The security advisory covers three vulnerabilities in the Red Hat Enterprise Linux 8.6 kernel live patch modules: CVE-2024-36971, a use-after-free vulnerability in network route management; CVE-2024-41090 and CVE-2024-41091, denial of service vulnerabilities caused by short frames in the virtio-net tap and tun interfaces respectively. These vulnerabilities can be mitigated by applying the kpatch live patch modules targeted for kernel-4.18.0-372.87.1.el8_6. The patches allow modification of the running kernel code without rebooting. The advisory is classified as important by Red Hat and affects specific kernel versions used in Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions and Extended Update Support Extension. No known exploits in the wild are reported at this time.

The vulnerabilities include a use-after-free in network route management, which could lead to potential memory corruption or instability, and denial of service conditions caused by short frame handling in virtio-net tap and tun interfaces. These issues could impact system stability and network functionality on affected Red Hat Enterprise Linux 8.6 systems. No information about exploitation in the wild is available.

A security update is available from Red Hat for the kpatch-patch-4_18_0-372_87_1 and kpatch-patch-4_18_0-372_91_1 live patch modules. Applying these updates will remediate the vulnerabilities without requiring a system reboot. Users should follow Red Hat's official guidance for applying these patches as detailed in the advisory at https://access.redhat.com/articles/11258. No additional mitigation steps are indicated by the vendor.