge_memory: update file PMD counter before folio_put() (CVE-2026-53189)

    * kernel: drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CVE-2026-53329)

    * kernel: drm/i915/gem: Fix phys BO pread/pwrite with offset (CVE-2026-53356)

    * kernel: drm/amdgpu: zero-initialize GART table on allocation (CVE-2026-53374)

    * kernel: drm/i915: Fix potential UAF in TTM object purge (CVE-2026-63884)

    * kernel: netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CVE-2026-64007)

    * kernel: memfd: deny writeable mappings when implying SEAL_WRITE (CVE-2026-63952)

    * kernel: scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd()     (CVE-2026-63888)

    * kernel: drm/amdgpu: fix amdgpu_hmm_range_get_pages (CVE-2026-63879)

    * kernel: net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CVE-2026-64048)

    * kernel: drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async     (CVE-2026-64219)

    * kernel: smb: client: fix double-free in SMB2_open() replay (CVE-2026-64382)

    * kernel: smb: client: mask server-provided mode to 07777 in modefromsid (CVE-2026-64379)

    * kernel: smb: client: fix query_info() replay double-free (CVE-2026-64386)

    * kernel: posix-cpu-timers: Prevent UAF caused by non-leader exec() race (CVE-2026-64560)

    * kernel: smb: client: validate DFS referral PathConsumed (CVE-2026-68343)

    * kernel: smb/client: handle overlapping allocated ranges in fallocate (CVE-2026-68388)

    Bug Fix(es) and Enhancement(s):

    * kernel 5.14.0-687.5.1.el9_8 breaks wifi when using FIPS  (JIRA:Rocky Linux-181065)

    * vhost: reset the vring metadata cache on vring reconfiguration [rhel-9.8.z] (JIRA:Rocky Linux-224549)

    * cifs: smb1 directory listings from xp server returning EINVAL and EIO [rhel-9.8.z] (JIRA:Rocky     Linux-235811)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:57251 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CVE-2026-43206)

    * kernel: drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management     v4 (CVE-2026-43237)

    * kernel: crypto: pcrypt - Fix handling of MAY_BACKLOG requests (CVE-2026-43493)

    * kernel: udf: fix partition descriptor append bookkeeping (CVE-2026-45991)

    * kernel: drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CVE-2026-45878)

    * kernel: smb/client: fix out-of-bounds read in symlink_data() (CVE-2026-46185)

    * kernel: sched/psi: fix race between file release and pressure write (CVE-2026-52991)

    * kernel: drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CVE-2026-53143)

    * kernel: drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CVE-2026-53136)

    * kernel: drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CVE-2026-53329)

    * kernel: drm/i915/gem: Fix phys BO pread/pwrite with offset (CVE-2026-53356)

    * kernel: drm/amdgpu: zero-initialize GART table on allocation (CVE-2026-53374)

    * kernel: drm/i915: Fix potential UAF in TTM object purge (CVE-2026-63884)

    * kernel: scsi: target: iscsi: Validate CHAP_R length before base64 decode (CVE-2026-63886)

    * kernel: memfd: deny writeable mappings when implying SEAL_WRITE (CVE-2026-63952)

    * kernel: scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd()     (CVE-2026-63888)

    * kernel: blk-mq: pop cached request if it is usable (CVE-2026-64017)

    * kernel: drm/amdgpu: fix amdgpu_hmm_range_get_pages (CVE-2026-63879)

    * kernel: drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async     (CVE-2026-64219)

    * kernel: smb: client: fix double-free in SMB2_open() replay (CVE-2026-64382)

    * kernel: smb: client: mask server-provided mode to 07777 in modefromsid (CVE-2026-64379)

    * kernel: smb: client: fix query_info() replay double-free (CVE-2026-64386)

    * kernel: posix-cpu-timers: Prevent UAF caused by non-leader exec() race (CVE-2026-64560)

    * kernel: smb/client: handle overlapping allocated ranges in fallocate (CVE-2026-68388)

    Bug Fix(es) and Enhancement(s):

    * CLONE - RHEL 10.2.z xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN     (JIRA:RHEL-223954)

    * vhost: reset the vring metadata cache on vring reconfiguration [rhel-10.2.z] (JIRA:RHEL-224545)

    * cifs: periodic IO errors when rename races with lease break [rhel-10.2.z] (JIRA:RHEL-235459)

    * cifs: smb1 directory listings from xp server returning EINVAL and EIO [rhel-10.2.z] (JIRA:RHEL-235812)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:57252 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CVE-2026-43233)

    * kernel: drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CVE-2026-43206)

    * kernel: drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management     v4 (CVE-2026-43237)

    * kernel: udf: fix partition descriptor append bookkeeping (CVE-2026-45991)

    * kernel: drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CVE-2026-45878)

    * kernel: ip6_gre: Use cached t->net in ip6erspan_changelink() (CVE-2026-46120)

    * kernel: sched/psi: fix race between file release and pressure write (CVE-2026-52991)

    * kernel: drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CVE-2026-53143)

    * kernel: drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CVE-2026-53136)

    * kernel: mm/huge_memory: update file PMD counter before folio_put() (CVE-2026-53189)

    * kernel: drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CVE-2026-53329)

    * kernel: drm/i915/gem: Fix phys BO pread/pwrite with offset (CVE-2026-53356)

    * kernel: drm/amdgpu: zero-initialize GART table on allocation (CVE-2026-53374)

    * kernel: drm/i915: Fix potential UAF in TTM object purge (CVE-2026-63884)

    * kernel: netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CVE-2026-64007)

    * kernel: memfd: deny writeable mappings when implying SEAL_WRITE (CVE-2026-63952)

    * kernel: scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd()     (CVE-2026-63888)

    * kernel: drm/amdgpu: fix amdgpu_hmm_range_get_pages (CVE-2026-63879)

    * kernel: net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CVE-2026-64048)

    * kernel: drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async     (CVE-2026-64219)

    * kernel: smb: client: fix double-free in SMB2_open() replay (CVE-2026-64382)

    * kernel: smb: client: mask server-provided mode to 07777 in modefromsid (CVE-2026-64379)

    * kernel: smb: client: fix query_info() replay double-free (CVE-2026-64386)

    * kernel: posix-cpu-timers: Prevent UAF caused by non-leader exec() race (CVE-2026-64560)

    * kernel: smb: client: validate DFS referral PathConsumed (CVE-2026-68343)

    * kernel: smb/client: handle overlapping allocated ranges in fallocate (CVE-2026-68388)

    Bug Fix(es) and Enhancement(s):

    * kernel 5.14.0-687.5.1.el9_8 breaks wifi when using FIPS  (JIRA:RHEL-181065)

    * vhost: reset the vring metadata cache on vring reconfiguration [rhel-9.8.z] (JIRA:RHEL-224549)

    * cifs: smb1 directory listings from xp server returning EINVAL and EIO [rhel-9.8.z] (JIRA:RHEL-235811)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 This     commit simplifies the amdgpu_gem_va_ioctl function, key updates include: - Moved the logic for managing     the last update fence directly into amdgpu_gem_va_update_vm. - Introduced checks for the timeline point to     enable conditional replacement or addition of fences. v2: Addressed review comments from Christian. v3:
    Updated comments (Christian). v4: The previous version selected the fence too early and did not manage its     reference correctly, which could lead to stale or freed fences being used. This resulted in refcount     underflows and could crash when updating GPU timelines. The fence is now chosen only after the VA mapping     work is completed, and its reference is taken safely. After exporting it to the VM timeline syncobj, the     driver always drops its local fence reference, ensuring balanced refcounting and avoiding use-after-free     on dma_fence. Crash signature: [ 205.828135] refcount_t: underflow; use-after-free. [ 205.832963] WARNING:
    CPU: 30 PID: 7274 at lib/refcount.c:28 refcount_warn_saturate+0xbe/0x110 ... [ 206.074014] Call Trace: [     206.076488] <TASK> [ 206.078608] amdgpu_gem_va_ioctl+0x6ea/0x740 [amdgpu] [ 206.084040] ?
    __pfx_amdgpu_gem_va_ioctl+0x10/0x10 [amdgpu] [ 206.089994] drm_ioctl_kernel+0x86/0xe0 [drm] [ 206.094415]     drm_ioctl+0x26e/0x520 [drm] [ 206.098424] ? __pfx_amdgpu_gem_va_ioctl+0x10/0x10 [amdgpu] [ 206.104402]     amdgpu_drm_ioctl+0x4b/0x80 [amdgpu] [ 206.109387] __x64_sys_ioctl+0x96/0xe0 [ 206.113156]     do_syscall_64+0x66/0x2d0 ... [ 206.553351] BUG: unable to handle page fault for address: ffffffffc0dfde90     ... [ 206.553378] RIP: 0010:dma_fence_signal_timestamp_locked+0x39/0xe0 ... [ 206.553405] Call Trace: [     206.553409] <IRQ> [ 206.553415] ? __pfx_drm_sched_fence_free_rcu+0x10/0x10 [gpu_sched] [ 206.553424]     dma_fence_signal+0x30/0x60 [ 206.553427] drm_sched_job_done.isra.0+0x123/0x150 [gpu_sched] [ 206.553434]     dma_fence_signal_timestamp_locked+0x6e/0xe0 [ 206.553437] dma_fence_signal+0x30/0x60 [ 206.553441]     amdgpu_fence_process+0xd8/0x150 [amdgpu] [ 206.553854] sdma_v4_0_process_trap_irq+0x97/0xb0 [amdgpu] [     206.554353] edac_mce_amd(E) ee1004(E) [ 206.554270] amdgpu_irq_dispatch+0x150/0x230 [amdgpu] [ 206.554702]     amdgpu_ih_process+0x6a/0x180 [amdgpu] [ 206.555101] amdgpu_irq_handler+0x23/0x60 [amdgpu] [ 206.555500]
    __handle_irq_event_percpu+0x4a/0x1c0 [ 206.555506] handle_irq_event+0x38/0x80 [ 206.555509]     handle_edge_irq+0x92/0x1e0 [ 206.555513] __common_interrupt+0x3e/0xb0 [ 206.555519]     common_interrupt+0x80/0xa0 [ 206.555525] </IRQ> [ 206.555527] <TASK> ... [ 206.555650] RIP:
    0010:dma_fence_signal_timestamp_locked+0x39/0xe0 ... [ 206.555667] Kernel panic - not syncing: Fatal     exception in interrupt (CVE-2026-43237)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
340747	AlmaLinux 9 : kernel (ALSA-2026:57252)	Nessus	Alma Linux Local Security Checks	Local	high
339386	AlmaLinux 10 : kernel (ALSA-2026:57251)	Nessus	Alma Linux Local Security Checks	Local	high
338772	RockyLinux 10 : kernel (RLSA-2026:57251)	Nessus	Rocky Linux Local Security Checks	Local	high
338722	Oracle Linux 9 : kernel (ELSA-2026-57252)	Nessus	Oracle Linux Local Security Checks	Local	high
338720	Oracle Linux 10 : kernel (ELSA-2026-57251)	Nessus	Oracle Linux Local Security Checks	Local	high
338679	RockyLinux 9 : kernel (RLSA-2026:57252)	Nessus	Rocky Linux Local Security Checks	Local	high
338240	RHEL 10 : kernel (RHSA-2026:57251)	Nessus	Red Hat Local Security Checks	Local	high
338239	RHEL 9 : kernel (RHSA-2026:57252)	Nessus	Red Hat Local Security Checks	Local	high
312706	Linux Distros Unpatched Vulnerability : CVE-2026-43237	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2026-43237

high

Tenable Plugins

high

high

high

high

high

high

high

high

high