The Red Hat kernel-rt packages for Real Time Linux kernels contain multiple security vulnerabilities including use-after-free bugs (CVE-2025-38248, CVE-2025-39981, CVE-2025-68800, CVE-2026-23171, CVE-2026-23231), denial of service conditions (CVE-2026-23066, CVE-2026-23144, CVE-2026-23231), and memory leaks (CVE-2026-23144). These vulnerabilities affect various kernel subsystems such as bridge multicast, Bluetooth MGMT, mlxsw spectrum multicast routing, rxrpc, DAMON sysfs, bonding, macvlan, net scheduler cls_u32, and nf_tables. Exploitation could result in system crashes, privilege escalation, or arbitrary code execution. Red Hat Product Security issued advisory RHSA-2026:9512 providing updated kernel-rt packages for Red Hat Enterprise Linux 9.2 Real Time variants to remediate these issues. The update must be applied and the system rebooted for the fixes to take effect.

Successful exploitation of these vulnerabilities could lead to system crashes, denial of service, privilege escalation, memory leaks, or arbitrary code execution on affected Red Hat Enterprise Linux Real Time systems. The vulnerabilities affect critical kernel components responsible for networking, Bluetooth management, and system resource monitoring, potentially impacting system stability and security.

Red Hat has released an official security update (RHSA-2026:9512) that addresses these vulnerabilities in the kernel-rt packages for Red Hat Enterprise Linux 9.2 Real Time variants. Users should apply the update as described in the Red Hat advisory (https://access.redhat.com/articles/11258) and reboot the system to ensure the fixes take effect. No alternative mitigations are indicated by the vendor advisory.