Red Hat Product Security issued an advisory (RHSA-2025:13099) for a kernel security update addressing two vulnerabilities: CVE-2025-21905, which limits the printed string from firmware files in the iwlwifi driver to prevent potential information leakage or related issues; and CVE-2025-37738, which fixes the ext4 filesystem to ignore extended attributes that extend past their expected boundary, preventing possible memory safety issues. The update applies to Red Hat Enterprise Linux 8.6 variants and requires a system reboot. The advisory rates the impact as moderate and does not provide a CVSS score. No known exploits in the wild have been reported.

The vulnerabilities could lead to potential information leakage or memory safety issues within the Linux kernel's wireless driver and filesystem components. The iwlwifi fix prevents excessive printing of strings from firmware files, which could otherwise expose sensitive information. The ext4 fix prevents processing of out-of-bounds extended attributes, mitigating risks related to memory corruption. The overall security impact is rated moderate by Red Hat. There are no reports of active exploitation in the wild.

Red Hat has released an official security update for Red Hat Enterprise Linux 8.6 that addresses these vulnerabilities. Users should apply the provided kernel update and reboot their systems to ensure the fixes take effect. For detailed update instructions, refer to Red Hat's official guidance at https://access.redhat.com/articles/11258. No additional mitigation actions are indicated by the vendor.