This advisory covers multiple security fixes in the Linux kernel packages for Red Hat Enterprise Linux 10 and related distributions. The vulnerabilities include CVE-2025-38403, a privilege escalation issue caused by uninitialized data in the vmci transport packet, along with other flaws such as memory corruption in Squashfs, data corruption in io_uring/net buffers, use-after-free bugs in various subsystems, heap overflow in USB serial drivers, and information disclosure via out-of-bounds reads. The kernel update addresses these by correcting improper initialization, validating inputs, and fixing memory handling errors. The update requires a reboot and recompilation of third-party kernel modules due to ABI changes. The vendor advisory confirms patch availability and provides detailed package versions for update.

Successful exploitation of these vulnerabilities could allow local privilege escalation, information disclosure, denial of service, or system instability. The specific CVE-2025-38403 vulnerability involves privilege escalation via uninitialized data in the vmci transport packet. Other vulnerabilities impact kernel memory safety and driver stability. The overall security impact is rated Moderate by Red Hat, with CVE-2025-38403 specifically rated high severity. There are no known exploits in the wild at this time.

A security update is available from Red Hat and should be applied immediately. The update includes fixes for CVE-2025-38403 and other kernel vulnerabilities. After applying the update, a system reboot is required for the changes to take effect. Due to an ABI change, all third-party kernel modules must be recompiled and reinstalled. Follow the vendor's official guidance at https://access.redhat.com/articles/11258 for update instructions. No additional mitigations are indicated by the vendor advisory.