The advisory covers a set of ten vulnerabilities in the Linux kernel used by Red Hat Enterprise Linux 9.6 Extended Update Support. These include CVE-2024-54456 (potential buffer overflow in NFS), CVE-2025-21647 (bounds checks in scheduler), CVE-2025-21786 (workqueue detachment ordering), CVE-2025-21791 (RCU protection in VRF), CVE-2025-38022 (use-after-free in RDMA core), CVE-2025-38051 (use-after-free in SMB client), CVE-2025-38568 (stack out-of-bounds write in network scheduler), CVE-2025-40294 (out-of-bounds write in Bluetooth MGMT causing info disclosure and DoS), CVE-2025-40322 (out-of-bounds read in font glyph handling causing info disclosure and DoS), and CVE-2025-68349 (NFSv4/pNFS stateid invalidation). The advisory provides patches for these issues and requires rebooting the system after applying the update.

The vulnerabilities collectively may lead to information disclosure, denial of service, and memory corruption issues such as buffer overflows and use-after-free conditions within the kernel. These could affect system stability and security by allowing attackers to cause crashes or potentially leak sensitive information. The overall security impact is rated as moderate by Red Hat.

A security update for the Linux kernel packages is available for Red Hat Enterprise Linux 9.6 Extended Update Support. Users should apply the update as described in the Red Hat advisory RHSA-2026:2352 and reboot their systems to ensure the fixes take effect. No additional mitigations are specified beyond applying the official update and rebooting.