This Red Hat security advisory (RHSA-2026:35894) addresses six vulnerabilities in the Linux kernel packages for Red Hat Enterprise Linux 8.6. The fixed issues include: a use-after-free in Bluetooth SCO due to missing sock_hold (CVE-2026-31408), a slab-use-after-free in multipath TCP (__inet_lookup_established) (CVE-2026-31669), an out-of-bounds write in ALSA USB audio silencing code (CVE-2026-43279), a potential race condition in tcp_v6_syn_recv_sock() (CVE-2026-43198), a use-after-free in the GFS2 iomap inline data write path (CVE-2026-45984), and a misuse of RCU in mlx4_srq_event() in the RDMA mlx4 driver (CVE-2026-46181). These vulnerabilities could lead to memory corruption and stability issues. Red Hat rates the security impact as Important (high severity). The advisory provides updated kernel packages and requires a system reboot for the fixes to take effect.

The vulnerabilities fixed in this advisory involve memory safety issues such as use-after-free and out-of-bounds writes, as well as race conditions in critical kernel subsystems. Exploitation could lead to kernel crashes, denial of service, or potentially privilege escalation or code execution, depending on the vulnerability and attack vector. The advisory does not report known exploits in the wild. The impact is considered high due to the kernel-level nature of these bugs affecting core system components.

Red Hat has released updated kernel packages that address these vulnerabilities. Users of Red Hat Enterprise Linux 8.6 should apply the kernel update provided in advisory RHSA-2026:35894 promptly. A system reboot is required for the update to take effect. No additional mitigations are specified or required beyond applying the official patch and rebooting.