This advisory covers four kernel vulnerabilities affecting Red Hat Enterprise Linux 8.6 variants: CVE-2026-23097 (denial of service due to deadlock in hugetlb folio migration), CVE-2026-23193 (use-after-free in iscsit_dec_session_usage_count()), CVE-2025-71238 (double free in qla2xxx driver leading to denial of service and potential privilege escalation), and CVE-2026-31402 (heap overflow in NFSv4.0 LOCK replay cache). Red Hat has released updated kernel packages to fix these issues and requires a system reboot to apply the changes. The advisory rates the update as important and the severity of CVE-2025-71238 as high. No CVSS scores are provided in the advisory; users are referred to the CVE pages for detailed scoring.

The vulnerabilities can lead to denial of service conditions and, in one case (CVE-2025-71238), potential privilege escalation on affected Red Hat Enterprise Linux 8.6 systems. The double free bug in the qla2xxx driver is particularly critical as it may allow an attacker to escalate privileges. The other issues can cause system instability or crashes due to deadlocks, use-after-free, or heap overflow conditions in kernel components.

Red Hat has released updated kernel packages addressing these vulnerabilities as part of advisory RHSA-2026:13664. Users should apply the provided kernel updates for Red Hat Enterprise Linux 8.6 variants and reboot their systems to ensure the fixes take effect. The vendor advisory provides detailed instructions on applying the update. No additional mitigations are specified or required beyond applying the official patch and rebooting.