The microcode_ctl package update for Red Hat Enterprise Linux 8 addresses two security vulnerabilities: CVE-2025-35973, a privilege escalation in the kernel hypervisor on Intel processors due to improper value handling in Ring 0; and CVE-2025-31936, a privilege escalation vulnerability in the microcode_ctl component affecting Intel Xeon 6 processors caused by improper memory range handling in System Management Mode (SMM). The update also includes an enhancement to update Intel CPU microcode to the latest version. The advisory is rated as Important by Red Hat Product Security. No CVSS base scores are provided, but the vulnerabilities are classified as privilege escalation issues with CWE-823 (Use of Out-of-range Pointer) and CWE-266 (Incorrect Privilege Assignment).

Successful exploitation of these vulnerabilities could allow a local attacker to escalate privileges to Ring 0 (kernel level) on affected Intel processors, potentially gaining unauthorized control over the system. This could lead to complete system compromise. The vulnerabilities specifically affect Intel processors, including Intel Xeon 6 series. The advisory does not report any known exploits in the wild at the time of publication.

Red Hat has released updated microcode_ctl packages for Red Hat Enterprise Linux 8 that address these vulnerabilities. Users should apply the provided microcode_ctl update as detailed in the Red Hat advisory RHSA-2026:65147 and the referenced article https://access.redhat.com/articles/11258. This update includes the security fixes and microcode enhancements. No additional mitigation steps are indicated beyond applying the official update.