This Red Hat security advisory addresses multiple vulnerabilities in the kernel-rt packages of Red Hat Enterprise Linux 9.2 Real Time variants. The fixed issues include a use-after-free in proc_get_inode() (CVE-2025-21999), a double free in the qla2xxx driver leading to denial of service and potential privilege escalation (CVE-2025-71238), denial of service and memory corruption in RDMA umad (CVE-2026-23243), privilege escalation or denial of service due to improper shadow page table handling in KVM (CVE-2026-23401), a use-after-free in CAN raw socket handling (CVE-2026-31532), a local privilege escalation vulnerability in the ESP/XFRM subsystem known as "Fragnesia" (CVE-2026-46300), and an issue allowing unprivileged users to read root-owned files (CVE-2026-46333). The advisory rates the update as Important and requires rebooting the system after applying the update. No CVSS scores are provided in the advisory.

The vulnerabilities collectively allow for potential denial of service, local privilege escalation, memory corruption, and unauthorized access to root-owned files on affected systems running the kernel-rt packages. Exploitation could lead to system instability, elevated privileges, or information disclosure. The issues affect critical kernel components and drivers, impacting system security and reliability.

An official security update is available from Red Hat for the kernel-rt packages in Red Hat Enterprise Linux 9.2 Real Time variants. Users should apply the update as described in the Red Hat advisory (RHSA-2026:19875) and reboot the system to ensure the fixes take effect. No additional mitigation steps are indicated beyond applying the vendor-provided update and rebooting.