This advisory covers a security update for the kpatch-patch-5_14_0-70_85_1 module, which allows live patching of the running kernel on Red Hat Enterprise Linux 9.0. It addresses four vulnerabilities: CVE-2024-36886, a use-after-free vulnerability in TIPC message reassembly that could lead to remote code execution; CVE-2024-36971, a use-after-free in network route management; and CVE-2024-41090 and CVE-2024-41091, denial of service vulnerabilities in virtio-net tap and tun drivers related to mlx5_core short frames. The update is rated as Important by Red Hat Product Security. The patch requires a system reboot to take effect.

The vulnerabilities include use-after-free flaws that may allow remote code execution or other unintended behavior, and denial of service conditions affecting network drivers. These issues could impact system stability and security if exploited. The advisory does not report known exploits in the wild. The severity is assessed as high due to the potential for remote code execution and denial of service.

An official security update (kpatch-patch-5_14_0-70_85_1) is available from Red Hat for Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions. Applying this update and rebooting the system is required to remediate the vulnerabilities. Refer to Red Hat's official advisory RHSA-2024:5858 and the update article https://access.redhat.com/articles/11258 for detailed instructions. No additional mitigations are indicated by the vendor.