The advisory covers nine distinct Linux kernel vulnerabilities fixed in Red Hat Enterprise Linux 9.4 Extended Update Support. CVE-2025-37882 involves a race condition in the xHCI driver causing data loss or use-after-free. CVE-2025-38415 is a memory corruption in Squashfs due to incorrect block size calculation. CVE-2025-38730 concerns data corruption and system instability from improper io_uring/net buffer handling. CVE-2025-39760 is a denial of service via out-of-bounds read in USB configuration parsing. CVE-2025-39933 addresses verification of data offsets and lengths in the SMB client. CVE-2025-40271 is a use-after-free in proc_readdir_de() potentially leading to privilege escalation or denial of service. CVE-2025-40304 involves out-of-bounds write in fbdev causing privilege escalation, information disclosure, or denial of service. CVE-2025-40269 is a buffer overflow in the ALSA USB audio driver leading to information disclosure and denial of service. CVE-2025-68349 relates to clearing NFS_INO_LAYOUTCOMMIT in pnfs_mark_layout_stateid_invalid. The advisory references Red Hat Bugzilla entries for each fix and recommends applying the update and rebooting the system.

These vulnerabilities collectively impact the Linux kernel core, potentially causing data loss, data corruption, system instability, denial of service, information disclosure, and privilege escalation on affected Red Hat Enterprise Linux 9.4 systems. Exploitation could allow attackers to disrupt system operations or gain elevated privileges, depending on the specific flaw.

An official security update is available from Red Hat for Red Hat Enterprise Linux 9.4 Extended Update Support. Users should apply the kernel update as provided in Red Hat Advisory RHSA-2026:2766 and reboot the system to activate the fixes. No additional mitigation steps are indicated beyond applying the update and rebooting.