Critical Security Update for kernel-rt Package: Addressing Multiple Vulnerabilities
Summary
ALSA-2025:15786: Important: kernel-rt security update. Affects kernel-rt versions < 4.18.0-553.75.1.rt7.416.el8_10. Fixed in 4.18.0-553.75.1.rt7.416.el8_10. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The kernel-rt package provides a Real Time Linux Kernel, designed for systems requiring high determinism and fine-tuning capabilities. It is essential for applications where timing and responsiveness are critical, such as in industrial automation and real-time data processing. However, this package is susceptible to several security vulnerabilities that could compromise system integrity and performance.
Vulnerability Detail
The vulnerabilities identified in the kernel-rt package stem from issues in the kernel's networking and graphics subsystems. Specifically, CVE-2025-38350 relates to improper notification handling when child classes become empty, potentially leading to denial of service. CVE-2025-38392 involves a mutex being improperly converted to a spinlock in the idpf driver, which could lead to race conditions. Lastly, CVE-2025-38449 addresses reference management on GEM handles for framebuffers, which could allow unauthorized access to memory. These vulnerabilities could lead to system crashes, unauthorized access, or degraded performance.
How To Fix
Minimum fixed version
4.18.0-553.75.1.rt7.416.el8_10
This is the first release that contains the fix.
sudo dnf update kernel-rtTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you may consider disabling the affected features of the kernel-rt package until the update can be applied. However, this may impact the performance of real-time applications. It is recommended to prioritize applying the update as soon as possible.
Conclusion
The kernel-rt package has critical vulnerabilities that require immediate attention. Updating to the latest patched version is essential to maintain system security and performance. Utilize tools like Vulert to monitor for vulnerabilities in your applications effectively.
See every vulnerability recorded for kernel-rt →
FAQ
The kernel-rt package is a Real Time Linux Kernel designed for applications that require high precision and low latency.
The main vulnerabilities include improper notification handling, mutex conversion issues, and reference management on GEM handles.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If you cannot update immediately, consider disabling the affected features as a temporary workaround, but be aware that this may affect performance.
More information can be found in the CVE details for CVE-2025-38350, CVE-2025-38392, and CVE-2025-38449.
Related vulnerabilities
Recent vulnerabilities recorded for kernel-rt.
