This Red Hat security advisory addresses several vulnerabilities in the Linux kernel and kernel-rt packages used in Red Hat Enterprise Linux 9.2 and 9.4 Extended Update Support (EUS) and related variants. The fixes include a use-after-free in proc_get_inode() (CVE-2025-21999), a double free in the qla2xxx driver leading to denial of service and potential privilege escalation (CVE-2025-71238), denial of service and memory corruption in RDMA umad (CVE-2026-23243), privilege escalation or denial of service in KVM due to improper shadow page table handling (CVE-2026-23401), use-after-free in CAN raw socket (CVE-2026-31532), a variant of Dirty Frag vulnerability in ESP/XFRM causing local privilege escalation (CVE-2026-46300), and unauthorized reading of root-owned files by unprivileged users (CVE-2026-46333). The advisory includes multiple other kernel fixes for related issues. The update is rated as having an important security impact and requires rebooting the system after applying the patches.

The vulnerabilities can lead to denial of service, memory corruption, use-after-free conditions, double free errors, local privilege escalation, and unauthorized access to root-owned files. These issues could allow attackers with local access to cause system crashes or elevate privileges, potentially compromising system integrity and confidentiality. The advisory rates the overall impact as important/high severity.

Red Hat has released official security updates for the affected kernel and kernel-rt packages. Users should apply these updates promptly following the instructions in the Red Hat advisory (https://access.redhat.com/articles/11258). A system reboot is required for the updates to take effect. No additional mitigations are indicated by the vendor advisory.