This Red Hat security advisory (RHSA-2026:13578) addresses multiple kernel vulnerabilities in the kernel-rt packages for Red Hat Enterprise Linux 8. The fixed issues include CVE-2024-41073 (NVMe double free), CVE-2025-40252 (out-of-bounds read in qlogic/qede network drivers), CVE-2025-68724 (overflow in asymmetric_key_generate_id), CVE-2026-31402 (heap overflow in NFSv4.0 LOCK replay cache), CVE-2026-23401 (privilege escalation or denial of service in KVM due to improper shadow page table entry handling), and CVE-2026-31431 (cryptographic algif_aead operation revert). The advisory provides updated kernel-rt packages for affected Red Hat Enterprise Linux 8 variants and requires a system reboot to apply the fixes.

The vulnerabilities affect the kernel-rt packages used in Red Hat Enterprise Linux 8 and its real-time and NFV variants. They include memory corruption issues such as double free, heap overflow, and out-of-bounds reads, which can lead to system instability or crashes. The KVM vulnerability can allow privilege escalation or denial of service. These issues collectively pose a high security risk if exploited, potentially impacting system confidentiality, integrity, and availability.

Red Hat has released updated kernel-rt packages that address these vulnerabilities. Users should apply the security update as described in the Red Hat advisory RHSA-2026:13578 and reboot affected systems to ensure the fixes take effect. No additional mitigations are specified or required beyond applying the official update and rebooting.