This advisory covers a security update for the kpatch live patch module targeting Red Hat Enterprise Linux kernel version 4.18.0-553.el8_10. It addresses two use-after-free vulnerabilities: CVE-2024-36886 in TIPC message reassembly that could lead to remote code execution, and CVE-2024-36971 in network route management. The kpatch module allows live patching of the running kernel to apply fixes without rebooting. Red Hat has released updated kpatch packages to remediate these vulnerabilities. The advisory rates the security impact as Important and provides packages for multiple architectures and extended life cycle versions of RHEL 8.

The vulnerabilities are use-after-free bugs in the kernel that could allow an attacker to execute arbitrary code remotely (CVE-2024-36886) or cause other security issues in network route management (CVE-2024-36971). Successful exploitation could compromise system integrity or availability. The issues affect the kernel live patch module for kernel version 4.18.0-553.el8_10 on Red Hat Enterprise Linux 8.

Red Hat has released an official security update for the kpatch-patch-4_18_0-553 module that addresses these vulnerabilities. Users should apply the updated kpatch packages for their respective architectures and versions as provided by Red Hat. Detailed instructions for applying the update are available at https://access.redhat.com/articles/11258. Since this is a live patch module, applying the update can modify the running kernel without requiring a reboot. No additional mitigation steps are indicated by the vendor.