The advisory covers a kernel live patch module for Red Hat Enterprise Linux 9.0 that modifies running kernel code via the kpatch utility. It addresses five security issues: a use-after-free vulnerability in the net_sched hfsc class with netem child qdisc (CVE-2025-37890), a reentrant enqueue bug causing duplicate class additions to eltree (CVE-2025-38001), a queue length accounting bug in hfsc_enqueue (CVE-2025-38000), a notification handling issue when child classes become empty (CVE-2025-38350), and an initialization issue in the i2c/designware driver (CVE-2025-38380). These fixes improve kernel stability and security in network scheduling and device initialization components. The advisory is rated as important by Red Hat and requires applying the update and rebooting the system.

The vulnerabilities include a use-after-free condition and logic bugs in kernel network scheduling components and device initialization. These could lead to kernel instability or potential escalation of privileges or denial of service in affected systems running the specified kernel version. The advisory does not report known exploits in the wild. The impact is rated as important by Red Hat, indicating a significant security risk if unpatched.

Red Hat has released updated kpatch modules for kernel-5.14.0-70.124.1.el9_0 that address these vulnerabilities. Users should apply the provided security updates for the kpatch-patch packages as per Red Hat's instructions and reboot the system to activate the fixes. No additional mitigation steps are indicated beyond applying the official patch and rebooting.