In the Linux kernel, the following vulnerability has been resolved: drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise Add validation in xe_vm_madvise_ioctl() to reject PAT indices with XE_COH_NONE coherency mode when applied to CPU cached memory. Using coh_none with CPU cached buffers is a security issue. When the kernel clears pages before reallocation, the clear operation stays in CPU cache (dirty). GPU with coh_none can bypass CPU caches and read stale sensitive data directly from DRAM, potentially leaking data from previously freed pages of other processes. This aligns with the existing validation in vm_bind path (xe_vm_bind_ioctl_validate_bo). v2(Matthew brost) - Add fixes - Move one debug print to better place v3(Matthew Auld) - Should be drm/xe/uapi - More Cc v4(Shuicheng Lin) - Fix kmem leak issues by the way v5 - Remove kmem leak because it has been merged by another patch v6 - Remove the fix which is not related to current fix v7 - No change v8 - Rebase v9 - Limit the restrictions to iGPU v10 - No change (cherry picked from commit 016ccdb674b8c899940b3944952c96a6a490d10a)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:81552 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (CVE-2026-46309)

    * kernel: macsec: fix replay protection at XPN lower-PN wrap (CVE-2026-63925)

    * kernel: bpf: Support for hardening against JIT spraying (CVE-2026-64508)

    * kernel: x86/bugs: Enable IBPB flush on BPF JIT allocation (CVE-2026-64507)

    * kernel: drm/amd/display: set new_stream to NULL after release (CVE-2026-68236)

    * kernel: drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CVE-2026-68278)

    * kernel: drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CVE-2026-68245)

    * kernel: openvswitch: fix GSO userspace truncation underflow (CVE-2026-68123)

    * kernel: cifs: validate DFS referral string offsets (CVE-2026-72318)

    * kernel: drm/vmwgfx: use check_add_overflow for shader size+offset bound (CVE-2026-80887)

    * kernel: nvmet-auth: Synchronize timeout work during SQ teardown (CVE-2026-89970)

    * kernel: drm/amdkfd: Add TLB flush after MES queue eviction/suspension (CVE-2026-89811)

    * kernel: media: cx231xx: reject geometry changes while the VBI queue is busy (CVE-2026-89894)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:81552 advisory.

    * kernel: drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (CVE-2026-46309)
      * kernel: macsec: fix replay protection at XPN lower-PN wrap (CVE-2026-63925)
      * kernel: bpf: Support for hardening against JIT spraying (CVE-2026-64508)
      * kernel: x86/bugs: Enable IBPB flush on BPF JIT allocation (CVE-2026-64507)
      * kernel: drm/amd/display: set new_stream to NULL after release (CVE-2026-68236)
      * kernel: drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CVE-2026-68278)
      * kernel: drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CVE-2026-68245)
      * kernel: openvswitch: fix GSO userspace truncation underflow (CVE-2026-68123)
      * kernel: cifs: validate DFS referral string offsets (CVE-2026-72318)
      * kernel: drm/vmwgfx: use check_add_overflow for shader size+offset bound (CVE-2026-80887)
      * kernel: nvmet-auth: Synchronize timeout work during SQ teardown (CVE-2026-89970)
      * kernel: drm/amdkfd: Add TLB flush after MES queue eviction/suspension (CVE-2026-89811)
      * kernel: media: cx231xx: reject geometry changes while the VBI queue is busy (CVE-2026-89894)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-2026_81552 advisory.

    * kernel: drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (CVE-2026-46309)

    * kernel: macsec: fix replay protection at XPN lower-PN wrap (CVE-2026-63925)

    * kernel: bpf: Support for hardening against JIT spraying (CVE-2026-64508)

    * kernel: x86/bugs: Enable IBPB flush on BPF JIT allocation (CVE-2026-64507)

    * kernel: drm/amd/display: set new_stream to NULL after release (CVE-2026-68236)

    * kernel: drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CVE-2026-68278)

    * kernel: drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CVE-2026-68245)

    * kernel: openvswitch: fix GSO userspace truncation underflow (CVE-2026-68123)

    * kernel: cifs: validate DFS referral string offsets (CVE-2026-72318)

    * kernel: drm/vmwgfx: use check_add_overflow for shader size+offset bound (CVE-2026-80887)

    * kernel: nvmet-auth: Synchronize timeout work during SQ teardown (CVE-2026-89970)

    * kernel: drm/amdkfd: Add TLB flush after MES queue eviction/suspension (CVE-2026-89811)

    * kernel: media: cx231xx: reject geometry changes while the VBI queue is busy (CVE-2026-89894)

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-81552 advisory.

    - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348]     {CVE-2026-89970}
    - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (Jose Exposito) [RHEL-262131]     {CVE-2026-89811}
    - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (Jose Exposito) [RHEL-250806]     {CVE-2026-46309}
    - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236}
    - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162]     {CVE-2026-80887}
    - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241]     {CVE-2026-68245}
    - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851]     {CVE-2026-68278}
    - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508}
    - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507}
    - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508}
    - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123}
    - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527]     {CVE-2026-89894}
    - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925}
    - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318}
    - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950]     {CVE-2026-89690}
    - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas)     [RHEL-187734] {CVE-2026-89530}
    - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186]     {CVE-2026-89669}
    - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas)     [RHEL-264152] {CVE-2026-89663}
    - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240]     {CVE-2026-53398}
    - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480]     {CVE-2026-72317}
    - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246]     {CVE-2026-74744}
    - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103}
    - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970}
    - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365}
    - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365}
    - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408]     {CVE-2026-68291}
    - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408]     {CVE-2026-53286}
    - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408]     {CVE-2026-64162}
    - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408]     {CVE-2026-31647}
    - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284]     {CVE-2026-53360}
    - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284]     {CVE-2026-53360}
    - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284]     {CVE-2026-53360}
    - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284]     {CVE-2026-53360}
    - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284]     {CVE-2026-53360}
    - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar)     [RHEL-192284] {CVE-2026-53360}
    - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360}
    - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284]     {CVE-2026-53360}
    - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360}
    - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360}
    - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360}
    - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284]     {CVE-2026-53360}
    - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360}
    - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284]     {CVE-2026-53360}
    - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284]     {CVE-2026-53360}
    - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270]     {CVE-2026-64115}
    - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035}
    - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227}
    - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot)     [RHEL-271672] {CVE-2026-93288}
    - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822]     {CVE-2026-43332}
    - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972}
    - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670]     {CVE-2026-97417}
    - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317}
    - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611]     {CVE-2026-46275}
    - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot)     [RHEL-232611] {CVE-2026-46275}
    - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460]     {CVE-2026-89481}
    - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480}
    - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442}
    - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792}
    - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924}
    - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922}
    - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279]     {CVE-2026-63984}
    - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381]     {CVE-2026-63920}
    - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351]     {CVE-2026-64557}
    - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351]     {CVE-2026-64557}
    - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351]     {CVE-2026-64557}
    - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721]     {CVE-2026-63993}
    - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal)     [RHEL-259588] {CVE-2026-63994}
    - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774]     {CVE-2026-63992}
    - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889]     {CVE-2026-68432}
    - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004]     {CVE-2026-72052}
    - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040]     {CVE-2026-63829}
    - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot)     [RHEL-260635] {CVE-2026-74569}
    - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385}
    - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921}
    - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099}
    - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374]     {CVE-2026-46076}
    - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524]     {CVE-2026-74516}
    - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524]     {CVE-2026-74516}
    - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516}
    - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357}
    - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777]     {CVE-2026-53357}
    - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400]     {CVE-2026-74669}
    - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400]     {CVE-2026-74669}
    - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669}
    - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427]     {CVE-2026-72255}
    - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481]     {CVE-2026-72289}
    - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746}
    - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060]     {CVE-2026-52942}
    - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986}
    - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049}
    - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:81552 advisory.

    * kernel: drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (CVE-2026-46309)

    * kernel: macsec: fix replay protection at XPN lower-PN wrap (CVE-2026-63925)

    * kernel: bpf: Support for hardening against JIT spraying (CVE-2026-64508)

    * kernel: x86/bugs: Enable IBPB flush on BPF JIT allocation (CVE-2026-64507)

    * kernel: drm/amd/display: set new_stream to NULL after release (CVE-2026-68236)

    * kernel: drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CVE-2026-68278)

    * kernel: drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CVE-2026-68245)

    * kernel: openvswitch: fix GSO userspace truncation underflow (CVE-2026-68123)

    * kernel: cifs: validate DFS referral string offsets (CVE-2026-72318)

    * kernel: drm/vmwgfx: use check_add_overflow for shader size+offset bound (CVE-2026-80887)

    * kernel: nvmet-auth: Synchronize timeout work during SQ teardown (CVE-2026-89970)

    * kernel: drm/amdkfd: Add TLB flush after MES queue eviction/suspension (CVE-2026-89811)

    * kernel: media: cx231xx: reject geometry changes while the VBI queue is busy (CVE-2026-89894)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - In the Linux kernel, the following vulnerability has been resolved: drm/xe/uapi: Reject coh_none PAT index     for CPU cached memory in madvise Add validation in xe_vm_madvise_ioctl() to reject PAT indices with     XE_COH_NONE coherency mode when applied to CPU cached memory. Using coh_none with CPU cached buffers is a     security issue. When the kernel clears pages before reallocation, the clear operation stays in CPU cache     (dirty). GPU with coh_none can bypass CPU caches and read stale sensitive data directly from DRAM,     potentially leaking data from previously freed pages of other processes. This aligns with the existing     validation in vm_bind path (xe_vm_bind_ioctl_validate_bo). v2(Matthew brost) - Add fixes - Move one debug     print to better place v3(Matthew Auld) - Should be drm/xe/uapi - More Cc v4(Shuicheng Lin) - Fix kmem leak     issues by the way v5 - Remove kmem leak because it has been merged by another patch v6 - Remove the fix     which is not related to current fix v7 - No change v8 - Rebase v9 - Limit the restrictions to iGPU v10 -     No change (cherry picked from commit 016ccdb674b8c899940b3944952c96a6a490d10a) (CVE-2026-46309)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
369197	RHEL 9 : kernel (RHSA-2026:81552)	Nessus	Red Hat Local Security Checks	Local	high
366103	AlmaLinux 9 : kernel (ALSA-2026:81552)	Nessus	Alma Linux Local Security Checks	Local	high
366054	Rocky Linux 9 [CIQ] Security Update: kernel / kernel-64k / kernel-64k-core / kernel-64k-debug / etc Multiple Vulnerabilities (crlsa-2026_81552)	Nessus	Rocky Linux Local Security Checks	Local	high
365679	Oracle Linux 9 : kernel (ELSA-2026-81552)	Nessus	Oracle Linux Local Security Checks	Local	high
365544	RockyLinux 9 : kernel (RLSA-2026:81552)	Nessus	Rocky Linux Local Security Checks	Local	high
343532	Ubuntu 24.04 LTS / Pro Realtime 24.04 LTS : Linux kernel (GCP) vulnerabilities (USN-8728-1)	Nessus	Ubuntu Local Security Checks	Local	high
340681	Ubuntu 24.04 LTS / 26.04 LTS : Linux kernel (NVIDIA) vulnerabilities (USN-8663-1)	Nessus	Ubuntu Local Security Checks	Local	high
340045	Ubuntu 26.04 LTS : Linux kernel (NVIDIA BaseOS) vulnerabilities (USN-8664-1)	Nessus	Ubuntu Local Security Checks	Local	high
319689	Linux Distros Unpatched Vulnerability : CVE-2026-46309	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2026-46309

high

Tenable Plugins

high

high

high

high

high

high

high

high

high