Red Hat Ships RHEL 9.6 Kernel Fixes for qla2xxx Memory Corruption and 17 Other CVEs

Red Hat released multiple Important security advisories for the Linux kernel in Red Hat Enterprise Linux 9.6 channels, including Extended Update Support, delivering fixes for a broad set of vulnerabilities and requiring customers to reboot systems after installation. The newer advisory, RHSA-2026:34094, updates the kernel to 5.14.0-570.125.1.el9_6 across x86_64, aarch64, ppc64le, and s390x, and addresses 18 CVEs spanning subsystems such as netfilter, ALSA, MPTCP, RDMA, TCP, DLM, SCSI, IPv6, SCTP, and process exit handling. An earlier advisory, RHSA-2026:14339, also targeted RHEL 9.6 kernel packages and listed impacts including denial of service, memory corruption, privilege escalation, and use-after-free flaws in components including nfsd, qla2xxx, RDMA umad, KVM, crypto algif_aead, and CAN raw.

One of the patched issues, CVE-2025-68741, affects the Linux kernel's qla2xxx SCSI driver and stems from improper freeing of a purex item in qla2xxx_process_purls_iocb(). Red Hat and Bugzilla records say the flaw occurs when memory obtained from qla24xx_alloc_purex_item() is incorrectly released with kfree() instead of qla24xx_free_purex_item(), creating a CWE-763 invalid pointer release condition that can cause memory corruption. Red Hat rated the issue Moderate for its products, noted that fixes were shipped across multiple RHEL 8, 9, and 10 kernel packages, and said RHEL 6 is not affected because the vulnerable code is absent.