The advisory covers security fixes for the kpatch live patch module targeting kernel-4.18.0-372.118.1.el8_6 in Red Hat Enterprise Linux 8.6. It addresses five CVEs: CVE-2025-37890 (use-after-free in net_sched hfsc class with netem child qdisc), CVE-2025-38001 (reentrant enqueue adding class to eltree twice), CVE-2025-38000 (queue length accounting bug in hfsc_enqueue), CVE-2025-38350 (notification passing when child class becomes empty), and CVE-2025-38380 (initialization issue in i2c/designware). These vulnerabilities affect kernel scheduling and device initialization components. The advisory provides updated kpatch-patch packages and requires rebooting the system to apply the fixes.

The vulnerabilities include a use-after-free condition and logic errors in kernel scheduling components that could lead to instability or potential privilege escalation if exploited. The initialization issue in the i2c/designware driver may affect device operation. The overall security impact is rated as Important by Red Hat, indicating significant risk if unpatched. No known exploits in the wild have been reported at this time.

Red Hat has released updated kpatch-patch packages for the affected kernel version 4.18.0-372.118.1.el8_6. Users should apply these updates as provided by Red Hat and reboot their systems to ensure the patches take effect. For detailed update instructions, refer to https://access.redhat.com/articles/11258. No additional mitigations are indicated by the vendor advisory.