The advisory covers five security vulnerabilities in the Linux kernel component of Red Hat Enterprise Linux 9. CVE-2026-22979 addresses a memory leak in networking due to incorrect Generic Receive Offload (GRO) packet handling. CVE-2026-43499 fixes improper use of the current task pointer in the rtmutex remove_waiter() function by switching to waiter::task. CVE-2026-46086 resolves instability in bridge networking by using a stable forwarding database (FDB) destination snapshot in RCU readers. CVE-2026-53016 corrects the copying of initialization vectors (IV) in the crypto CCP module to use the correct skcipher ivsize. CVE-2026-53166 prevents a NULL pointer dereference in futex/requeue during self-deadlock scenarios. Additionally, a bug fix addresses kernel panic during early boot related to tracefs file reading. The advisory provides updated kernel packages for multiple Red Hat Enterprise Linux 9 variants and requires a reboot to apply.

These vulnerabilities affect the Linux kernel core, potentially leading to memory leaks, kernel panics, NULL pointer dereferences, and unstable networking behavior. Such issues can degrade system stability and reliability, and may be leveraged to cause denial of service or other impacts depending on the specific vulnerability. Red Hat rates the overall security impact as Important (high). There are no known exploits in the wild at this time.

Red Hat has released updated kernel packages that address these vulnerabilities. Users of Red Hat Enterprise Linux 9 should apply the available kernel update as described in the Red Hat advisory RHSA-2026:38491 and reboot their systems to ensure the fixes take effect. No additional mitigation steps are indicated beyond applying the official update.