The advisory covers five distinct vulnerabilities in the Linux kernel: CVE-2025-38051 fixes a use-after-free in the SMB client (cifs_fill_dirent); CVE-2025-38383 addresses a denial of service caused by a data race in vmalloc's show_numa_info function; CVE-2025-40271 corrects a use-after-free in proc_readdir_de() that could lead to privilege escalation or denial of service; CVE-2025-40294 fixes an out-of-bounds write in Bluetooth MGMT that may cause information disclosure and denial of service; and CVE-2025-40269 resolves a buffer overflow in the ALSA USB audio driver leading to information disclosure and denial of service. These vulnerabilities affect the core Linux kernel in Red Hat Enterprise Linux 10.0 Extended Update Support and related CodeReady Linux Builder products. The advisory provides updated kernel packages that must be installed and followed by a system reboot to mitigate these issues.

The vulnerabilities collectively can cause denial of service, information disclosure, and privilege escalation on affected systems running the Linux kernel in Red Hat Enterprise Linux 10.0 Extended Update Support. Exploitation could disrupt system availability, expose sensitive information, or allow attackers to gain elevated privileges.

Red Hat has released updated kernel packages addressing these vulnerabilities. Users should apply the security update as detailed in the Red Hat advisory RHSA-2026:2761 and reboot affected systems to ensure the fixes take effect. No alternative mitigations are indicated; patching and rebooting is required.