Red Hat Product Security released an important security advisory (RHSA-2025:16583) for the kpatch live patch modules targeting kernel-4.18.0-477.67.1.el8_8 in Red Hat Enterprise Linux 8.8. The update fixes five vulnerabilities: CVE-2025-37890 (use-after-free in net_sched hfsc class with netem child qdisc), CVE-2025-38001 (reentrant enqueue adding class to eltree twice), CVE-2025-38000 (queue length accounting bug in hfsc_enqueue), CVE-2025-38350 (notification passing when child class becomes empty), and CVE-2025-38380 (initialization issue in i2c/designware). The advisory provides updated kpatch-patch packages for x86_64 and ppc64le architectures. The update requires a system reboot to apply the fixes. No CVSS scores are provided in the advisory, and no known exploits in the wild have been reported.

The vulnerabilities fixed include a use-after-free condition, which can lead to memory corruption and potential kernel crashes or privilege escalation, reentrant enqueue issues that may cause kernel instability, queue length accounting errors affecting network scheduling, notification handling flaws that could impact kernel network class behavior, and an initialization bug in the i2c/designware driver that may affect device operation. These issues collectively pose a high security risk to affected systems running the specified kernel version.

Red Hat has released updated kpatch-patch modules addressing these vulnerabilities. Systems running the affected kernel version should apply the provided kpatch updates and reboot to ensure the patches take effect. Refer to the Red Hat advisory RHSA-2025:16583 and the linked article https://access.redhat.com/articles/11258 for detailed update instructions. No alternative mitigations are indicated; applying the official patches and rebooting is required.