Red Hat issued a security advisory (RHSA-2026:13936) for the Linux kernel packages in Red Hat Enterprise Linux 9.0 and related variants, addressing nine CVEs including CVE-2025-37861 and CVE-2026-23097 among others. The vulnerabilities fixed include synchronous access issues in SCSI mpi3mr, denial of service via deadlock in hugetlb folio migration, use-after-free in iscsi target code, race conditions in ALSA aloop PCM trigger, denial of service and memory corruption in RDMA umad, privilege escalation or denial of service in KVM shadow page table handling, heap overflow in NFSv4.0 LOCK replay cache, and a crypto subsystem regression. The advisory states that a kernel update is available and must be applied with a system reboot. The update is rated as Important by Red Hat Product Security.

The vulnerabilities collectively can lead to denial of service, memory corruption, privilege escalation, use-after-free conditions, deadlocks, and heap overflows within the Linux kernel. These issues affect core kernel components and subsystems, potentially impacting system stability, security, and confidentiality if exploited. The advisory does not report any known exploits in the wild at the time of publication.

Red Hat has released an official kernel update that addresses all listed vulnerabilities. Users of Red Hat Enterprise Linux 9.0 and related variants should apply the update promptly and reboot their systems to ensure the fixes take effect. Detailed update instructions are available in the Red Hat advisory. No additional mitigations are specified or required beyond applying the official update and rebooting.