Red Hat Product Security issued an advisory (RHSA-2026:2282) for multiple vulnerabilities in the Linux kernel packages included in Red Hat Enterprise Linux 10. The vulnerabilities include CVE-2025-38415 (memory corruption in Squashfs), CVE-2025-38403 (improper clearing of vmci transport packet), CVE-2025-38730 (data corruption and instability due to improper io_uring/net buffer handling), CVE-2025-39933 (SMB client data verification issues), CVE-2025-40133 (incorrect socket destination handling in mptcp), CVE-2025-40304 (out-of-bounds write in fbdev potentially leading to privilege escalation, information disclosure, or denial of service), CVE-2025-40322 (out-of-bounds read in font glyph handling causing information disclosure and denial of service), and CVE-2025-68811 (incorrect memcpy byte offset in svcrdma). The advisory provides updated kernel packages that fix these issues and requires a system reboot to apply the fixes. No CVSS scores are provided in the advisory, but the overall severity is rated as Moderate.

The vulnerabilities collectively can cause memory corruption, data corruption, system instability, privilege escalation, information disclosure, and denial of service conditions in affected Red Hat Enterprise Linux 10 systems. Specific impacts include potential unauthorized privilege escalation via out-of-bounds write, exposure of sensitive information via out-of-bounds read, and disruption of normal kernel operations leading to system instability or crashes.

Red Hat has released updated kernel packages that address all listed vulnerabilities. Users should apply the security update as detailed in the Red Hat advisory RHSA-2026:2282 and reboot affected systems to ensure the fixes take effect. No additional mitigations are indicated or required beyond applying the official update and rebooting.