The advisory covers multiple Linux kernel vulnerabilities affecting Red Hat Enterprise Linux 9 and its variants. CVE-2026-23136 involves a denial of service in the libceph OSD client caused by an unreset sparse-read state. CVE-2026-23270 is a use-after-free in traffic control (act_ct) that may result in denial of service or privilege escalation. CVE-2026-31402 fixes a heap overflow in the NFSv4.0 LOCK replay cache. CVE-2026-31431 addresses a regression in the crypto algif_aead component by reverting to operating out-of-place. Red Hat has released updated kernel packages that fix these vulnerabilities. The update requires a system reboot to take effect. The advisory references multiple CVEs and provides links to detailed CVE pages for further information.

The vulnerabilities can lead to denial of service conditions and potential privilege escalation on affected systems running vulnerable versions of the Linux kernel in Red Hat Enterprise Linux 9. Specifically, the use-after-free vulnerability in traffic control may allow privilege escalation, while other issues primarily cause denial of service. The cryptographic regression could affect cryptographic operations. These impacts can disrupt system availability and security if exploited.

Red Hat has released an official kernel update that addresses these vulnerabilities. Users should apply the provided kernel update for Red Hat Enterprise Linux 9 and reboot their systems to ensure the fixes take effect. Detailed update instructions are available at https://access.redhat.com/articles/11258. No additional mitigation steps are indicated by the vendor advisory.