Red Hat ships kernel fixes for Linux qla2xxx and net/sched vulnerabilities

Red Hat released multiple Important kernel advisories across RHEL 8, 9, and 10 to address Linux kernel flaws including CVE-2025-39766 in net/sched and CVE-2025-68741 in the qla2xxx SCSI driver. Advisories RHSA-2026:8921 and RHSA-2026:9264 patched both issues for broad RHEL 9 and RHEL 10 product lines, while RHSA-2026:9131, RHSA-2026:9135, and RHSA-2026:10996 included fixes for CVE-2025-68741 alongside other kernel bugs in standard, real-time, and extended support channels. Red Hat said affected systems should be rebooted after applying the updated kernel packages.

CVE-2025-39766 stems from the Linux traffic-control scheduler, where cake_enqueue() could return NET_XMIT_SUCCESS after dropping packets past buffer_limit, allowing htb_enqueue() to activate an empty child qdisc and trigger a kernel warning; the fix changes the return value to NET_XMIT_CN. CVE-2025-68741 affects drivers/scsi/qla2xxx/qla_nvme.c, where an error path improperly frees a purex item with kfree() instead of qla24xx_free_purex_item(), creating a risk of memory corruption. Additional Red Hat kernel advisories in the same period also bundled other flaws such as race conditions, heap overflows, use-after-free bugs, and privilege-escalation issues across legacy, SAP, real-time, and extended lifecycle offerings.