Critical Security Update for Kernel Package: Addressing Multiple Vulnerabilities
Summary
ALSA-2025:14009: Important: kernel security update. Affects kernel versions < 6.12.0-55.28.1.el10_0. Fixed in 6.12.0-55.28.1.el10_0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The kernel package is a fundamental component of any Linux operating system, serving as the core interface between the hardware and the user-level applications. It manages system resources, facilitates communication between hardware and software, and ensures system stability and security. The kernel is crucial for system performance and security, making it vital to address any vulnerabilities that may arise.
Vulnerability Detail
This vulnerability arises from multiple security flaws identified in the kernel package, including a use-after-free issue in the eth_skb_pkt_type function, UDP GSO skb_segment issues, and Bluetooth hci_core vulnerabilities. These flaws can lead to unauthorized access, system crashes, or data corruption, posing significant risks to system integrity and user data. The vulnerabilities are tracked under CVEs: CVE-2025-21867, CVE-2025-38124, CVE-2025-38250, CVE-2025-38380, and CVE-2025-38471.
How To Fix
Minimum fixed version
6.12.0-55.28.1.el10_0
This is the first release that contains the fix.
sudo dnf update kernelTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can disable specific kernel features related to the vulnerabilities, but this is not recommended as a long-term solution. It is always best to apply the official patch as soon as possible.
Conclusion
In summary, the kernel package has critical vulnerabilities that need immediate attention. Updating to the patched version is essential to maintain system security and integrity. Users are encouraged to monitor their systems for vulnerabilities and apply updates promptly.
See every vulnerability recorded for kernel →
FAQ
The kernel package is the core of the Linux operating system, managing hardware and software interactions.
The vulnerabilities can lead to unauthorized access, system crashes, and potential data loss or corruption.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If immediate updates are not possible, consider disabling features related to the vulnerabilities as a temporary workaround.
Detailed information about the vulnerabilities can be found on the CVE pages linked in the advisory.
Related vulnerabilities
Recent vulnerabilities recorded for kernel.
