This Red Hat security advisory (RHSA-2026:14137) addresses nine distinct vulnerabilities in the kernel-rt packages for Red Hat Enterprise Linux 9.0, including CVE-2025-37861 (SCSI mpi3mr synchronous access issue), CVE-2026-23097 (deadlock causing denial of service in hugetlb folio migration), CVE-2026-23193 (use-after-free in iscsi session usage count), CVE-2026-23191 (race condition in ALSA aloop PCM trigger), CVE-2026-23243 (denial of service and memory corruption in RDMA umad), CVE-2026-23401 (privilege escalation or denial of service in KVM shadow page table handling), CVE-2026-31402 (heap overflow in NFSv4.0 LOCK replay cache), CVE-2026-31431 (crypto algif_aead revert to out-of-place operation), and CVE-2026-43077 (not detailed in the advisory). The update is rated as Important by Red Hat Product Security. The advisory includes fixes for these vulnerabilities and requires a system reboot to apply the update. No CVSS scores are provided in the advisory; users are referred to individual CVE pages for detailed scoring.

The vulnerabilities collectively impact kernel-rt components, potentially allowing denial of service, privilege escalation, memory corruption, use-after-free conditions, heap overflow, and race conditions. These issues could affect system stability, security, and reliability in environments relying on the Real Time Linux Kernel. The severity is rated as Important by Red Hat, indicating significant risk if unpatched. No known exploits in the wild have been reported at this time.

Red Hat has released an official security update (RHSA-2026:14137) that addresses all listed vulnerabilities in the kernel-rt packages for Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions. Users should apply the update promptly following Red Hat's guidance at https://access.redhat.com/articles/11258. A system reboot is required for the update to take effect. No additional mitigation actions are indicated by the vendor advisory.