This Red Hat security advisory (RHSA-2025:16669) provides patches for five kernel vulnerabilities affecting Red Hat Enterprise Linux 9.4 Extended Update Support. The vulnerabilities include: CVE-2024-50121, which fixes cancellation of nfsd_shrinker_work using synchronous mode during NFSv4 state shutdown; CVE-2025-22058, addressing a memory accounting leak in UDP; CVE-2025-37810, ensuring event counts do not exceed buffer lengths in USB dwc3 gadget drivers; CVE-2025-38211, correcting a use-after-free condition in RDMA iwcm work objects after cm_id destruction; and CVE-2025-38461, resolving a TOCTOU race condition in vsock transport functions. The advisory covers multiple architectures and product variants of Red Hat Enterprise Linux 9.4. The update is rated moderate severity by Red Hat Product Security and requires rebooting the system after applying the patches. No CVSS scores are provided in the advisory, and no known exploits in the wild are reported.

The vulnerabilities fixed by this advisory could lead to issues such as resource leaks, use-after-free conditions, and race conditions within the Linux kernel, potentially affecting system stability and security. However, the advisory rates the overall impact as moderate and does not report any known active exploitation. The affected components include network file system operations, UDP networking, USB gadget drivers, RDMA communication, and virtual socket transport layers.

Red Hat has released an official security update for the Linux kernel packages in Red Hat Enterprise Linux 9.4 Extended Update Support that addresses these vulnerabilities. Users should apply the update as detailed in the Red Hat advisory (https://access.redhat.com/articles/11258) and reboot their systems to ensure the fixes take effect. No additional mitigation steps are indicated by the vendor.