The advisory covers eight distinct Linux kernel vulnerabilities identified by CVE identifiers CVE-2025-37882, CVE-2025-38349, CVE-2025-38730, CVE-2025-39760, CVE-2025-39933, CVE-2025-40269, CVE-2025-40271, and CVE-2025-40304. These include a race condition in the xHCI driver causing data loss or use-after-free, use-after-free in eventpoll, data corruption and instability from improper io_uring/net buffer handling, denial of service via out-of-bounds USB configuration parsing, verification flaws in SMB client data handling, use-after-free in proc_readdir_de() potentially leading to privilege escalation or denial of service, out-of-bounds write in framebuffer device with possible privilege escalation and information disclosure, and a buffer overflow in the ALSA USB audio driver causing information disclosure and denial of service. The advisory provides updated kernel packages for Red Hat Enterprise Linux 9.6 Extended Update Support and related variants. The update must be applied and the system rebooted to mitigate these vulnerabilities.

These vulnerabilities collectively can result in data loss, use-after-free conditions, data corruption, system instability, denial of service, privilege escalation, and information disclosure on affected systems running the Linux kernel in Red Hat Enterprise Linux 9.6 Extended Update Support. The impact ranges from moderate to potentially severe depending on the specific vulnerability, with some allowing privilege escalation or information disclosure. No known exploits in the wild have been reported at the time of the advisory.

Red Hat has released updated kernel packages addressing all listed vulnerabilities. Users should apply the security update for Red Hat Enterprise Linux 9.6 Extended Update Support as provided in advisory RHSA-2026:2759. After applying the update, a system reboot is required for the fixes to take effect. No additional mitigation steps are indicated by the vendor advisory.