This Red Hat security advisory addresses eight distinct vulnerabilities in the Linux kernel, including CVE-2025-38024 (RDMA/rxe use-after-free leading to potential arbitrary code execution), CVE-2026-23191 (race condition in ALSA aloop PCM trigger), CVE-2026-23243 (denial of service and memory corruption in RDMA umad), CVE-2026-23401 (privilege escalation or denial of service in KVM due to improper shadow page table handling), CVE-2026-31419 (use-after-free in bonding driver causing denial of service), CVE-2026-31532 (use-after-free in can: raw driver), CVE-2026-46300 (local privilege escalation via a variant of Dirty Frag vulnerability in ESP/XFRM), and CVE-2026-46333 (unauthorized reading of root-owned files by unprivileged users). These vulnerabilities affect Red Hat Enterprise Linux 8.8 and related update services on x86_64 and ppc64le architectures. The advisory includes updated kernel packages that fix these issues and requires a system reboot to apply the updates.

The vulnerabilities collectively allow for potential arbitrary code execution, local privilege escalation, denial of service, memory corruption, and unauthorized access to root-owned files on affected systems running vulnerable Red Hat Enterprise Linux kernel versions. Exploitation could compromise system integrity and confidentiality. The advisory rates the security impact as Important, indicating significant risk if unpatched. No known exploits in the wild have been reported at the time of this advisory.

Red Hat has released updated kernel packages that address all listed vulnerabilities. Users of affected Red Hat Enterprise Linux 8.8 versions should apply the provided kernel updates promptly. A system reboot is required for the updates to take effect. Refer to the official Red Hat advisory (RHSA-2026:19521) and the linked article https://access.redhat.com/articles/11258 for detailed update instructions. No additional mitigations are specified or required beyond applying the official patches and rebooting.