Red Hat Security Advisory: kernel security update
This Red Hat security advisory addresses multiple vulnerabilities in the Linux kernel packages for Red Hat Enterprise Linux 9 and related variants. The fixes include resolving an issue in the net/sched subsystem where a class was not properly removed before deletion (CVE-2025-71066) and two use-after-free vulnerabilities in the KVM x86 shadow paging implementation (CVE-2026-46113 and CVE-2026-53359). These vulnerabilities could potentially lead to system instability or privilege escalation if exploited. Red Hat has released patches for these issues, and applying the update requires a system reboot.
AI Analysis
Technical Summary
The advisory covers three kernel vulnerabilities: CVE-2025-71066 fixes a flaw in the net/sched ETS queuing discipline where a class was not removed from the active list before deletion, preventing potential use-after-free or memory corruption. CVE-2026-46113 and CVE-2026-53359 address separate use-after-free bugs in the KVM x86 shadow paging code caused by unexpected guest frame numbers (GFN) and roles, respectively. These bugs could lead to memory corruption within the kernel's virtualization subsystem. Red Hat has issued patches for these vulnerabilities in Red Hat Enterprise Linux 9 and associated product variants, requiring a reboot to apply.
Potential Impact
Successful exploitation of these vulnerabilities could cause kernel memory corruption, potentially leading to system crashes or privilege escalation within affected Red Hat Enterprise Linux 9 systems. The issues affect core kernel components including networking and virtualization subsystems, which are critical for system stability and security.
Mitigation Recommendations
Red Hat has released official patches addressing these vulnerabilities as part of the kernel update for Red Hat Enterprise Linux 9. Users should apply the update promptly following Red Hat's guidance at https://access.redhat.com/articles/11258 and reboot affected systems to ensure the fixes take effect. No additional mitigations are indicated by the vendor advisory.
Red Hat Security Advisory: kernel security update
Description
This Red Hat security advisory addresses multiple vulnerabilities in the Linux kernel packages for Red Hat Enterprise Linux 9 and related variants. The fixes include resolving an issue in the net/sched subsystem where a class was not properly removed before deletion (CVE-2025-71066) and two use-after-free vulnerabilities in the KVM x86 shadow paging implementation (CVE-2026-46113 and CVE-2026-53359). These vulnerabilities could potentially lead to system instability or privilege escalation if exploited. Red Hat has released patches for these issues, and applying the update requires a system reboot.
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The advisory covers three kernel vulnerabilities: CVE-2025-71066 fixes a flaw in the net/sched ETS queuing discipline where a class was not removed from the active list before deletion, preventing potential use-after-free or memory corruption. CVE-2026-46113 and CVE-2026-53359 address separate use-after-free bugs in the KVM x86 shadow paging code caused by unexpected guest frame numbers (GFN) and roles, respectively. These bugs could lead to memory corruption within the kernel's virtualization subsystem. Red Hat has issued patches for these vulnerabilities in Red Hat Enterprise Linux 9 and associated product variants, requiring a reboot to apply.
Potential Impact
Successful exploitation of these vulnerabilities could cause kernel memory corruption, potentially leading to system crashes or privilege escalation within affected Red Hat Enterprise Linux 9 systems. The issues affect core kernel components including networking and virtualization subsystems, which are critical for system stability and security.
Mitigation Recommendations
Red Hat has released official patches addressing these vulnerabilities as part of the kernel update for Red Hat Enterprise Linux 9. Users should apply the update promptly following Red Hat's guidance at https://access.redhat.com/articles/11258 and reboot affected systems to ensure the fixes take effect. No additional mitigations are indicated by the vendor advisory.
Technical Details
- Gcve Source
- db.gcve.eu
- Csaf Category
- csaf_security_advisory
- Csaf Version
- 2.0
- Publisher
- Red Hat Product Security
- Advisory Id
- RHSA-2026:36957
- Cve Count
- 3
- Additional Cves
- ["CVE-2026-46113","CVE-2026-53359"]
- Cvss Version
- 3.1
Threat ID: 6a4f6c1568715ace43154f8a
Added to database: 07/09/2026, 09:38:29 UTC
Last enriched: 08/12/2026, 18:44:06 UTC
Last updated: 08/23/2026, 22:52:08 UTC
Views: 228
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.