This advisory addresses two security vulnerabilities in the Linux kernel packages distributed by Red Hat. CVE-2025-38499 fixes a flaw in clone_private_mnt() where the caller's CAP_SYS_ADMIN capability was not properly verified within the correct user namespace, which could lead to unauthorized privilege escalation. CVE-2025-39984 resolves an issue in the network tun driver where the napi->skb pointer was not updated correctly after XDP processing, potentially causing inconsistent network packet handling. The update is rated as Important by Red Hat Product Security and applies to Red Hat Enterprise Linux 10 and its extended update support versions across multiple architectures. The vendor advisory confirms that a security update is available and that a system reboot is necessary to apply the fix.

The vulnerabilities could allow an attacker with certain privileges to escalate their capabilities improperly (CVE-2025-38499) or cause network packet processing inconsistencies (CVE-2025-39984). The exact impact details and CVSS scores are not provided in the advisory, but Red Hat rates the update as Important, indicating a significant security risk if unpatched. There are no known exploits in the wild at the time of the advisory.

Red Hat has released an official security update for the kernel packages that addresses these vulnerabilities. Users should apply the update as soon as possible following the instructions in the Red Hat advisory (https://access.redhat.com/articles/11258). A system reboot is required to activate the fixes. No additional mitigations are indicated or necessary beyond applying this official patch.