Moderate Security Vulnerability in kernel-rt Package: Kernel-rt Security Update
Summary
ALSA-2025:1067: Moderate: kernel-rt security update. Affects kernel-rt versions < 4.18.0-553.37.1.rt7.378.el8_10. Fixed in 4.18.0-553.37.1.rt7.378.el8_10. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The kernel-rt package provides a Real Time Linux Kernel, designed for systems that require high determinism and low latency. It is essential for applications in fields such as telecommunications, robotics, and real-time data processing. This package allows for fine-tuning of system performance to meet stringent timing requirements. However, vulnerabilities in the kernel can lead to severe security risks, affecting system stability and data integrity.
Vulnerability Detail
This vulnerability arises from two specific issues: CVE-2024-26935, which involves a regression in the removal of procfs host directories in the SCSI core, and CVE-2024-50275, which pertains to the handling of stale CPU state during SVE traps on arm64 architecture. These vulnerabilities can potentially allow unauthorized access to system resources or lead to system crashes, compromising the overall security and reliability of the affected systems.
How To Fix
Minimum fixed version
4.18.0-553.37.1.rt7.378.el8_10
This is the first release that contains the fix.
sudo dnf update kernel-rtTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can limit access to the affected SCSI core functionalities or disable the SVE features on arm64 systems until the patch is applied. However, this may impact system performance and should only be considered as a short-term solution.
Conclusion
The kernel-rt security update addresses critical vulnerabilities that could compromise system integrity and performance. It is essential for users to update their packages promptly and consider temporary workarounds if immediate updates are not feasible. Regular monitoring of vulnerabilities using tools like Vulert can help maintain system security.
See every vulnerability recorded for kernel-rt →
FAQ
The kernel-rt package provides a Real Time Linux Kernel, optimized for applications requiring high determinism and low latency.
CVE-2024-26935 is a vulnerability related to the SCSI core's procfs host directory management, while CVE-2024-50275 involves stale CPU state handling in SVE traps on arm64 architecture.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
If immediate updates are not possible, consider implementing temporary workarounds such as limiting access to affected functionalities.
Addressing this vulnerability is crucial to maintain system security, prevent unauthorized access, and ensure the stability of real-time applications.
Related vulnerabilities
Recent vulnerabilities recorded for kernel-rt.
