Red Hat Product Security released an advisory (RHSA-2025:13946) for multiple kernel vulnerabilities affecting Red Hat Enterprise Linux 9.4 Extended Update Support. The kernel update fixes six CVEs: CVE-2024-26878 (potential NULL pointer dereference in quota), CVE-2024-41035 (USB core duplicate endpoint bug), CVE-2025-22020 (slab-use-after-free in memstick rtsx_usb_ms driver), CVE-2025-22026 (NFS daemon ignoring svc_proc_register() return code), CVE-2025-37797 (use-after-free in net_sched hfsc class handling), and CVE-2025-38086 (uninitialized access in net ch9200 driver). The advisory recommends applying the update and rebooting the system to mitigate these issues.

The vulnerabilities affect critical kernel components, potentially leading to system instability or unintended behavior such as NULL pointer dereferences and use-after-free conditions. These could be leveraged to cause denial of service or other impacts depending on the specific kernel subsystem affected. The advisory rates the overall security impact as Moderate. No known exploits in the wild have been reported at this time.

Red Hat has released an official security update for the Linux kernel packages addressing these vulnerabilities. Users of Red Hat Enterprise Linux 9.4 Extended Update Support should apply the kernel update provided in advisory RHSA-2025:13946 and reboot their systems to ensure the fixes take effect. For detailed update instructions, refer to https://access.redhat.com/articles/11258. No additional mitigation steps are required beyond applying the official patch and rebooting.