The advisory covers security fixes in a kernel live patch module for Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions, specifically for kernel version 5.14.0-284.104.1.el9_2. It addresses five CVEs: CVE-2025-37890 (use-after-free in net_sched hfsc class with netem child qdisc), CVE-2025-38001 (reentrant enqueue adding class to eltree twice), CVE-2025-38000 (queue length accounting bug in hfsc_enqueue), CVE-2025-38350 (notification passing when child class becomes empty), and CVE-2025-38380 (initialization issue in i2c/designware). These vulnerabilities affect kernel scheduling and device initialization components. The advisory provides updated kpatch-patch packages to remediate these issues and requires a reboot for the patch to be applied.

The vulnerabilities fixed include a use-after-free condition which can lead to memory corruption, potential instability or security issues in kernel network scheduling, and bugs affecting queue length accounting and notification mechanisms. The initialization issue in the i2c/designware driver could affect device operation. These issues could impact system stability and security, particularly in environments using the affected kernel version and live patching. No known exploits in the wild have been reported at this time.

Red Hat has released updated kpatch-patch packages for kernel-5.14.0-284.104.1.el9_2 that address these vulnerabilities. Users should apply the provided security update and reboot their systems to ensure the patches take effect. Detailed update instructions are available at https://access.redhat.com/articles/11258. Since this is a kernel live patch, the update modifies running kernel code but requires a reboot to fully apply changes. No alternative mitigations are indicated in the advisory.