Red Hat issued a security advisory (RHSA-2025:19224) for the Linux kernel packages in Red Hat Enterprise Linux 9.2 variants, addressing four vulnerabilities: CVE-2025-38556 (HID core s32ton() function hardened against conversion to zero bits), CVE-2025-38718 (SCTP protocol linearizes cloned GSO packets in sctp_rcv), CVE-2025-39682 (TLS fixes for zero-length record handling on rx_list), and CVE-2025-39751 (ALSA hda/ca0132 driver buffer overflow in add_tuning_control). The advisory rates these issues as moderate severity and provides updated kernel packages that must be installed followed by a system reboot. The advisory references Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions and Extended Life Cycle variants on multiple architectures including x86_64, ppc64le, aarch64, and s390x. No CVSS scores are provided in the advisory, and no known exploits in the wild are reported.

The vulnerabilities affect the Linux kernel core components and drivers, potentially allowing issues such as improper bit conversions, packet handling errors, TLS record processing flaws, and buffer overflows. These could lead to system instability or security weaknesses if exploited. The advisory classifies the overall impact as moderate. No active exploitation has been reported.

Red Hat has released updated kernel packages that address these vulnerabilities. Users of affected Red Hat Enterprise Linux 9.2 variants should apply the kernel update as described in the Red Hat advisory (https://access.redhat.com/articles/11258) and reboot their systems to ensure the fixes take effect. This is the official and recommended remediation.