In the Linux kernel, the following vulnerability has been resolved: drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() Two error handling issues exist in xe_exec_queue_create_ioctl(): 1. When xe_hw_engine_group_add_exec_queue() fails, the error path jumps to put_exec_queue which skips xe_exec_queue_kill(). If the VM is in preempt fence mode, xe_vm_add_compute_exec_queue() has already added the queue to the VM's compute exec queue list. Skipping the kill leaves the queue on that list, leading to a dangling pointer after the queue is freed. 2. When xa_alloc() fails after xe_hw_engine_group_add_exec_queue() has succeeded, the error path does not call xe_hw_engine_group_del_exec_queue() to remove the queue from the hw engine group list. The queue is then freed while still linked into the hw engine group, causing a use-after-free. Fix both by: - Changing the xe_hw_engine_group_add_exec_queue() failure path to jump to kill_exec_queue so that xe_exec_queue_kill() properly removes the queue from the VM's compute list. - Adding a del_hw_engine_group label before kill_exec_queue for the xa_alloc() failure path, which removes the queue from the hw engine group before proceeding with the rest of the cleanup. (cherry picked from commit 37c831f401746a45d510b312b0ed7a77b1e06ec8)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:52764 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: libceph: make decode_pool() more resilient against corrupted osdmaps (CVE-2025-71116)

    * kernel: libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CVE-2026-22990)

    * kernel: smb: client: fix OOB reads parsing symlink error response (CVE-2026-31613)

    * kernel: xen/privcmd: fix double free via VMA splitting (CVE-2026-31787)

    * kernel: fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CVE-2026-43112)

    * kernel: selinux: fix overlayfs mmap() and mprotect() access checks (CVE-2026-46054)

    * kernel: ipc: limit next_id allocation to the valid ID range (CVE-2026-52923)

    * kernel: drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CVE-2026-52976)

    Bug Fix(es) and Enhancement(s):

    * xfs corruption from [xfs_trans_cancel] during inode allocation [rhel-10.0.z] (JIRA:RHEL-142606)

    * [RFE] Requesting FOU and GUE/GRE support in RHEL 10 [rhel-10.0.z] (JIRA:RHEL-144983)

    * Send error in SessSetup messages fill up the logs [rhel-10.0.z] (JIRA:RHEL-145510)

    * Host kernel panics with unexpected #NM exception at restore_fpregs_from_fpstate [rhel-10.0.z]     (JIRA:RHEL-148634)

    * blktests throtl/001 failed [rhel-10.0.z] (JIRA:RHEL-180588)

    * RHEL 10: s390: Revert support for DCACHE_WORD_ACCESS [rhel-10.0.z] (JIRA:RHEL-188179)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:52667 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: crypto: seqiv - Do not use req->iv after crypto_aead_encrypt (CVE-2025-71131)

    * kernel: selinux: fix overlayfs mmap() and mprotect() access checks (CVE-2026-46054)

    * kernel: drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CVE-2026-52976)

    Bug Fix(es) and Enhancement(s):

    * RHEL9.4 - dasd: Fix PPRC copy pair swap state and format information. [rhel-9.6.z] (JIRA:RHEL-176469)

    * [xfstests xfs/017] xfs_repair fails and hit XFS: Assertion failed: 0, file: fs/xfs/xfs_icache.c, line:
    1840 [rhel-9.6.z] (JIRA:RHEL-188771)

    * nfs: backport patch which checks delegation validity in nfs_start_delegation_return_locked to RHEL 9     [rhel-9.6.z] (JIRA:RHEL-212042)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:45192 advisory.

    * kernel: KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (CVE-2025-40026)
      * kernel: dm log: fix out-of-bounds write due to region_count overflow (CVE-2026-53059)
      * kernel: drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CVE-2026-52976)
      * kernel: drm/xe/dma-buf: fix UAF with retry loop (CVE-2026-52950)
      * kernel: ipv6: fix possible UAF in icmpv6_rcv() (CVE-2026-53006)


    Bug Fix(es) and Enhancement(s):

      * scsi device removal may hang from race with error recovery [almalinux-9.8.z] (JIRA:AlmaLinux-187412)
      * [AlmaLinux9] kvm fixes for 2026-07-21 [almalinux-9.8.z] (JIRA:AlmaLinux-213468)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-45192 advisory.

    - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace)     [RHEL-213468] {CVE-2026-63807}
    - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277]     {CVE-2025-40026}
    - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950}
    - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950}
    - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228]     {CVE-2026-52950}
    - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228]     {CVE-2026-52950}
    - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006}
    - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647]     {CVE-2026-52976}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:45192 advisory.

    * kernel: KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (CVE-2025-40026)

    * kernel: dm log: fix out-of-bounds write due to region_count overflow (CVE-2026-53059)

    * kernel: drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CVE-2026-52976)

    * kernel: drm/xe/dma-buf: fix UAF with retry loop (CVE-2026-52950)

    * kernel: ipv6: fix possible UAF in icmpv6_rcv() (CVE-2026-53006)

    Bug Fix(es) and Enhancement(s):

    * scsi device removal may hang from race with error recovery [rhel-9.8.z] (JIRA:Rocky Linux-187412)

    * [Rocky Linux9] kvm fixes for 2026-07-21 [rhel-9.8.z] (JIRA:Rocky Linux-213468)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:45192 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (CVE-2025-40026)

    * kernel: dm log: fix out-of-bounds write due to region_count overflow (CVE-2026-53059)

    * kernel: drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CVE-2026-52976)

    * kernel: drm/xe/dma-buf: fix UAF with retry loop (CVE-2026-52950)

    * kernel: ipv6: fix possible UAF in icmpv6_rcv() (CVE-2026-53006)

    Bug Fix(es) and Enhancement(s):

    * scsi device removal may hang from race with error recovery [rhel-9.8.z] (JIRA:RHEL-187412)

    * [RHEL9] kvm fixes for 2026-07-21 [rhel-9.8.z] (JIRA:RHEL-213468)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:42919 advisory.

    * kernel: crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CVE-2025-71113)
      * kernel: Linux kernel: Denial of Service due to memory leak in tpm2_load_cmd (CVE-2025-71147)
      * kernel: flex_proportions: make fprop_new_period() hardirq safe (CVE-2026-23168)
      * kernel: cxl/port: Fix use after free of parent_port in cxl_detach_ep() (CVE-2026-31530)
      * kernel: xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (CVE-2026-46116)
      * kernel: fanotify: fix false positive on permission events (CVE-2026-46150)
      * kernel: drm: Set old handle to NULL before prime swap in change_handle (CVE-2026-46215)
      * kernel: drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CVE-2026-52976)
      * kernel: drm/xe/dma-buf: fix UAF with retry loop (CVE-2026-52950)
      * kernel: ice: fix double-free of tx_buf skb (CVE-2026-53009)
      * kernel: Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CVE-2026-53071)
      * kernel: can: bcm: thrtimer use-after-free during RX operation teardown ()


    Bug Fix(es) and Enhancement(s):

      * nfsd_file slab cache objects remaining on kmem_cache_shutdown during nfsd teardown while running     bz1477872 testcase (JIRA:AlmaLinux-173103)
      * tools/lib/perf/Makefile: libperf includes appended after CFLAGS causes parallel build race, breaking     kernel builds [almalinux-10.2.z] (JIRA:AlmaLinux-183975)
      * [AlmaLinux10-debug]: BUG: KASAN: slab-use-after-free in __pv_queued_spin_lock_slowpath     [almalinux-10.2.z] (JIRA:AlmaLinux-186311)
      * ice: driver update 2026-06, part 1 [almalinux-10.2.z] (JIRA:AlmaLinux-191324)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-42919 advisory.

    - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150}
    - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-191324 RHEL-192200] {CVE-2026-53009}
    - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-191324]     {CVE-2026-46162}
    - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-191324]     {CVE-2026-43346}
    - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Jakub Ramaseuski) [RHEL-191324]     {CVE-2026-23166}
    - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (CKI Backport Bot) [RHEL-189604] {CVE-2025-71147}
    - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CKI Backport Bot) [RHEL-189576]     {CVE-2025-71113}
    - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188644]     {CVE-2026-52976}
    - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180167]     {CVE-2026-46116}
    - drm/xe/dma-buf: fix UAF with retry loop (Karol Herbst) [RHEL-192232] {CVE-2026-52950}
    - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179887]     {CVE-2026-46215}
    - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180697]     {CVE-2026-31530}
    - flex_proportions: make fprop_new_period() hardirq safe (CKI Backport Bot) [RHEL-189658] {CVE-2026-23168}
    - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188331]     {CVE-2026-53071}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:42919 advisory.

    * kernel: crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CVE-2025-71113)

    * kernel: Linux kernel: Denial of Service due to memory leak in tpm2_load_cmd (CVE-2025-71147)

    * kernel: flex_proportions: make fprop_new_period() hardirq safe (CVE-2026-23168)

    * kernel: cxl/port: Fix use after free of parent_port in cxl_detach_ep() (CVE-2026-31530)

    * kernel: xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (CVE-2026-46116)

    * kernel: fanotify: fix false positive on permission events (CVE-2026-46150)

    * kernel: drm: Set old handle to NULL before prime swap in change_handle (CVE-2026-46215)

    * kernel: drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CVE-2026-52976)

    * kernel: drm/xe/dma-buf: fix UAF with retry loop (CVE-2026-52950)

    * kernel: ice: fix double-free of tx_buf skb (CVE-2026-53009)

    * kernel: Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CVE-2026-53071)

    * kernel: can: bcm: thrtimer use-after-free during RX operation teardown ()

    Bug Fix(es) and Enhancement(s):

    * nfsd_file slab cache objects remaining on kmem_cache_shutdown during nfsd teardown while running     bz1477872 testcase (JIRA:Rocky Linux-173103)

    * tools/lib/perf/Makefile: libperf includes appended after CFLAGS causes parallel build race, breaking     kernel builds [rhel-10.2.z] (JIRA:Rocky Linux-183975)

    * [Rocky Linux10-debug]: BUG: KASAN: slab-use-after-free in __pv_queued_spin_lock_slowpath [rhel-10.2.z]     (JIRA:Rocky Linux-186311)

    * ice: driver update 2026-06, part 1 [rhel-10.2.z] (JIRA:Rocky Linux-191324)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:42919 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CVE-2025-71113)

    * kernel: Linux kernel: Denial of Service due to memory leak in tpm2_load_cmd (CVE-2025-71147)

    * kernel: flex_proportions: make fprop_new_period() hardirq safe (CVE-2026-23168)

    * kernel: cxl/port: Fix use after free of parent_port in cxl_detach_ep() (CVE-2026-31530)

    * kernel: xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (CVE-2026-46116)

    * kernel: fanotify: fix false positive on permission events (CVE-2026-46150)

    * kernel: drm: Set old handle to NULL before prime swap in change_handle (CVE-2026-46215)

    * kernel: drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CVE-2026-52976)

    * kernel: drm/xe/dma-buf: fix UAF with retry loop (CVE-2026-52950)

    * kernel: ice: fix double-free of tx_buf skb (CVE-2026-53009)

    * kernel: Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CVE-2026-53071)

    * kernel: can: bcm: thrtimer use-after-free during RX operation teardown ()

    Bug Fix(es) and Enhancement(s):

    * nfsd_file slab cache objects remaining on kmem_cache_shutdown during nfsd teardown while running     bz1477872 testcase (JIRA:RHEL-173103)

    * tools/lib/perf/Makefile: libperf includes appended after CFLAGS causes parallel build race, breaking     kernel builds [rhel-10.2.z] (JIRA:RHEL-183975)

    * [RHEL10-debug]: BUG: KASAN: slab-use-after-free in __pv_queued_spin_lock_slowpath [rhel-10.2.z]     (JIRA:RHEL-186311)

    * ice: driver update 2026-06, part 1 [rhel-10.2.z] (JIRA:RHEL-191324)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() Two error handling issues exist in     xe_exec_queue_create_ioctl(): 1. When xe_hw_engine_group_add_exec_queue() fails, the error path jumps to     put_exec_queue which skips xe_exec_queue_kill(). If the VM is in preempt fence mode,     xe_vm_add_compute_exec_queue() has already added the queue to the VM's compute exec queue list. Skipping     the kill leaves the queue on that list, leading to a dangling pointer after the queue is freed. 2. When     xa_alloc() fails after xe_hw_engine_group_add_exec_queue() has succeeded, the error path does not call     xe_hw_engine_group_del_exec_queue() to remove the queue from the hw engine group list. The queue is then     freed while still linked into the hw engine group, causing a use-after-free. Fix both by: - Changing the     xe_hw_engine_group_add_exec_queue() failure path to jump to kill_exec_queue so that xe_exec_queue_kill()     properly removes the queue from the VM's compute list. - Adding a del_hw_engine_group label before     kill_exec_queue for the xa_alloc() failure path, which removes the queue from the hw engine group before     proceeding with the rest of the cleanup. (cherry picked from commit     37c831f401746a45d510b312b0ed7a77b1e06ec8) (CVE-2026-52976)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
335080	openSUSE 16: cluster-md-kmp-64kb / cluster-md-kmp-azure / cluster-md-kmp-default / etc (openSUSE-SU-2026:21555-1)	Nessus	SuSE Local Security Checks	Local	high
333593	RHEL 10 : kernel (RHSA-2026:52764)	Nessus	Red Hat Local Security Checks	Local	high
333589	RHEL 9 : kernel (RHSA-2026:52667)	Nessus	Red Hat Local Security Checks	Local	medium
331473	AlmaLinux 9 : kernel (ALSA-2026:45192)	Nessus	Alma Linux Local Security Checks	Local	high
331324	Oracle Linux 9 : kernel (ELSA-2026-45192)	Nessus	Oracle Linux Local Security Checks	Local	high
330207	RockyLinux 9 : kernel (RLSA-2026:45192)	Nessus	Rocky Linux Local Security Checks	Local	high
329342	RHEL 9 : kernel (RHSA-2026:45192)	Nessus	Red Hat Local Security Checks	Local	high
329317	AlmaLinux 10 : kernel (ALSA-2026:42919)	Nessus	Alma Linux Local Security Checks	Local	high
329205	Oracle Linux 10 : kernel (ELSA-2026-42919)	Nessus	Oracle Linux Local Security Checks	Local	high
329181	RockyLinux 10 : kernel (RLSA-2026:42919)	Nessus	Rocky Linux Local Security Checks	Local	high
329149	SUSE SLED15: cluster-md-kmp-default / dlm-kmp-default / gfs2-kmp-default / etc (SUSE-SU-2026:3166-1)	Nessus	SuSE Local Security Checks	Local	medium
328856	RHEL 10 : kernel (RHSA-2026:42919)	Nessus	Red Hat Local Security Checks	Local	high
323453	Linux Distros Unpatched Vulnerability : CVE-2026-52976	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2026-52976

high

Tenable Plugins

high

high

medium

high

high

high

high

high

high

high

medium

high

high