The advisory covers three kernel vulnerabilities addressed by kpatch live patch modules for Red Hat Enterprise Linux 9.4. CVE-2026-23401 involves privilege escalation or denial of service in the KVM subsystem caused by improper handling of shadow page table entries. CVE-2026-31402 is a heap overflow in the NFSv4.0 LOCK replay cache within the nfsd kernel service. CVE-2026-31419 is a use-after-free vulnerability in the bonding driver that can lead to denial of service. These issues are fixed by updated kpatch modules targeted at kernel version 5.14.0-427.68.2.el9_4. The advisory is rated as important by Red Hat Product Security, and the patches are available for affected Red Hat Enterprise Linux 9.4 variants.

Successful exploitation of CVE-2026-23401 could allow an attacker to escalate privileges or cause a denial of service via the KVM kernel module. CVE-2026-31402 could lead to a heap overflow in the NFS daemon, potentially causing denial of service or other impacts. CVE-2026-31419 could cause a denial of service due to a use-after-free in the bonding driver. These vulnerabilities affect kernel components critical to system stability and security. No known exploits in the wild have been reported, but the impact includes potential privilege escalation and denial of service conditions.

Red Hat has released official kpatch live patch modules that address these vulnerabilities for Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions and related variants. Users should apply these official patches as detailed in the Red Hat advisory RHSA-2026:36533 and the referenced article https://access.redhat.com/articles/11258. Applying these patches mitigates the vulnerabilities without requiring a system reboot. Patch status is official-fix and remediation is available.