This advisory covers three kernel vulnerabilities in Red Hat Enterprise Linux 9: CVE-2026-31613 fixes an out-of-bounds read when parsing symlink error responses in the SMB client; CVE-2026-31786 addresses a buffer overflow in the Xen hypervisor driver code; and CVE-2026-46243 prevents the SMB client from accepting potentially malicious userspace cifs.spnego descriptions. These issues affect the Linux kernel packages which are central to the operating system's functionality. Red Hat has released updated kernel packages to remediate these vulnerabilities, requiring a reboot to apply the fixes.

The vulnerabilities could lead to memory corruption issues such as out-of-bounds reads and buffer overflows within kernel components, potentially impacting system stability or security. The SMB client vulnerabilities could allow improper handling of certain network responses or authentication descriptions, which may be leveraged in attacks against SMB services. The Xen driver buffer overflow could affect systems using Xen virtualization. Red Hat rates the overall security impact as Important. There are no reports of active exploitation in the wild.

Red Hat has released updated kernel packages that address these vulnerabilities. Users of affected Red Hat Enterprise Linux 9 versions and related products should apply the kernel update as detailed in the Red Hat advisory RHSA-2026:24381. A system reboot is required for the update to take effect. No additional mitigation steps are indicated by the vendor.