RLSA-2026:87374: Important security update for Rocky Linux 8 kernel-rt
Summary
RLSA-2026:87374: Multiple kernel security flaws can allow local attackers to compromise confidentiality, integrity, and availability on affected systems. Affects kernel-rt versions < 0:4.18.0-553.177.1.rt7.518.el8_10. Fixed in 0:4.18.0-553.177.1.rt7.518.el8_10. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
kernel-rt is a real-time Linux kernel package in the Rocky Linux:8 ecosystem. It enables fine-tuning for systems with extremely high determinism requirements. The package provides kernel functionality for workloads that need predictable timing, including systems that rely on real-time processing.
Vulnerability Detail
The update addresses multiple kernel vulnerabilities that can affect system confidentiality, integrity, and availability. The issues involve IPv4 raw packet handling and fragmentation, FUSE request locking, IPv4 route alias cleanup, ALSA sequencer queue timers, XFS log-item bitmap bounds checking, and VFIO PCI initialization cleanup. The advisory lists seven related CVE identifiers; the supplied CVSS vector indicates local access with low privileges and high potential impact across confidentiality, integrity, and availability.
How To Fix
Minimum fixed version
0:4.18.0-553.177.1.rt7.518.el8_10
This is the first release that contains the fix.
sudo dnf update kernel-rtTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
AI-generated workaround (not vendor-documented): Restrict local access to systems running kernel-rt and limit access to kernel interfaces and devices used by affected components. Apply the fixed package version when it is available through your normal Rocky Linux update process.
Conclusion
Bottom line: update kernel-rt to the minimum fixed version, 0:4.18.0-553.177.1.rt7.518.el8_10. The advisory covers several kernel components and describes potential effects on confidentiality, integrity, and availability. Restrict local access until the fixed package is applied. Vulert monitors the dependencies in a manifest file like package-lock.json and alerts when a new vulnerability affects them; check an application at https://vulert.com/scanner.
See every vulnerability recorded for kernel-rt →
FAQ
RLSA-2026:87374 affects kernel-rt versions introduced at 0 and fixed at 0:4.18.0-553.177.1.rt7.518.el8_10.
The kernel-rt issues can threaten confidentiality, integrity, and availability; the supplied CVSS vector describes local access with low privileges.
Update kernel-rt to the minimum fixed version, 0:4.18.0-553.177.1.rt7.518.el8_10.
Restrict local access to kernel-rt systems and limit access to kernel interfaces and devices involved in the affected components.
Manually inspect the system's installed package inventory for kernel-rt. Vulert can scan a manifest or SBOM and monitor the dependency at Vulert Scanner.
References
Related vulnerabilities
Recent vulnerabilities recorded for kernel-rt.
