Critical Security Update for kernel-rt Package: In-Place Decrypt Vulnerability
Summary
ALSA-2026:A007: Important: kernel-rt security update. Affects kernel-rt versions < 4.18.0-553.123.2.rt7.464.el8_10. Fixed in 4.18.0-553.123.2.rt7.464.el8_10. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The kernel-rt package provides a Real Time Linux Kernel, designed for systems requiring high determinism. It is essential for applications that demand precise timing and responsiveness. This package is widely used in environments where performance and reliability are critical, such as industrial automation and real-time data processing.
Vulnerability Detail
The vulnerability identified as CVE-2026-43284 affects the kernel-rt package, specifically related to the xfrm (IPsec transformation) functionality. The flaw allows for in-place decryption on shared socket buffer fragments, which could lead to unauthorized access to sensitive data. This vulnerability poses a significant risk as it can be exploited by attackers to manipulate network traffic and potentially gain control over affected systems.
How To Fix
Minimum fixed version
4.18.0-553.123.2.rt7.464.el8_10
This is the first release that contains the fix.
sudo dnf update kernel-rtTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, consider disabling the xfrm functionality if it is not critical for your application. This can be done by modifying the system's network configuration files, but it is recommended to apply the patch as soon as possible for a permanent fix.
Conclusion
The kernel-rt package has a critical vulnerability (CVE-2026-43284) that requires immediate attention. Updating to the patched version is essential to protect your systems from potential exploitation. Utilize tools like Vulert to monitor and assess vulnerabilities in your software.
See every vulnerability recorded for kernel-rt →
FAQ
CVE-2026-43284 is a security vulnerability in the kernel-rt package that allows for in-place decryption on shared socket buffer fragments, potentially leading to unauthorized data access.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The risks include unauthorized access to sensitive data, potential manipulation of network traffic, and compromise of system integrity.
Yes, a patch is available in version 4.18.0-553.123.2.rt7.464.el8_10 of the kernel-rt package.
If you cannot apply the patch immediately, consider disabling the xfrm functionality as a temporary workaround until you can update.
Related vulnerabilities
Recent vulnerabilities recorded for kernel-rt.
