Moderate Security Update for kernel-rt Package: Addressing CVE-2024-50154 and CVE-2025-38086
Summary
ALSA-2025:11456: Moderate: kernel-rt security update. Affects kernel-rt versions < 4.18.0-553.63.1.rt7.404.el8_10. Fixed in 4.18.0-553.63.1.rt7.404.el8_10. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The kernel-rt package provides a Real Time Linux Kernel designed for systems requiring high determinism. It enables fine-tuning for performance-critical applications, making it essential for environments where timing and responsiveness are crucial. However, like any software, it is susceptible to vulnerabilities that can compromise system security and stability.
Vulnerability Detail
The kernel-rt package has been identified with two significant vulnerabilities. The first, CVE-2024-50154, involves improper use of timer_pending() in the reqsk_queue_unlink() function, which could lead to unexpected behavior in TCP/DCCP networking. The second, CVE-2025-38086, pertains to an uninitialized access issue in the ch9200 network driver during the mii_nway_restart process. Both vulnerabilities could potentially allow an attacker to exploit the system, leading to data leaks or system crashes.
How To Fix
Minimum fixed version
4.18.0-553.63.1.rt7.404.el8_10
This is the first release that contains the fix.
sudo dnf update kernel-rtTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for these vulnerabilities. The best course of action is to apply the security update as soon as it is available.
Conclusion
The kernel-rt package has been found to have moderate security vulnerabilities that require immediate attention. By updating to the latest patched version, users can protect their systems from potential exploits. Regular monitoring and updates are crucial for maintaining system security.
See every vulnerability recorded for kernel-rt →
FAQ
The kernel-rt package provides a Real Time Linux Kernel, optimized for applications requiring precise timing and high responsiveness.
CVE-2024-50154 relates to improper timer handling in networking, while CVE-2025-38086 involves uninitialized access in a network driver, both posing security risks.
You can use Vulert, which monitors open-source vulnerabilities in your software. By uploading your manifest file, you can receive real-time alerts about vulnerabilities.
Yes, a patch is available. Updating to version 4.18.0-553.63.1.rt7.404.el8_10 will resolve the vulnerabilities.
While no specific workarounds are available, it is recommended to prioritize the update to mitigate potential risks.
Related vulnerabilities
Recent vulnerabilities recorded for kernel-rt.
