This advisory covers security fixes for the kpatch live patch module targeting kernel-5.14.0-427.44.1.el9_4 in Red Hat Enterprise Linux 9.4. The fixes address five vulnerabilities: CVE-2025-37890 (use-after-free in net_sched hfsc with netem child qdisc), CVE-2025-38001 (reentrant enqueue causing duplicate class addition to eltree), CVE-2025-38000 (queue length accounting bug in hfsc_enqueue), CVE-2025-38350 (ensuring notifications are passed when child class becomes empty), and CVE-2025-38380 (initialization issue in i2c/designware). These vulnerabilities affect kernel scheduling and device driver components and are mitigated by applying the updated kpatch modules and rebooting the system.

The vulnerabilities impact the kernel's network scheduling subsystem and device driver initialization, potentially leading to use-after-free conditions, incorrect data structure handling, and improper notification behavior. These issues could cause system instability or unexpected behavior. The advisory rates the overall security impact as Important (high severity). No known exploits in the wild have been reported at this time.

Red Hat has released updated kpatch live patch modules for kernel-5.14.0-427.44.1.el9_4 that address these vulnerabilities. Users should apply the provided security updates and reboot their systems to ensure the patches take effect. Detailed update instructions are available at https://access.redhat.com/articles/11258. No additional mitigations are indicated by the vendor advisory.