Critical Security Update for Real Time Linux Kernel: kernel-rt Vulnerability
Summary
ALSA-2025:3264: Important: kernel-rt security update. Affects kernel-rt versions < 4.18.0-553.46.1.rt7.387.el8_10. Fixed in 4.18.0-553.46.1.rt7.387.el8_10. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The kernel-rt package provides a Real Time Linux Kernel, designed for systems that require high determinism and fine-tuning for performance. It is essential for applications where timing and responsiveness are critical, such as in industrial automation, telecommunications, and real-time data processing. This package is part of the AlmaLinux ecosystem, which aims to provide a stable and secure operating system for enterprise environments.
Vulnerability Detail
The vulnerability identified as CVE-2025-21785 affects the kernel-rt package, specifically in the arm64 architecture. It involves an out-of-bounds write to the cacheinfo array, which could potentially allow an attacker to exploit this flaw to execute arbitrary code or cause a denial of service. The ramifications of this vulnerability are significant, as it could compromise the integrity and availability of systems relying on the Real Time Linux Kernel.
How To Fix
Minimum fixed version
4.18.0-553.46.1.rt7.387.el8_10
This is the first release that contains the fix.
sudo dnf update kernel-rtTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users may consider disabling features that rely on the affected kernel-rt package until the update can be applied. However, this may impact system performance and functionality, so it should be approached with caution.
Conclusion
The kernel-rt security update addresses a critical vulnerability that could impact the stability and security of systems using the Real Time Linux Kernel. It is essential for users to update their packages to the fixed version to mitigate risks associated with CVE-2025-21785. Regular monitoring for vulnerabilities using tools like Vulert can help maintain system integrity.
See every vulnerability recorded for kernel-rt →
FAQ
CVE-2025-21785 is a security vulnerability in the kernel-rt package that allows for an out-of-bounds write to the cacheinfo array, potentially leading to arbitrary code execution.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. Simply upload your manifest file like package-lock.json to check for vulnerabilities.
Failing to address this vulnerability could lead to unauthorized access, data breaches, or system crashes, significantly impacting system reliability and security.
While the best course of action is to apply the patch, you may temporarily disable features relying on the kernel-rt package as a workaround.
For detailed information, including CVSS scores and acknowledgments, refer to the CVE page associated with CVE-2025-21785.
Related vulnerabilities
Recent vulnerabilities recorded for kernel-rt.
