The advisory covers four distinct vulnerabilities in the Linux kernel: CVE-2025-38022 fixes a use-after-free read in the RDMA core during device registration; CVE-2025-38568 addresses a stack out-of-bounds write in the multi-queue priority scheduler's traffic control entry parsing; CVE-2025-40294 resolves an out-of-bounds write in Bluetooth management that could cause information disclosure and denial of service; and CVE-2025-40322 fixes an out-of-bounds read in font glyph handling leading to similar impacts. These vulnerabilities are rated as moderate severity by Red Hat and affect Red Hat Enterprise Linux 9.4 Extended Update Support and related variants. The advisory provides updated kernel packages to remediate these issues.

Successful exploitation of these vulnerabilities may allow an attacker to cause denial of service or gain unauthorized information disclosure on affected systems running the vulnerable Linux kernel versions. The issues involve memory safety errors such as use-after-free and out-of-bounds accesses in critical kernel components, which can compromise system stability and confidentiality.

Red Hat has released updated kernel packages that address these vulnerabilities. Users of Red Hat Enterprise Linux 9.4 Extended Update Support and related variants should apply the security update as detailed in the Red Hat advisory RHSA-2026:2594. A system reboot is required for the update to take effect. No additional mitigations are specified by the vendor.