Moderate Security Vulnerability in kernel-rt Package: Packet Header Length Validation Flaw
Summary
ALSA-2025:21397: Moderate: kernel-rt security update. Affects kernel-rt versions < 4.18.0-553.84.1.rt7.425.el8_10. Fixed in 4.18.0-553.84.1.rt7.425.el8_10. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The kernel-rt package provides a Real Time Linux Kernel, designed for systems that require high determinism and low latency. It is essential for applications in fields such as telecommunications, automotive, and robotics, where timing is critical. The kernel-rt package allows fine-tuning of the Linux kernel to meet these stringent performance requirements. However, like any software, it can be susceptible to vulnerabilities that may compromise system integrity and security.
Vulnerability Detail
The vulnerability identified as CVE-2025-39718 affects the kernel-rt package due to improper validation of the length in the packet header before executing the skb_put() function. This flaw can potentially allow an attacker to exploit the system by sending specially crafted packets, leading to memory corruption or denial of service. The impact of this vulnerability is moderate, as it could disrupt the normal operation of the system and affect real-time processing capabilities.
How To Fix
Minimum fixed version
4.18.0-553.84.1.rt7.425.el8_10
This is the first release that contains the fix.
sudo dnf update kernel-rtTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can limit the exposure of their systems by implementing firewall rules to restrict incoming traffic, thereby minimizing the risk of exploitation until the package is updated.
Conclusion
The kernel-rt package has a moderate security vulnerability (CVE-2025-39718) that requires immediate attention. Users are advised to update to the latest patched version to ensure system integrity and security. Implementing temporary workarounds can help mitigate risks until the update is applied.
See every vulnerability recorded for kernel-rt →
FAQ
CVE-2025-39718 is a security vulnerability in the kernel-rt package that involves improper validation of packet header lengths, potentially leading to memory corruption.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected by this vulnerability.
The risks include potential memory corruption and denial of service, which can disrupt the normal operation of systems relying on real-time processing.
Yes, a patch is available. Users should update to kernel-rt version 4.18.0-553.84.1.rt7.425.el8_10 or later to mitigate the vulnerability.
If immediate updates are not possible, consider implementing firewall rules to restrict incoming traffic as a temporary measure to reduce exposure.
Related vulnerabilities
Recent vulnerabilities recorded for kernel-rt.
