The kernel-rt packages for Red Hat Enterprise Linux 9.0 include security fixes for three vulnerabilities: CVE-2026-31532 addresses a use-after-free in the CAN raw socket code (raw_rcv function), CVE-2026-46300 is a local privilege escalation vulnerability stemming from a variant of the Dirty Frag vulnerability affecting ESP/XFRM, and CVE-2026-46333 allows unprivileged users to read files owned by root. These vulnerabilities could impact system security by enabling privilege escalation or unauthorized data access. Red Hat has released updated kernel-rt packages to remediate these issues, and a system reboot is required to apply the fixes.

Successful exploitation of these vulnerabilities could allow an attacker to escalate privileges locally or access sensitive files without authorization, potentially compromising system integrity and confidentiality. The use-after-free bug could lead to memory corruption, while the Dirty Frag variant enables local privilege escalation. The ability for unprivileged users to read root-owned files could expose sensitive information. However, no known exploits in the wild have been reported at this time.

Red Hat has released an official security update for the kernel-rt packages addressing these vulnerabilities. Users should apply the update as soon as possible following the guidance at https://access.redhat.com/articles/11258. A system reboot is required for the update to take effect. No additional mitigation steps are indicated by the vendor advisory.