The advisory covers four kernel vulnerabilities: CVE-2026-31684 involves validating nested VLAN headers in the network scheduler checksum; CVE-2026-43499 fixes the use of waiter::task instead of current in the rtmutex remove_waiter function; CVE-2026-46116 improves defensive unhashing of xfrm_state lists during deletion; and CVE-2026-53166 prevents NULL pointer dereference in futex requeue remove_waiter on self-deadlock. These issues affect the Linux kernel core in Red Hat Enterprise Linux 7 Extended Lifecycle Support. The vendor has released updated kernel packages that address these vulnerabilities and requires rebooting the system for the update to take effect.

The vulnerabilities affect the Linux kernel, which is critical to system operation. Exploitation could lead to kernel-level faults such as NULL pointer dereferences or improper handling of kernel data structures, potentially impacting system stability or security. The advisory rates the impact as important but does not provide CVSS scores or confirm active exploitation in the wild.

Red Hat has released updated kernel packages for Red Hat Enterprise Linux 7 Extended Lifecycle Support that fix these vulnerabilities. Users should apply the kernel update as described in the Red Hat advisory and reboot affected systems to ensure the fixes take effect. Patch status is confirmed by the vendor advisory. No additional mitigations are specified.