This Red Hat security advisory (RHSA-2025:9080) covers seven distinct vulnerabilities in the Linux kernel affecting Red Hat Enterprise Linux 9 and its variants. The fixes address: a truesize calculation error in the bnxt Ethernet driver (CVE-2025-21961), a slab-use-after-free in Bluetooth L2CAP command sending (CVE-2025-21969), an integer overflow in CIFS mount option processing (CVE-2025-21963), a use-after-free in WiFi cfg80211 wiphy handling (CVE-2025-21979), a use-after-free in proc_get_inode() (CVE-2025-21999), a use-after-free in md device iteration (CVE-2025-22126), and a use-after-free in SMB client decryption with multichannel (CVE-2025-37750). Red Hat rates the overall security impact as Important (high). The advisory provides updated kernel packages and requires a system reboot to apply the fixes. No CVSS scores are provided in the advisory; users are directed to individual CVE pages for details.

The vulnerabilities fixed in this advisory include multiple use-after-free conditions and an integer overflow, which could lead to memory corruption or denial of service in the kernel. These issues affect core kernel components responsible for networking (Ethernet, Bluetooth, WiFi, SMB, CIFS) and system internals (proc filesystem, MD devices). Exploitation could potentially impact system stability or security, depending on the vulnerability. Red Hat classifies the overall impact as Important (high severity). There are no known exploits in the wild at the time of the advisory.

Red Hat has released updated kernel packages that address these vulnerabilities. Users of Red Hat Enterprise Linux 9 and related variants should apply the kernel update provided in advisory RHSA-2025:9080 as soon as possible. A system reboot is required for the update to take effect. Refer to the official Red Hat article https://access.redhat.com/articles/11258 for detailed update instructions. Patch status is confirmed as available and official.