This advisory covers a security update for Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions, specifically for kpatch-patch modules 4_18_0-305_120_1 and 4_18_0-305_138_1. The update fixes two vulnerabilities: CVE-2024-36886, a use-after-free vulnerability in the TIPC message reassembly code that could lead to remote code execution, and CVE-2024-41071, an out-of-bounds array indexing vulnerability in the mac80211 WiFi subsystem. These patches modify the running kernel code via the kpatch utility. Red Hat classifies the security impact as Important and recommends applying the update followed by a system reboot. No CVSS scores are provided in the advisory, and no known exploits in the wild have been reported.

The vulnerabilities fixed by this update could allow an attacker to execute arbitrary code remotely (CVE-2024-36886) or cause memory corruption due to out-of-bounds array access (CVE-2024-41071). Successful exploitation could compromise system integrity or availability. Red Hat rates the impact as Important, indicating a significant security risk if unpatched.

Red Hat has released official patches for these vulnerabilities as kpatch live patch modules for kernel version 4.18.0-305.120.1.el8_4. Users should apply the provided kpatch updates (kpatch-patch-4_18_0-305_120_1 and kpatch-patch-4_18_0-305_138_1) and reboot the system to ensure the fixes take effect. Detailed update instructions are available at https://access.redhat.com/articles/11258. No alternative mitigations are indicated or required.