The advisory covers a set of 10 vulnerabilities in the Linux kernel used by Red Hat Enterprise Linux 10 and associated products. Key issues include use-after-free vulnerabilities in device mapper (CVE-2025-38141), io_uring (CVE-2025-38106), GPIO character device (CVE-2025-40249), and macvlan (CVE-2026-23001), which can lead to local privilege escalation, information disclosure, or denial of service. Other vulnerabilities include denial of service via out-of-bounds USB configuration parsing (CVE-2025-39760), incorrect pointer arithmetic in HID intel-thc (CVE-2025-39818), a BUG() in ipv6 skb buffer handling (CVE-2025-71085), deadlock in hugetlb folio migration (CVE-2026-23097), and information disclosure in efivarfs (CVE-2026-23156). The advisory provides updated kernel packages to address these issues and requires rebooting the system to apply the fixes.

The vulnerabilities collectively allow for local privilege escalation, information disclosure, and denial of service conditions on affected Red Hat Enterprise Linux 10 systems. Exploitation could enable attackers with local access to escalate privileges or cause system instability. No known exploits in the wild have been reported. The overall security impact is rated as moderate by Red Hat.

Red Hat has released updated kernel packages for Red Hat Enterprise Linux 10 and related products that address these vulnerabilities. Users should apply the available kernel updates as described in the Red Hat advisory RHSA-2026:4012 and reboot their systems to ensure the fixes take effect. Patch status is confirmed by the vendor advisory. No additional mitigations are specified beyond applying the official update and rebooting.