This Red Hat security advisory addresses multiple vulnerabilities in the Linux kernel for Red Hat Enterprise Linux 8.8. The key issues include a use-after-free vulnerability in RDMA/rxe (CVE-2025-38024) that could lead to arbitrary code execution, race conditions in ALSA aloop PCM trigger (CVE-2026-23191), denial of service and memory corruption in RDMA umad (CVE-2026-23243), privilege escalation or denial of service in KVM due to improper shadow page table handling (CVE-2026-23401), use-after-free in bonding driver causing denial of service (CVE-2026-31419), use-after-free in CAN raw socket (CVE-2026-31532), a local privilege escalation vulnerability via a variant of the Dirty Frag vulnerability in ESP/XFRM (CVE-2026-46300), and unauthorized reading of root-owned files by unprivileged users (CVE-2026-46333). Red Hat has released patched kernel packages and advises rebooting systems after applying the update.

The vulnerabilities collectively could allow attackers to execute arbitrary code, cause denial of service, escalate privileges locally, or access sensitive root-owned files without authorization. The issues affect critical kernel subsystems, potentially impacting system stability, confidentiality, and integrity. No known exploits in the wild have been reported at the time of this advisory.

Red Hat has released updated kernel packages that address these vulnerabilities as part of advisory RHSA-2026:19521. Users of Red Hat Enterprise Linux 8.8 should apply the kernel update promptly and reboot their systems to activate the fixes. For detailed update instructions, refer to https://access.redhat.com/articles/11258. No additional mitigations are indicated by the vendor advisory.