Red Hat Product Security issued an advisory (RHSA-2025:22854) for a kernel security update affecting Red Hat Enterprise Linux 10 and related variants. The update addresses nine distinct vulnerabilities in the Linux kernel, including a CIFS uninitialized variable causing kernel oops (CVE-2025-38737), CAN bus notification handler implementation (CVE-2025-39925), multiple use-after-free bugs in Bluetooth components (CVE-2025-39981, CVE-2025-39982, CVE-2025-39983), a use-after-free in mlx5 flow counter release (CVE-2025-39979), a wait queue pruning fix in io_uring (CVE-2025-40047), disallowing dirty tracking in iommu/vt-d under incoherent page walk (CVE-2025-40058), and an adapter allocation failure fix in the ice driver (CVE-2025-40185). These fixes mitigate potential kernel crashes and memory corruption issues. The advisory recommends updating to the fixed kernel packages and rebooting the system to apply the changes.

The vulnerabilities fixed in this update could lead to kernel crashes (oops), use-after-free conditions, and memory corruption, potentially affecting system stability and security. While no known exploits are reported in the wild, these issues could be leveraged to cause denial of service or other unintended behavior in affected systems running vulnerable kernel versions. The impact is rated as moderate by Red Hat.

Red Hat has released updated kernel packages that address these vulnerabilities. Users of Red Hat Enterprise Linux 10 and related products should apply the security update as detailed in the advisory RHSA-2025:22854 and reboot their systems to ensure the fixes take effect. For update instructions, refer to https://access.redhat.com/articles/11258. No additional mitigation is required beyond applying the official update and rebooting.