This Red Hat security advisory addresses four vulnerabilities in the Linux kernel affecting Red Hat Enterprise Linux 9 and related variants. CVE-2025-38109 is a use-after-free vulnerability in the mlx5 network driver's ECVF vports unload code that can cause denial of service. CVE-2026-23111 involves privilege escalation or denial of service in nf_tables due to an inverted element activity check. CVE-2026-23210 is a denial of service vulnerability caused by a race condition during VSI rebuild in the ice driver. CVE-2026-23231 is a use-after-free vulnerability in nf_tables_addchain() that can lead to privilege escalation or denial of service. Red Hat has issued kernel updates to fix these issues, requiring a system reboot for the update to take effect.

The vulnerabilities can result in denial of service conditions or privilege escalation on affected systems running Red Hat Enterprise Linux 9 and related products. Exploitation could disrupt system availability or allow unauthorized privilege gains. No known exploits in the wild have been reported at this time.

Red Hat has released an official kernel update for Red Hat Enterprise Linux 9 that addresses these vulnerabilities. Users should apply the update as described in the Red Hat advisory RHSA-2026:6570 and reboot their systems to ensure the fixes take effect. Patch status is confirmed as fixed by the vendor advisory.