Red Hat Product Security issued an advisory (RHSA-2026:2766) for multiple Linux kernel vulnerabilities affecting Red Hat Enterprise Linux 9.4 Extended Update Support and associated CodeReady Linux Builder products. The vulnerabilities include race conditions in the xHCI driver (CVE-2025-37882), memory corruption in Squashfs (CVE-2025-38415), data corruption and instability due to io_uring/net buffer mishandling (CVE-2025-38730), denial of service from out-of-bounds USB configuration parsing (CVE-2025-39760), SMB client verification issues (CVE-2025-39933), use-after-free in proc_readdir_de() leading to privilege escalation or denial of service (CVE-2025-40271), out-of-bounds write in fbdev causing privilege escalation, information disclosure, or denial of service (CVE-2025-40304), buffer overflow in ALSA USB audio driver causing information disclosure and denial of service (CVE-2025-40269), and an NFSv4/pNFS stateid invalidation issue (CVE-2025-68349). Red Hat has released updated kernel packages addressing these vulnerabilities, and applying these updates requires a system reboot.

The vulnerabilities collectively can lead to data loss, use-after-free conditions, memory corruption, data corruption, system instability, denial of service, privilege escalation, and information disclosure. The impact varies by vulnerability but includes potential escalation of privileges and system crashes. The advisory rates the overall security impact as moderate.

Red Hat has released updated kernel packages that address all listed vulnerabilities. Users of Red Hat Enterprise Linux 9.4 Extended Update Support and related products should apply the provided security update promptly. A system reboot is required for the update to take effect. Refer to the official Red Hat advisory RHSA-2026:2766 for detailed update instructions. Patch status is confirmed as available via this official vendor advisory.