This Red Hat security advisory (RHSA-2026:13932) addresses multiple vulnerabilities in the Linux kernel packages, including CVE-2025-71238, a double free vulnerability in the qla2xxx driver that can cause denial of service and potential privilege escalation. Other fixed issues include a race condition in ALSA aloop PCM trigger (CVE-2026-23191), privilege escalation or denial of service in KVM due to improper shadow page table entry handling (CVE-2026-23401), a revert to out-of-place operation in crypto algif_aead (CVE-2026-31431), and a use-after-free in the CAN raw socket code (CVE-2026-31532). The advisory covers Red Hat Enterprise Linux 9.4 Extended Update Support and related CodeReady Linux Builder products across multiple architectures. The update requires a system reboot to apply the fixes.

The vulnerabilities fixed in this update can lead to denial of service conditions and potential privilege escalation on affected systems running the vulnerable Linux kernel versions. Specifically, the double free in the qla2xxx driver may allow attackers to crash the system or escalate privileges. The KVM vulnerability may allow guest virtual machines to escalate privileges or cause host denial of service. Other issues include race conditions and use-after-free bugs that can destabilize the kernel or expose it to exploitation.

Red Hat has released an official security update for the Linux kernel packages addressing these vulnerabilities. Users of Red Hat Enterprise Linux 9.4 Extended Update Support and related products should apply the update promptly. A system reboot is required for the update to take effect. For detailed update instructions, refer to Red Hat's advisory and knowledge base article at https://access.redhat.com/articles/11258. No additional mitigation steps are indicated beyond applying the official update.