Critical Security Update for kernel-rt Package: Addressing Multiple Vulnerabilities
Summary
ALSA-2026:45116: Important: kernel-rt security update. Affects kernel-rt versions < 4.18.0-553.147.1.rt7.488.el8_10. Fixed in 4.18.0-553.147.1.rt7.488.el8_10. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The kernel-rt package provides a Real Time Linux Kernel designed for systems requiring high determinism. It is essential for applications that demand precise timing and low latency. This package is widely used in environments such as telecommunications, industrial automation, and real-time data processing. However, it is susceptible to various vulnerabilities that could compromise system integrity and security.
Vulnerability Detail
The kernel-rt package has been identified with several vulnerabilities, including a flaw in the KVM module that fails to properly check L1 intercepts during userspace I/O operations (CVE-2025-40026). Additionally, there is an issue with the xfrm single-frag length not being properly limited, which could lead to potential denial of service. Another critical vulnerability involves an out-of-bounds write due to region_count overflow in the dm log (CVE-2026-53059), and a double-free error in the tipc_buf_append() function (CVE-2026-52993). These vulnerabilities could allow attackers to execute arbitrary code, cause system crashes, or lead to unauthorized access.
How To Fix
Minimum fixed version
4.18.0-553.147.1.rt7.488.el8_10
This is the first release that contains the fix.
sudo dnf update kernel-rtTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can limit the exposure of their systems by disabling the affected modules or restricting access to sensitive functionalities until the patch is applied. However, this is not a permanent solution and should be followed by an update as soon as possible.
Conclusion
The kernel-rt package has critical vulnerabilities that require immediate attention. Users are advised to update to the latest patched version to ensure system security and integrity. Temporary workarounds can be implemented, but they do not replace the need for a proper update.
See every vulnerability recorded for kernel-rt →
FAQ
The kernel-rt package provides a Real Time Linux Kernel optimized for applications that require high determinism and low latency.
The update addresses multiple vulnerabilities, including improper checks in KVM, out-of-bounds writes, and double-free errors.
You can use Vulert, which monitors open-source vulnerabilities in your software by analyzing your manifest file. Visit Vulert Scanner to check your application without needing to sign up.
If immediate updates are not possible, consider implementing workarounds such as disabling affected modules or restricting access to sensitive functionalities.
Detailed information about the vulnerabilities can be found in the security advisory linked in the package documentation or through the CVE references provided.
Related vulnerabilities
Recent vulnerabilities recorded for kernel-rt.
