Red Hat Security Advisory: kernel security update

The advisory covers three kernel vulnerabilities: CVE-2025-71066 fixes a flaw in the net/sched ETS queuing discipline where a class was not removed from the active list before deletion, preventing potential use-after-free or memory corruption. CVE-2026-46113 and CVE-2026-53359 address separate use-after-free bugs in the KVM x86 shadow paging code caused by unexpected guest frame numbers (GFN) and roles, respectively. These bugs could lead to memory corruption within the kernel's virtualization subsystem. Red Hat has issued patches for these vulnerabilities in Red Hat Enterprise Linux 9 and associated product variants, requiring a reboot to apply.

Successful exploitation of these vulnerabilities could cause kernel memory corruption, potentially leading to system crashes or privilege escalation within affected Red Hat Enterprise Linux 9 systems. The issues affect core kernel components including networking and virtualization subsystems, which are critical for system stability and security.

Red Hat has released official patches addressing these vulnerabilities as part of the kernel update for Red Hat Enterprise Linux 9. Users should apply the update promptly following Red Hat's guidance at https://access.redhat.com/articles/11258 and reboot affected systems to ensure the fixes take effect. No additional mitigations are indicated by the vendor advisory.